v0.24.2 — published by the pipeline, verifiably

Nothing new to install

Nothing that ships changed since v0.24.0. This closes out the release plumbing.

What was wrong

package.json carried no repository field. npm checks a provenance attestation's source repository against that field and refuses the tarball when they disagree — and an empty value disagrees with everything, so the v0.24.1 publish was rejected with E422 after signing successfully. It had never surfaced, because v0.24.0 was published by hand without provenance to verify.

• repository, homepage and bugs are now set.
• v0.24.1 is deliberately absent from npm: provenance ties a tarball to the commit it was built from, and publishing it from the fix commit would have left an attestation pointing at a commit that is not its tag.

What this release proves

The path now runs end to end without a person in it: publishing a release triggers a workflow that runs the tests, checks the tag against package.json, skips anything already on the registry, publishes, and confirms the registry has it — with a provenance attestation tying the tarball to this repository and this build.

Install is unchanged: curl -fsSL https://moshcoding.com/install.sh | sh, or npm i -g moshcode.