[hkwuks]

Summary

hooks/release-check now reads the $schema a manifest declares. Nothing had ever inspected those pointers, and measured 2026-10-29 both of this repository's resolve to 404 — each 301s to www.anthropic.com/... and stops there.

The assertion judges only what the repository can decide by itself:

• the value is non-empty ("" and a non-string are reported separately — they are different mistakes)
• it is an absolute https URL
• the key appears once per file (a duplicate key's winner is parser-dependent, so the count is the finding)
• the set of files declaring one is pinned, so adding or removing a declaration is a visible event

Reachability is deliberately not checked. Every other check in this file is offline; a curl here would redden on a DNS blip and would still be wrong the moment the remote moved — which is how these two went unnoticed. The pin is enforced only once something declares, so a repository that has not adopted $schema is not told it dropped one it never had.

TaskFlow traceability

• Task: TaskFlowDocs/2026-10-29-schema-check/ (v2)
• Scope: hooks/release-check (the new section), hooks/smoke-test (six fixture cases appended to the section that already drives release-check), CHANGELOG.md
• Base branch: main
• Target repository: https://github.com/hkwuks/TaskFlow (origin; no fork remotes configured)

Verification

• The Hooks workflow reports pass for this branch — run to be linked once CI reports
• git diff --check
• bash hooks/release-check . → STATUS: pass, exit 0
• bash hooks/smoke-test → ALL SMOKE PASSED
• Results recorded in the TaskFlow Plan — the CI run is recorded after it reports

Mutation results

Each mutation breaks one condition; the case that names it goes red, and no other does.

Mutation	Smoke output
drop the empty-value branch	FAIL empty $schema accepted
remove the https test	FAIL non-https $schema accepted: http://example.invalid/x.schema.json
stop counting duplicates	FAIL duplicate $schema accepted
never enforce the pin	FAIL a pinned declaration was dropped silently
restore byte-identically	ALL SMOKE PASSED, diff -q clean

Review boundaries

• No secrets or opaque remote payloads included
• No unrelated task or user files changed — the TaskFlowDocs/todo.md diff is this task's own intake and promote
• Remote/base assumptions are stated above
• Known limitations and follow-ups are documented — see below

Why the check also lives in smoke-test

hooks/* is in the smoke path set, while the release job runs only when a manifest, CHANGELOG.md or a README changes. A change to release-check alone would therefore never execute the new check in CI. hooks/smoke-test already drives release-check from a fixture (== release-check catches version drift and a bad marketplace pin ==), so the new cases are appended there rather than introducing a second mechanism.

Known limitations

• The two 404 URLs are not fixed, and no automated check will find them. The v1 PRD asked the assertion to name them, which contradicts its own "no network" requirement — an offline assertion cannot know what a remote returns. v2 dropped that criterion and moved the 404s to follow-ups. This is a deliberate, recorded trade: the check guarantees the declaration is well-formed and its set is stable, not that the target exists. Fixing the URLs needs a verifiable replacement address; six candidates were probed on 2026-10-29 and none returned a real schema.
• Three of the five manifests declare no $schema (.codebuddy-plugin/*, .codex-plugin/plugin.json, package.json). Whether that is intentional is not decided here; the pin records the current set so a change either way is visible.
• release-check still runs in CI only when a manifest, CHANGELOG.md or a README changes. The smoke wiring makes the check exercised on every hook change, but the real repository's own manifests are only read by the release job.