Ship 1.5.0, and fail when the version stops describing the payload

A packaging audit found the label covering three different trees. Both manifests
said 1.4.0 while the installable payload sat nine commits ahead of that tag —
including a whole new hook. `VSTACK_REF=v1.4.0` got the tag; the unpinned
bootstrap and the plugin marketplace both take the default branch. Three lanes,
three trees, one version, and a changelog describing none of what the last two
actually delivered.

Check 24 is the fix that outlives this release. It does not demand that HEAD
always be a release — only that if a tag exists with the version the manifests
declare, the installable payload is identical to it. Between releases you bump
the version and it goes quiet until that version is tagged. It went red on its
first run, which is why 1.5.0 exists.

Docs and tests are deliberately outside its scope: they change constantly without
changing what a stranger receives.

Two smaller things from the same audit. NOTICE still named two MIT upstreams
after gstack's notice was vendored as the third — the notice was present, the
cross-reference to it was not. And the README described the plugin lane as
shipping "the routing hook" when hooks.json declares two: routing, and a Stop
gate that stays inert until a repo's verify.sh is trusted.

1.5.0 itself is the second external review's findings: the cloud gate that was
installed and never ran, credentials exported into every shell, a guard adapted
from gstack and armed by default, a pinned bootstrap that 404'd for tags, six
skills pointing at skills this port does not vendor, and a first screen that led
with the widest lane instead of the narrowest.

verify.sh 26/26, falsifiability 27/27, matrix 19/19, doctor and drift green.

Author: itsvedantkumar

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "vstack",
-      "version": "1.4.0",
+      "version": "1.5.0",
       "source": "./claude",
       "description": "26 skills that fire without a slash command, 8 agents, 14 commands, and the session hook that routes situations to skills. Most skills are ported from pstack and Superpowers — see claude/skills/ATTRIBUTION.md for per-skill source and license.",
       "category": "workflow"

.claude/verify.sh

@@ -881,6 +881,36 @@ else
   skip "destructive guard decides correctly" "jq not installed"
 fi
 
+# --- 24. the declared version describes what actually installs -------------------------------
+# Three lanes install three different trees, and only one of them is pinned. `VSTACK_REF=v1.4.0`
+# gets the tag; the unpinned bootstrap and the plugin marketplace both take the default branch.
+# So when the payload moves ahead of the tag while the manifests still name it, a stranger
+# installs something that is not the version it claims to be — and the changelog describes a
+# different artefact than the one they got.
+#
+# The rule is narrow on purpose: it does not demand that HEAD always be a release. It only
+# demands that if a tag exists with the version the manifests declare, the installable payload
+# is identical to it. Between releases you simply bump the version, and the check goes quiet
+# until that version is tagged.
+if command -v git >/dev/null && command -v jq >/dev/null; then
+  mv_=$(jq -r '.version' claude/.claude-plugin/plugin.json 2>/dev/null)
+  if [ -z "$mv_" ]; then
+    bad "declared version matches what installs" "could not read the version from the plugin manifest"
+  elif ! git rev-parse -q --verify "refs/tags/v$mv_" >/dev/null 2>&1; then
+    ok "declared version matches what installs (v$mv_ not yet tagged)"
+  else
+    # Everything a lane actually delivers. Docs, tests and CI are deliberately excluded: they
+    # change without changing what a stranger receives.
+    drift=$(git diff --name-only "v$mv_..HEAD" -- claude/ mcp/ bin/ shell/ conductor/ \
+              install.sh bootstrap.sh overlay.sh uninstall.sh setup-machine.sh 2>/dev/null)
+    [ -z "$drift" ] && ok "declared version matches what installs (v$mv_)" \
+      || bad "declared version matches what installs" \
+             "$(printf 'the manifests say v%s but the payload has moved since that tag:\n%s\nbump the version and changelog it, or the plugin and unpinned lanes ship something v%s never described' "$mv_" "$(printf '%s' "$drift" | sed 's/^/  /' | head -10)" "$mv_")"
+  fi
+else
+  skip "declared version matches what installs" "git or jq not installed"
+fi
+
 echo
 # Accounting. Every declared check must have reported either a result or a skip. A check
 # that throws a shell error mid-body, or is wrapped in a conditional with no else, silently

CHANGELOG.md

@@ -6,6 +6,51 @@ Versions follow [semver](https://semver.org). The version lives in two manifests
 
 ## Unreleased
 
+## 1.5.0 — 2026-08-20
+
+A second external review, of the improvements rather than the bugs. Its headline finding was
+that the cloud lane's central promise was inert, and it was right.
+
+**The Stop gate never ran in a cloud sandbox.** `overlay.sh` installs `.claude/verify.sh` and
+wires the hook, but `verify-gate.sh` refuses to execute a repo's gate without a machine-local
+trust entry — and a fresh sandbox has none. Installed, wired, silently skipping on every Stop,
+in the one lane that exists for cloud work. The sandbox setup line now runs `vstack trust`.
+Local protection is unchanged: an untrusted repo cloned to your laptop still runs nothing until
+you type it yourself.
+
+**Credentials are no longer exported into your shells.** `install.sh` sourced `secrets.env` into
+`.zshenv` with `set -a`, and the bash lane extended that to `.bashrc` and `.profile`. One token
+reached every child process of every shell: every script in every repo, every package
+postinstall. Every wrapper in `bin/` already loads what it needs. The installer now removes the
+line it previously wrote, and leaves any other spelling alone.
+
+**A destructive-command guard, armed by default.** vstack had no pre-execution interception at
+all, which is a strange gap for a setup that recommends `--bypass-permissions` — bypassing
+permissions is exactly what removes the prompt that would catch `rm -rf /`. Adapted from
+gstack's `careful` skill (MIT, Garry Tan) with two differences: it is always armed rather than
+opt-in per session, and its decisions are tested. Sixteen commands across deny, ask and allow,
+plus a stripped-environment run.
+
+**The pinned bootstrap worked for branches and not tags** — `archive/refs/heads/$REF` 404s for
+`VSTACK_REF=v1.4.0`, the exact value the README tells people to pin. And a no-git install could
+not be converted once git returned, which was the recovery that path itself recommends. It now
+marks its own tarball installs, converts them by moving aside rather than deleting, and refuses
+outright to touch a directory it did not create.
+
+**Skills stopped pointing at skills that are not here.** Six `superpowers:` references across
+three skills instructed the model to invoke tooling this port does not vendor. Check 7 could not
+see them — its token pattern skips the namespace prefix.
+
+**First contact leads with the narrow thing.** The plugin lane is the headline now, with an
+invitation to stop after thirty seconds. The workstation setup follows, labelled as one person's
+whole environment, with the pinned and readable path before the unpinned one-liner. The plugin
+lane also stopped mandating a four-skill chain for every change, which was operating policy in
+the one profile whose job is stripping operating policy.
+
+**New checks.** 22 extended to cover skills as well as scripts. 23 tests the guard's decisions.
+24 fails when the payload moves ahead of the version the manifests declare — which it caught on
+its first run, and which is why this release exists.
+
 ## 1.4.0 — 2026-08-20
 
 An external adversarial audit of 1.3.0 by a different model returned twelve findings and a

NOTICE

@@ -15,7 +15,7 @@ Adapted for Claude Code as the `agent-browser` skill.
 
 MIT-licensed work is vendored here too, and MIT requires its copyright and
 permission notices travel with it. Those are in LICENSE.mit-upstream
-(obra/superpowers and ehmo/platform-design-skills) and in
+(obra/superpowers, ehmo/platform-design-skills and garrytan/gstack) and in
 claude/skills/LICENSE.pstack (pstack).
 
 Modifications: every vendored skill was adapted for Claude Code — model names

README.md

@@ -30,7 +30,8 @@ honest version of "it works".
 ## Start here: the skills alone
 
 If you want better Claude Code behaviour and nothing else, this is the whole thing. It adds
-skills, subagents, commands and the routing hook. It does not touch your shell, your
+skills, subagents, commands and the routing hook, plus a Stop-hook gate that stays inert until
+you trust a repo's own `.claude/verify.sh`. It does not touch your shell, your
 credentials, your `~/.claude/settings.json`, or anything else on the machine.
 
 ```bash
@@ -102,8 +103,9 @@ nothing — no home directory config of any kind. If the skills are not committe
 that session does not have them. `bin/doctor` fails when an active repo has no overlay, and it
 finds those repos through their Conductor workspaces rather than a hardcoded list of paths.
 
-The plugin lane is deliberately the narrowest. It ships the skills, subagents, commands and the
-routing hook, and stops there. The token, delegation and autonomy rules in the other two lanes
+The plugin lane is deliberately the narrowest. It ships the skills, subagents, commands, the
+routing hook, and an opt-in Stop-hook verify gate that does nothing until a repo's
+`.claude/verify.sh` is trusted — two hooks, not one. The token, delegation and autonomy rules in the other two lanes
 are one person's operating policy and have no business arriving with a skill pack a stranger
 installed.
 

claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vstack",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Skills that fire on the situation instead of a slash command, plus the subagents, commands, and session hook that make them fire. Verification gates, parallel fan-out, code review, and writing discipline.",
   "author": {
     "name": "Vedant Kumar"

tests/gate-falsifiability.sh

@@ -18,7 +18,7 @@ set -uo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")/.." || exit 1
 
 # One id per `# --- N.` section in .claude/verify.sh. Check 16 parses this line.
-CHECKS="0 1 2 3 4 5 6 7 8 9 9b 10 11 12 13 14 15 16 17 18 19 20 21 22 23"
+CHECKS="0 1 2 3 4 5 6 7 8 9 9b 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24"
 
 BK=$(mktemp -d)
 NOJQ=$(mktemp -d)
@@ -67,6 +67,7 @@ files_for(){ case "$1" in
   21)  printf 'install.sh' ;;
   22)  printf 'claude/skills/swarm/SKILL.md' ;;
   23)  printf 'claude/hooks/guard-destructive.sh' ;;
+  24)  printf 'claude/.claude-plugin/plugin.json' ;;
 esac }
 
 # The label the gate must print. Matched against the FAIL lines only.
@@ -96,6 +97,7 @@ label_for(){ case "$1" in
   21)  printf 'RETIRED names only retired keys' ;;
   22)  printf 'skills disclose what they do not ship' ;;
   23)  printf 'destructive guard decides correctly' ;;
+  24)  printf 'declared version matches what installs' ;;
 esac }
 
 # Break exactly what the check watches, and nothing else. Surgical matters: a mutation that
@@ -167,6 +169,10 @@ exit 0
       # and the ask/allow tiers keep working, so only a test of the decisions notices.
       sed -i.t 's/^if \[ "\$SIMPLE" = 1 \]; then/if false; then/' claude/hooks/guard-destructive.sh \
         && rm -f claude/hooks/guard-destructive.sh.t ;;
+  24) # claim an already-tagged version while the payload has moved on — the exact state that
+      # ships three lanes three different trees under one label
+      sed -i.t 's/"version": "[0-9.]*"/"version": "1.4.0"/' claude/.claude-plugin/plugin.json \
+        && rm -f claude/.claude-plugin/plugin.json.t ;;
 esac }
 
 echo "falsifying $(printf '%s' "$CHECKS" | wc -w | tr -d ' ') checks"