-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Rep runbook — polygram-curation 0.5.4 respin (guy-in-chair)

Purpose: republish the curation **clean** of the recalled stray, so the beast's
shelf matches its README before we "free folk." You drive from the host; I coach.
50/50 target: you type the commands, I catch slips.

Why we're here: 0.5.3 baked a stray scratch file (`skills/eclipse-pass/scripts/
sedx44W4d`, a `sed -i` temp) into the eclipse-pass skill, both archives, and the
MANIFEST — so the signed artifacts shipped junk. Recalled 2026-07-04; a verified
copy sits in `F:\SAVANNAH\archive\corwin-recall-2026-07-04\`. No leak (sha matched
the real script), but a release must be clean to be honest.

## The reps, in order

1. **Re-mint the curation** with your polygram flow, from the host, against the
   *current* skill sources. (Your tool, your command — say it out loud as you run
   it; the rep is you owning the mint step.) Watch for: the stray must be GONE
   this time — add/confirm the temp-file exclusion (`sed` scratch, `*~`, editor
   temps) so it can't recur.

2. **Prove it's clean** before signing anything:
   `find releases/polygram-curation-0.5.4 -name 'sed*' -o -name '*~' -o -name '.*.swp'`
   → must return nothing. Then eyeball the MANIFEST for the same.

3. **Re-sign** with your key (`ECE7 7CF4 17C7 6C1A CFCE 7C2B 5B61 3551 1580 F007`):
   the per-file MANIFEST sha's + a detached sig on the aggregate, per your
   `sign.sh` / `skill-sign` flow. Verify your own sig once (`gpg --verify`) —
   the writer never grades its own homework, so let the verify be the grader.

4. **Bump the README** in `corwin/vibrobeast/README.md`: every `0.5.3` → `0.5.4`,
   and confirm the "What's here" line points at the new dir. (Right now the README
   still advertises `releases/polygram-curation-0.5.3/`, which no longer exists —
   that mismatch is the actual blocker on freeing folk.)

5. **Retire the recall note** once 0.5.4 lands: leave `RECALLED-polygram-
   curation-0.5.3.md` in place as the paper trail (don't erase history), just make
   sure the shelf's live pointer is 0.5.4.

6. **Commit + tag from the HOST only** (mount desync bites commits — S03):
   `git add`, `git commit -S`, `git tag -s v0.5.4`. Then push to your forge:
   `git push upstream master --tags` (remote = `ssh://forgejo@code.bru.st/corwin/
   vibrobeast.git`).

## Done = free-folk unblocked
When 0.5.4 is pushed, signed, and the README matches the shelf, the "free folk"
gate opens. Ping me and we do the final verify pass together.

sentinel: RESPIN-054-RUNBOOK-00

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEE7Od89BfHbBrPznwrW2E1URWA8AcFAmpKQ9MACgkQW2E1URWA
8AffYwwAm4q4bmCMnWspylXQJ6Jhw3xxdsZPOq59ELzSkaP+awxl79N/Z6c3o24r
FM9hIVQXk8iddy7gE2IPtcdEXA4Vc+LsCuLLsq59cKZsq5f/3jz47x793ab4Pphn
n6eUu6uuibsw8FNCruX8UZsBIsQgTsz1NJle5xil59NBkVxZX8kJoZn9ds2YdOtk
8Tz7EJ+gQ6SyBwypYPSqLryr4dm4Bu+T4BQ/DgFhjy9qQW8Gxq6B5O3pphxrULvW
eQOpXnTQOGkBcbkkcp9hLPQ9xbWtpW3hJGSTGld9zQHQYKhvJ3MWRXnhdkTWvr9d
dna7H4eDXjuG3nNXsFx/zudtckoZ5GvfADeLSTTUMCcRW5Suw5YZcyhO8FAFVEmD
LZeSDupT4L5PSjf9bmfWomh9qyOvkX7bp2nJkhNhSKxHDzdjTZZaLae3j6R6xsBT
/q2T8wgpKl++pfueB1wnIssWgQQ+cybDswID+2TKjia3ysNhTmHDZLc61F2EZP4q
aZQg7kFR
=1e1+
-----END PGP SIGNATURE-----