Prepare services orchestrator for ClawHub publishing

Author: romgenie

.clawhubignore

@@ -29,11 +29,13 @@ ENV/
 
 .env
 .env.*
-!.env.example
 secrets.json
 *_secret.ini
 *_local.ini
 *.tmp
 .DS_Store
 Thumbs.db
 desktop.ini
+
+# Development-only QA entry point; public package keeps runtime renderers only.
+scripts/validate_quality.py

.env.example

@@ -13,13 +13,13 @@ Part of the CompleteTech LLC agentic services skill library. This skill coordina
 ## OpenClaw / ClawHub Metadata
 
 - Skill key: `agentic-services-orchestrator-skill`
-- Version-ready metadata: `1.0.0`
+- Version-ready metadata: `1.0.2`
 - Homepage: https://github.com/CompleteTech-LLC/agentic-services-orchestrator-skill
 - README: https://github.com/CompleteTech-LLC/agentic-services-orchestrator-skill#readme
-- Runtime binaries: none
-- Python packages: `reportlab>=4.0` (optional PNG preview: `pypdfium2`, `pillow`)
+- Runtime binaries: `python3`
+- Python packages: `reportlab==4.5.1`, `pyyaml==6.0.3` (optional PNG preview: `pypdfium2==5.8.0`, `pillow==12.2.0`)
 - Intended registry/discovery tags: `latest`, `complete-tech`, `codex-skill`, `agentic-development`, `agentic-workflows`, `orchestration`, `skill-routing`, `lifecycle`, `pdf`, `pdf-generator`
-- License: repository code, templates, and documentation use MIT; ClawHub publishing is intentionally skipped for now.
+- License: repository code, templates, and documentation use MIT; published by CompleteTech on ClawHub.
 - Brand assets: CompleteTech LLC names, logos, seals, and brand assets are reserved; see `BRAND_ASSETS.md`.
 
 ## Workflow Diagram
@@ -108,53 +108,16 @@ python3 scripts/render_pdf.py --markdown assets/examples/example.md \
 
 Use a direct, practical, low-hype tone. The orchestrator coordinates the lifecycle; it does not replace specialist templates or invent missing facts.
 
-## License
-
-Code, templates, and documentation are licensed under the MIT License. CompleteTech LLC names, logos, seals, and brand assets are reserved and are not licensed for reuse except to identify this project. See `LICENSE` and `BRAND_ASSETS.md`.
-
-## Certificate Receipts
-
-This skill can run normally without a classroom key. For certificate credit, run the skill workflow first, then request a one-time receipt from `cert.complete.tech`:
-
-```bash
-python scripts/request_receipt.py \
-  --class-id "cls_agentic_services_orchestrator_skill" \
-  --session-id "ses_YYYYMMDD_agentic_services_orchestrator_skill" \
-  --completion-key "$CT_CERT_COMPLETION_KEY"
-```
-
-The helper sends `class_id`, `session_id`, `completion_key`, `skill_id`, `skill_version`, a generated `run_id`, optional artifact hash, and metadata to `https://cert.complete.tech/api/skill-runs`. It prints the receipt code and writes a receipt JSON file. Students use the receipt code at `https://cert.complete.tech/claim`. Do not commit real completion keys.
-
-If the skill produced a file, include it so the receipt records an artifact hash:
-
-```bash
-python scripts/request_receipt.py --artifact output/example.pdf
-```
-
-### Orchestration Receipt Prerequisites
+## Runtime Permissions
 
-The orchestrator certificate requires at least three prerequisite skill receipts. Pass them with repeated flags or a JSON file:
+This skill is a local workflow-orchestration and document-rendering workflow. It reads bundled workflow definitions, schemas, references, examples, Mermaid sources, `assets/logo.png`, and user-provided project-state/workflow facts. It writes only user-selected PDF/PNG/Markdown artifact paths when `scripts/render_pdf.py` is explicitly run.
 
-```bash
-python scripts/request_receipt.py \
-  --registry-profile agentic_services_orchestrator_skill \
-  --prerequisite-receipt "CTREC-..." \
-  --prerequisite-receipt "CTREC-..." \
-  --prerequisite-receipt "CTREC-..."
-```
+It does not send emails, call external workflow systems, call Mautic or other CRMs, contact certificate services, require credential access, create persistence, escalate privileges, perform destructive file operations, or run background services.
 
-```json
-{
-  "prerequisite_receipts": ["CTREC-...", "CTREC-...", "CTREC-..."]
-}
-```
+## Network Boundary
 
-Then pass `--prerequisite-receipts-file receipts.json`. The server enforces the three-distinct-skills rule before it returns the orchestration receipt.
+This skill is local-only. It does not include outbound network helpers, callbacks, receipt helpers, telemetry submission, CRM integrations, or any helper that posts orchestration run metadata to an external service.
 
-### Receipt Tests
-
-```bash
-python tests/test_receipt_cli.py
-```
+## License
 
-The test uses a local fake receipt API and does not require live keys or the live `cert.complete.tech` endpoint.
+Code, templates, and documentation are licensed under the MIT License. CompleteTech LLC names, logos, seals, and brand assets are reserved and are not licensed for reuse except to identify this project. See `LICENSE` and `BRAND_ASSETS.md`.

README.md

@@ -2,7 +2,7 @@
 name: agentic-services-orchestrator-skill
 description: >-
   Coordinate schema-driven workflows across configurable domains using workflow definitions, adapters, active tracks, artifact versions, approval/risk triage, event logs, validation, and recovery actions. Use the CompleteTech LLC agentic services workflow as the default adapter for discovery, proposal, contract, delivery, customer success, invoice, certificate, case study, email, envelope, and security-review work.
-version: 1.0.1
+version: 1.0.2
 metadata:
   openclaw:
     skillKey: agentic-services-orchestrator-skill
@@ -12,9 +12,13 @@ metadata:
         - python3
     install:
       - kind: uv
-        package: reportlab>=4.0
+        package: reportlab==4.5.1
       - kind: uv
-        package: pyyaml>=6.0
+        package: pyyaml==6.0.3
+      - kind: uv
+        package: pypdfium2==5.8.0
+      - kind: uv
+        package: pillow==12.2.0
 ---
 
 # Agentic Services Orchestrator Skill
@@ -29,6 +33,16 @@ For the complete architecture, per-skill responsibility matrix, handoff schema,
 
 This skill owns workflow definition loading, routing policy, project state, event logging, validation, recovery selection, and specialist handoff coordination. It does not author specialist artifacts directly, replace generator scripts, approve commercial/legal/billing/security decisions, or change another skill's business logic. Use adapter definitions to add new workflow domains without rewriting this file.
 
+## Runtime Permissions
+
+This skill is a local workflow-orchestration and document-rendering workflow. It reads bundled workflow definitions, schemas, references, examples, Mermaid sources, `assets/logo.png`, and user-provided project-state/workflow facts. It writes only user-selected PDF/PNG/Markdown artifact paths when `scripts/render_pdf.py` is explicitly run.
+
+It does not send emails, call external workflow systems, call Mautic or other CRMs, contact certificate services, require credential access, create persistence, escalate privileges, perform destructive file operations, or run background services.
+
+## Network Boundary
+
+This skill is local-only. It does not include outbound network helpers, callbacks, receipt helpers, telemetry submission, CRM integrations, or any helper that posts orchestration run metadata to an external service.
+
 ## Universal Workflow Model
 
 The orchestrator is based on generic workflow primitives:
@@ -279,14 +293,4 @@ python3 scripts/render_pdf.py \
   --meta "DOCUMENT NO.=ORCH-2026-001" --meta "DATE=2026-05-24"
 ```
 
-`scripts/render_pdf.py` applies the shared CompleteTech branding (logo, cover page, letterhead band, watermark, footer) and supports a Markdown subset: `#`/`##`/`###` headings, paragraphs, `-` bullet lists, tables, `>` callouts, `**bold**`, and `[PAGE_BREAK]`. It requires `reportlab`; the optional `--png` preview montage requires `pypdfium2` and `pillow`. See `assets/examples/` for a rendered example.
-
-## Certificate Receipt Guidance
-
-The skill remains usable without a classroom key. When certificate credit is needed, use `scripts/request_receipt.py` after the skill run. The shared class key is provided through `CT_CERT_COMPLETION_KEY`, `--completion-key`, or a registry profile; the website claim form receives only the generated receipt code.
-
-Receipt requests include this skill ID: `agentic-services-orchestrator-skill`. The helper sends class/session IDs, the shared key, skill version, generated run ID, optional artifact hash, and metadata to `https://cert.complete.tech/api/skill-runs`. The student claims the certificate at `https://cert.complete.tech/claim` with the returned receipt.
-
-For `agentic-services-orchestrator-skill`, collect at least three prerequisite receipt codes and pass `--prerequisite-receipt` once per code, or use `--prerequisite-receipts-file`. The backend rejects orchestration receipts without three distinct valid prerequisite skill receipts.
-
-Do not print, store, or commit real classroom completion keys.
+`scripts/render_pdf.py` applies the shared CompleteTech branding (logo, cover page, letterhead band, watermark, footer) and supports a Markdown subset: `#`/`##`/`###` headings, paragraphs, `-` bullet lists, tables, `>` callouts, `**bold**`, and `[PAGE_BREAK]`. It requires `reportlab==4.5.1`; the optional `--png` preview montage requires `pypdfium2==5.8.0` and `pillow==12.2.0`. See `assets/examples/` for a rendered example.

SKILL.md

@@ -4,4 +4,4 @@ interface:
   default_prompt: "Use $agentic-services-orchestrator-skill to choose and sequence the right CompleteTech agentic specialist skills for a multi-stage services workflow."
 
 policy:
-  allow_implicit_invocation: true
+  allow_implicit_invocation: false

agents/openai.yaml

@@ -1,5 +1,6 @@
 # Branded PDF artifact rendering (scripts/render_pdf.py)
-reportlab>=4.0
+reportlab==4.5.1
+pyyaml==6.0.3
 # Optional: only needed to also emit a PNG preview montage (scripts/render_pdf.py --png)
-pypdfium2>=4.30
-pillow>=10.0
+pypdfium2==5.8.0
+pillow==12.2.0