# v1.2.1 publication and current-tag readback

Original release verified at: `2026-08-29T23:24Z`. Current tag and archive
reverified at: `2026-08-30T21:03Z`.

```text
VERSION: 1.2.1
TAG: v1.2.1
COMMIT_SHA: 0010140d19a7ff847dff776569772ef04d82c314
TREE_SHA: 0a2640cc66df5a1a4227769d12f9670e4d996561
RELEASE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.2.1
TARBALL_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/archive/refs/tags/v1.2.1.tar.gz
TARBALL_FILENAME: v1.2.1.tar.gz
TARBALL_SHA256: 45ad2987f291ddd557497b6fc41421aa5fb5b2cbd151282a2ae54ce2ed2279e9
PR_CI_RUN: 33216374869
MAIN_CI_RUN: 33216427097
GITHUB_RELEASE_IMMUTABLE: false
TAG_PROTECTION_STATUS: NOT_VERIFIED
ARCHIVE_FILE_MATCH: PASS
ARCHIVE_SKILL_COUNT: 15
ARCHIVE_TESTS_PASSED: 88
ARCHIVE_TESTS_FAILED: 0
ARCHIVE_TESTS_TOTAL: 88
ARCHIVE_TESTS_STATUS: PASS
ARCHIVE_QUICK_VALIDATE: 15/15 PASS
ARCHIVE_SECRET_SCAN: PASS
INSTALL_CLIENT: agents
INSTALL_MODE: copy
INSTALL_SKILL_COUNT: 15
INSTALL_FILE_MATCH: PASS
INSTALL_QUICK_VALIDATE: 15/15 PASS
INSTALL_READBACK: PASS
ACCEPTANCE: PASS
```

## GitHub state

- Release: [NoBrainer Tech Skills v1.2.1](https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.2.1)
- Published at: `2026-08-28T22:21:36Z`
- Current `refs/tags/v1.2.1` and source commit:
  `0010140d19a7ff847dff776569772ef04d82c314`
- The GitHub release API still reports its historical `target_commitish`; it is
  not the current tag ref after the metadata-only history rewrite.
- Git tree: `0a2640cc66df5a1a4227769d12f9670e4d996561`
- Source PR: [#26](https://github.com/nobrainer-tech/nobrainer-tech-skills/pull/26)
- PR CI: [run 33216374869](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33216374869), Ubuntu and macOS passed
- Merged-main CI: [run 33216427097](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33216427097), the tree-equivalent pre-rewrite commit passed
- GitHub release API flags: `draft: false`, `prerelease: false`,
  `immutable: false`

The release object is not immutable according to GitHub's API. Tag protection
was not independently verified. The current tag preserves the verified tree
across a metadata-only history rewrite; historical CI binds that tree, not the
current commit identity. GitHub documents that a tag archive can change when
its tag moves, so security-sensitive consumers should pin the full current
commit SHA above.

## Downloaded source archive

- The public tarball SHA-256 at the current readback was
  `45ad2987f291ddd557497b6fc41421aa5fb5b2cbd151282a2ae54ce2ed2279e9`.
- Every extracted file matched `git archive v1.2.1`; no path was missing or
  added.
- Exactly fifteen canonical skill directories and fifteen `SKILL.md` files
  were present, and all version manifests reported `1.2.1`.
- A fresh Gitleaks directory scan passed before Python generated bytecode.
- The canonical validator and full unit suite passed from the archive without
  `.git`: 88 passed, zero failed.
- Python, shell and Node syntax checks passed.
- All fifteen source skill folders passed the platform `quick_validate.py`.

## Isolated installation

The downloaded archive performed a dry-run and then a copy installation for
the `agents` destination into a new temporary directory. All fifteen installed
folders matched the archive source exactly and all fifteen installed copies
passed `quick_validate.py`. No existing user installation was touched by this
readback.

## Proof boundary

This proves GitHub source publication, tag-to-commit identity at readback,
merged-main CI, extracted archive parity, source secret scan, archive-native
tests and isolated portable installation. It does not prove client marketplace
distribution, native client loading, clean-session routing, production behavior
or buyer usefulness. Those levels remain separate in
[the compatibility matrix](../COMPATIBILITY.md).

Rollback is to pin the accepted `v1.1.0` full commit
`711be31d654835a04ef8c70674c3e493aeb2da8a`, or another independently reviewed
full commit, and remove only installation targets created by the exact recorded
operation.