feat(vale): add the six Vale platform packages and pinned manifest

.changeset/config.json

@@ -7,5 +7,12 @@
   "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
-  "ignore": []
+  "ignore": [
+    "@taskless/vale-darwin-arm64",
+    "@taskless/vale-darwin-x64",
+    "@taskless/vale-linux-arm64",
+    "@taskless/vale-linux-x64",
+    "@taskless/vale-win32-arm64",
+    "@taskless/vale-win32-x64"
+  ]
 }

.github/scripts/vale-manifest.json

@@ -0,0 +1,81 @@
+{
+  "comment": [
+    "The pinned upstream Vale release and the digests that gate packaging it.",
+    "This file is the trust boundary for @taskless/vale-* : the publish pipeline",
+    "verifies every downloaded archive against the sha256 recorded here and",
+    "refuses to continue on a mismatch, so changing which bytes can be published",
+    "means changing this file, which means passing code review.",
+    "",
+    "Each sha256 is the digest of the RELEASE ARCHIVE, not of the executable",
+    "inside it. Upstream publishes vale_<valeVersion>_checksums.txt covering the",
+    "archives, so these values are independently checkable against upstream, and",
+    "the archive is verified before anything is unpacked from it.",
+    "",
+    "`asset` is a template; {version} is replaced with valeVersion. The detect",
+    "phase of .github/workflows/vale-binaries.yml rewrites valeVersion and every",
+    "sha256 from upstream's checksums file, and leaves the templates alone."
+  ],
+  "valeVersion": "3.17.1",
+  "upstream": {
+    "repository": "errata-ai/vale",
+    "tag": "v{version}",
+    "downloadUrl": "https://github.com/errata-ai/vale/releases/download/v{version}/{asset}",
+    "checksumsAsset": "vale_{version}_checksums.txt"
+  },
+  "platforms": [
+    {
+      "package": "@taskless/vale-darwin-arm64",
+      "directory": "packages/vale-darwin-arm64",
+      "os": "darwin",
+      "cpu": "arm64",
+      "asset": "vale_{version}_macOS_arm64.tar.gz",
+      "archiveMember": "vale",
+      "sha256": "80cacf85ef23f53cfdd77355ec41a6ef99aec136f15dfb3517723482f35593f9"
+    },
+    {
+      "package": "@taskless/vale-darwin-x64",
+      "directory": "packages/vale-darwin-x64",
+      "os": "darwin",
+      "cpu": "x64",
+      "asset": "vale_{version}_macOS_64-bit.tar.gz",
+      "archiveMember": "vale",
+      "sha256": "b37ab999dfd1414d041bd2e94ced103292d634da76f954c385bf789dc7f5f939"
+    },
+    {
+      "package": "@taskless/vale-linux-arm64",
+      "directory": "packages/vale-linux-arm64",
+      "os": "linux",
+      "cpu": "arm64",
+      "asset": "vale_{version}_Linux_arm64.tar.gz",
+      "archiveMember": "vale",
+      "sha256": "92d91ebf9ee69ec077379be95cd09e6710ab33d3d5bab66bb482e66ebc80dc23"
+    },
+    {
+      "package": "@taskless/vale-linux-x64",
+      "directory": "packages/vale-linux-x64",
+      "os": "linux",
+      "cpu": "x64",
+      "asset": "vale_{version}_Linux_64-bit.tar.gz",
+      "archiveMember": "vale",
+      "sha256": "db947f89f2292e6a0381a61de155f6a5f5cb4cb460ca178ea412ef605559cefd"
+    },
+    {
+      "package": "@taskless/vale-win32-arm64",
+      "directory": "packages/vale-win32-arm64",
+      "os": "win32",
+      "cpu": "arm64",
+      "asset": "vale_{version}_Windows_arm64.zip",
+      "archiveMember": "vale.exe",
+      "sha256": "6fe10e873b09cf31feab2780ac9738ba42d69fb00fac491faadd3cb97c040587"
+    },
+    {
+      "package": "@taskless/vale-win32-x64",
+      "directory": "packages/vale-win32-x64",
+      "os": "win32",
+      "cpu": "x64",
+      "asset": "vale_{version}_Windows_64-bit.zip",
+      "archiveMember": "vale.exe",
+      "sha256": "0be3fead4e845fc7e740ad8a7e744eee3041ef8c874748a947b7adb63250a642"
+    }
+  ]
+}

CLAUDE.md

@@ -26,18 +26,36 @@ When running OpenSpec commands in this repo, use `pnpm openspec` instead of a ba
 
 - **ALWAYS** wait for confirmation before committing. After staging changes with `git add`, present a summary and pause for user approval before running the commit. This allows the user to review diffs and catch issues early.
 
+- **CHECK the clone is not shallow before rebasing or force-pushing.** A `git clone --depth=N` also implies `--single-branch`, which leaves the clone unable to do ordinary branch work:
+
+  ```bash
+  git rev-parse --is-shallow-repository   # must be false
+  git config --get-all remote.origin.fetch # must be +refs/heads/*:refs/remotes/origin/*
+  ```
+
+  If either is wrong, repair it once — both are local settings, nothing is committed:
+
+  ```bash
+  git fetch --unshallow
+  git config remote.origin.fetch '+refs/heads/*:refs/remotes/origin/*'
+  git fetch origin
+  ```
+
+  Until then: `--force-with-lease` fails with `stale info` on every branch (there is no remote-tracking ref to lease against, so people fall back to a bare `--force`), `git push -u` cannot store an upstream, `gh pr create` needs an explicit `--head <branch>`, and `git branch -r` shows only `main`. The dangerous one is quieter — `git rebase main` is only correct while the merge base sits inside the shallow window, so as `main` advances a rebase can reconstruct the wrong base without saying so.
+
 ## PR Issue References
 
 Reference issues as a **trailing line at the bottom of the PR body**, not inline in the opening paragraph:
 
-| Syntax                | Effect                       |
-| --------------------- | ---------------------------- |
-| `Fixes #1234`         | Closes GitHub issue on merge |
-| `Fixes TSKL-1234`     | Closes Taskless Linear issue |
-| `Refs GH-1234`        | Links without closing        |
-| `Refs LINEAR-ABC-123` | Links Linear issue           |
+| Syntax                | Effect                          |
+| --------------------- | ------------------------------- |
+| `Fixes #1234`         | Closes GitHub issue on merge    |
+| `Fixes TSKL-1234`     | Closes Taskless Linear issue    |
+| `Fixes OSS-123`       | Closes an OSS-team Linear issue |
+| `Refs GH-1234`        | Links without closing           |
+| `Refs LINEAR-ABC-123` | Links Linear issue              |
 
-- `TSKL-` is the Taskless Linear team prefix; a bare `TSKL-NNNN` resolves without a URL.
+- A bare `<TEAM>-NNN` resolves without a URL for **any** Linear team, not just `TSKL-`. `TSKL-` is Product and `OSS-` is the open-source team; verified with `OSS-23`, which the integration linked and moved to In Review on PR creation.
 - `Fixes` for the issue this PR resolves; `Refs` for a parent or related issue that stays open.
 - Mentioning an issue in prose (`Found while investigating TSKL-5678.`) is **not** a reference — a PR can cite an issue mid-body with no trailing directive at all.
 - Only use a reference you can verify from user input, the branch name, commits, PR discussion, or tracker output. Never invent an issue number.

openspec/changes/add-vale-binary-packages/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-07-27