vibrobeast/RESPIN-0.5.4-runbook.md

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

Rep runbook — polygram-curation 0.5.4 respin (guy-in-chair)

Purpose: republish the curation clean of the recalled stray, so the beast's shelf matches its README before we "free folk." You drive from the host; I coach. 50/50 target: you type the commands, I catch slips.

Why we're here: 0.5.3 baked a stray scratch file (skills/eclipse-pass/scripts/ sedx44W4d, a sed -i temp) into the eclipse-pass skill, both archives, and the MANIFEST — so the signed artifacts shipped junk. Recalled 2026-07-04; a verified copy sits in F:\SAVANNAH\archive\corwin-recall-2026-07-04\. No leak (sha matched the real script), but a release must be clean to be honest.

The reps, in order

1. Re-mint the curation with your polygram flow, from the host, against the current skill sources. (Your tool, your command — say it out loud as you run it; the rep is you owning the mint step.) Watch for: the stray must be GONE this time — add/confirm the temp-file exclusion (sed scratch, *~, editor temps) so it can't recur.

2. Prove it's clean before signing anything: find releases/polygram-curation-0.5.4 -name 'sed*' -o -name '*~' -o -name '.*.swp' → must return nothing. Then eyeball the MANIFEST for the same.

3. Re-sign with your key (ECE7 7CF4 17C7 6C1A CFCE 7C2B 5B61 3551 1580 F007): the per-file MANIFEST sha's + a detached sig on the aggregate, per your sign.sh / skill-sign flow. Verify your own sig once (gpg --verify) — the writer never grades its own homework, so let the verify be the grader.

4. Bump the README in corwin/vibrobeast/README.md: every 0.5.3 → 0.5.4, and confirm the "What's here" line points at the new dir. (Right now the README still advertises releases/polygram-curation-0.5.3/, which no longer exists — that mismatch is the actual blocker on freeing folk.)

5. Retire the recall note once 0.5.4 lands: leave RECALLED-polygram- curation-0.5.3.md in place as the paper trail (don't erase history), just make sure the shelf's live pointer is 0.5.4.

6. Commit + tag from the HOST only (mount desync bites commits — S03): git add, git commit -S, git tag -s v0.5.4. Then push to your forge: git push upstream master --tags (remote = ssh://forgejo@code.bru.st/corwin/ vibrobeast.git).

Done = free-folk unblocked

When 0.5.4 is pushed, signed, and the README matches the shelf, the "free folk" gate opens. Ping me and we do the final verify pass together.

sentinel: RESPIN-054-RUNBOOK-00

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEE7Od89BfHbBrPznwrW2E1URWA8AcFAmpKQ9MACgkQW2E1URWA 8AffYwwAm4q4bmCMnWspylXQJ6Jhw3xxdsZPOq59ELzSkaP+awxl79N/Z6c3o24r FM9hIVQXk8iddy7gE2IPtcdEXA4Vc+LsCuLLsq59cKZsq5f/3jz47x793ab4Pphn n6eUu6uuibsw8FNCruX8UZsBIsQgTsz1NJle5xil59NBkVxZX8kJoZn9ds2YdOtk 8Tz7EJ+gQ6SyBwypYPSqLryr4dm4Bu+T4BQ/DgFhjy9qQW8Gxq6B5O3pphxrULvW eQOpXnTQOGkBcbkkcp9hLPQ9xbWtpW3hJGSTGld9zQHQYKhvJ3MWRXnhdkTWvr9d dna7H4eDXjuG3nNXsFx/zudtckoZ5GvfADeLSTTUMCcRW5Suw5YZcyhO8FAFVEmD LZeSDupT4L5PSjf9bmfWomh9qyOvkX7bp2nJkhNhSKxHDzdjTZZaLae3j6R6xsBT /q2T8wgpKl++pfueB1wnIssWgQQ+cybDswID+2TKjia3ysNhTmHDZLc61F2EZP4q aZQg7kFR =1e1+ -----END PGP SIGNATURE-----