docs: finalize 0.0.22 release evidence

docs/CLI.md

@@ -61,7 +61,7 @@ export CLAUDECODE_HOME="$ISOLATED_ROOT/claudecode-home"
 export AMP_CLI_HOME="$ISOLATED_ROOT/ampcli-home"
 cd "$WORKDIR"
 npm init -y
-npm install <public-repo-root>/opendevbrowser-0.0.21.tgz
+npm install <public-repo-root>/opendevbrowser-0.0.22.tgz
 npx --no-install opendevbrowser --help
 npx --no-install opendevbrowser help
 ```

docs/FIRST_RUN_ONBOARDING.md

@@ -1,7 +1,7 @@
 # First-Run Onboarding (Local Artifact Validation)
 
 Status: active  
-Last updated: 2026-04-13
+Last updated: 2026-04-20
 
 This guide is the shipping checklist for validating OpenDevBrowser as a new user from a local package artifact. Use `docs/RELEASE_RUNBOOK.md` for the separate published npm registry-consumer proof lane.
 
@@ -27,22 +27,36 @@ This guide is the shipping checklist for validating OpenDevBrowser as a new user
 ```bash
 cd <public-repo-root>
 npm pack
-# -> opendevbrowser-0.0.21.tgz
+# -> opendevbrowser-0.0.22.tgz
 ```
 
-## 2) Simulate a brand-new user workspace
+## 2) Simulate a brand-new isolated user workspace
 
 ```bash
-WORKDIR=$(mktemp -d /tmp/opendevbrowser-first-run-XXXXXX)
+WORKROOT=$(mktemp -d /tmp/opendevbrowser-first-run-XXXXXX)
+WORKDIR="$WORKROOT/workdir"
+export HOME="$WORKROOT/home"
+export OPENCODE_CONFIG_DIR="$WORKROOT/opencode-config"
+export OPENCODE_CACHE_DIR="$WORKROOT/opencode-cache"
+export CODEX_HOME="$WORKROOT/codex-home"
+export CLAUDECODE_HOME="$WORKROOT/claude-home"
+export AMP_CLI_HOME="$WORKROOT/amp-home"
+mkdir -p "$WORKDIR" "$HOME" "$OPENCODE_CONFIG_DIR" "$OPENCODE_CACHE_DIR" "$CODEX_HOME" "$CLAUDECODE_HOME" "$AMP_CLI_HOME"
 cd "$WORKDIR"
 npm init -y
-npm install <public-repo-root>/opendevbrowser-0.0.21.tgz
+npm install <public-repo-root>/opendevbrowser-0.0.22.tgz
 npx --no-install opendevbrowser version --output-format json
 ```
 
 Expected:
 - package is installed under `./node_modules/opendevbrowser`
 - CLI command inventory is available via both `npx --no-install opendevbrowser --help` and `npx --no-install opendevbrowser help`
+- packaged postinstall skill sync already populates isolated managed skill targets for:
+  - `$OPENCODE_CONFIG_DIR/skill`
+  - `$CODEX_HOME/skills`
+  - `$CLAUDECODE_HOME/skills`
+  - `$AMP_CLI_HOME/skills`
+- each populated global skill directory contains `.opendevbrowser-managed-skills.json` plus one `.opendevbrowser-managed-skill.json` sentinel per bundled canonical pack
 
 ## 2b) Validate the help-led quick-start path
 
@@ -91,17 +105,15 @@ opendevbrowser_skill_load opendevbrowser-best-practices "validated capability la
 Region note:
 - treat `--region` as advisory unless workflow output reports `meta.selection.region_authoritative=true`
 
-## 3) Isolate config/cache to avoid daemon collisions
+## 3) Write isolated config/cache defaults
 
-For onboarding tests on machines that already run OpenDevBrowser, isolate runtime state:
+The temp workspace above already isolates managed-skill targets and the extension extraction home. Add an explicit config file before the first daemon or extension checks:
 
 ```bash
-export OPENCODE_CONFIG_DIR=/tmp/opendevbrowser-first-run-isolated/config
-export OPENCODE_CACHE_DIR=/tmp/opendevbrowser-first-run-isolated/cache
 mkdir -p "$OPENCODE_CONFIG_DIR" "$OPENCODE_CACHE_DIR"
 ```
 
-This isolation keeps config, cache, daemon state, and managed-skill lifecycle proof contained to a temp home while you validate local-package behavior.
+This keeps config, cache, daemon state, extension assets, and managed-skill lifecycle proof contained to the temp home while you validate local-package behavior.
 
 Minimal isolated config:
 
@@ -131,6 +143,7 @@ npx --no-install opendevbrowser --global --full --no-prompt
 Expected:
 - global OpenCode config is created/updated under `$OPENCODE_CONFIG_DIR`
 - bundled skills sync runs without errors
+- if packaged postinstall already populated the managed skill targets, the command may honestly report `unchanged` counts instead of reinstalling the same packs
 - extension assets are extracted to `~/.config/opencode/opendevbrowser/extension`
 - extracted assets now include `manifest.json`, `popup.html`, `canvas.html`, `dist/`, and `icons/`
 - `OPENCODE_CONFIG_DIR` isolates config lookup only; it does not relocate the extracted extension asset directory

docs/RELEASE_0.0.22_EVIDENCE.md

@@ -0,0 +1,142 @@
+# v0.0.22 Release Evidence
+
+Status: active release ledger
+Target release date: 2026-04-20  
+Last updated: 2026-04-20
+
+## Scope
+
+Tracks the `0.0.22` release cycle after the published `v0.0.21` release, including the post-merge follow-up that closes the remaining bundled skill lifecycle ownership gaps in installer sync and uninstall flows.
+
+## Baseline comparison
+
+- Reference release: GitHub `v0.0.21`
+  - URL: `https://github.com/freshtechbro/opendevbrowser/releases/tag/v0.0.21`
+  - Published: `2026-04-19`
+  - Target: `main`
+  - GitHub assets:
+    - `opendevbrowser-extension.zip`
+    - `opendevbrowser-extension.zip.sha256`
+- Current `0.0.22` delta is based on merged PR `#31` plus release-prep version and evidence updates on top of `main`.
+
+## Release summary
+
+- Preserves sentinel-discovered canonical bundled skill packs during subset-marker sync and uninstall cleanup.
+- Stops rediscovering edited retired packs as managed lifecycle artifacts once cleanup no longer owns them.
+- Keeps the install and postinstall contract unchanged: every install redistributes bundled skills into supported global agent skill directories.
+
+## Current repo note
+
+- Release-prep branch: `main`
+- Release tag target: `v0.0.22`
+- npm `latest`: `0.0.22` after local publish verification
+- GitHub release: pending
+- Local version authority is `package.json` at `0.0.22`; extension version owners stay synced via `npm run extension:sync`
+- `docs/RELEASE_0.0.21_EVIDENCE.md` remains historical release evidence
+
+## Mandatory release gates
+
+- [x] `npm run extension:sync`
+- [x] `npm run version:check`
+- [x] `npm run test:release-gate`
+- [x] `node scripts/audit-zombie-files.mjs`
+- [x] `node scripts/docs-drift-check.mjs`
+- [x] `node scripts/chrome-store-compliance-check.mjs`
+- [x] `./skills/opendevbrowser-best-practices/scripts/validate-skill-assets.sh`
+- [x] `npx opendevbrowser --help`
+- [x] `npx opendevbrowser help`
+- [x] `npm run lint`
+- [x] `npm run typecheck`
+- [x] `npm run test`
+- [x] `npm run build`
+- [x] `npm run extension:build`
+- [x] `npm run extension:pack`
+- [x] `npm pack`
+- [x] After npm publish, `node scripts/registry-consumer-smoke.mjs --version 0.0.22 --output artifacts/release/v0.0.22/registry-consumer-smoke.json`
+
+## Optional release-environment gates
+
+- [x] `node scripts/provider-direct-runs.mjs --release-gate --out artifacts/release/v0.0.22/provider-direct-runs.json`
+- [x] `node scripts/live-regression-direct.mjs --release-gate --out artifacts/release/v0.0.22/live-regression-direct.json`
+- [x] First-run onboarding dry run from `docs/FIRST_RUN_ONBOARDING.md`
+
+## Repo sanity checks
+
+- [x] `git diff --check`
+- [ ] `git status --short`
+
+## Artifacts
+
+- [x] `opendevbrowser-extension.zip`
+- [x] `opendevbrowser-0.0.22.tgz`
+
+## Local verification snapshot
+
+- Local release-gate sweep reran after the onboarding-proof doc updates on `2026-04-20` and passed:
+  - `git diff --check`
+  - `npm run version:check`
+  - `node scripts/audit-zombie-files.mjs`
+  - `node scripts/docs-drift-check.mjs`
+  - `node scripts/chrome-store-compliance-check.mjs`
+  - `./skills/opendevbrowser-best-practices/scripts/validate-skill-assets.sh`
+  - `npx opendevbrowser --help`
+  - `npx opendevbrowser help`
+  - `npm run lint`
+  - `npm run typecheck`
+  - `npm run test:release-gate`
+  - `npm run test`
+  - `npm run build`
+  - `npm run extension:build`
+  - `npm run extension:pack`
+  - `npm pack`
+- Test summary from that sweep:
+  - `259` test files passed, `1` skipped
+  - `3771` tests passed, `1` skipped
+  - Coverage: `98.10%` statements, `97.01%` branches, `97.75%` functions, `98.16%` lines
+- Provider direct release gate:
+  - Artifact: `artifacts/release/v0.0.22/provider-direct-runs.json`
+  - Counts: `19 pass`, `11 env_limited`, `0 fail`, `0 skipped`
+  - Notes: the script returned non-zero because env-limited lanes remain honest blockers for auth, challenge, or provider-policy constrained sources; there were no true failures.
+- Live regression direct release gate:
+  - Artifact: `artifacts/release/v0.0.22/live-regression-direct.json`
+  - Counts: `6 pass`, `0 env_limited`, `0 fail`, `2 skipped`
+  - Skipped lanes:
+    - `feature.annotate.relay` -> `manual_probe_boundary_observed:relay_annotation_timeout`
+    - `feature.annotate.direct` -> `manual_probe_boundary_observed:direct_annotation_timeout`
+- Onboarding dry run from the packaged tarball:
+  - Isolated env homes were set before `npm install`: `HOME`, `OPENCODE_CONFIG_DIR`, `OPENCODE_CACHE_DIR`, `CODEX_HOME`, `CLAUDECODE_HOME`, `AMP_CLI_HOME`
+  - `npm install opendevbrowser-0.0.22.tgz` redistributed all 9 canonical bundled skill packs into isolated OpenCode, Codex, ClaudeCode, and Amp global skill directories during package postinstall
+  - Each global skill directory contained `.opendevbrowser-managed-skills.json` plus one `.opendevbrowser-managed-skill.json` sentinel per bundled pack
+  - `npx --no-install opendevbrowser --global --full --no-prompt` exited `0`, reported `Skills global sync: 36 unchanged across 4 targets`, and extracted extension assets to the isolated home config path
+  - Autostart repair correctly warned that the temp onboarding CLI path is transient
+- External publish-state verification:
+  - `npm publish --access public` succeeded and ended with `+ opendevbrowser@0.0.22`
+  - `npm view opendevbrowser version dist-tags --json` now reports:
+    - `version: 0.0.22`
+    - `dist-tags.latest: 0.0.22`
+  - Registry consumer smoke:
+    - Command: `node scripts/registry-consumer-smoke.mjs --version 0.0.22 --output artifacts/release/v0.0.22/registry-consumer-smoke.json`
+    - Artifact: `artifacts/release/v0.0.22/registry-consumer-smoke.json`
+    - Result: `success: true`
+    - Checks:
+      - `helpAliasMatches: true`
+      - `findItFastPresent: true`
+      - `extensionDirExists: true`
+      - `skillsDirExists: true`
+      - `versionMatches: true`
+  - Release automation constraints remain unchanged:
+    - `gh secret list --repo freshtechbro/opendevbrowser` still shows `PRIVATE_REPO_DISPATCH_TOKEN` only
+    - `npm whoami` remains `bishopdotun`
+
+## External release workflow evidence
+
+- [ ] GitHub release workflow run URL
+- [ ] GitHub release URL
+- [x] npm publish verification (`npm view opendevbrowser version`)
+- [ ] Chrome Web Store upload or publish status
+
+## Notes
+
+- Public repo secrets currently visible through `gh secret list --repo freshtechbro/opendevbrowser`: `PRIVATE_REPO_DISPATCH_TOKEN` only.
+- Because the public repo still lacks repo-level `NPM_TOKEN` and `CWS_*` secrets, npm publish must run locally and the Chrome Web Store lane must use local credentials or a browser-manual dashboard flow from this operator machine.
+- Keep this ledger active until npm, GitHub release artifacts, and the Chrome lane are either completed or blocked with evidence.

extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "OpenDevBrowser Relay",
-  "version": "0.0.21",
+  "version": "0.0.22",
   "description": "Optional bridge to reuse existing Chrome tabs with OpenDevBrowser.",
   "permissions": [
     "debugger",

extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opendevbrowser-extension",
-  "version": "0.0.21",
+  "version": "0.0.22",
   "private": true,
   "type": "module",
   "scripts": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "opendevbrowser",
-  "version": "0.0.21",
+  "version": "0.0.22",
   "description": "Browser automation runtime with snapshot-refs-actions, browser replay screencasts, public read-only desktop observation, and browser-scoped computer-use orchestration",
   "type": "module",
   "main": "dist/index.js",