hannsxpeter · hannsxpeter · Jul 13, 2026 · Jul 13, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -51,9 +51,16 @@ jobs:
         with:
           node-version: '20'
 
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.13'
+
       - name: Install dependencies
         run: npm ci --no-audit --no-fund
 
+      - name: Install pinned official Agent Skills validator
+        run: python -m pip install -r requirements/skills-ref.txt
+
       - name: Run release gate
         run: npm run release:check
 

diff --git a/.github/workflows/publish-pack.yml b/.github/workflows/publish-pack.yml
@@ -34,12 +34,22 @@ jobs:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
 
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.13'
+
       - name: Install dependencies
         run: npm ci --no-audit --no-fund
 
+      - name: Install pinned official Agent Skills validator
+        run: python -m pip install -r requirements/skills-ref.txt
+
       - name: Verify pack publishability
         run: npm run release:check
 
+      - name: Verify fresh pre-publication gate
+        run: npm run release:prepublication:check
+
       - name: Publish pack
         working-directory: extensions/${{ inputs.pack }}
         env:

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -26,9 +26,16 @@ jobs:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
 
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.13'
+
       - name: Install dependencies
         run: npm ci
 
+      - name: Install pinned official Agent Skills validator
+        run: python -m pip install -r requirements/skills-ref.txt
+
       - name: Verify release identity
         shell: bash
         run: |
@@ -49,6 +56,9 @@ jobs:
       - name: Release gate
         run: npm run release:check
 
+      - name: Verify fresh pre-publication gate
+        run: npm run release:prepublication:check
+
       - name: Publish godpowers with provenance
         run: npm publish --provenance --access public
         env:

diff --git a/.godpowers/PROGRESS.mdx b/.godpowers/PROGRESS.mdx
@@ -40,7 +40,7 @@
 - [DECISION] PRD and ROADMAP were reconstructed from the shipped v2.1.1 codebase with stable requirement ids, and the linkage map was populated via `scripts/reconstruct-self-ledger.js`. Deliverable status lives in `.godpowers/REQUIREMENTS.mdx`: 32 of 33 requirements done, 1 in progress (deliverable-progress, unreleased), 100% requirement-to-code coverage.
 
 <!-- godpowers:state-view:begin -->
-<!-- godpowers:checksum sha256:f3a1eb8bea182dc62784150cfeb8519c04301cd46c703550cf4f466318ec805a -->
+<!-- godpowers:checksum sha256:2c115bd8a71789570f4cb1bdf72fc6c0c7b24f8f56a5a3a4a322560a2064c419 -->
 # Godpowers Progress
 
 - [DECISION] This file is a generated human-readable view of `.godpowers/state.json`.
@@ -66,13 +66,13 @@
 | 9 | Planning | Design | not-required | - | 2026-07-13T05:12:51.236Z |
 | 10 | Planning | Product | not-required | - | 2026-07-13T05:12:51.236Z |
 | 11 | Planning | Architecture | done | arch/ARCH.mdx | 2026-07-13T05:45:00.000Z |
-| 12 | Planning | Roadmap | done | roadmap/ROADMAP.mdx | 2026-07-13T08:08:49.000Z |
+| 12 | Planning | Roadmap | done | roadmap/ROADMAP.mdx | 2026-07-13T15:56:11.591Z |
 | 13 | Planning | Stack | done | stack/DECISION.mdx | 2026-07-13T05:12:51.236Z |
 | 14 | Building | Repo | done | repo/AUDIT.mdx | 2026-07-13T05:57:20.000Z |
-| 15 | Building | Build | done | build/STATE.mdx | 2026-07-13T07:59:42.000Z |
+| 15 | Building | Build | done | build/STATE.mdx | 2026-07-13T15:59:58.000Z |
 | 16 | Shipping | Deploy | done | deploy/STATE.mdx | 2026-07-13T08:08:49.000Z |
 | 17 | Shipping | Observe | done | observe/STATE.mdx | 2026-07-13T07:59:42.000Z |
-| 18 | Shipping | Harden | done | harden/FINDINGS.mdx | 2026-07-13T07:59:42.000Z |
+| 18 | Shipping | Harden | done | harden/FINDINGS.mdx | 2026-07-13T15:59:58.000Z |
 | 19 | Shipping | Launch | done | launch/STATE.mdx | 2026-07-13T08:08:49.000Z |
 
 <!-- godpowers:state-view:end -->
diff --git a/.godpowers/build/STATE.mdx b/.godpowers/build/STATE.mdx
@@ -1,5 +1,5 @@
 <!-- godpowers:state-view:begin -->
-<!-- godpowers:checksum sha256:c1570dbd19f538df42b7d75472a43637d848e000cf8ae8861d2a6ab715d42832 -->
+<!-- godpowers:checksum sha256:ad9ad4fba30199b9132845330653bbb88b0a0b1857c352385d79e103df9b482d -->
 # Godpowers Build State
 
 - [DECISION] This file is a generated human-readable view of `.godpowers/state.json` for `tier-2.build`.
@@ -9,22 +9,22 @@
 - [DECISION] Step: Building: Build.
 - [DECISION] Status: `done`.
 - [DECISION] Artifact: `.godpowers/build/STATE.mdx`.
-- [DECISION] Updated: 2026-07-13T07:59:42.000Z.
-- [DECISION] Notes: All implementation and behavioral tests pass..
+- [DECISION] Updated: 2026-07-13T15:59:58.000Z.
+- [DECISION] Notes: All implementation, behavioral, standards, coverage, audit, and package checks pass for version 5.5.0..
 
 ## Verification Commands
 
 | Command | Status | Exit code | Ran at | Duration ms | Diagnostics |
 |---|---|---|---|---|---|
-| npm test | pass | 0 | 2026-07-13T07:59:42.000Z | 44100 | All test commands passed with 94.65% line, 79.28% branch, and 96.93% function coverage. |
-| npm run pack:check | pass | 0 | 2026-07-13T07:59:42.000Z | 700 | Root npm package contents verified: 577 files. |
-| npm run pack:mcp:check | pass | 0 | 2026-07-13T07:59:42.000Z | 400 | MCP package contents verified: 8 files. |
-| npm run release:check | pass | 0 | 2026-07-13T07:59:42.000Z | 45000 | Aggregate coverage, per-file coverage across 96 expected runtime modules, dependency audit, 141 self-project truth checks, public surface, root package, and MCP package checks passed. |
+| npm test | pass | 0 | 2026-07-13T15:59:58.000Z | 41300 | All test commands passed in 41.3 seconds. |
+| npm run pack:check | pass | 0 | 2026-07-13T15:59:58.000Z | - | Root npm package contents verified: 582 files. |
+| npm run pack:mcp:check | pass | 0 | 2026-07-13T15:59:58.000Z | - | MCP package contents verified: 8 files. |
+| npm run release:check | pass | 0 | 2026-07-13T15:59:58.000Z | 46000 | Official skill validation, Pillars 1.1 conformance, 94.64 percent line coverage, 79.26 percent branch coverage, 96.77 percent function coverage, per-file coverage across 98 runtime modules, dependency audit, 141 self-project truth checks, public surface, root package, and MCP package checks passed. |
 
 ## Evidence Fields
 
 | Field | Value |
 |---|---|
-| release-version | 5.4.0 |
+| release-version | 5.5.0 |
 
 <!-- godpowers:state-view:end -->
diff --git a/.godpowers/docs/REPO-DOC-SYNC.mdx b/.godpowers/docs/REPO-DOC-SYNC.mdx
@@ -109,3 +109,14 @@
 - [DECISION] Repo documentation sync status before apply was fresh.
 - [DECISION] Repo documentation sync status after apply is fresh.
 - [DECISION] No mechanical repo documentation files were changed.
+
+## 2026-07-13T15:52:41.841Z
+
+- [DECISION] Repo documentation sync status before apply was stale.
+- [DECISION] Repo documentation sync status after apply is stale.
+- [DECISION] Refreshed README.md for readme-version-badge.
+- [DECISION] Refreshed USERS.md for users-version.
+- [DECISION] Refreshed ARCHITECTURE.md for architecture-version.
+- [DECISION] Refreshed docs/ROADMAP.md for roadmap-version.
+- [DECISION] Refreshed docs/reference.md for reference-version.
+- [HYPOTHESIS] god-docs-writer should review CHANGELOG.md, RELEASE.md, SECURITY.md.
diff --git a/.godpowers/harden/FINDINGS.mdx b/.godpowers/harden/FINDINGS.mdx
@@ -2,7 +2,7 @@
 
 - [DECISION] Date: 2026-07-13.
 - [DECISION] Reviewer: autonomous product trust hardening run.
-- [DECISION] Scope: installer, host capability detection, Quick Proof, state reconciliation, release checks, package contents, and production dependencies.
+- [DECISION] Scope: CLI and SDK routing, installer and release workflows, hash-bound public activation, package contents, and production dependencies.
 
 ## Summary
 
@@ -15,20 +15,20 @@
 
 - [DECISION] Launch gate: PASSED.
 
-## OWASP Coverage
-
-| Category | Status | Evidence |
-|---|---|---|
-| A01 Broken Access Control | Reviewed | [DECISION] No application authorization surface exists in the package runtime. |
-| A02 Cryptographic Failures | Reviewed | [DECISION] Event integrity uses SHA-256 and no product secrets are stored. |
-| A03 Injection | Reviewed | [DECISION] Shell-sensitive helpers prefer argument-array process execution. |
-| A04 Insecure Design | Reviewed | [DECISION] Level-4 release actions remain user-owned and guarded. |
-| A05 Security Misconfiguration | Reviewed | [DECISION] Host guarantees fail closed without active-session evidence. |
-| A06 Vulnerable Components | Reviewed | [DECISION] `npm audit --omit=dev` is a release check and the core has no production dependency. |
-| A07 Authentication Failures | Reviewed | [DECISION] Authentication is delegated to host and release providers, with no local credential store. |
-| A08 Data Integrity Failures | Reviewed | [DECISION] Checksummed state views, event hash chains, and self-truth checks protect release claims. |
-| A09 Logging Failures | Reviewed | [DECISION] Events, checkpoints, gate results, and sync logs remain inspectable on disk. |
-| A10 SSRF | Reviewed | [DECISION] Core runtime does not expose a server-side URL fetch endpoint. |
+## OWASP Web Top 10:2025 Coverage
+
+| Category | Manual procedure | Result | Evidence or finding |
+|---|---|---|---|
+| A01:2025 Broken Access Control | Trace CLI project-root access and inspect the new routing and gate modules for user-controlled URL fetches or internal-resource access | Not Applicable, no network server or URL fetch boundary exists in the reviewed runtime | `scripts/test-product-routing.js`; `scripts/test-prepublication-gate.js`; source inspection of `lib/product-routing.js` and `lib/prepublication-gate.js` |
+| A02:2025 Security Misconfiguration | Exercise missing, invalid, pending, and stale hardening state through the public activation gate | pass, invalid or incomplete authority fails closed | `scripts/test-prepublication-gate.js` missing, invalid, incomplete, and stale-state cases |
+| A03:2025 Software Supply Chain Failures | Verify dependency audit, immutable workflow action identities, package allowlist contents, provenance workflow, and pre-publish gate ordering | pass | `npm audit --omit=dev`; `.github/workflows/publish.yml`; `.github/workflows/publish-pack.yml`; `scripts/check-package-contents.js` |
+| A04:2025 Cryptographic Failures | Mutate reviewed hardening bytes and verify SHA-256 revision mismatch blocks publication | pass | `lib/prepublication-gate.js`; `scripts/test-prepublication-gate.js` hash-mutation case |
+| A05:2025 Injection | Pass explicit and ambiguous product text plus project path arguments through parsing without shell interpolation | pass | `lib/product-routing.js`; `lib/prepublication-gate.js`; `scripts/test-product-routing.js`; `scripts/test-prepublication-gate.js` |
+| A06:2025 Insecure Design | Exercise ambiguous form selection, accepted Critical status, stale timestamp, and missing gate abuse cases | pass, ambiguity remains open and every unsafe activation case blocks | `scripts/test-product-routing.js`; `scripts/test-prepublication-gate.js` |
+| A07:2025 Authentication Failures | Inspect credential and session ownership across the local runtime and publication workflows | Not Applicable, authentication is delegated to the active AI host, GitHub, and npm with no local credential store | `.github/workflows/publish.yml`; `SECURITY.md`; source inspection |
+| A08:2025 Software or Data Integrity Failures | Record the exact hardening revision, then alter findings bytes and authoritative hardening state independently | pass, either change invalidates the gate | `scripts/test-prepublication-gate.js` revision and authoritative-update cases |
+| A09:2025 Security Logging and Alerting Failures | Trigger a blocked gate and verify a non-zero command result plus explicit blocking reasons for CI and operator action | pass | `lib/prepublication-gate.js`; `scripts/test-prepublication-gate.js`; publish workflow gate step |
+| A10:2025 Mishandling of Exceptional Conditions | Inject malformed JSON, missing files, incomplete state, invalid timestamps, stale updates, and changed Critical counts | pass, all cases fail closed without public activation | `scripts/test-prepublication-gate.js` exceptional-condition cases |
 
 ## Findings
 
@@ -38,5 +38,5 @@
 ## Have-Nots Checklist
 
 - [x] [DECISION] Manual code and contract review supplemented automated dependency checks.
-- [x] [DECISION] Every OWASP category has an explicit package-specific disposition.
+- [x] [DECISION] Every OWASP Web Top 10:2025 category has an explicit package-specific procedure, result, and evidence reference.
 - [x] [DECISION] Critical findings count is zero.
diff --git a/.godpowers/launch/PREPUBLICATION.mdx b/.godpowers/launch/PREPUBLICATION.mdx
@@ -0,0 +1,19 @@
+---
+schema-version: 1
+checked_at: "2026-07-13T16:01:05.617Z"
+hardening_revision: "sha256:f7bcf07a292362d2f40dcf7f2a8f40c35facb70fd5621e2c569a20d2a2d1b337"
+hardening_updated_at: "2026-07-13T15:59:58.000Z"
+critical_total: 0
+critical_unresolved: 0
+critical_accepted: 0
+policy: "block-unresolved-critical"
+verdict: "pass"
+---
+# Pre-Publication Gate
+
+- [DECISION] Checked at: 2026-07-13T16:01:05.617Z.
+- [DECISION] Hardening revision: sha256:f7bcf07a292362d2f40dcf7f2a8f40c35facb70fd5621e2c569a20d2a2d1b337.
+- [DECISION] Hardening updated at: 2026-07-13T15:59:58.000Z.
+- [DECISION] Critical findings: 0 total, 0 unresolved or accepted.
+- [DECISION] Verdict: pass.
+- [DECISION] Any later hardening revision or hardening state update invalidates this gate.
diff --git a/.godpowers/roadmap/ROADMAP.mdx b/.godpowers/roadmap/ROADMAP.mdx
@@ -1,14 +1,14 @@
 # Roadmap
 
-> Reconciled against the Godpowers 5.4.0 published release. Increments carry a
+> Reconciled against the Godpowers 5.5.0 release candidate. Increments carry a
 > stable M-slug id, a Status, and the PRD requirement ids they deliver. Status is
 > derived from current artifacts, linkage, and executable evidence.
 
 ## Evidence Provenance
 
-- [DECISION] Evidence generated at: `2026-07-13T08:08:49.000Z`.
-- [DECISION] Source version: `5.4.0`.
-- [DECISION] Source hash `package.json`: `sha256:b4408eb0bd0365433a55d2a29b23d45a52874117f7228caa7bbf487123dfa1f5`.
+- [DECISION] Evidence generated at: `2026-07-13T15:55:18.000Z`.
+- [DECISION] Source version: `5.5.0`.
+- [DECISION] Source hash `package.json`: `sha256:3cdde60011cd4891c7c6109bec611176d56d6d6c1c92d3bcc28d5bba9e810f5b`.
 - [DECISION] Source hash `.godpowers/prd/PRD.mdx`: `sha256:239990ed2eb267c26d3de744bf318d6260bfd67463fec8e7ccccbc348fc1712c`.
 - [DECISION] Source hash `.godpowers/arch/ARCH.mdx`: `sha256:ec90f0ec06d07fbc67c3b5ac22f3ae882a10d714ef230316f75823709e44642b`.
 - [DECISION] Source hash `.godpowers/stack/DECISION.mdx`: `sha256:cc9e9227262d9d472fa7806fbafc9a83b8e621728c3652fae1a423a867989ce3`.

diff --git a/.godpowers/runs/20260713-arc-pillars-1-1-hardening/ORCHESTRATOR-HANDOFF.mdx b/.godpowers/runs/20260713-arc-pillars-1-1-hardening/ORCHESTRATOR-HANDOFF.mdx
@@ -0,0 +1,22 @@
+# Arc-Ready And Pillars 1.1 Hardening Handoff
+
+- [DECISION] Project root: `/Users/hprincivil/Projects/godpowers`.
+- [DECISION] This is a brownfield resume from authoritative `.godpowers/state.json` state.
+- [DECISION] Invocation mode is autonomous implementation with release authority.
+- [DECISION] The user authorized implementation, commits, pushes, merges, GitHub release creation, release asset publication, npm publication, and repository cleanup.
+- [DECISION] The target is a release-quality Godpowers version that closes every evidenced gap against Arc-Ready 1.1.0 and Pillars 1.1.0.
+- [DECISION] Read `.godpowers/state.json`, `.godpowers/CHECKPOINT.mdx`, `.godpowers/intent.yaml`, current tier artifacts, and this handoff before choosing work.
+- [DECISION] Treat `.godpowers/PROGRESS.mdx` and tier state views as generated human views when state exists.
+- [DECISION] Compute the Pillars load set before each major command while repairing the Pillars implementation itself from the authoritative Pillars 1.1.0 specification at `/Users/hprincivil/Projects/pillars/SPEC.md`.
+- [DECISION] Read `/Users/hprincivil/Projects/arc-ready/SKILL.md`, its product-form router, domain registry, OWASP 2025 router, completion gates, and evaluation cases as upstream evidence.
+- [DECISION] Implement Pillars 1.1 nested scopes, path-derived identities, portable token matching, offline absent catalogs, conditional soft references, context budgets, conformance fixtures, and the current catalog.
+- [DECISION] Separate Godpowers specialist agent source contracts from the project Pillars namespace while preserving installed runtime agent paths and compatibility.
+- [DECISION] Implement form-first routing, four-axis domain composition, form-specific completion evidence, OWASP 2025 coverage, and a hash-bound pre-publication gate that invalidates after hardening changes.
+- [DECISION] Add Arc-Ready artifact import and managed sync-back without overwriting Arc-Ready-owned canonical files.
+- [DECISION] Add pinned official Agent Skills validation, align root skill metadata, and add deterministic plus live-harness evaluation evidence.
+- [DECISION] Update all affected docs, routes, workflows, schemas, templates, package allowlists, tests, generated state, release notes, and version references.
+- [DECISION] Use the autonomous repair loop until focused tests, full tests, release checks, official validators, package checks, and isolated published-install checks pass.
+- [DECISION] Do not bypass safe-sync, unresolved Critical findings, validation failures, package mismatches, or publication verification failures.
+- [DECISION] Follow `references/orchestration/GOD-MODE-RUNBOOK.md` for the project-run contract.
+- [DECISION] GitHub and npm identities are already authenticated and available for the authorized release actions.
+- [OPEN QUESTION] None. The user explicitly authorized the full implementation and release path. Owner: user. Due: resolved in this invocation.