upstream-version-tested actually promisesIt is a provenance claim, not a version number: it says this is the release we read and verified the body against. That makes a pin-only bump a way of asserting something nobody checked. Switch modes to see what each strategy does to the drift linter, and what it misses even when green.
| skill | package | pin | body says | linter |
|---|
Neither of these is a version-string problem. Both would have survived any number of pin-only bumps.
Stripe-Signature: t=<ts>,v1=<hmac> signed over <ts>.<raw body>. The skill showed one generic helper:
'sha256=' + hmac(body) // correct for GitHub, wrong for Stripe
Anyone following it for Stripe writes a verifier that fails on both the header shape and the signed payload.
pushstate landed in 0.27.0, the plugin system and --tools in 0.28.0, --webgpu in 0.31.2, and removeinitscript and confirm/deny appear nowhere in it. Only --pin-tab was 0.34.0. The file already dated pushstate to v0.27 in two other places, so it contradicted itself.