v1821: Make adoption validation and approval operator-owned (samebase/samebase#1365)

Samebase-Source-Repository: samebase/samebase
Samebase-Source-Commit: d361ad5d9652933b3bd761f5e896e2992038d7a8
Samebase-Source-Path: packages/agent-plugins

Author: github-actions[bot]

package.json

@@ -1,6 +1,6 @@
 {
   "name": "samebase-agent-plugins",
-  "version": "0.2.12",
+  "version": "0.2.15",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

plugins/samebase/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "samebase",
   "displayName": "Samebase",
   "description": "Build and ship web apps with Samebase through a user-owned GitHub repository, Convex backend, and Cloudflare Workers delivery.",
-  "version": "0.2.12",
+  "version": "0.2.15",
   "author": {
     "name": "Samebase"
   },

plugins/samebase/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "samebase",
-  "version": "0.2.12",
+  "version": "0.2.15",
   "description": "Build and ship web apps with Samebase through a user-owned GitHub repository, Convex backend, and Cloudflare Workers delivery.",
   "author": {
     "name": "Samebase",

plugins/samebase/skills/samebase/SKILL.md

@@ -61,6 +61,10 @@ or copy tool schemas into this skill.
   setup is incomplete.
 - Reread inventory after each attachment, configuration, or repair action.
 - A started run, requested build, commit, or push is not proof of a live deployment.
+- Before a write sequence that can start or request a production build, name that effect and get
+  explicit approval. One approval can cover the named sequence when the repository, provider
+  account, possible production effect, and rule for attaching an existing resource or creating a new
+  one are clear. Ask again if one of those facts or the approved scope changes.
 
 ## Work in the repository
 
@@ -77,6 +81,10 @@ pins. Classify each difference as alignment, a proven target constraint, an inve
 tested exception. Samebase is the first baseline, not an unquestioned authority. Carry target
 findings back when they improve the public reference.
 
+Keep validation proportionate to the project and the migration risk. Discuss material cost and
+coverage tradeoffs with the operator. Do not turn Samebase adoption into an unrelated testing
+upgrade.
+
 Treat authored `.js`, `.mjs`, and `.cjs` files and direct ESLint, Prettier, Vitest, or Vite runners
 as review smells. Keep an exception only for one named tool or runtime boundary that cannot use the
 normal TypeScript and Vite+ path. Document the boundary. Do not add a repository scanner only to

scripts/check.ts

@@ -102,6 +102,22 @@ check(
   ),
   "The Samebase skill must classify every toolchain difference before implementation.",
 );
+check(
+  samebaseSkill.includes(
+    "Keep validation proportionate to the project and the migration risk. Discuss material cost and coverage tradeoffs with the operator.",
+  ) && samebaseSkill.includes("Do not turn Samebase adoption into an unrelated testing upgrade."),
+  "The Samebase skill must keep validation proportionate and operator-informed.",
+);
+check(
+  samebaseSkill.includes(
+    "Before a write sequence that can start or request a production build, name that effect and get explicit approval.",
+  ) &&
+    samebaseSkill.includes(
+      "One approval can cover the named sequence when the repository, provider account, possible production effect, and rule for attaching an existing resource or creating a new one are clear.",
+    ) &&
+    samebaseSkill.includes("Ask again if one of those facts or the approved scope changes."),
+  "The Samebase skill must require informed approval for a production-build sequence.",
+);
 const scopeGateIndex = samebaseSkill.indexOf(
   "Do not use Samebase for unrelated Git work or standalone provider resources. A standalone Cloudflare Worker means no Samebase.",
 );