[scrimshawlife-ctrl]

Slice "Clients from GitHub" (Danny, 2026-10-24): agents can install the clients from GitHub release files until npm and PyPI publishing (#80) is unblocked. The repository is public, so release assets are publicly downloadable.

Gaps fixed

• Clients installable without npm or PyPI. release-clients.yml on a clients-v<version> tag now runs the client tests, packs @zero-state/jchain and @zero-state/jchain-mcp (npm pack) and builds the Python wheel and sdist, and attaches them with a SHA256SUMS file to a GitHub release. The release notes repeat the checksums and the check-then-install commands. workflow_dispatch packs only and keeps the files as a workflow artifact.
• No registry publishing. The npm and PyPI publish steps are removed; that stays Clients: publish @zero-state/jchain, jchain-mcp, and zero-state-jchain #80. No secret is read.
• MCP tarball resolves without npm. In the release job only, the MCP package's @zero-state/jchain dependency is pointed at the client tarball on the same release before npm pack. The repository's package.json is unchanged.
• Version drift. A first job refuses the run unless the TypeScript, MCP, and Python versions, the pages' CLIENTS_VERSION, and the tag all agree.
• Docs. Each client README shows a pinned version, the release download, sha256sum --check --ignore-missing SHA256SUMS, and the install command (pip also gets the #sha256= URL form). The quickstart and the root README point at the release.
• Pages. /join (under More, after every step), /llms.txt (a Clients key link), Get started, and the setup prompts name the release only as advanced and optional. The plain-HTTP /join flow is unchanged and still says "No package, no script, no form."
• Spec. The Run an agent line, the connect helper line (issue Clients: publish @zero-state/jchain, jchain-mcp, and zero-state-jchain #80), CT-33, and AT-77 now say pages name the GitHub release only as advanced and optional, and never npm, PyPI, or npx jchain-connect. No version bump.
• Tests. The AT-77 onboarding test checks the release link on each page, that /join names it only after its steps, and that no page says npm install @zero-state, pip install zero-state-jchain, or npx jchain-connect. No test uses the network.

After merge (coordinator)

Push tag clients-v0.1.0 on the merge commit. Expected assets:

• zero-state-jchain-0.1.0.tgz
• zero-state-jchain-mcp-0.1.0.tgz
• zero_state_jchain-0.1.0-py3-none-any.whl
• zero_state_jchain-0.1.0.tar.gz
• SHA256SUMS

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-25T03:09:05.770598Z We couldn’t complete this review. Comment @codex review to try again.	999c03c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.