← Commit history

publish runbook: lock the slim-zip KEEP/EXCLUDE policy + no-images-in-pkg rule (audit 2026-07-15)

John Lauer ·78720b73d8 ·3mo ago ·parent d144171
1 file changed +39−2
skills/kicad-bridge-publish/SKILL.md+39−2
@@ -16,9 +16,33 @@ How to cut and publish a KiCad-bridge release. **Use the `adom-wiki` CLI for ALL  They must match. `bridge.json` also carries `updateManifestUrl` (durable auto-update), `docs` (your page), `homepage` (a **wiki.adom.inc** URL, NEVER github), `detect` (host-app paths incl. `%LocalAppData%\Programs\KiCad`), `verbPrefixes`, complete `verbs[]`, `statusVerb`. -## 2. Build the zip+## 2. Build the zip — KEEP IT TINY (it is auto-bundled into AD) -Zip the repo dir CONTENTS (bridge.json at the zip root). Exclude: `__pycache__`, `*.pyc`, `.git`, `.github`, `node_modules`, `.DS_Store`, and the generated `adom-bridge-kicad-manifest.json`. Include `certs/cacert.pem`. Compute `sha256` + byte `size` for the manifest.+The runtime zip ships inside Adom Desktop for **every** user, so it carries ONLY what the+bridge needs to RUN. No docs, no images, no skills, no samples. (Audited 2026-07-15: the zip+had grown to 488.9 KB carrying 219 KB of hero *fonts*, five `skills/` trees, demo scripts and+READMEs — none referenced by runtime code. Slimming it to 335.7 KB was a 31% cut with zero+functional change.)++**KEEP** (runtime-required):+- all `*.py` (server + `handlers/` + `plugin_payload/`)+- `certs/cacert.pem` — AD's portable Python has no CA bundle+- `*.ps1` (`launch_editor.ps1`, `navigate_symbol.ps1`) — UIA scripts the handlers shell out to+- `templates/blank-board.kicad_pcb` — read by `handlers/place_footprint.py`+- `bridge.json`, `BRIDGE_VERSION`, `start.bat`, `start.sh`+- root `SKILL.md` ONLY (the runtime skill `adom-desktop-kicad`, `public: true` — AD installs it)++**EXCLUDE** (everything else):+`skills/**` (container-side docs — they ship in the PKG, duplicating them here is pure bloat),+`demo/**`, `docs/**`, `tour*/**`, every `*.md` except root `SKILL.md`, every image/font+(`*.png *.jpg *.svg *.gif *.ttf *.otf *.woff*`), every archive/video (`*.zip *.tar.gz *.bundle+*.mp4` — note `mesa-llvmpipe-x64.zip` is 22 MB and must NEVER land in the zip),+`__pycache__`, `*.pyc`, `.git`, `.github`, `node_modules`, `.DS_Store`, and the generated+`adom-bridge-kicad-manifest.json`.++Compute `sha256` + byte `size` for the manifest. **Verify before publishing:** every local+import resolves inside the zip, and the data files above are all present — then deploy and+call `kicad_describe` (verb count) + one data-file-dependent verb on a real target.  Manifest fields: `manifest_version:1, name:"kicad", version, url` (the `/blob/app/.../adom-bridge-kicad-v<ver>.zip`), `sha256, size, verbPrefixes:["kicad_"], healthEndpoint:"/status", released_at, hero, languages`. @@ -37,6 +61,19 @@ adom-wiki release create adom/adom-desktop-kicad-bridge <ver> \  ## 4. Publish the skills pkg (container docs) +**The pkg is skills-only — it is NOT the bridge.** Say so in `package.json` `description` and at+the top of the README: the pkg teaches a container agent the `kicad_*` verbs; the **release zip**+is what AD downloads and runs as the bridge runtime. Users conflate them constantly.++**No images in the pkg.** The README references page art by ABSOLUTE+`https://wiki.adom.inc/blob/app/adom-desktop-kicad-bridge/<name>.png` URLs, so the PNGs render on+the page without riding in the install tarball. (Audited 2026-07-15: `files[]` listed+`hero.png` + `arch.png` + `verbs.png` + `outcomes.png` = **496 KB** downloaded by every+`pkg install`, referenced by nothing. Removing them took the tarball to 29.5 KB.) Push page art+with `repo push`, never list it in `files[]`. Before publishing, **stage only the declared+`files[]` into a clean dir and pack from there** — packing from the page repo sweeps up art,+zips and videos.+ Stage a dir with `package.json` (name/version/`files[]`), a ROOT `SKILL.md`, and a `skills/<name>/SKILL.md` for **every** skill. **SKILLPACK convention (SDK, replaces the dead `dev-skills/*.md` rule): EVERY skill — user, dev, AND publish — is a real `skills/<name>/SKILL.md` and ships in the tarball.** Dev/publish skills are scoped by AUDIENCE, not filename: frontmatter `user-invocable: false` + a description that opens DEVELOPER-only, so everyday users never get them offered but maintainers still install them. **List every skill path EXPLICITLY (no globs) in `package.json` `files[]` AND `install.sh`/`uninstall.sh`.** Then:  ```bash