Publish r13 audited Builder installer (#21)

Author: vibeforge1111

docs/AGENTS.md

@@ -129,7 +129,7 @@ Spark Swarm network submission and hosted workspace review are upcoming private
 
 ## Current Installer Pins
 
-- Spark CLI commit: `de7622cfce0798e6552c0d05b44bbec4eaa45cc8`
+- Spark CLI commit: `264baaaf0cbb3e1790b20c425b391d2919505a21`
 - Node: `22.18.0`
 - Python: `3.11`
 - uv: `0.11.7`

docs/install-safety.md

@@ -23,8 +23,8 @@ If you are non-technical, ask your coding assistant to open this page, run the d
 ## Current Hashes
 
 ```text
-555d94d3c835bb16d084c8a13bc972ef08bde9b91f7f2523f7d1079007314d5c  install.sh
-a68c4c0549ae098d71d2e0263a46d205aac958701d7126a5297acf14506159b6  install.ps1
+5b825ef3d824de60f84d07d1f0bf5b1de39279fc7f5c8b1c761169f904fe25f2  install.sh
+9cceb4178d4f324ac8ee7583e7b8b30b6cf87fff6e8d925805abc0c2627356be  install.ps1
 ```
 
 ## Safe Procedure
@@ -113,7 +113,7 @@ Users can change this later in Telegram with `/access 1`, `/access 2`, `/access
 
 ## Pinned Parts
 
-- Spark CLI commit: `de7622cfce0798e6552c0d05b44bbec4eaa45cc8`
+- Spark CLI commit: `264baaaf0cbb3e1790b20c425b391d2919505a21`
 - Node: `22.18.0`
 - Python: `3.11`
 - uv: `0.11.7`

docs/llms-full.txt

@@ -139,7 +139,7 @@ Do not send Telegram tokens or LLM keys to websites.
 
 ## Current Installer Pins
 
-- Spark CLI commit: `de7622cfce0798e6552c0d05b44bbec4eaa45cc8`
+- Spark CLI commit: `264baaaf0cbb3e1790b20c425b391d2919505a21`
 - Node: `22.18.0`
 - Python: `3.11`
 - uv: `0.11.7`

docs/pages/index.md

@@ -70,8 +70,8 @@ The installer has checksums, a release manifest, pinned managed runtimes, immuta
 
 Current public installer state:
 
-- Release: `spark-cli-public-installer-2026-05-17-r12`
-- Installed Spark CLI runtime commit: `de7622cfce0798e6552c0d05b44bbec4eaa45cc8`
+- Release: `spark-cli-public-installer-2026-05-17-r13`
+- Installed Spark CLI runtime commit: `264baaaf0cbb3e1790b20c425b391d2919505a21`
 - Local installer hashes match the committed release manifest.
 - Hosted installer verification passed after deploy.
 - Windows and WSL sandbox install checks are part of the release gate.

docs/pages/install-safety.md

@@ -50,8 +50,8 @@ Only then run the real install.
 ## Current Hashes
 
 ```text
-555d94d3c835bb16d084c8a13bc972ef08bde9b91f7f2523f7d1079007314d5c  install.sh
-a68c4c0549ae098d71d2e0263a46d205aac958701d7126a5297acf14506159b6  install.ps1
+5b825ef3d824de60f84d07d1f0bf5b1de39279fc7f5c8b1c761169f904fe25f2  install.sh
+9cceb4178d4f324ac8ee7583e7b8b30b6cf87fff6e8d925805abc0c2627356be  install.ps1
 ```
 
 ## Safe Human Procedure

docs/updates.md

@@ -40,6 +40,6 @@ spark verify --installers --hosted-installers
 The expected Spark CLI release is:
 
 ```text
-spark-cli-public-installer-2026-05-17-r12
-de7622cfce0798e6552c0d05b44bbec4eaa45cc8
+spark-cli-public-installer-2026-05-17-r13
+264baaaf0cbb3e1790b20c425b391d2919505a21
 ```

docs/updates/index.html

@@ -45,7 +45,7 @@ <h1>Public labs are open. Spark Swarm stays private for now.</h1>
     <section class="doc-section">
       <h2>What changed.</h2>
       <div class="doc-grid doc-grid-3">
-        <div class="doc-card"><span class="doc-kicker">Installer</span><h3>May 17 pin</h3><p>The hosted installer now points at <code>spark-cli-public-installer-2026-05-17-r12</code> with matching checksums, manifest, command metadata, attestations, voice-safe defaults, stale Windows shim cleanup, and production smoke.</p></div>
+        <div class="doc-card"><span class="doc-kicker">Installer</span><h3>May 17 pin</h3><p>The hosted installer now points at <code>spark-cli-public-installer-2026-05-17-r13</code> with matching checksums, manifest, command metadata, attestations, voice-safe defaults, stale Windows shim cleanup, and production smoke.</p></div>
         <div class="doc-card"><span class="doc-kicker">Creator Lab</span><h3>Domain Chip Labs</h3><p>Public standards for domain chips, benchmarks, specialization paths, autoloop policies, tool integrations, and publish packet drafts.</p></div>
         <div class="doc-card"><span class="doc-kicker">Telegram</span><h3>Local recursive loops</h3><p>Builder chip loops can now start and report from Telegram using local status files, without depending on Spark Swarm workspace APIs.</p></div>
         <div class="doc-card"><span class="doc-kicker">Identity</span><h3>Character And Personality</h3><p>Spark Character is public, and Personality Chip Labs is public for modular profile experiments.</p></div>
@@ -66,7 +66,7 @@ <h3>Spark Swarm comes later</h3>
     <section class="doc-section">
       <h2>Verify the release.</h2>
       <pre class="docs-code">spark verify --installers --hosted-installers</pre>
-      <p>Expected release: <code>spark-cli-public-installer-2026-05-17-r12</code> at <code>de7622cfce0798e6552c0d05b44bbec4eaa45cc8</code>.</p>
+      <p>Expected release: <code>spark-cli-public-installer-2026-05-17-r13</code> at <code>264baaaf0cbb3e1790b20c425b391d2919505a21</code>.</p>
     </section>
   </article>
 </main>

install.ps1

@@ -1,7 +1,7 @@
 param(
     [string]$Prefix = "$HOME\.spark",
     [string]$Source = "https://github.com/vibeforge1111/spark-cli",
-    [string]$Ref = "de7622cfce0798e6552c0d05b44bbec4eaa45cc8",
+    [string]$Ref = "264baaaf0cbb3e1790b20c425b391d2919505a21",
     [string]$NodeVersion = "22.18.0",
     [string]$PythonVersion = "3.11",
     [string]$UvVersion = "0.11.7",
@@ -30,7 +30,7 @@ param(
 )
 
 $ErrorActionPreference = "Stop"
-$SparkCliReleaseName = "spark-cli-public-installer-2026-05-17-r12"
+$SparkCliReleaseName = "spark-cli-public-installer-2026-05-17-r13"
 $RefWasProvided = $PSBoundParameters.ContainsKey("Ref")
 $Script:InstallLockDir = ""
 $Script:PythonExe = ""

install.sh

@@ -3,8 +3,8 @@ set -euo pipefail
 
 SPARK_PREFIX="${SPARK_PREFIX:-$HOME/.spark}"
 SPARK_CLI_SOURCE="${SPARK_CLI_SOURCE:-https://github.com/vibeforge1111/spark-cli}"
-SPARK_CLI_RELEASE_NAME="${SPARK_CLI_RELEASE_NAME:-spark-cli-public-installer-2026-05-17-r12}"
-SPARK_DEFAULT_CLI_REF="de7622cfce0798e6552c0d05b44bbec4eaa45cc8"
+SPARK_CLI_RELEASE_NAME="${SPARK_CLI_RELEASE_NAME:-spark-cli-public-installer-2026-05-17-r13}"
+SPARK_DEFAULT_CLI_REF="264baaaf0cbb3e1790b20c425b391d2919505a21"
 SPARK_CLI_REF_USER_SET=0
 if [ -n "${SPARK_CLI_REF:-}" ]; then
   SPARK_CLI_REF_USER_SET=1

install/attestations.md

@@ -24,7 +24,7 @@ The manifest includes the immutable Spark CLI commit, managed Node version, mana
 
 ```bash
 curl -fsSL https://agent.sparkswarm.ai/install.sh -o ./install.sh
-expected='555d94d3c835bb16d084c8a13bc972ef08bde9b91f7f2523f7d1079007314d5c'
+expected='5b825ef3d824de60f84d07d1f0bf5b1de39279fc7f5c8b1c761169f904fe25f2'
 actual=$(if command -v sha256sum >/dev/null 2>&1; then sha256sum ./install.sh | awk '{print $1}'; elif command -v shasum >/dev/null 2>&1; then shasum -a 256 ./install.sh | awk '{print $1}'; else echo 'Missing sha256sum or shasum'; exit 1; fi)
 test "$actual" = "$expected" || { echo 'spark installer checksum mismatch'; exit 1; }
 gh attestation verify ./install.sh --repo vibeforge1111/Spark-Agent-Site --signer-workflow vibeforge1111/Spark-Agent-Site/.github/workflows/install-hardening.yml --source-ref refs/heads/main
@@ -36,7 +36,7 @@ bash ./install.sh --dry-run
 
 ```powershell
 iwr https://agent.sparkswarm.ai/install.ps1 -OutFile .\install.ps1
-if ((Get-FileHash .\install.ps1 -Algorithm SHA256).Hash.ToLowerInvariant() -ne 'a68c4c0549ae098d71d2e0263a46d205aac958701d7126a5297acf14506159b6') { throw 'install.ps1 checksum mismatch' }
+if ((Get-FileHash .\install.ps1 -Algorithm SHA256).Hash.ToLowerInvariant() -ne '9cceb4178d4f324ac8ee7583e7b8b30b6cf87fff6e8d925805abc0c2627356be') { throw 'install.ps1 checksum mismatch' }
 gh attestation verify .\install.ps1 --repo vibeforge1111/Spark-Agent-Site --signer-workflow vibeforge1111/Spark-Agent-Site/.github/workflows/install-hardening.yml --source-ref refs/heads/main
 Get-Content .\install.ps1
 powershell -NoProfile -ExecutionPolicy Bypass -File .\install.ps1 -DryRun