[Lutherwaves]

Milestone 3 of the Go port, into feat/go. After this merges, feat/go merges to main once, and that merge is released as builder 3.

What a person can now do

• Install the binary from the session. When the binary is missing, the session hook offers it once: yes, not now (quiet for 7 days) or never. On yes, the agent runs scripts/install.sh and reports it under ↗ Outside. The hook stays offline.
• Trust what gets installed. scripts/install.sh downloads the binary of the plugin's version and checks its .sha256. With a signed-in gh, it also checks the build provenance. It then checks that builder version prints the tag. Only then does it install to ~/.config/builder/bin/builder-<v>. A failed check leaves nothing behind. It keeps three versions, so other harnesses keep theirs.
• Get a clear stop in a skill. budget, reach and security stop when the shim says the binary is not installed or is off, and offer the install once.
• Release by merging. release-please is gone. release.yml and publish.yml are adapted from matchblox's:
  • go-semantic-release computes the version and the tag is pushed.
  • Four binaries are built, each with a checksum, an SBOM and attestations.
  • The installer runs on Linux and macOS (amd64 and arm64), then the release becomes latest.
  • A bot PR bumps the manifests. It merges only after publish verified the release.

Carried from the milestone 2 review

1. scripts/install.sh ships at the path that the shim's "not installed" line names, with that text unchanged.
2. README.md:55 and docs/install.md:3 no longer say Python 3.
3. Bash 3.2: the shim, the offer and the installer pass under Bash 3.2.57 in a bash:3.2 container. A new macos CI job runs them under /bin/bash.
4. Paid evals: skipped, as agreed.

Before the feat/go → main merge (owner)

RELEASING.md → "Before the first release":

1. Allow auto-merge.
2. Create RELEASE_TOKEN.
3. Push the seed tag v2.1.0. Without it, go-semantic-release cannot see the old builder-v* tags, and check-next-version.sh refuses the release.
4. Set RELEASE_ENABLED=true.

Then squash-merge feat/go with a feat!: title, so that the release is 3.0.0.

Calls made without the owner

• install.answer (<verdict> <epoch>) belongs to the shim and the installer. ledger.json is unchanged.
• install-answer takes later and never only. Yes is the install itself.
• opencode runs hooks/session-start, so one script owns the no-binary text.
• The skill's stop line matches the shim's own messages, not every exit 3. reach matchblox-notify exits 3 on its normal no-route path, and the spec keeps that code.
• The installer takes BUILDER_RELEASE_URL, for tests and a local release. The checksum and provenance checks still apply.
• matchblox's latest, Homebrew, docs and site steps are dropped.

Proof

• bash scripts/validate.sh: ✓ all checks passed.
• bash tests/test_validate.sh: rc 0.
• go test -count=1 ./...: ok.
• actionlint: clean.
• test_shim, test_offer, test_install: rc 0 under Bash 3.2.57.
• Local release, end to end:
  • A build stamped with -X main.version=v2.1.0 and its .sha256 installs with gh signed out.
  • With gh signed in, the installer correctly refuses the build, because it has no attestation.
  • The hook with the binary shows no offer. Without the binary, it shows the offer word for word, with empty stderr. After install-answer later, it shows no offer.
• Not proven until the first real release: the workflows on GitHub (draft, tag, attest, verify on macOS, the bot PR).

🤖 Generated with Claude Code