feat: a release rendered from the monorepo

CHANGELOG.md

@@ -20,6 +20,20 @@ sibling project the same week this note was added.
 
 ## [Unreleased]
 
+## [0.0.61] - 2026-09-04
+
+Installed nddev-builder toolkits now name only validation commands
+available in their rendered public repository. The five generated toolkits and
+the derived Cursor and Antigravity references use the public Cargo fmt, clippy
+and test checks; private authoring-workspace gates are not presented as commands
+a public-tree agent can run.
+
+Codex software pins move to 0.153.1 across all six platform artifacts. Grok
+Build 1.0.18 skill metadata is aligned with the current product: allowed-tools
+is descriptive rather than a permission grant, and user-root command Markdown
+is discovered as a skill rather than a separate component kind. All seven
+catalogues are rebound to the resulting setup bytes.
+
 ## [0.0.60] - 2026-09-03
 
 Provider profiles are adaptation-bound and accept only

Cargo.toml

@@ -8,7 +8,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.0.60"
+version = "0.0.61"
 edition = "2024"
 rust-version = "1.89"
 license = "AGPL-3.0-or-later"
@@ -23,9 +23,9 @@ sha2 = "0.11"
 # `setup-core::archive`); an inflate loop is not, because its bugs are
 # memory-safety bugs and it is not improved by being hand-written here.
 miniz_oxide = "0.9"
-setup-core = { path = "crates/setup-core", version = "0.0.60" }
-provider-v3 = { path = "crates/provider-v3", version = "0.0.60" }
-harness-runtime = { path = "crates/harness-runtime", version = "0.0.60" }
+setup-core = { path = "crates/setup-core", version = "0.0.61" }
+provider-v3 = { path = "crates/provider-v3", version = "0.0.61" }
+harness-runtime = { path = "crates/harness-runtime", version = "0.0.61" }
 
 [workspace.lints.rust]
 unsafe_code = "forbid"

README.md

@@ -179,7 +179,7 @@ release is a convenience, not the authorised copy.
 
 ```bash
 docker run --rm -v "$HOME/.config:/config" \
-  ghcr.io/nddev-opennetwork/opencode-setup-system:0.0.60 \
+  ghcr.io/nddev-opennetwork/opencode-setup-system:0.0.61 \
   status --target /config/<dir> --json
 ```
 

install.ps1

@@ -7,7 +7,7 @@
 #   powershell -ExecutionPolicy Bypass -File install.ps1 -Version 0.1.0
 [CmdletBinding()]
 param(
-  [string]$Version = "0.0.60",
+  [string]$Version = "0.0.61",
   [string]$InstallDir = "$env:LOCALAPPDATA\Programs\opencode-setup-system"
 )
 $ErrorActionPreference = "Stop"

install.sh

@@ -14,7 +14,7 @@ set -eu
 
 REPO="NDDev-OpenNetwork/opencode-setup-system"
 BINARY="opencode-setup-system"
-VERSION="${1:-0.0.60}"
+VERSION="${1:-0.0.61}"
 PREFIX="${OPENCODE_INSTALL_DIR:-$HOME/.local/bin}"
 
 case "$(uname -s)" in

references/opencode-baseline.json

@@ -333,7 +333,7 @@
     "version": "1.18.27",
     "verified_at": "2026-09-03T14:13:03+00:00"
   },
-  "setup_catalogue_digest": "sha256:db280f58e88697d8c2b6c041e97da7af323227138b4f65a40baf14c7bdc26d06",
+  "setup_catalogue_digest": "sha256:867fc17609fd2da2c2787671cead513478a36d0d596acd33a8b07b4600f82eba",
   "previous_software_artifacts": {
     "command": "opencode",
     "shape": "gzip-tar",

setups/nddev-builder/home/commands/nddev-validate.md

@@ -3,34 +3,13 @@
 Run everything that must pass before handing off, in order, and report what each
 one said rather than that it passed.
 
-**Check which repository you are in first**, because half of these exist in only
-one of them. `scripts/gate.sh` and `tools/` belong to the private authoring
-monorepo; a checkout of a published `<harness>-setup-system` has neither.
-
-In the authoring repository:
-
-```bash
-scripts/state.sh                         # what is true right now, each fact with its command
-scripts/gate.sh --render                 # toolchain, fmt, clippy, tests, and the render
-scripts/check_render.sh                  # the published trees match this source
-```
-
-In a published tree, where those do not exist:
-
 ```bash
 cargo fmt --all --check
 cargo clippy --workspace --all-targets -- -D warnings
 cargo test --workspace
 ```
 
-`check_render.sh` clones the seven from their remotes and answers a question no
-local checkout can. It is the check that catches published trees drifting behind
-their own releases -- and it runs on `main` and hourly, not on a branch, because
-a branch has published nothing yet.
-
-**If a command here is not present, say so rather than working around it.** The
-reader of this file is a model, and a missing script is a fact about which
-repository it is in, not an obstacle to route past.
+If a command here is not present, say so rather than working around it.
 
 Then, where a change touched the wire surface or the harness facts, run the
 consumer's conformance against the built binary and report the verdict **with

setups/nddev-builder/home/skills/nddev-builder/references/authoring-skills.md

@@ -33,7 +33,7 @@ Generated from the same rows as the section above, for every harness in this est
 | `description` | yes | yes | **required** | **required** | **required** | **required** |
 | `argument-hint` | yes | yes | — | — | — | — |
 | `arguments` | yes | — | — | — | — | — |
-| `allowed-tools` | yes | yes | yes | — | — | — |
+| `allowed-tools` | yes | **dropped** | yes | — | — | — |
 | `disallowed-tools` | yes | — | — | — | — | — |
 | `disable-model-invocation` | yes | yes | yes | — | yes | — |
 | `user-invocable` | yes | yes | — | — | — | — |

setups/nddev-builder/home/skills/nddev-builder/references/validation.md

@@ -1,50 +1,15 @@
 # Before Handing Off
 
-## Which repository you are in decides what you can run
-
-This setup ships in two places and the commands below exist in only one of them.
-**They belong to the source workspace that publishes this public tree.** A
-checkout of this public repository carries
-`crates/`, `setups/`, `references/` and `scripts/evidence.py` -- and neither
-`scripts/gate.sh` nor `tools/`.
-
-That is not a gap to fill. A rendered tree is generated: the fix for anything
-here is a change in the authoring repository and a re-render, never an edit to
-this checkout. What a reader of *this* tree can run is `cargo fmt --all
---check`, `cargo clippy --workspace --all-targets -- -D warnings` and
-`cargo test --workspace`, which is what its own CI runs.
-
-Naming a command a reader cannot run used to be the whole of this page, and the
-reader is a model, which will try it and then work around the failure rather
-than say so.
-
-## The gate, in the authoring repository
-
-One entry point, from its root:
+Run the checks this tree's CI runs, in order, and report what each one said
+rather than that it passed.
 
 ```bash
-scripts/gate.sh
+cargo fmt --all --check
+cargo clippy --workspace --all-targets -- -D warnings
+cargo test --workspace
 ```
 
-It exists rather than four bare `cargo` commands because the workspace pins a
-toolchain that a local `cargo` earlier on `PATH` will shadow, and a green run
-under the wrong compiler is worse than a red one.
-
-## And the render, whenever the output could have moved
-
-```bash
-scripts/gate.sh --render                # the question this ref can answer
-scripts/check_render.sh --deterministic # does the renderer agree with itself?
-```
-
-Run it for any change to `crates/`, `setups/`, `references/`, `provider-kit/`
-or the renderer. **The plain gate does not render**, and a change to the
-renderer that only passes it has not been checked at all -- that has reached CI
-more than once.
-
-The strict form clones the seven from their remotes, so it answers a question no
-local checkout can: are the published trees actually current? It runs on `main`
-and hourly, never on a branch, because a branch has published nothing yet.
+If a command here is not present, say so rather than working around it.
 
 ## The rule that does not move