Research report · 17 October 2026
What the emails release asset proves—and does not
GitHub lists an original emails-source.zip asset in release v2.11.37. The tagged emails/SKILL.md source displays 2.1.4. We could not read the ZIP bytes or attached manifest, so no path inside the selected ZIP is confirmed present or missing.
Three evidence layers
The published asset
GitHub release metadata reports publication on 15 October 2026 at 18:35:22 UTC, target commit 365b412152b9542499ca1439426f7fc3cc92bb65, and an emails-source.zip asset (ID 644792940; created 18:35:29 UTC; 14,583 bytes). GitHub reports SHA-256 b605c474886414be0232034938e53effdf54112d690727f462fbb29304c0beaf. This is a reported metadata value, not a checksum computed from downloaded bytes.
The access boundary
The direct ZIP and attached manifest URLs returned a web-broker cache miss. A local HTTPS request failed at DNS resolution before an HTTP response. The release connector supplied metadata, not either body. We did not open a ZIP central directory, compute a hash, rebuild an archive, inspect manifest fields, or install anything. Inaccessibility does not show that the assets are absent.
The release metadata marks immutable: false. The tagged packaging document says reruns may replace named assets at the same tag. The reported digest is therefore a dated observation, not a permanent pin.
Named paths are not confirmed ZIP entries
The tagged source file has Git blob SHA-1 e660baf4adf7430ff90bfbdeaf9a9ad101a2d2ed and displays version 2.1.4. It names three same-folder references, a Copywriting AI-tells cross-reference, and separate implementation URLs. Git blob SHA-1 IDs are not the release-reported archive SHA-256 or file-byte checksums.
| Requested path or category | Tagged source fact | Selected ZIP |
|---|---|---|
emails/SKILL.md | Source file exists and displays 2.1.4. | Unknown |
Three emails/references/ files | Sequence templates, email types, and copy guidelines exist at the tag and are named in SKILL.md. | Unknown for each |
copywriting/references/ai-tells.md | Cross-skill file exists at the tag. The email file names it but does not embed its full text. | Unknown |
tools/ registry and six guides | The email file names implementation URLs on mutable main; the earlier source reading found account, recipient-data and send examples. | Unknown |
LICENSE | A license file exists at the repository tag. | Unknown |
The maintainer’s packaging design expects one named skill’s authored references and license, while excluding other skills and tools. That is a testable expectation, not observed inclusion or exclusion in this asset. The tagged 2.1.4 file is not a check of today’s mutable main or the exact 2.1.3→2.1.4 diff.
What would close the gap?
- Obtain the original bytesUse a readable download of the selected source ZIP and attached manifest, not a rebuilt substitute.
- Check the dated digestCompute SHA-256 on the bytes and compare with the release metadata observed here.
- Read entries and fieldsInspect central-directory names and manifest fields read-only; record each present or missing path separately.
- Keep decisions separateArchive content would not by itself verify a CLI-selected payload, host resolution, permission, quality, deliverability or recipient-policy approval.
Skill catalogue · Browse by job · Earlier linked-route reading · Earlier packaging-document reading · Release metadata · Tagged source