Publish r21 Spark CLI installer

Author: vibeforge1111

docs/AGENTS.md

@@ -129,7 +129,8 @@ Spark Swarm network submission and hosted workspace review are upcoming private
 
 ## Current Installer Pins
 
-- Spark CLI commit: `bb188d440707ff0a9f866f782760929a69872ed2`
+- Spark CLI release ref: `spark-cli-public-installer-2026-05-29-r21`
+- Spark CLI commit: `b07d72d5a0e510b8dddc7dffad3c9073af4031fd`
 - Node: `22.18.0`
 - Python: `3.11`
 - uv: `0.11.7`

docs/install-safety.md

@@ -23,8 +23,8 @@ If you are non-technical, ask your coding assistant to open this page, run the d
 ## Current Hashes
 
 ```text
-33659e85e6ac370acc5a4ae8b57eb1555140364df97bba310a6511a9c835d8f0  install.sh
-5cd18867b1411f2674af6620e85e205f3a69c243360a7a43a69b9c7791fe7d18  install.ps1
+56bb32b0e455f9c92cfffe7ee153fae98ab95d0aab3461568ee64918ce10940c  install.sh
+29c7432628134071f11805cdb64362a67013c78e9105165f2be78b53339ea5a6  install.ps1
 ```
 
 ## Safe Procedure
@@ -113,7 +113,8 @@ Users can change this later in Telegram with `/access 1`, `/access 2`, `/access
 
 ## Pinned Parts
 
-- Spark CLI commit: `bb188d440707ff0a9f866f782760929a69872ed2`
+- Spark CLI release ref: `spark-cli-public-installer-2026-05-29-r21`
+- Spark CLI commit: `b07d72d5a0e510b8dddc7dffad3c9073af4031fd`
 - Node: `22.18.0`
 - Python: `3.11`
 - uv: `0.11.7`

docs/llms-full.txt

@@ -139,7 +139,8 @@ Do not send Telegram tokens or LLM keys to websites.
 
 ## Current Installer Pins
 
-- Spark CLI commit: `bb188d440707ff0a9f866f782760929a69872ed2`
+- Spark CLI release ref: `spark-cli-public-installer-2026-05-29-r21`
+- Spark CLI commit: `b07d72d5a0e510b8dddc7dffad3c9073af4031fd`
 - Node: `22.18.0`
 - Python: `3.11`
 - uv: `0.11.7`

docs/pages/index.md

@@ -66,12 +66,12 @@ Domain chips teach Spark how to improve one specialist area without bloating the
 
 ## Current status
 
-The installer has checksums, a release manifest, pinned managed runtimes, immutable Spark CLI source, GitHub Artifact Attestations, Sigstore keyless release signatures, multi-OS dry-run CI, and disposable real-install CI.
+The installer has checksums, a release manifest, pinned managed runtimes, a Spark CLI public release tag, GitHub Artifact Attestations, Sigstore keyless release signatures, multi-OS dry-run CI, and disposable real-install CI.
 
 Current public installer state:
 
-- Release: `spark-cli-public-installer-2026-05-29-r20`
-- Installed Spark CLI runtime commit: `bb188d440707ff0a9f866f782760929a69872ed2`
+- Release: `spark-cli-public-installer-2026-05-29-r21`
+- Installed Spark CLI runtime commit: `b07d72d5a0e510b8dddc7dffad3c9073af4031fd`
 - Local installer hashes match the committed release manifest.
 - Hosted installer verification passed after deploy.
 - Windows and WSL sandbox install checks are part of the release gate.

docs/pages/install-safety.md

@@ -50,8 +50,8 @@ Only then run the real install.
 ## Current Hashes
 
 ```text
-33659e85e6ac370acc5a4ae8b57eb1555140364df97bba310a6511a9c835d8f0  install.sh
-5cd18867b1411f2674af6620e85e205f3a69c243360a7a43a69b9c7791fe7d18  install.ps1
+56bb32b0e455f9c92cfffe7ee153fae98ab95d0aab3461568ee64918ce10940c  install.sh
+29c7432628134071f11805cdb64362a67013c78e9105165f2be78b53339ea5a6  install.ps1
 ```
 
 ## Safe Human Procedure

docs/updates.md

@@ -6,7 +6,7 @@ This update publishes the safe public surfaces we can share now, without making
 
 ## Included
 
-- May 29 Spark CLI r20 installer pin with hosted checksums, release manifest, command metadata, attestations, voice-safe setup defaults, stale Windows shim cleanup, production smoke checks, a softer upgrade-refresh pause, and a browser-use Windows proof fix.
+- May 29 Spark CLI r21 installer pin with hosted checksums, release manifest, command metadata, attestations, voice-safe setup defaults, stale Windows shim cleanup, production smoke checks, a softer upgrade-refresh pause, browser-use Windows proof, and self-consistent installed-checkout release metadata.
 - Telegram recursive loops now have a local-only public path for Builder chip loops: `/recursive start <chipKey> rounds <n>`, `/recursive sessions`, `/recursive report`, and `/recursive trace` work from local status files without Spark Swarm.
 - `spark-domain-chip-labs` as the public creator lab for domain chips, benchmark packs, specialization paths, autoloop policies, tool integrations, and publish packet standards.
 - `spark-character` as the public character and voice-consistency layer.
@@ -40,6 +40,6 @@ spark verify --installers --hosted-installers
 The expected Spark CLI release is:
 
 ```text
-spark-cli-public-installer-2026-05-29-r20
-bb188d440707ff0a9f866f782760929a69872ed2
+spark-cli-public-installer-2026-05-29-r21
+b07d72d5a0e510b8dddc7dffad3c9073af4031fd
 ```

docs/updates/index.html

@@ -45,7 +45,7 @@ <h1>Public labs are open. Spark Swarm stays private for now.</h1>
     <section class="doc-section">
       <h2>What changed.</h2>
       <div class="doc-grid doc-grid-3">
-        <div class="doc-card"><span class="doc-kicker">Installer</span><h3>May 29 r20 pin</h3><p>The hosted installer now points at <code>spark-cli-public-installer-2026-05-29-r20</code> with matching checksums, manifest, command metadata, attestations, voice-safe defaults, stale Windows shim cleanup, production smoke, a softer upgrade-refresh pause, and a browser-use Windows proof fix.</p></div>
+        <div class="doc-card"><span class="doc-kicker">Installer</span><h3>May 29 r21 pin</h3><p>The hosted installer now points at <code>spark-cli-public-installer-2026-05-29-r21</code> with matching checksums, manifest, command metadata, attestations, voice-safe defaults, stale Windows shim cleanup, production smoke, a softer upgrade-refresh pause, browser-use Windows proof, and self-consistent installed-checkout release metadata.</p></div>
         <div class="doc-card"><span class="doc-kicker">Creator Lab</span><h3>Domain Chip Labs</h3><p>Public standards for domain chips, benchmarks, specialization paths, autoloop policies, tool integrations, and publish packet drafts.</p></div>
         <div class="doc-card"><span class="doc-kicker">Telegram</span><h3>Local recursive loops</h3><p>Builder chip loops can now start and report from Telegram using local status files, without depending on Spark Swarm workspace APIs.</p></div>
         <div class="doc-card"><span class="doc-kicker">Identity</span><h3>Character And Personality</h3><p>Spark Character is public, and Personality Chip Labs is public for modular profile experiments.</p></div>
@@ -66,7 +66,7 @@ <h3>Spark Swarm comes later</h3>
     <section class="doc-section">
       <h2>Verify the release.</h2>
       <pre class="docs-code">spark verify --installers --hosted-installers</pre>
-      <p>Expected release: <code>spark-cli-public-installer-2026-05-29-r20</code> at <code>bb188d440707ff0a9f866f782760929a69872ed2</code>.</p>
+      <p>Expected release: <code>spark-cli-public-installer-2026-05-29-r21</code> at <code>b07d72d5a0e510b8dddc7dffad3c9073af4031fd</code>.</p>
     </section>
   </article>
 </main>

install.ps1

@@ -1,7 +1,7 @@
 param(
     [string]$Prefix = "$HOME\.spark",
     [string]$Source = "https://github.com/vibeforge1111/spark-cli",
-    [string]$Ref = "bb188d440707ff0a9f866f782760929a69872ed2",
+    [string]$Ref = "spark-cli-public-installer-2026-05-29-r21",
     [string]$NodeVersion = "22.18.0",
     [string]$PythonVersion = "3.11",
     [string]$UvVersion = "0.11.7",
@@ -30,7 +30,7 @@ param(
 )
 
 $ErrorActionPreference = "Stop"
-$SparkCliReleaseName = "spark-cli-public-installer-2026-05-29-r20"
+$SparkCliReleaseName = "spark-cli-public-installer-2026-05-29-r21"
 $RefWasProvided = $PSBoundParameters.ContainsKey("Ref")
 $Script:InstallLockDir = ""
 $Script:PythonExe = ""
@@ -459,8 +459,8 @@ function Test-InstallSettings {
     if ($UvVersion -notmatch '^\d+\.\d+\.\d+$') {
         throw "Unsafe uv version value: $UvVersion"
     }
-    if (-not $RefWasProvided -and $Ref -notmatch '^[0-9a-f]{40}$') {
-        throw "Default Spark CLI ref must be an immutable 40-character commit SHA: $Ref"
+    if (-not $RefWasProvided -and $Ref -notmatch '^([0-9a-f]{40}|spark-cli-public-installer-\d{4}-\d{2}-\d{2}-r\d+)$') {
+        throw "Default Spark CLI ref must be a 40-character commit SHA or Spark public release tag: $Ref"
     }
     $normalizedSource = $Source.TrimEnd("/")
     if ($normalizedSource.EndsWith(".git")) {

install.sh

@@ -3,8 +3,8 @@ set -euo pipefail
 
 SPARK_PREFIX="${SPARK_PREFIX:-$HOME/.spark}"
 SPARK_CLI_SOURCE="${SPARK_CLI_SOURCE:-https://github.com/vibeforge1111/spark-cli}"
-SPARK_CLI_RELEASE_NAME="${SPARK_CLI_RELEASE_NAME:-spark-cli-public-installer-2026-05-29-r20}"
-SPARK_DEFAULT_CLI_REF="bb188d440707ff0a9f866f782760929a69872ed2"
+SPARK_CLI_RELEASE_NAME="${SPARK_CLI_RELEASE_NAME:-spark-cli-public-installer-2026-05-29-r21}"
+SPARK_DEFAULT_CLI_REF="spark-cli-public-installer-2026-05-29-r21"
 SPARK_CLI_REF_USER_SET=0
 if [ -n "${SPARK_CLI_REF:-}" ]; then
   SPARK_CLI_REF_USER_SET=1
@@ -512,8 +512,8 @@ validate_install_settings() {
     exit 1
   fi
 
-  if [ "$SPARK_CLI_REF_USER_SET" = "0" ] && ! printf '%s' "$SPARK_CLI_REF" | grep -Eq '^[0-9a-f]{40}$'; then
-    echo "Default Spark CLI ref must be an immutable 40-character commit SHA: $SPARK_CLI_REF" >&2
+  if [ "$SPARK_CLI_REF_USER_SET" = "0" ] && ! printf '%s' "$SPARK_CLI_REF" | grep -Eq '^([0-9a-f]{40}|spark-cli-public-installer-[0-9]{4}-[0-9]{2}-[0-9]{2}-r[0-9]+)$'; then
+    echo "Default Spark CLI ref must be a 40-character commit SHA or Spark public release tag: $SPARK_CLI_REF" >&2
     exit 1
   fi
 

install/attestations.md

@@ -18,13 +18,13 @@ The pinned installer inputs are published at:
 https://agent.sparkswarm.ai/install/release-manifest.json
 ```
 
-The manifest includes the immutable Spark CLI commit, managed Node version, managed Python version, pinned uv version, uv asset hashes, and the installer network allowlist.
+The manifest includes the Spark CLI public release tag, resolved Spark CLI commit, managed Node version, managed Python version, pinned uv version, uv asset hashes, and the installer network allowlist.
 
 ## Verify macOS, Linux, or WSL
 
 ```bash
 curl -fsSL https://agent.sparkswarm.ai/install.sh -o ./install.sh
-expected='33659e85e6ac370acc5a4ae8b57eb1555140364df97bba310a6511a9c835d8f0'
+expected='56bb32b0e455f9c92cfffe7ee153fae98ab95d0aab3461568ee64918ce10940c'
 actual=$(if command -v sha256sum >/dev/null 2>&1; then sha256sum ./install.sh | awk '{print $1}'; elif command -v shasum >/dev/null 2>&1; then shasum -a 256 ./install.sh | awk '{print $1}'; else echo 'Missing sha256sum or shasum'; exit 1; fi)
 test "$actual" = "$expected" || { echo 'spark installer checksum mismatch'; exit 1; }
 gh attestation verify ./install.sh --repo vibeforge1111/Spark-Agent-Site --signer-workflow vibeforge1111/Spark-Agent-Site/.github/workflows/install-hardening.yml --source-ref refs/heads/main
@@ -36,7 +36,7 @@ bash ./install.sh --dry-run
 
 ```powershell
 iwr https://agent.sparkswarm.ai/install.ps1 -OutFile .\install.ps1
-if ((Get-FileHash .\install.ps1 -Algorithm SHA256).Hash.ToLowerInvariant() -ne '5cd18867b1411f2674af6620e85e205f3a69c243360a7a43a69b9c7791fe7d18') { throw 'install.ps1 checksum mismatch' }
+if ((Get-FileHash .\install.ps1 -Algorithm SHA256).Hash.ToLowerInvariant() -ne '29c7432628134071f11805cdb64362a67013c78e9105165f2be78b53339ea5a6') { throw 'install.ps1 checksum mismatch' }
 gh attestation verify .\install.ps1 --repo vibeforge1111/Spark-Agent-Site --signer-workflow vibeforge1111/Spark-Agent-Site/.github/workflows/install-hardening.yml --source-ref refs/heads/main
 Get-Content .\install.ps1
 powershell -NoProfile -ExecutionPolicy Bypass -File .\install.ps1 -DryRun