Pin envelope reportlab dependency

Author: romgenie

.clawhubignore

@@ -29,11 +29,11 @@ ENV/
 
 .env
 .env.*
-!.env.example
 secrets.json
 *_secret.ini
 *_local.ini
 *.tmp
+scripts/validate_quality.py
 .DS_Store
 Thumbs.db
 desktop.ini

README.md

@@ -24,13 +24,13 @@ Part of the CompleteTech LLC agentic services skill library. This skill owns del
 ## OpenClaw / ClawHub Metadata
 
 - Skill key: `agentic-envelope-skill`
-- Version-ready metadata: `1.0.0`
+- Version-ready metadata: `1.0.3`
 - Homepage: https://github.com/CompleteTech-LLC/agentic-envelope-skill
 - README: https://github.com/CompleteTech-LLC/agentic-envelope-skill#readme
 - Runtime binaries: `python3`
-- Python packages: `reportlab>=4.0`
+- Python packages: `reportlab==4.5.1`
 - Intended registry/discovery tags: `latest`, `complete-tech`, `codex-skill`, `agentic-development`, `agentic-workflows`, `envelope`, `delivery-packaging`, `pdf-generator`
-- License: repository code, templates, and documentation use MIT; ClawHub publishing is intentionally skipped for now.
+- License: repository code, templates, and documentation use MIT; published by CompleteTech on ClawHub.
 - Brand assets: CompleteTech LLC names, logos, seals, and brand assets are reserved; see `BRAND_ASSETS.md`.
 
 ## Workflow Diagram
@@ -137,6 +137,10 @@ Pass multiple config files with `--config`; later files override earlier files.
 
 Use envelope packaging only after the source artifact exists. Do not invent recipient names, mailing addresses, email addresses, attachment lists, billing approval, signature authority, or send approval. Keep the contract, invoice, certificate, proposal, proof asset, and email body owned by their specialist skills; this skill packages and labels the delivery.
 
+## Runtime Permissions
+
+This skill needs local filesystem access only for the documented envelope workflow. It reads bundled config files, recipient override INI files, and the configured local logo path, then writes only to the selected `--out` path or default `output/addressed_envelope.pdf`. It runs `generate_envelope.py` and does not require network access, credential access, persistence, privilege escalation, or destructive file operations.
+
 ## Source
 
 This standalone skill was extracted from the envelope generator originally bundled in `CompleteTech-LLC/agentic-contract-skill`.

SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agentic-envelope-skill
 description: Generate branded CompleteTech LLC printable #10 addressed envelope PDFs and delivery packages with sender, recipient, optional attention line, postage box text, return-address toggle, logo, brand palette, attachment manifests, filenames, recipient metadata, and delivery-readiness checks. Use when Codex needs to package contracts, certificates, invoices, proposals, notices, or other CompleteTech artifacts for mailing or external delivery.
-version: 1.0.2
+version: 1.0.3
 metadata:
   openclaw:
     skillKey: agentic-envelope-skill
@@ -11,9 +11,9 @@ metadata:
         - python3
     install:
       - kind: uv
-        package: pyyaml>=6.0
+        package: pyyaml==6.0.3
       - kind: uv
-        package: reportlab>=4.0
+        package: reportlab==4.5.1
 ---
 
 # Agentic Envelope Skill
@@ -33,6 +33,15 @@ This skill owns packaging, addressed envelopes, recipient metadata, attachment l
 - `examples/client_address_override.ini` - recipient address override example.
 - `assets/logo.png` - envelope header logo.
 
+## Runtime Permissions
+
+This skill needs local filesystem access only for its documented envelope workflow:
+
+- Reads bundled config files, recipient override INI files, and the configured local logo path.
+- Writes only to the user-selected `--out` path or default `output/addressed_envelope.pdf`.
+- Runs the local Python entry point `generate_envelope.py`.
+- Does not require network access, credential access, persistence, privilege escalation, or destructive file operations.
+
 ## Required Inputs
 
 For a normal envelope run, collect:

requirements.txt

@@ -1 +1 @@
-reportlab>=4.0
+reportlab==4.5.1

scripts/validate_quality.py

@@ -60,10 +60,7 @@ def run_ruff() -> None:
     if shutil.which("ruff"):
         run(["ruff", "check", "."])
         return
-    if shutil.which("uvx"):
-        run(["uvx", "ruff", "check", "."])
-        return
-    run([sys.executable, "-m", "ruff", "check", "."])
+    raise RuntimeError("ruff is required for quality validation")
 
 
 def compile_python() -> None:
@@ -218,11 +215,15 @@ def publish_candidate_files(patterns: list[str]) -> list[Path]:
 
 def assert_dependency(openclaw: dict[str, Any], package: str) -> None:
     installs = openclaw.get("install") or []
-    packages = {str(item.get("package", "")).split(">=", 1)[0].lower() for item in installs if isinstance(item, dict)}
+    packages = {package_name(str(item.get("package", ""))) for item in installs if isinstance(item, dict)}
     if package.lower() not in packages:
         raise RuntimeError(f"metadata.openclaw.install must declare {package}")
 
 
+def package_name(spec: str) -> str:
+    return re.split(r"[<>=!~]", spec, 1)[0].strip().lower()
+
+
 def validate_clawhub_bundle() -> None:
     data = frontmatter()
     name = data.get("name")