The listing's MIT-0 next to the repository's Apache-2.0 was documented as a
drift to repair in the ClawHub listing itself. It is not repairable and not
drift: ClawHub's own client pins the platform skill license
(dist/schema/license.js sets PLATFORM_SKILL_LICENSE = "MIT-0", and the
version schema accepts only "MIT-0" or null), so every skill published there
is offered under MIT No Attribution. Publishing to ClawHub means offering
this skill on those terms in addition to Apache-2.0; the field is not
editable and the mismatch must not be read as drift.
pre-commit: 1) maintain.sh - exit 2 at the uv-secure gate, the three triaged
no-fix advisories in docs/development.md (rechecked 2026-09-09 against PyPI);
ruff check+format clean, pyright src/ 0 errors, 2368 passed 3 skipped run
separately; 2) /simplify - single pass, no fan-out available, prose-only
change, no findings; 3) docs sync - MIT-0/ClawHub grepped across docs/,
README, .claude/rules/, skills/: only release-and-distribution.md describes
the publish flow and stays accurate, the audit doc row is a dated snapshot,
no refs to update; 4) CLAUDE.md - audited against the structure rule, no
additions, revise-claude-md: no additions
The previous commit recorded openclaw/clawhub#3643 as still open. It was
closed as completed at 17:29 UTC, minutes before that commit landed, so the
claim was already false when it was written: the state was read earlier in
the session and never re-read against the tracker.
The note now says the reporter closed it once 1.0.5 published, that nothing
upstream was confirmed fixed, and that this was the fifth report of the same
shape, so a future stalled submission gets a fresh report rather than an
assumption that the pipeline is repaired.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PrJja6MnncVhyWnmXPN4GM
docs/agent-skill.md still described the ClawHub surface as blocked: 1.0.3
and 1.0.4 stuck in pending.publication, with an instruction not to bump the
skill version until openclaw/clawhub#3643 resolved. The registry disagrees.
1.0.5, submitted by the clawhub job during the 0.39.0 release, is public:
clawhub search returns the row, and the public API reports tags.latest
1.0.5 with a single published version, which is also how the two earlier
submissions are shown never to have gone public. They were bypassed by the
next submission rather than recovered, and the pipeline issue stays open.
The note now says to read the catalog rather than the job log, since a
green job proves only a submission. It also records that the job fires on a
published release alone, so the 1.0.6 bump that landed after 0.39.0 reaches
ClawHub with the next release and must not be published by hand, and that
the listing carries MIT-0 where SKILL.md declares Apache-2.0, which the
publish command has no flag to set.
The awesome-openclaw entry loses its ClawHub prerequisite and stays
deferred on adoption alone: the listing reports no installs in 60 days.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PrJja6MnncVhyWnmXPN4GM
Repair image and metadata publication contracts, detection routing, research
artifact validation, release verification, and the published agent skill.
Refresh the dependency lock and reconcile documentation with verified behavior.
Add regression coverage and record the completed audit and corrected VideoSeal
measurements. Preserve the existing Accelerate and Lightning versions.
Validation: Ruff and Pyright pass; 2358 tests pass with 3 skipped. The maintenance
gate exits 2 on the documented Accelerate and Lightning security findings.
ComposioHQ accepted a submission with no adoption bar (PR 1841);
VoltAgent lists reject brand-new skills, and the openclaw list indexes
ClawHub entries only. Both re-attempts are deferred with their
re-entry criteria.
`skills/remove-ai-watermarks/` teaches a coding agent to drive the CLI on
content the user generated, and refuses stock-agency and other third-party
paid-asset marks. It ships with this repository rather than as a fifth release
surface, and installs through `npx skills add` in any harness or as a Claude
plugin from `.claude-plugin/marketplace.json`.
`scripts/probe.py` measures capability rather than presence: a found binary said
nothing about whether the build can run a visible-mark command, so it writes a
blank PNG with zlib and struct and runs the installed `visible` and `invisible`
on it. Exit 2 is a state only a working stack reaches, and `invisible` checks
its extra before detection, so a signal-free image answers in 0.23s with no
model download. That distinction matters: without CUDA, `all` writes nothing
with the invisible extra installed and writes a useful visible+metadata result
without it, and both exit 1.
The skill also carries what a weak model gets wrong. It must report only what a
command in the session actually did, because a run on a machine with no pixel
stack produced a finished-looking removal report, complete with a size table for
a file nobody wrote. It must not read exit 2 as a verdict, because Click's usage
errors share that code. And it must get explicit consent before
`verify-openai-synthid`, which uploads the user's image to a third party.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Victor Kuznetsov