0.1.3 — a lightweight tag cannot publish a release

.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "web3d-dev",
       "displayName": "Web3D Dev",
       "description": "Three skills for realtime 3D on the web: the three.js WebGPU runtime with TSL, compute, post-processing and a WebGL2 fallback; the glTF asset pipeline from source to frame, with compression, budgets, sourcing and optional Asset Foundry ordering; and a 3D animation protocol covering rigs, clip conventions, blending, GPU and instanced animation, and reduced motion. Every API fact is pinned to a verified three.js release.",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "author": {
         "name": "ssheleg",
         "url": "https://x.com/sshlg93"

.github/workflows/release.yml

@@ -48,6 +48,20 @@ jobs:
           ref: ${{ steps.t.outputs.tag }}
           fetch-depth: 0
 
+      - name: The tag must be annotated (a lightweight tag hides the release)
+        run: |
+          set -eu
+          # `git describe` and `git submodule status` see annotated tags only; the
+          # 2026-10-09 wave cut four lightweight tags and the hub read each member
+          # as its previous release. Refuse here, before anything is published.
+          TAG="${{ steps.t.outputs.tag }}"
+          KIND=$(git cat-file -t "$TAG")
+          if [ "$KIND" != "tag" ]; then
+            echo "::error::$TAG is a $KIND, not an annotated tag object. Remedy: git tag -a $TAG -m '<release>' at the same commit."
+            exit 1
+          fi
+          echo "$TAG is annotated"
+
       - name: The tag must be reachable from the default branch
         env:
           GH_TOKEN: ${{ github.token }}

CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.1.3 — 2026-10-10
+
+- **The release refuses a lightweight tag.** `release.yml` gains one step, right after
+  checkout and before any gate: `git cat-file -t` on the tag must print `tag`; a `commit`
+  fails the job with the remedy (`git tag -a <tag> -m '<release>'` at the same commit)
+  before anything is published. `git describe` and `git submodule status` see annotated
+  tags only, and the 2026-10-09 family wave cut four lightweight member tags that the
+  umbrella then read as each member's previous release. The step is identical across the
+  family (umbrella plan 2026-10-10, T5 / REQ-6). Published tags are not re-cut.
+- No skill, reference or installer change.
+
 ## 0.1.2 — 2026-09-28
 
 - **npm releases armed.** The package is on npm (`@ssheleg/web3d-dev`, first publish by the

SKILL-CARD.md

@@ -5,7 +5,7 @@
 | Field | Value |
 |---|---|
 | Pack | `web3d-dev` |
-| Version | `0.1.2` |
+| Version | `0.1.3` |
 | Skills | `web3d-runtime`, `web3d-assets`, `web3d-animation` |
 | License | MIT |
 | Source | https://github.com/ssheleg/web3d-dev |

docs/RELEASING.md

@@ -3,8 +3,8 @@
 ## Automatic path
 
 [release.yml](../.github/workflows/release.yml) runs on a pushed `v*` tag or a
-manual dispatch naming an existing tag. It calls the validation workflow, checks
-that the tag is reachable from the actual default branch, checks manifest versions,
+manual dispatch naming an existing tag. It calls the validation workflow, refuses a
+lightweight tag (`git cat-file -t` must print `tag`), checks that the tag is reachable from the actual default branch, checks manifest versions,
 creates/refreshes the GitHub release, installs the GitHub package in a clean home,
 and publishes the npm package with provenance. GitHub OIDC authenticates publishing;
 there is no `NPM_TOKEN` dependency. Node 24 and current npm run on GitHub-hosted Ubuntu.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/web3d-dev",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Three skills for realtime 3D on the web: the three.js WebGPU runtime with TSL, compute, post-processing and a WebGL2 fallback; the glTF asset pipeline from source to frame, with compression, budgets, sourcing and optional Asset Foundry ordering; and a 3D animation protocol covering rigs, clip conventions, blending, GPU and instanced animation, and reduced motion. Every API fact is pinned to a verified three.js release.",
   "bin": {
     "web3d-dev": "bin/web3d-dev.js"

plugins/web3d-dev/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "web3d-dev",
   "displayName": "Web3D Dev",
   "description": "Three skills for realtime 3D on the web: the three.js WebGPU runtime with TSL, compute, post-processing and a WebGL2 fallback; the glTF asset pipeline from source to frame, with compression, budgets, sourcing and optional Asset Foundry ordering; and a 3D animation protocol covering rigs, clip conventions, blending, GPU and instanced animation, and reduced motion. Every API fact is pinned to a verified three.js release.",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

plugins/web3d-dev/skills/web3d-animation/SKILL.md

@@ -18,7 +18,7 @@ compatibility: >-
   needed to call motion verified — without one the verdict is NOT_RUN, never PASS.
 metadata:
   author: ssheleg
-  version: "0.1.2"
+  version: "0.1.3"
 ---
 
 # web3d-animation — decide how it moves, then make both halves agree

plugins/web3d-dev/skills/web3d-assets/SKILL.md

@@ -18,7 +18,7 @@ compatibility: >-
   Asset Foundry is optional: detected through its foundry_* MCP tools or its skill, never assumed.
 metadata:
   author: ssheleg
-  version: "0.1.2"
+  version: "0.1.3"
 ---
 
 # web3d-assets — from a source to the frame, within a budget someone wrote down

plugins/web3d-dev/skills/web3d-runtime/SKILL.md

@@ -18,7 +18,7 @@ compatibility: >-
   visual result verified; without one the verdict is NOT_RUN.
 metadata:
   author: ssheleg
-  version: "0.1.2"
+  version: "0.1.3"
 ---
 
 # web3d-runtime — the scene runs, on every GPU it meets, and you can prove how fast