catalogue: io.pilot.bowmark v1.0.1 - #448
Merged
Merged
Conversation
Bowmark pivoted: bowmark.ask and bowmark.report_outcome are retired upstream and the API 404s both, so every command on the current store page fails today. v1.0.0 replaces them with bowmark.get_library and bowmark.run. Four platform bundles are live on the prod artifact registry under io.pilot.bowmark/1.0.0/, all signed by the app's existing publisher key (ed25519:Lmf0vzz0...), unchanged since 0.1.0. The store page is regenerated from the v1.0.0 submission rather than carried over: description, tagline, methods and keywords all described the retired methods. Changelog notes are the publisher's own (a submission has nowhere to carry a changelog, so the generated placeholder would have read 'Released v1.0.0').
added 2 commits
August 3, 2026 17:22
Replaces the generator's output with a hand-authored page. Every field is set explicitly; the prose blocks (description_md, product_demo, next_steps) are lifted verbatim from the merged submission, so the page cannot drift from what was reviewed. Two departures from the generated version: - methods lists the callable surface only: get_library, run and the help discovery contract, as 0.1.0 did. - changelog carries the publisher's own v1.0.0 notes above the 0.1.0 history, instead of the generated 'Released v1.0.0' placeholder. metadata_sha256 re-pinned to the committed bytes and catalogue.json re-signed; pilot-app verify is green on all ten checks for this entry.
This entry never merged at 1.0.0, so the live catalogue is still on 0.1.0 and no user ever saw a 1.0.0. 1.0.1 supersedes it and ships directly; 1.0.0's bundles stay on the registry untouched, since the registry is write-once and additive. 1.0.1 routes the two methods through /v1/pilot-app/* so app-store traffic is attributable upstream, rewrites the product demo for a small context window (demo-score 100.0, rendered skill 2982 bytes against a 3000 target), and documents incomplete.failures[].fixable on a partial result. Store page hand-built from the merged 1.0.1 submission, same as before: every field explicit, prose blocks verbatim, methods the callable surface only. Changelog keeps the full history including 1.0.0 — the pivot it describes is what the current description is about, even though it never shipped. Bundle URLs, shas and sizes point at the 1.0.1 prefix; metadata_sha256 re-pinned to the committed bytes and catalogue.json re-signed. pilot-app verify green on all ten checks.
Alexgodoroja
changed the title
Collaborator
Author
|
Broker swapped and runtime e2e green — this is ready to merge. The allow-list is now The access log captures the transition cleanly: Every call now arrives on the attributable path, which is the point of the release. Runtime e2e against the published 1.0.1 bundles, on macOS/arm64 and Linux/amd64 (the latter fetching the real artifact from the registry and sha-checking it first):
No auth or allow-list errors on either platform. |
Alexgodoroja
enabled auto-merge (squash)
August 5, 2026 19:36
TeoSlayer
approved these changes
Aug 5, 2026
Alexgodoroja
added a commit
to pilot-protocol/website
that referenced
this pull request
Aug 5, 2026
* app-store: Bowmark v1.0.0, pinned to New & Updated Bowmark pivoted. bowmark.ask and bowmark.report_outcome are retired upstream and api.bowmark.ai 404s both, so every command on the current store page fails today. v1.0.0 replaces them with bowmark.get_library (typed function library) and bowmark.run (server-side script execution on the live sites). Data comes from the catalogue snapshot in pilot-protocol/pilotprotocol#448, so the page matches what installs: tagline, description, keywords, version, sizes and changelog, plus the rebuilt product demo carried through to the page and its plain twin. Pins io.pilot.bowmark first in the New & Updated shelf. The methods list carries the two product methods. bowmark.help is boilerplate on every app, and the generator's auto-added bowmark.balance answers only for apps with a broker credit ledger — this one has none, so it 403s and is not worth advertising. apps.ts regenerated: every changed line falls inside the Bowmark record, no churn to other apps. Plain twin re-stamped; it is static prose with no app list, so shelf order cannot change its content (verified). check:plain, check:site and the build are green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * app-store: Bowmark 1.0.0 -> 1.0.1 1.0.0's catalogue entry never merged, so no user ever saw it. 1.0.1 supersedes it and this card goes straight there. - version, sizes and changelog to 1.0.1 (the full history is kept: the pivot at 1.0.0 is what the description describes, even though it never shipped) - product demo rewritten upstream for a small context window: three worked examples covering three distinct shapes, down from five with overlap. The rendered skill is 2982 bytes against a 3000 target, and demo-score is 100.0. - method summaries pick up incomplete.failures[].fixable, which lets an agent tell its own rejected argument from a site that did not answer The two methods now route through /v1/pilot-app/* upstream so app-store traffic is attributable. That is invisible on the page — no method name, parameter or behaviour changes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Alex Godoroja <alex@vulturelabs.io> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Catalogue entry for io.pilot.bowmark v1.0.1 (app-template#99, merged).
Retargeted from 1.0.0. This PR was opened for 1.0.0 and never merged, so the live catalogue is still on 0.1.0 and no user ever saw a 1.0.0. 1.0.1 supersedes it and ships directly. The 1.0.0 bundles stay on the registry untouched — it is write-once and additive, so nothing had to be undone.
What 1.0.1 changes
/v1/pilot-app/*upstream, so calls arriving from the app store are attributable. No change to method names, parameters or behaviour.demo-score100.0 (was 90.0), rendered skill 2982 bytes against a 3000 target.incomplete.failures[].fixableon apartialresult, so an agent can tell its own rejected argument from a site that never answered.Artifacts
All four platform bundles live under
bundles/io.pilot.bowmark/1.0.1/, each fetched back over its public URL and sha-checked:b08735619328a76e…9e35c5ba7e05da01…f59b40676a5f1960…1217c6e3b975b9c4…Publisher pin unchanged since 0.1.0:
ed25519:Lmf0vzz0CNPu94pbqsbD/ueSuOaKsGc0xU/DoL+Yu7c=.pilot-app verify catalogue/catalogue.jsongreen on all ten checks for this entry.metadata_sha256pinned to the committed bytes,catalogue.jsonre-signed and verifying under the embedded trust anchor. Catalogue stays atversion: 2.Store page
Hand-built from the merged 1.0.1 submission — every field set explicitly, the prose blocks (
description_md,product_demo,next_steps) lifted verbatim so the page cannot drift from what was reviewed, andmethodslisting the callable surface plus thehelpdiscovery contract. The changelog keeps the full history including 1.0.0: the pivot it describes is what the current description is about, even though that version never reached anyone.This is deliberate rather than automatic — for an app that already has a store page, the publish script reuses it and refreshes only the runtime facts, the demo and the next-steps graph, which on a pivot leaves a page describing methods that no longer exist.
Merge order — please read
The broker allow-list must be swapped to
/v1/pilot-app/*before this merges. It is registered configuration, not derived per call, so a stale list refuses the new paths. It is not urgent and nothing is currently broken by the gap: the live catalogue is 0.1.0, whose/v1/askroute was retired upstream weeks ago, so those installs already fail regardless. I will confirm here once the swap and the runtime e2e are done.The upstream API accepts both old and new paths — an unrecognised segment falls through rather than 404ing, which I verified directly — so the swap and this merge do not have to be simultaneous in either direction.
Still opened by hand
CATALOG_PUBLISH_TOKENremains dead, so this is hand-built and hand-signed like the 1.0.0 attempt. That is now four merges in a row (agentphone#93, firecrawl#95, bowmark#97, bowmark#99) where the automation got as far as verifying the bundles on the registry and then failed at the catalogue step. Worth rotating.