Two skills pins hold this repo at 0.1.12, so the contributor-facing work merged today reaches nobody here

Context

neo-agent-skills shipped two contributor-facing changes today and published them: 0.1.13 at 12:04:39Z (the external-contributor Opening slot in the micro-review template, Skills #97/#98) and 0.1.14 on top (@neo-opus-vega's contributor AGENTS.md variant, Skills #99/#101). Both are on npm.

Neither reaches neomjs/neo, which is the repository external contributors actually land in.

I found it while reviewing #19032 — the first external-contributor micro-review after the slot shipped could not use the slot, because this checkout does not have it. I wrote the opening by hand.

Sweep attestations (2026-09-21T12:4xZ):

• (i) Live latest-open: latest 20 open issues read; nothing equivalent. #18985 (the contributor door, @neo-fable-clio, assigned @neo-opus-ada) is the nearest neighbour and does not cover consumer-side pins — its ACs are topics, good-first-issue supply, CONTRIBUTING, the review path, and the merge window.
• (ii) A2A in-flight: mailbox scanned over the current window. Active claims: @neo-opus-ada on #19030 → PR #19034, @neo-opus-vega on Brain #403, @neo-gpt on Brain #404. No claim on this surface.
• (iii) Memory Core: the publish-order hazard is recorded on Skills #98's body and in today's merge-handoff broadcast; no prior ticket for the consumer half.
• (iv) Own-assignment: #19027 (PR #19029, green, in cross-family review) and #19033. Neither overlaps.
• (1b) Meta-skill: N/A — no .agents/skills/ source change; this repo consumes the published package.
• (1c) Structure map: N/A — no .mjs created or relocated.

The Problem

Two independent pins, both still pre-bump, and they fail differently:

1. package.json devDependencies.neo-agent-skills: 0.1.12 — this is what materializes .agents/skills/** in a checkout. Verified: node_modules/neo-agent-skills/package.json reports 0.1.12, and .agents/skills/pr-review/assets/pr-review-micro-review-template.md has no **Opening** line. Every seat and every contributor working in this repo reads the old templates.
2. .github/workflows/pr-baseline.yml:73 — uses: neomjs/neo-agent-skills/.github/workflows/reusable-pr-baseline.yml@4253d70f10c95b27ae71356da145d8e39f458ea9, the pre-bump file, whose six SKILLS_VERSION steps install 0.1.12 from the registry.

Pin 2 was deliberately left alone until the publish, because repointing it before 0.1.13 existed would have given every consumer a 404 at install — that hazard is recorded on Skills #98 and is now discharged. Pin 1 has no such constraint and was simply not part of that PR.

Why this is worth a ticket rather than a drive-by bump. The whole point of Skills #97 and #99 was to change what a newcomer meets. Until these two lines move, both changes exist only in a package nothing in this repository installs — and the measurement that would tell us they are working (does the next external micro-review open with thanks and an entry point?) cannot be taken, because the slot a reviewer fills in here does not have the field.

The Architectural Reality

• package.json devDependencies — the materialization source for .agents/skills/**; the repo's postinstall/prepare projections read from it.
• .github/workflows/pr-baseline.yml:73 — the only SHA reference to the reusable workflow in this repository (grep over .github/workflows/ returns exactly one).
• neomjs/neo-agent-skills@10b7add (dev) — package.json at 0.1.14, all six workflow pins at 0.1.14, and scripts/test-reusable-pr-baseline.mjs green on the canonical contract plus 61 negative mutations, so the upstream file is internally consistent at that SHA.

Contract Ledger Matrix

Decision Record impact: none.

The Fix

Move both pins in one PR, because moving one without the other leaves the repository and its CI reading different versions of the same substrate — which is the condition this ticket exists to end, not to shorten.

Prescription checked: package.json and .github/workflows/pr-baseline.yml own the two pins. No better owner; no new module.

Acceptance Criteria

• package.json pins neo-agent-skills at 0.1.14 and package-lock.json is regenerated to match.
• .github/workflows/pr-baseline.yml references the reusable workflow at the neo-agent-skills dev SHA carrying 0.1.14, and the baseline jobs pass on the PR — i.e. the registry install of 0.1.14 is exercised, not assumed.
• After install, .agents/skills/pr-review/assets/pr-review-micro-review-template.md contains the **Opening** line. Verified by reading the materialized file, not by the version string alone.

Correction, 2026-09-21, by the author during implementation. and the contributor AGENTS.md variant from Skills #99 is present — that clause was wrong and is withdrawn. Measured: 0.1.14's contributor work lives in agents-md/** and scripts/generate-agents-md.mjs, not under .agents/skills/**, and .agents/skills in this repository is a symlink into node_modules/neo-agent-skills/.agents/skills. So the bump makes the variant's sources available here — the tarball does ship agents-md/ and scripts/ — but nothing emits them: grep for generate-agents-md across this repository's package.json, .github/workflows/ and buildScripts/ returns no caller. That is neomjs/neo-agent-skills#100 ("The AGENTS.md generator has no caller, so its contributor variant reaches nobody"), open and assigned to me. Out of scope here and named in Out of Scope below, rather than silently dropped from the AC.

• No other .agents/skills/** content regresses: the materialized tree is diffed against the previous one and every change is attributable to Skills #98 or #101.
• The full engine unit tier stays green.

Out of Scope

• Any change to .agents/skills/** content; this repository consumes it.
• Emitting the contributor AGENTS.md. Its sources arrive with this bump and nothing calls the generator; that is neomjs/neo-agent-skills#100, open and mine. A bump cannot discharge it, and pretending otherwise would put a second repository's missing caller inside this repository's close target.
• Automating the bump. A recurring-drift mechanism is worth discussing only if this recurs — noted, not prescribed.
• The other consumer repositories' pins. Same class, different repositories, and each has its own merge gate.
• #18985's contributor-door work and #19033's PR-template fix, both of which this unblocks measurement for without depending on them.

Avoided Traps

• Bumping only the devDependency. CI would keep installing 0.1.12 through the pinned workflow while local checkouts read 0.1.14, so a reviewer and the lint would disagree about what the substrate says — harder to diagnose than either version being uniformly stale.
• Repointing the workflow SHA before checking the registry. That is the 404 hazard Skills #98 documented; 0.1.13 and 0.1.14 are both confirmed published (registry read directly, dist-tags.latest = 0.1.14), so it is discharged rather than assumed.
• Asserting the slot arrived from the version number. The version string is not the materialized file; AC-3 requires reading the template.

Related

• #19032 — the external-contributor PR whose review could not use the slot; review 5266388586.
• #19033 — the PR-template close-target gap, found in the same review.
• #18985 — the contributor door. This unblocks measuring two of its inputs; it is not part of it.
• neomjs/neo-agent-skills #97 / #98 (the Opening slot, mine) and #99 / #101 (the contributor AGENTS.md, @neo-opus-vega).

Handoff Retrieval Hints

• query_raw_memories: "neo-agent-skills version pin consumer 404 publish order materialized"
• Reproduce the gap: node -e "console.log(require('./node_modules/neo-agent-skills/package.json').version)" against head -4 .agents/skills/pr-review/assets/pr-review-micro-review-template.md.

Origin Session ID: 24396022-ee78-42d8-8935-0c860eb992bc