# v1.0.0 publication and current-tag readback

Original release verified at: `2026-08-28T08:02Z`. Current tag and archive
reverified at: `2026-08-30T21:03Z`.

```text
VERSION: 1.0.0
TAG: v1.0.0
COMMIT_SHA: 55c49f40d7dc4ebe900f139711cd46617c706233
TREE_SHA: 4d2f02aae304e8c2ff88975fc194d115f7a1c57a
RELEASE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.0.0
TARBALL_URL: https://api.github.com/repos/nobrainer-tech/nobrainer-tech-skills/tarball/v1.0.0
TARBALL_FILENAME: v1.0.0.tar.gz
TARBALL_DOWNLOADED_AT: 2026-08-28T08:02Z
TARBALL_SHA256: 1d632f98c57b39246ab7c377da729cf1327dd32a9d0feb5bfe465dfbce36849b
PR_CI_RUN: 33153619658
MAIN_CI_RUN: 33153660970
GITHUB_RELEASE_IMMUTABLE: false
ARCHIVE_FILE_MATCH: PASS
ARCHIVE_SKILL_COUNT: 9
ARCHIVE_TESTS: 57/57 PASS
INSTALL_CLIENT: codex
INSTALL_READBACK: PASS
```

## GitHub state

- Release: [NoBrainer Tech Skills 1.0](https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.0.0)
- Published at: `2026-08-28T08:01:36Z`
- Tag: `v1.0.0`
- Current tag: `55c49f40d7dc4ebe900f139711cd46617c706233`
- The release API retains a historical target from an earlier metadata rewrite;
  it is not the current tag ref.
- Git tree: `4d2f02aae304e8c2ff88975fc194d115f7a1c57a`
- Source PR: [#21](https://github.com/nobrainer-tech/nobrainer-tech-skills/pull/21)
- PR CI: [run 33153619658](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33153619658), Ubuntu and macOS passed
- Merged-main CI: [run 33153660970](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33153660970), the tree-equivalent pre-rewrite commit passed
- GitHub API flags: `isDraft: false`, `isPrerelease: false`, `isImmutable: false`

The release and tag are not immutable according to GitHub's API. The current
tag preserves the verified tree across a metadata-only history rewrite. The
historical CI binds the same tree, not the current commit identity. Pin the full
current commit SHA above when a moving tag would be an unacceptable
supply-chain risk.

## Downloaded source archive

- Tarball SHA-256 at the current readback:
  `1d632f98c57b39246ab7c377da729cf1327dd32a9d0feb5bfe465dfbce36849b`
- Every extracted file matched the corresponding path in the release Git tree.
- No tracked path was missing and no extra file was present.
- Exactly nine `SKILL.md` files were present.
- Both repository validators passed from the extracted archive.
- Unit suite from the extracted archive: `57/57 PASS`.
- The public archive's installer completed an isolated Codex-target install of
  all nine skills; a second apply reported nine unchanged links, and readback
  resolved every `SKILL.md` to the extracted release source.

Download and checksum command used for this readback:

```bash
curl --fail --location --proto '=https' --tlsv1.2 \
  --output v1.0.0.tar.gz \
  https://api.github.com/repos/nobrainer-tech/nobrainer-tech-skills/tarball/v1.0.0
shasum -a 256 v1.0.0.tar.gz
```

The tarball checksum records this download, but the full commit SHA remains the
canonical content identity.

## Proof boundary

This proves publication, source download and isolated portable installation from
the GitHub release. It does not prove npm publication, client marketplace
distribution, native client loading, clean-session routing, production behavior
or buyer usefulness. Those levels remain separate in
[the compatibility matrix](../COMPATIBILITY.md).

Rollback for an installed copy is to remove only links created from this source
or restore the project's previously reviewed Git ref. There is no earlier stable
NoBrainer Tech Skills release to pin automatically.