Update Bug Receipt to v1.4.1

[lMysticl]

Summary

Updates Bug Receipt from the v1.3 closeout contract merged in #2631 to the released v1.4.1 contract.

What changed

• requires privacy-minimal evidence and explicit redaction of secrets and sensitive payloads;
• introduces receipt schema v2 with executed-now, supplied, or mixed evidence provenance;
• retains schema v1 compatibility for existing receipts;
• hardens the bundled validator against malformed verification containers;
• adds explicit metadata.version: "1.4.1" for iteration tracking;
• regenerates the skills index from the updated discovery description.

The source package now enforces this automatically: npm run skill:validate requires SemVer metadata and rejects any mismatch between SKILL.md and package.json.

Measured result

The separately pre-registered four-case v1.4 robustness cohort covered security redaction, rollback recovery, diagnosis-only authority, and rolling version skew:

• Skills ON: 18/20 assertions (90%)
• Skills OFF: 5/20 assertions (25%)
• lift: +65 percentage points
• exact McNemar p = 0.000244
• natural routing: 4/4
• correct status and complete receipt: 4/4
• secret leaks: 0
• candidate actions: 0

This is a bounded comparison against the no-skill arm, not a claim against every alternative. The SHA-verified reports, methodology, quarantine history, and limitations are published in the v1.4.1 benchmark report. Version 1.4.1 only adds version metadata and automatic drift enforcement; the instruction behavior measured by the cohort is unchanged from v1.4.0.

Release: https://github.com/lMysticl/bug-receipt/releases/tag/v1.4.1

Validation

• npm ci — 0 vulnerabilities
• npm run skill:validate — all 407 skills valid
• npm run build
• schema v1 compatibility check: pass
• schema v2 required-provenance check: pass
• bundled v2 sample validation: pass
• git diff --check
• changed files verified as LF with git ls-files --eol

The v1.4.1 source release also passes 33/33 repository tests, lint, TypeScript build, distribution verification, and packed-artifact installation smoke; CI is green on Windows and Ubuntu with Node 20 and 22.

[github-actions]

🔒 PR Risk Scan Results

Scanned 5 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	1

Severity	Rule	File	Line	Match
ℹ️	skill-script-touched	skills/bug-receipt/scripts/validate-receipt.mjs	1	skills/bug-receipt/scripts/validate-receipt.mjs

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔍 Vally Lint Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	✅ bug-receipt (2/2 checks passed)
ℹ️	✓ [spec-compliance] All 1 skill(s) are spec-compliant.
ℹ️	✓ spec-compliance: All spec checks passed.
ℹ️	✓ [valid-refs] All file references across 1 skill(s) are valid.
ℹ️	✓ valid-refs: All file references resolve to existing files within the skill directory.
ℹ️	1 skill(s) linted, 1 passed

Full linter output

### Linting skills/bug-receipt
✅ bug-receipt (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

[aaronpowell]

it might be useful to use the metadata property to put a version for the skill so you can track your iterations easier

[lMysticl]

Thanks for the suggestion, @aaronpowell! I added metadata.version: "1.4.1" and source validation that keeps it in sync with package.json. All PR checks are passing now. Could you please take another look and merge it when ready?