fix(connectors): pin the compatible public Factory patch

.github/workflows/publish-factory.yml

@@ -15,10 +15,10 @@ jobs:
           node-version: 24.22.1
           registry-url: https://registry.npmjs.org
       - name: Download the licensed public package
-        run: curl --fail --location --output vana-factory-core-0.0.1.tgz https://github.com/vana-com/vana-cli/releases/download/v0.45.0/vana-factory-core-0.0.1.tgz
+        run: curl --fail --location --output vana-factory-core-0.0.2.tgz https://github.com/vana-com/vana-cli/releases/download/v0.45.1/vana-factory-core-0.0.2.tgz
       - name: Verify the reviewed artifact
-        run: echo '58f9d3cadbf456bb77e5e6ce22a37a34c65d18f338a04ecfaba4e95ab5ac19f3  vana-factory-core-0.0.1.tgz' | sha256sum --check
+        run: echo '089a528f4a7a302d2dae9a0724e4b25f62ada14c61eb7728507c4139875a30d9  vana-factory-core-0.0.2.tgz' | sha256sum --check
       - name: Publish the exact artifact to npm
-        run: npm publish ./vana-factory-core-0.0.1.tgz --ignore-scripts --access public --tag latest
+        run: npm publish ./vana-factory-core-0.0.2.tgz --ignore-scripts --access public --tag latest
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

LOG.md

@@ -126,3 +126,24 @@ Final combined CLI validation passes typecheck, ESLint, formatting and all 952
 tests. The public tarball was downloaded anonymously and installed with private
 checkout/config reads denied; its capabilities report version 0.0.1 and supported
 API/export routes. The downloaded hash matches the frozen licensed artifact.
+
+## Exact public compatibility patch guidance
+
+The public-only acceptance found a supported-schema gap after installation,
+preparation and all static checks passed. Factory 0.0.2 will enforce the standard
+minLength and boolean additionalProperties assertions used by the valid public
+manifest. Update only the exact public install pin and bounded schema guidance,
+then release through the existing route. Preserve the connector's constraints;
+no weakening of verification or provider access is authorized.
+
+The existing npm credential rejected the @vana namespace. Public tarball
+installation works independently. Update the manual publisher's pinned artifact
+and hash for the new version, but do not repeat registry publication without a
+permission change. Active CLI and #106 remain outside both isolated trees.
+
+The exact public-pin regression failed before repair. All 45 focused CLI tests,
+full validation (952 tests, typecheck, ESLint and formatting), build and emitted
+instruction JSON now pass. The candidate package SHA256 is
+089a528f4a7a302d2dae9a0724e4b25f62ada14c61eb7728507c4139875a30d9.
+The manual publisher points at only that exact patch artifact; it will not be
+rerun while the npm namespace permission remains unchanged.

skills/create-connector/SKILL.md

@@ -21,7 +21,7 @@ another coding agent or service.
 
 1. Read the bundled instructions. They include the public data-connectors
    checkout, its locked dependency installation and the exact public
-   `@vana/factory-core@0.0.1` release artifact to install locally. No private
+   `@vana/factory-core@0.0.2` release artifact to install locally. No private
    Factory access or internal service is required. Use synthetic or explicitly
    reviewed evidence and a real Node 24 runtime on macOS or Linux; Node 24.22.1
    is recommended for both Factory and the checkout. The instructions set
@@ -42,6 +42,10 @@ another coding agent or service.
    accepted artifacts without network. Changed accepted inputs need a new job.
    Read safe `api.md`, research, profiles and fixtures, then implement in the
    named checkout. Raw captures are private and are not linked for the agent.
+   Factory validates stream schemas with `type`, `properties`, `required`,
+   `items`, `enum`, `format: date-time`, `minLength` and boolean
+   `additionalProperties`. Other assertions need explicit unsupported handling;
+   do not remove constraints to obtain a pass.
 4. Run the returned `actions.check.argv`. Repair failures and check the same
    job again. Use `actions.resume.argv` to refresh work or continue after
    export prerequisites. Resume and check never acquire API evidence. An API

src/cli/connector-build-instructions.ts

@@ -6,9 +6,9 @@ export const CONNECTOR_BUILD_INSTRUCTIONS = `Build a Collection Profile connecto
   cd /absolute/path/to/data-connectors
   PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 npm ci
 Read AUTHORING.md and docs/spec/collection-profile.md in that checkout before writing the connector. Factory needs the packages/polyfill-connectors layout, Git metadata and installed TypeScript, tsx and Biome inside the checkout. Do not link dependencies from another checkout. Factory supports synthetic or explicitly reviewed export evidence and declared API preparation. Browser preparation remains unsupported.
-2. Install the public @vana/factory-core@0.0.1 release artifact locally. This needs no private Factory repository access, internal services or Factory account. Put factory-build on PATH, or set VANA_FACTORY_BUILD to its absolute executable path. Vana never installs or downloads it. The external executable supplies its own Node host, including when Vana runs on Node 22 or as a standalone binary.
+2. Install the public @vana/factory-core@0.0.2 release artifact locally. This needs no private Factory repository access, internal services or Factory account. Put factory-build on PATH, or set VANA_FACTORY_BUILD to its absolute executable path. Vana never installs or downloads it. The external executable supplies its own Node host, including when Vana runs on Node 22 or as a standalone binary.
   export VANA_FACTORY_TOOLS="\${VANA_HOME:-$HOME/.vana}/factory-tools"
-  npm install --prefix "$VANA_FACTORY_TOOLS" --ignore-scripts --no-audit --no-fund https://github.com/vana-com/vana-cli/releases/download/v0.45.0/vana-factory-core-0.0.1.tgz
+  npm install --prefix "$VANA_FACTORY_TOOLS" --ignore-scripts --no-audit --no-fund https://github.com/vana-com/vana-cli/releases/download/v0.45.1/vana-factory-core-0.0.2.tgz
   export VANA_FACTORY_BUILD="$VANA_FACTORY_TOOLS/node_modules/.bin/factory-build"
   "$VANA_FACTORY_BUILD" capabilities --json
 Use the installed executable's absolute path for the capability command if it is not on PATH. The PATH must select the real Node 24+ executable used by its shebang. Require protocolVersion 1, contextVersion 2, apiPreparationVersion 1 and supportedRoutes ["export", "api"]. Older context versions are incompatible.
@@ -76,6 +76,8 @@ Declare only reviewed structural JSON field paths starting with $, and string or
 4. Run vana connectors build --request /absolute/path/to/request.json --json. Factory creates one explicit job and a private workFile before API preparation. Build does not acquire API evidence. For an API, read the workFile and run actions.prepare.argv for the same UUID and state directory. A declared fetch or GET input plus explicit prepare authorizes that bounded acquisition. No extra network flag or approval is needed. Missing files or auth references preserve the UUID. Supply them and run prepare again. A successful repeated prepare verifies accepted artifacts without network. Changed accepted inputs or artifacts require a new job.
 
 Read the prepared workFile and its safe api.md, research, profile and fixture pointers. Raw captures remain private and are not linked in the work package. Distinguish documentation claims, observed safe shapes and unresolved auth, pagination, termination, rate-limit and stream questions. Implement the connector in the named checkout. The current agent writes and repairs the code. No model, agent service, collection or registration is started.
+
+Factory validates manifest stream schemas with type, properties, required, items, enum, format: date-time, minLength and boolean additionalProperties. Other schema assertions need explicit unsupported handling; do not remove constraints to obtain a pass.
 5. Run the returned check argv after editing. Repair failures and repeat check for the same UUID and state directory. Use the returned resume argv to refresh instructions. Resume and check never acquire or re-sample API evidence. API check before successful preparation returns agent_work with reason prepare. Use prepare after supplying API prerequisites. Never substitute a latest-job lookup or change the job's immutable request. Create a new request/job when the source, access, goal or evidence declaration changes.
 6. A checks_passed result covers static_and_fixture checks only. Live verification is pending and ingestion is not_run. Only a passing result offers an explicit local vana connect command with the exact directory spelling, checkout, streams, --factory-job and --factory-state-dir. That opt-in action requires a compatible Factory before provider launch, verifies the actual Vana run before saving results or checkpoints, and admits only the accepted exact bytes to ingestion. Failed verification keeps previous data. Failed ingestion keeps verified local bytes for vana server sync without recollection or source rechecks. Ingestion and server readback remain separate facts; no body readback is performed. Supply the required environment names from collectionContext.access separately when using it. Export access names its input variable. API access names its auth variables. Continue the original authorized collection request using that command; ask only for missing account, scope, authentication or a blocked decision. It may require account, server and export access. Registration is also separate and trusts unsigned local code.
 

test/cli/connector-build.test.ts

@@ -223,7 +223,7 @@ describe("connector build subprocess policy", () => {
     expect(output.value.instructions).toContain("static_and_fixture");
     expect(output.value.instructions).toContain("VANA_FACTORY_BUILD");
     expect(output.value.instructions).toContain(
-      'npm install --prefix "$VANA_FACTORY_TOOLS" --ignore-scripts --no-audit --no-fund https://github.com/vana-com/vana-cli/releases/download/v0.45.0/vana-factory-core-0.0.1.tgz',
+      'npm install --prefix "$VANA_FACTORY_TOOLS" --ignore-scripts --no-audit --no-fund https://github.com/vana-com/vana-cli/releases/download/v0.45.1/vana-factory-core-0.0.2.tgz',
     );
     expect(output.value.instructions).toContain(
       'export VANA_FACTORY_TOOLS="${VANA_HOME:-$HOME/.vana}/factory-tools"',