Vibe Skills 4.1.1

Highlights

This patch release collects the runtime-correctness and installer-safety fixes merged since v4.1.0, including PRs #313, #315, #317, #319, #321, #323, and #325, plus the merged-main CI repair in #328.

• Share read-only Skill source authority across Python discovery and canonical admission, including configured workspace/user roots, enabled state, metadata validation, controller exclusion, duplicate precedence, and resolved path containment.
• Bind checkpoints, reused work, and dependency readiness to the approved WorkUnit, current artifacts, input content, selected Skill, verification targets, and required evidence. Damaged or stale evidence enters recovery; failed prerequisites block dependents.
• Preserve accepted task/run/checkpoint state when organization preflight rejects a request, and record effective known_context and unknowns revisions.
• Bound native bridge lifetimes with Windows Job Objects and POSIX process groups; reclaim descendants and report incomplete cancellation explicitly.
• Harden install/update/uninstall ownership boundaries for linked destinations, path aliases, receipt files, and interrupted lifecycle operations; accept supported BOM JSON inputs.
• Make the process-tree cancellation proof tolerate bounded PowerShell startup latency while retaining readiness, cleanup-time, and no-late-write assertions.
• Keep the public ZIP self-contained, with aligned package versions, current download guidance, generated manifests, and expanded Windows/Ubuntu validation.

Installation

Download vibe-skills-4.1.1-public.zip, verify its SHA-256 against SHA256SUMS.txt, and extract it outside the managed Skills directory.

pwsh -NoProfile -File .\install.ps1 -SkillsDir "$HOME\.agents\skills"
pwsh -NoProfile -File .\check.ps1 -SkillsDir "$HOME\.agents\skills"

bash ./install.sh --skills-dir "$HOME/.agents/skills"
bash ./check.sh --skills-dir "$HOME/.agents/skills"

Validation Notes

• Source and annotated tag: 5ce2258ecb57a9532257dcadaca571dc7fe54868 (v4.1.1). Release preparation PR #329 includes the merged-main CI repair #328.
• Merged-main CI: all 6 jobs passed, covering Windows/Ubuntu runtime recovery, installer safety, host boundaries, and canonical validation. Canonical validation: 167 passed; runtime recovery: 429 passed on Ubuntu and 424 passed, 5 platform skips on Windows.
• Published-tag formal release proof: PASS, all 4 command proofs passed, zero absent proofs or missing artifacts. Expanded release validation: 188 passed, including the repaired process-tree proof.
• The final workflow-built ZIP was downloaded and independently verified against GitHub asset digests, the formal proof, embedded release metadata, and the recomputed payload digest (494 payload files).
• Downloaded ZIP lifecycle passed on Windows and WSL Ubuntu in fresh isolated roots: install → check → update → check → installed canonical bootstrap → uninstall. Each installation owned 279 files, with zero missing/drifted files, a verified bootstrap receipt, and preservation of an unmanaged user Skill. No user host settings were modified.
• ZIP SHA-256: 746b5b44a9cc7852d33eadbbe9b9b950f83f104d0d33ea4cf33876b4bba9e3b8. SHA256SUMS.txt covers the ZIP, generated release evidence, and sanitized installation-proof.json.
• Bilingual download guidance now resolves through the latest stable Release during preparation, staging, and promotion. Historical benchmark claims remain tied to v4.1.0.

Migration Notes

• For an existing installation, extract v4.1.1 outside the managed Skill directory, run update with the existing SkillsDir, then run check. Confirm zero missing and drifted receipt-owned files.
• Declare nested vendor Skill container roots explicitly in workspace/user .vibeskills/skill-roots.json; ordinary host roots use the shared scanner's direct/custom layouts. Codex plugin caches retain recursive discovery and ambiguity rejection.
• A disabled higher-priority Skill continues to shadow enabled duplicates. Missing declared inputs and invalid prerequisite evidence block execution until repaired.
• Existing v4.1.0 benchmark figures remain historical v4.1.0 results. This patch makes no new benchmark-performance claim.

Known Governance Limitations

Three additional legacy documentation-policy diagnostics retain the failures already reproduced on the pre-release main baseline: the routing-debt checker flags existing docs/README.md wording, and the release/install/runtime coherence checker expects two retired documentation paths; the legacy distribution-manifest checker also references retired universalization documentation (97 unchanged assertions). Their independent repair is outside this version cut. Formal release proof, package integrity, installed lifecycle checks, and runtime CI are reported at their actual scopes.