← Commit history

Require matching package and standalone-download release verification

John Lauer ·111c5e68ce · ·parent 582e699
1 file changed +6
dev-skills/review-safe-contributions/SKILL.md+6
@@ -17,3 +17,9 @@ Read the target's latest PR comments, reviews, linked issues and development ins 9. PR body: exact base hash, scope, dependencies, preserved capabilities, commands/results, native acceptance status, remaining limitations. Owner review, merge, publication, installation and live verification are distinct states. Do not self-merge another bridge owner's change or replace a shared runtime.  For this repository, the preflight and tests are source tools under `tools/`. This skill is development guidance, so it belongs in `dev-skills/`, not the installed user skills.++## Verify every user-facing release path++A registry publication does not refresh the standalone download button. After publishing a tested release, upload the matching executable with `adom-wiki release upload adom/adom-aiflow <version> <binary> --platform linux --arch x64` (use the actual built platform). Verify its SHA-256 matches the binary in the published package. Do not relabel an older build as the new version.++Check the public page in Pup: the package install version, standalone Download card, source version and MIT license must agree. In 0.1.85 the registry was current while the Download card still offered 0.1.69; uploading the verified 0.1.85 asset fixed that independent path. Record the asset hash and rendered check in the release evidence. Keep development-only release guidance in this source skill, outside installed user skills.