fix: publish history-safe portable skill v0.14.1

README.md

@@ -7,6 +7,9 @@ Tree Ring Memory is a framework-agnostic, local-first memory lifecycle for AI
 agents. It helps agents decide when to recall, capture, audit, consolidate, and
 forget project memory without turning memory into an unbounded transcript dump.
 
+Skill package **0.14.1** keeps coordinator capabilities out of shell history
+and requires Tree Ring Memory CLI **0.14.0 or newer**.
+
 ## Install
 
 For Claude Code's personal skills directory:
@@ -89,6 +92,7 @@ memory-lifecycle guidance.
 ## Source Project
 
 - Framework: <https://github.com/TerminallyLazy/Tree-Ring-Memory>
+- Skill release: <https://github.com/TerminallyLazy/tree-ring-memory-skill/releases/tag/v0.14.1>
 - v0.14 release: <https://github.com/TerminallyLazy/Tree-Ring-Memory/releases/tag/v0.14.0>
 - Claude plugin wrapper:
   <https://github.com/TerminallyLazy/tree-ring-memory-claude-plugin>

SKILL.md

@@ -1,21 +1,11 @@
 ---
 name: tree-ring-memory
 description: Guides AI agents in using Tree Ring Memory for durable recall, project decisions, user preferences, warnings, future seeds, privacy-safe memory capture, and lifecycle-aware forgetting.
-version: 0.14.0
 license: MIT
-tags: ["memory", "agents", "recall", "privacy", "projects", "dox", "revolve", "skills", "cli"]
-triggers:
-  - "remember this"
-  - "recall what we decided"
-  - "what did we learn"
-  - "tree ring memory"
-  - "consolidate memory"
-  - "forget this"
-  - "project memory"
-  - "sync DOX"
-  - "sync Revolve"
-  - "evidence loop"
-  - "multi-agent memory"
+metadata:
+  version: "0.14.1"
+  tags: "memory, agents, recall, privacy, projects, dox, revolve, skills, cli"
+  triggers: "remember this; recall what we decided; what did we learn; tree ring memory; consolidate memory; forget this; project memory; sync DOX; sync Revolve; evidence loop; multi-agent memory"
 ---
 
 # Tree Ring Memory
@@ -392,7 +382,8 @@ optional Coordinated policy:
 
 ```bash
 tree-ring --root .tree-ring policy enable --coordinator release-coordinator
-export TREE_RING_COORDINATOR_TOKEN='<one-time capability printed by enable>'
+# Set and export TREE_RING_COORDINATOR_TOKEN with a history-safe, no-echo prompt
+# supported by your shell, or inject it through an approved secret manager.
 tree-ring --root .tree-ring policy status
 tree-ring --root .tree-ring policy audit --limit 100
 ```
@@ -401,7 +392,9 @@ Enable prints the capability once. Put it only in
 `TREE_RING_COORDINATOR_TOKEN`; never pass it as a CLI flag or place it in a
 memory, log, source ref, transcript, or committed file. Tree Ring stores only a
 hash. `policy status` and `policy audit` are read-only and do not reveal the
-capability. Inject it only into coordinator processes, and launch every ordinary
+capability. Do not paste it into an `export` command; use a history-safe,
+no-echo prompt supported by the current shell or approved secret-manager
+injection. Inject it only into coordinator processes, and launch every ordinary
 worker with `TREE_RING_COORDINATOR_TOKEN` unset so fan-out does not inherit
 coordinator authority.
 
@@ -428,7 +421,8 @@ replace the environment value with the newly printed capability:
 
 ```bash
 tree-ring --root .tree-ring policy rotate --coordinator release-coordinator-next
-export TREE_RING_COORDINATOR_TOKEN='<new one-time capability>'
+# Replace TREE_RING_COORDINATOR_TOKEN through the same history-safe, no-echo
+# input path before using the new capability.
 tree-ring --root .tree-ring policy disable
 unset TREE_RING_COORDINATOR_TOKEN
 ```

scripts/validate.py

@@ -30,15 +30,13 @@ def main() -> None:
     for field in (
         "name:",
         "description:",
-        "version:",
         "license:",
-        "tags:",
-        "triggers:",
+        "metadata:",
     ):
         if field not in frontmatter:
             raise SystemExit(f"missing frontmatter field: {field}")
-    if not re.search(r"^version:\s*0\.14\.0\s*$", frontmatter, re.MULTILINE):
-        raise SystemExit("SKILL.md must declare version 0.14.0")
+    if not re.search(r'^\s+version:\s*"0\.14\.1"\s*$', frontmatter, re.MULTILINE):
+        raise SystemExit("SKILL.md must declare version 0.14.1")
     if "Claude Code" in frontmatter or "Codex" in frontmatter:
         raise SystemExit("portable skill frontmatter must remain provider-neutral")
 
@@ -58,6 +56,7 @@ def main() -> None:
         "needs-user-review",
         "--operation-id",
         "TREE_RING_COORDINATOR_TOKEN",
+        "history-safe, no-echo",
         "same-host local-filesystem processes",
         "schema v3 fences",
         "operation is unsupported",
@@ -75,12 +74,17 @@ def main() -> None:
         "README.md",
         [
             "0.14.0 or newer",
+            "Skill package **0.14.1**",
             "configured-awaiting-proof",
             "needs-project-mount",
             "observed command output",
         ],
     )
     require_markers("PRIVACY.md", ["local SQLite database", "does not receive"])
+    require_markers(
+        "SECURITY.md",
+        ["https://github.com/TerminallyLazy/Tree-Ring-Memory/security/advisories/new"],
+    )
     require_markers("TERMS.md", ["MIT License", "provided without warranty"])
 
     blocked = ["OPENAI_API_KEY", "ANTHROPIC_API_KEY", "BEGIN PRIVATE KEY"]
@@ -98,6 +102,8 @@ def main() -> None:
             raise SystemExit(f"potential secret marker found: {marker}")
     if "[TODO:" in public_text:
         raise SystemExit("placeholder text remains in the package")
+    if "export TREE_RING_COORDINATOR_TOKEN='<" in public_text:
+        raise SystemExit("token-bearing export example must not appear in the package")
 
     print("Tree Ring Memory portable skill validation passed")