agent-task-kit origin tarballs (0.1.0 live baseline, 0.1.2 continuation)

Distribution: versioned origin tarball (not an npm registry package).
License: MIT (see LICENSE in this directory and inside each archive).
execute: false
posted: false
wakeSource: false
npmPublished: false

Live baseline 0.1.0
- Archive: agent-task-kit-0.1.0.tgz
- SHA-256: 86cea321569ad5375a4ebd9865c2b084af694f207f80056afe9531ae94f438e8
- Bytes: 57958
- SOURCE_DATE_EPOCH: 1788912000 (2026-09-09T00:00:00Z)
- Allowlist members: 87 (see PUBLICATION-ALLOWLIST.json paths)
- publicationStatus: served
- hostedAcquisitionVerified: true

Continuation 0.1.2 (this origin tree)
- Archive: agent-task-kit-0.1.2.tgz
- SHA-256: f58d6adde1584b364e4772d5bfa1691ea9c2b6ea52deffe7da13183e6d78948b
- Bytes: 67584
- Allowlist members: 89 (see PUBLICATION-ALLOWLIST.json continuationRelease.paths)
- publicationStatus: in-origin-tree
- hostedAcquisitionVerified: false
- liveDns: false until Root deploys this cohort
- Recapture pre-seal samples into fresh directories. executionAuthorized=false. latestRevisionVerified=false.

Source closures (git object names, not local paths)
- S34 tested kit source: 2d896a605ef114b747d3e781ef8962bfd2199ba8
- S36 package commit: e9415e569496432ef42989eb996d31f07daa18f0
- S36 pack receipt: a0d894e4872e556a468a6efdb1081a5fda1487ba
- S63 continue: bc2112b98e775a7c9f7c7d29c2abc6f574b640b4
- S70 package: b9fdd575a18b6a1382a48c4fb4b582b68f235f92

Not claimed
- Not published to npm. The package prepublishOnly script exits 1.
- Not a Hermes Skills Hub slug and not a Goose recipe YAML.
- Direct curl, Node, and Git remain first-class. These archives do not claim a speed or cost advantage over those paths.
- Hosted acquisition of 0.1.2 is not independently verified on live DNS before Root deploy.

First use (Node 22+, POSIX shell, curl and tar; no npm install)

(
  set -eu
  mkdir agent-task-kit-0.1.0
  cd agent-task-kit-0.1.0
  response=$(curl -fsS --max-time 30 -o agent-task-kit-0.1.0.tgz \
    --write-out '%{http_code} %{content_type}' \
    https://neomorphic.io/downloads/agent-task-kit/agent-task-kit-0.1.0.tgz)
  case "$response" in
    "200 application/gzip"*|"200 application/x-gzip"*|"200 application/octet-stream"*) ;;
    *) echo "Unexpected archive HTTP status or MIME: $response" >&2; exit 1 ;;
  esac
  node --input-type=module -e 'import {readFileSync} from "node:fs"; import {createHash} from "node:crypto"; const b=readFileSync("agent-task-kit-0.1.0.tgz"); if(b.length!==57958 || createHash("sha256").update(b).digest("hex")!=="86cea321569ad5375a4ebd9865c2b084af694f207f80056afe9531ae94f438e8") throw Error("Untrusted or incomplete archive; extraction stopped");'
  tar -xzf agent-task-kit-0.1.0.tgz
  node package/bin/agent-task-kit.mjs --help
)

Continue with: cd agent-task-kit-0.1.0/package
See /labs/task-kit/ for compose/job/correct/export and for 0.1.2 continue capture/validate/compare/prepare/consume.

Release status is separate: release-status.json. package.json private is an npm
publish guard, not static HTTP access control; do not flip it on deployment.
The immutable S36 archive already has private:false and prepublishOnly exits 1.
Accepted S34 review: 2382081bd1eb71806cbe694766f6de136fedae5c.
Reproduction note: SOURCE_DATE_EPOCH is the pack input; npm uses tar member
mtime 499162500 and gzip mtime 0. Preserve the pinned archive bytes.