# v1.1.0 publication and current-tag readback

Original release verified at: `2026-08-28T14:19Z`. Current tag and archive
reverified at: `2026-08-30T21:03Z`.

```text
VERSION: 1.1.0
TAG: v1.1.0
COMMIT_SHA: 711be31d654835a04ef8c70674c3e493aeb2da8a
TREE_SHA: 085e6d083b87f85ee5dc89816bd6818fa5aa6f1d
RELEASE_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.1.0
TARBALL_URL: https://github.com/nobrainer-tech/nobrainer-tech-skills/archive/refs/tags/v1.1.0.tar.gz
TARBALL_FILENAME: v1.1.0.tar.gz
TARBALL_DOWNLOADED_AT: 2026-08-28T14:18Z
TARBALL_SHA256: 1a05186234487df1fa2381a291b53141a5fad6347d24f1638fc86b961abb7f5e
PR_CI_RUN: 33179388586
MAIN_CI_RUN: 33179433836
GITHUB_RELEASE_IMMUTABLE: false
ARCHIVE_FILE_MATCH: PASS
ARCHIVE_SKILL_COUNT: 13
ARCHIVE_TESTS: 70/70 PASS
ARCHIVE_QUICK_VALIDATE: 13/13 PASS
ARCHIVE_SECRET_SCAN: PASS
INSTALL_CLIENT: agents
INSTALL_MODE: copy
INSTALL_READBACK: PASS
```

## GitHub state

- Release: [NoBrainer Tech Skills v1.1.0](https://github.com/nobrainer-tech/nobrainer-tech-skills/releases/tag/v1.1.0)
- Published at: `2026-08-28T14:18:00Z`
- Current tag and source commit:
  `711be31d654835a04ef8c70674c3e493aeb2da8a`
- The release API retains its historical target; it is not the current tag ref
  after the metadata-only history rewrite.
- Git tree: `085e6d083b87f85ee5dc89816bd6818fa5aa6f1d`
- Source PR: [#23](https://github.com/nobrainer-tech/nobrainer-tech-skills/pull/23)
- PR CI: [run 33179388586](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33179388586), Ubuntu and macOS passed
- Merged-main CI: [run 33179433836](https://github.com/nobrainer-tech/nobrainer-tech-skills/actions/runs/33179433836), the tree-equivalent pre-rewrite commit passed
- GitHub API flags: `draft: false`, `prerelease: false`, `immutable: false`

The release and tag are not immutable according to GitHub's API. The current
tag preserves the verified tree across a metadata-only history rewrite. The
historical CI binds the same tree, not the current commit identity. Pin the full
current commit SHA above when a moving tag would be an unacceptable
supply-chain risk.

## Downloaded source archive

- Tarball SHA-256 at the current readback:
  `1a05186234487df1fa2381a291b53141a5fad6347d24f1638fc86b961abb7f5e`
- Every extracted file matched the corresponding file from `git archive v1.1.0`;
  no path was missing or added.
- Exactly thirteen active skill directories and `SKILL.md` files were present.
- The canonical suite validator and unit suite passed from the archive:
  `70/70 PASS`.
- All thirteen installed copies passed the platform `quick_validate.py`.
- The archive passed a fresh `gitleaks dir` scan.
- The public archive installer completed an isolated `agents` copy install of
  all thirteen skills, and exact inventory/readback passed.

Download and checksum command used for this readback:

```bash
curl --fail --location \
  --output v1.1.0.tar.gz \
  https://github.com/nobrainer-tech/nobrainer-tech-skills/archive/refs/tags/v1.1.0.tar.gz
shasum -a 256 v1.1.0.tar.gz
```

The tarball checksum records this download, while the full commit SHA remains
the canonical content identity.

## Proof boundary

This proves GitHub publication, tag-to-commit identity, source download, file
parity and isolated portable installation. It does not prove npm publication,
client marketplace distribution, native client loading, clean-session routing,
production behavior or buyer usefulness. Those levels remain separate in
[the compatibility matrix](../COMPATIBILITY.md).

Rollback is to pin `v1.0.0` or another reviewed full commit, remove only targets
created by the exact installation, and inspect any reported migration/rollback
recovery claim before exact manual cleanup.