← Commit history

2.0.3: record the packaging trap - a doc will publish happily without its payload

John Lauer ·ad108774e8 ·1mo ago ·parent 4a35828
2 files changed +25−1
package.json+1−1
@@ -1,6 +1,6 @@ {   "slug": "adom-ui-design",-  "version": "2.0.2",+  "version": "2.0.3",   "type": "skill",   "description": "The Adom UI Design System plus a bundle of focused UI skills (tooltips, floating-windows, toasts, responsive-ui, app-shell, ai-driven-apps, clickable-paths, dark-default, input-feedback, settings-layout). One install drops the whole set of skill files onto your container, plus shared icon assets (the settings cog) so every Adom app draws the same glyph.",   "dependencies": {},
skills/newbie-panel/SKILL.md+24
@@ -69,6 +69,30 @@ open/closed memory.  **What you still own:** your phrases, your noun, and what the demo button does. +### ⛔ A DOC WILL PUBLISH PERFECTLY HAPPILY WITHOUT ITS PAYLOAD++2.0.0 and 2.0.1 shipped this skill, which says "`assets/module/newbie-panel.js` in this pack+IS the panel", **without that file in the package**. `package.json` carries an explicit+`files` allowlist and the module was never added to it. The tarball built, the publish+succeeded, the integrity hash verified, and the skill read as proof that the module had+shipped. Six apps were told to mount a file that did not exist. Caught by chip-fetcher from a+clean install, not from a tree, roughly one hour after I had published the rule that says to+verify the artifact rather than the tree it was built in.++The sharper form of that rule, which is now the rule: **a description of a payload is not+evidence of a payload, and it is the most convincing possible non-evidence, because it is+written in the same commit.** Before announcing anything that ships a file:++```sh+rm -rf ~/.claude/skills/<pack> && adom-wiki pkg install <owner>/<pack>+find ~/.claude/skills/<pack> -name '*.js'        # the file is THERE+grep -c 'root.AdomNewbiePanel' <that file>       # and it is the IMPLEMENTATION+```++Version sizes are a second, cheap check: 2.0.1 was 120202 bytes and 2.0.2 was 192654. A+release that claims to add a 100KB module and does not grow is not carrying it. Deprecate the+broken versions rather than leaving them installable.+ ### Prove it in one call  ```js