chore(release): freeze legacy prerelease inventory

[davida-ps]

User description

Summary

• freeze the exact 15 historical public beta tag refs as reviewed policy evidence
• record annotated/lightweight ref identity, peeled commit identity, and the four matching GitHub Release objects
• record all 44 release assets by GitHub asset ID, name, size, and independently verified SHA-256
• add an offline fixture test that pins the complete snapshot digest and exact identities

Security behavior

The snapshot is explicitly historical-fetch-only. It grants no authorization and denies:

• public writes and tag creation
• GitHub Release creation or republishing
• store publication
• catalog activation or active resolution
• discovery publication
• ref or asset mutation

This inventory is evidence for the later stable-only tag policy. It is not an allowlist for publication or release resumption.

Scope

Exactly two new policy-data files:

• contracts/release-policy/legacy-prereleases-v1.json
• scripts/test-skill-legacy-prerelease-inventory.mjs

No workflow, release script, skill, runtime, documentation, tag, release, store, catalog, or discovery behavior changes.

Evidence collection

• complete public Git tag advertisement inspected, including peeled annotated refs
• complete one-page GitHub Releases result: 16 total release objects, four matching beta tags
• 15 beta refs: 10 annotated and five lightweight
• four prerelease objects and 44 assets
• every asset downloaded and SHA-256 checked against GitHub's digest
• final inventory SHA-256: f688f138685126e6bb234151f7fa5d737096b525191922ad06d2cfaa49ba1720

Remote validation

Validated from a clean origin/main checkout at c6194eb92e2e0232987f5d473d65e02cfcf87fa0 in an operator-approved remote quarantine after individual SCP and SHA-256 verification:

• focused offline inventory fixture
• full scripts/test-skill-*.mjs loop
• full ESLint gate
• npx tsc --noEmit
• production build

The remote host lacks zip; the existing reviewed narrow compatibility wrapper was hash-verified and used only for the unrelated tag-release simulation test.

No merge, tag, release, publication, or mutation was performed.

---

Generated description

Below is a concise technical summary of the changes proposed in this PR:
Freeze the legacy prerelease inventory in contracts/release-policy/legacy-prereleases-v1.json, capturing the observed beta tag refs, GitHub Release objects, asset identities, and historical fetch-only policy gates. Add scripts/test-skill-legacy-prerelease-inventory.mjs to pin the snapshot digest and verify the recorded refs, releases, and assets offline.

Topic	Details
Offline validation	Validate the frozen snapshot with an offline fixture test that checks the JSON digest, expected counts, and exact tag, release, and asset identities. Modified files (1) scripts/test-skill-legacy-prerelease-inventory.mjs Latest Contributors(1) User Commit Date David.a@prompt.security chore(release): freeze... July 22, 2026
Inventory snapshot	Capture the historical beta-tag inventory as immutable policy evidence, including ref OIDs, peeled commits, release metadata, asset checksums, and explicit non-publication rules. Modified files (1) contracts/release-policy/legacy-prereleases-v1.json Latest Contributors(1) User Commit Date David.a@prompt.security chore(release): freeze... July 22, 2026

_{Review this PR on Baz | Customize your next review}