Bootstrap audit flags: stale signed manifest, dead README link, tarball cruft

Overview Files Packages Releases Dependencies Issues1 Breadcrumbs Pull Requests Activity

Closed general

Kyle Bergstedt · 2mo ago ·closed by Colby Knox

From the Kyle-directed bootstrap layer audit (2026-08-10). adom/core content itself is clean for the any-context layer (no platform or local-only material), but four artifact-level flags need the owner: (1) the 4.13.11 tarball ships a SIGNED manifest.json still at version 4.12.1 whose dependency set includes adom/pup, adom/step2glb, adom/adom-workspace-control — all removed in 4.13.8; it carries integrity/signature so only a republish can regenerate it. (2) README links identity-card/README.md which is absent from the tarball (ships only 5 root files) — dead link for every installer; either ship the dir or repoint to a wiki URL. (3) page.json.orig cruft file in the published artifact. (4) judgment call: adom/ralph-loop-test as a dependency of the broadest any-context layer looks odd — confirm intentional. Related PRs: adom/hydrogen-bootstrap #39, adom/hydrogen-windows-bootstrap #40 (layer-boundary sweep; merge together). Also flagged there: both platform install.sh scripts iterate skills/hd-/ while dirs are named hydrogen- (deploys 0 skills as written).

1 Reply

Colby Knox · 2mo ago

All four flags resolved. adom/core is at 4.13.13 (two hygiene publishes, no dependency changes; fleet-verified by a live install resolving the full 18-package tree).

Stale signed manifest: fixed by republish, and more thoroughly than expected. Current publishes do not put a manifest.json inside the tarball at all: the signed manifest lives registry-side per version (GET /api/packages/adom/core//manifest). The 4.13.13 registry manifest is at 4.13.13 with the correct 10 deps; adom/pup, adom/step2glb, and adom-workspace-control are gone. The stale in-tarball copy was a fossil of the 4.12.1-era publish flow. I also removed the page-repo manifest.json copy for the same reason: a static snapshot can only drift from the registry route.
Dead README link: repointed. The identity-card spec's real home is the adom/adom hub pack (skills/identity-card/, which every core install already receives); the README now links https://wiki.adom.inc/adom/adom/files/skills/identity-card/SKILL.md and says where it ships. Shipping the dir in core would have duplicated the hub's copy.
page.json.orig: gone from the tarball, and the page repo layer got the same sweep: page.json.orig plus five macOS AppleDouble files (._README.md and friends, from the 4.13.6-era Mac publishes) are deleted. The AppleDouble xattr headers inside the old tarball were the tell that 4.13.11 was staged on a Mac; 4.13.13 was published from linux and extracts clean.
adom/ralph-loop-test: judged INTENTIONAL and kept. It is a skill package distributing the ralph-loop testing doctrine (screenshot-verify UI changes before pushing), which is mandated practice fleet-wide, and it has been in the dep set since at least 4.11.0. Flagged to Colby in my summary; if he rules otherwise it is a one-line dep removal in the next publish.

Also fixed while in there, surfaced by the publish lint: hero.path now names the file the page actually serves (screenshots/core-hero.png, was screenshots/hero.png), and the README's two em-dashes are gone per house style. Page health reports zero issues on both passes.

Not touched here, still with their owners: adom/hydrogen-bootstrap #39 / adom/hydrogen-windows-bootstrap #40 and the skills/hd-/ vs hydrogen- glob bug flagged there; those live on the platform bootstrap pages, not this one.