scripts/check-release-version.mjs compares the tag, package.json's version, and commitlore --version. It never reads .claude-plugin/plugin.json or package-lock.json.
ADR-0026 makes the plugin the canonical install path, so the one manifest a plugin user's install resolves is the one the release gate does not look at. A release whose plugin.json disagreed with its tag would publish, and the file's own header says a version disagreement is "not fixable after the fact — the tag is immutable once fetched".
This is not hypothetical for the lock file. package-lock.json declared 0.1.0 from the first release through 0.7.0 while both manifests moved, and the gate passed every time, because it does not look there. It was found by reading, not by a check.
v0.7.1 is correct here — all three read 0.7.1 at ce5162a — but it is correct by inspection rather than by gate, which is the same standing this had for six releases.
Fix: extend the script to every manifest that carries a version, and fail on any disagreement.
scripts/check-release-version.mjscompares the tag,package.json's version, andcommitlore --version. It never reads.claude-plugin/plugin.jsonorpackage-lock.json.ADR-0026 makes the plugin the canonical install path, so the one manifest a plugin user's install resolves is the one the release gate does not look at. A release whose
plugin.jsondisagreed with its tag would publish, and the file's own header says a version disagreement is "not fixable after the fact — the tag is immutable once fetched".This is not hypothetical for the lock file.
package-lock.jsondeclared0.1.0from the first release through 0.7.0 while both manifests moved, and the gate passed every time, because it does not look there. It was found by reading, not by a check.v0.7.1 is correct here — all three read 0.7.1 at
ce5162a— but it is correct by inspection rather than by gate, which is the same standing this had for six releases.Fix: extend the script to every manifest that carries a version, and fail on any disagreement.