fix: verify signed release tag objects

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "terraphim-skills-intro",
       "source": "./",
       "description": "Search code, capture learning, and retrieve memory with Terraphim command-line tools.",
-      "version": "0.2.0",
+      "version": "0.2.1",
       "category": "development",
       "homepage": "https://terraphim-skills.md/"
     }

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "terraphim-skills-intro",
   "description": "Search code, capture learning, and retrieve memory with Terraphim command-line tools.",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "author": {
     "name": "Terraphim AI",
     "email": "engineering@terraphim.ai"

.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "terraphim-skills-intro",
   "description": "Search code, capture learning, and retrieve memory with Terraphim command-line tools.",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "author": {
     "name": "Terraphim AI",
     "email": "engineering@terraphim.ai"

.github/workflows/release.yml

@@ -15,6 +15,9 @@ jobs:
       - name: Check out tagged source
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
+          # Signature verification needs the annotated tag object, not only the
+          # commit that a shallow tag checkout resolves to.
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Set up Python

.zcode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "terraphim-skills-intro",
   "description": "Search code, capture learning, and retrieve memory with Terraphim command-line tools.",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "author": {
     "name": "Terraphim AI",
     "email": "engineering@terraphim.ai"

dist/autoclaw/SHA256SUMS

@@ -1,3 +1,3 @@
-38d8f394d04aeec419cc52a1d146525b8357bc48df5b03b0f24970e5b37453d9  terraphim-grep-0.2.0.zip
-69c2be81b8ff879fc7f9a62f5d48399be98e9a9934f3b17e2fcd657729590012  terraphim-agent-learn-0.2.0.zip
-b0f9de6fa5eff647b92bd6a6aeabe825ed3f7e00d1f690ae4f0145a7489357e9  terraphim-agent-memory-0.2.0.zip
+38d8f394d04aeec419cc52a1d146525b8357bc48df5b03b0f24970e5b37453d9  terraphim-grep-0.2.1.zip
+69c2be81b8ff879fc7f9a62f5d48399be98e9a9934f3b17e2fcd657729590012  terraphim-agent-learn-0.2.1.zip
+b0f9de6fa5eff647b92bd6a6aeabe825ed3f7e00d1f690ae4f0145a7489357e9  terraphim-agent-memory-0.2.1.zip

distribution/metadata.json

@@ -3,7 +3,7 @@
   "plugin": {
     "name": "terraphim-skills-intro",
     "display_name": "Terraphim Skills Introduction",
-    "version": "0.2.0",
+    "version": "0.2.1",
     "description": "Search code, capture learning, and retrieve memory with Terraphim command-line tools.",
     "description_zh_cn": "使用 Terraphim 命令行工具搜索代码、记录经验并检索记忆。",
     "author_name": "Terraphim AI",

docs/distribution.md

@@ -1,6 +1,6 @@
 # Multi-marketplace distribution
 
-This repository is the canonical source for all hosts. Release `v0.2.0` contains
+This repository is the canonical source for all hosts. Release `v0.2.1` contains
 exactly three skills and deterministic AutoClaw archives.
 
 ## Availability model
@@ -17,7 +17,7 @@ exactly three skills and deterministic AutoClaw archives.
 
 Install the immutable release URL through Kimi Code's `/plugins install`, or
 open `/plugins marketplace` with
-`https://raw.githubusercontent.com/terraphim/terraphim-cursor-plugin/v0.2.0/marketplaces/kimi.json`
+`https://raw.githubusercontent.com/terraphim/terraphim-cursor-plugin/v0.2.1/marketplaces/kimi.json`
 and install
 `terraphim-skills-intro`. Run `/plugins reload` (or start a new session), then
 confirm that exactly the three documented skills appear. The native manifest is
@@ -27,7 +27,7 @@ Update by installing the newer tag; remove through Kimi's plugin manager.
 
 ## AutoClaw
 
-Download the three ZIP files and `SHA256SUMS` from the `v0.2.0` release. Verify
+Download the three ZIP files and `SHA256SUMS` from the `v0.2.1` release. Verify
 each digest, then use **Skills & Connectors → Skills → Create → Add skill file**.
 Import each ZIP separately. Restart AutoClaw and confirm the skills persist. Remove
 them through the same Skills screen. If Homebrew binaries are missing from the GUI
@@ -36,7 +36,7 @@ them through the same Skills screen. If Homebrew binaries are missing from the G
 ## ZCode
 
 Open ZCode's **Discover** view and add
-`https://raw.githubusercontent.com/terraphim/terraphim-cursor-plugin/v0.2.0/marketplaces/zcode.json`
+`https://raw.githubusercontent.com/terraphim/terraphim-cursor-plugin/v0.2.1/marketplaces/zcode.json`
 as a personal marketplace source, install `terraphim-skills-intro`, then confirm the Plugin
 Skills view shows exactly three skills. Curated discovery requires a separate
 pull request to `zai-org/zcode-plugins`; this repository does not claim that
@@ -54,7 +54,7 @@ hermes skills inspect terraphim/terraphim-cursor-plugin/skills/terraphim-agent-l
 hermes skills inspect terraphim/terraphim-cursor-plugin/skills/terraphim-agent-memory
 ```
 
-Record the immutable `v0.2.0` provenance. Remove the skills with Hermes' normal
+Record the immutable `v0.2.1` provenance. Remove the skills with Hermes' normal
 skill-management command.
 
 ## skills.sh
@@ -66,7 +66,7 @@ npx skills add terraphim/terraphim-cursor-plugin
 ```
 
 Set `DISABLE_TELEMETRY=1` to opt out of anonymous telemetry. Confirm exactly three
-skills are offered and that their files match tag `v0.2.0`. Update by repeating the
+skills are offered and that their files match tag `v0.2.1`. Update by repeating the
 command for the new tag; remove the installed skill directories through the target
 agent's documented skill manager.
 

docs/uat/evidence-v0.2.1.md

@@ -0,0 +1,24 @@
+# Validation evidence — v0.2.1
+
+## Purpose
+
+Patch release `v0.2.1` preserves the reviewed `v0.2.0` Community pack and fixes
+release automation so GitHub Actions fetches the signed annotated tag object
+before running `git verify-tag`.
+
+## Regression addressed
+
+The first `v0.2.0` release run checked out only the tagged commit. Git therefore
+reported `cannot verify a non-tag object of type commit` even though the pushed
+tag was signed and verified locally. The release checkout now uses full history,
+including annotated tag objects, while keeping persisted Git credentials
+disabled.
+
+## Required evidence
+
+- generator drift check passes;
+- all distribution unit tests pass, including the tag-fetch regression test;
+- Ruff, actionlint, Claude strict validation, and `git diff --check` pass;
+- AutoClaw archives reproduce byte-for-byte and their checksums match;
+- the signed `v0.2.1` tag verifies against `.github/trusted-release-signers`;
+- the GitHub release workflow succeeds and publishes the six expected assets.

docs/uat/multi-marketplace.md

@@ -8,7 +8,7 @@ older installation cannot make a failed package appear healthy.
 
 1. Install and verify the runtime dependencies using
    [Install dependencies](../install-dependencies.md).
-2. Confirm the plugin version is `0.2.0`.
+2. Confirm the plugin version is `0.2.1`.
 3. Confirm the installed skill set is exactly:
    `terraphim-grep`, `terraphim-agent-learn`, and
    `terraphim-agent-memory`.

kimi.plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "terraphim-skills-intro",
   "description": "Search code, capture learning, and retrieve memory with Terraphim command-line tools.",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "author": {
     "name": "Terraphim AI",
     "email": "engineering@terraphim.ai"

marketplaces/kimi.json

@@ -5,7 +5,7 @@
       "id": "terraphim-skills-intro",
       "displayName": "Terraphim Skills Introduction",
       "description": "Search code, capture learning, and retrieve memory with Terraphim command-line tools.",
-      "source": "https://github.com/terraphim/terraphim-cursor-plugin/archive/refs/tags/v0.2.0.zip"
+      "source": "https://github.com/terraphim/terraphim-cursor-plugin/archive/refs/tags/v0.2.1.zip"
     }
   ]
 }

marketplaces/zcode.json

@@ -8,14 +8,14 @@
         "source": "github",
         "repo": "terraphim/terraphim-cursor-plugin",
         "path": ".",
-        "ref": "v0.2.0"
+        "ref": "v0.2.1"
       },
       "description": "Search code, capture learning, and retrieve memory with Terraphim command-line tools.",
       "description_i18n": {
         "en": "Search code, capture learning, and retrieve memory with Terraphim command-line tools.",
         "zh-CN": "使用 Terraphim 命令行工具搜索代码、记录经验并检索记忆。"
       },
-      "version": "0.2.0",
+      "version": "0.2.1",
       "category": "developer-tools",
       "tags": [
         "terraphim",

plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "terraphim-skills-intro",
   "description": "Search code, capture learning, and retrieve memory with Terraphim command-line tools.",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "author": {
     "name": "Terraphim AI",
     "email": "engineering@terraphim.ai"

tests/test_distribution.py

@@ -31,11 +31,11 @@ def test_exact_public_skill_allowlist_and_tree(self) -> None:
         self.assertEqual(GENERATOR.ALLOWED_SKILLS, names)
 
     def test_print_version_matches_manifests(self) -> None:
-        self.assertEqual("0.2.0", self.metadata["plugin"]["version"])
+        self.assertEqual("0.2.1", self.metadata["plugin"]["version"])
         output = io.StringIO()
         with redirect_stdout(output):
             self.assertEqual(0, GENERATOR.main(["--print-version"]))
-        self.assertEqual("0.2.0\n", output.getvalue())
+        self.assertEqual("0.2.1\n", output.getvalue())
 
     def test_generated_manifests_are_current_and_deterministic(self) -> None:
         expected = GENERATOR.generated_files(ROOT, self.metadata)
@@ -93,7 +93,7 @@ def test_zcode_marketplace_pins_release_and_category(self) -> None:
         entry = marketplace["plugins"][0]
         self.assertEqual("terraphim-skills-intro", entry["name"])
         self.assertEqual("developer-tools", entry["category"])
-        self.assertEqual("v0.2.0", entry["source"]["ref"])
+        self.assertEqual("v0.2.1", entry["source"]["ref"])
         self.assertTrue(entry["strict"])
         self.assertEqual({"en", "zh-CN"}, set(entry["description_i18n"]))
         manifest = json.loads((ROOT / ".zcode-plugin/plugin.json").read_text())
@@ -133,6 +133,11 @@ def test_committed_autoclaw_checksums_match_archives(self) -> None:
                 recorded[archive.name], hashlib.sha256(archive.read_bytes()).hexdigest()
             )
 
+    def test_release_checkout_fetches_annotated_tag_object(self) -> None:
+        workflow = (ROOT / ".github/workflows/release.yml").read_text()
+        self.assertIn("fetch-depth: 0", workflow)
+        self.assertIn('git verify-tag "$GITHUB_REF_NAME"', workflow)
+
     def test_docs_cover_hosts_and_dependency_probes(self) -> None:
         readme = (ROOT / "README.md").read_text().lower()
         uat = (ROOT / "docs/uat/multi-marketplace.md").read_text().lower()