chore: stamp workspace 0.19.1-sudo.15

Also brings the bundled agent skill to 0.6.0. The skill and AI-GUIDANCE ship
inside the release, so they are updated before the tag rather than after --
a post-tag doc fix never reaches the installed copy, which is the trap the .12
release hit.

SKILL.md already carried the corrected `check` stream pitfall from be901ba;
this adds the consequence that only appears once the report is on a stream the
reader can close: `check | head` now ends with a broken-pipe error and a
non-zero exit, which means the reader closed the pipe, not that a secret is
missing. AI-GUIDANCE.md was re-checked and genuinely has no stream discussion
anywhere -- SKILL.md owns pitfalls -- so it needed no edit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: djbclark

Cargo.lock

@@ -11,7 +11,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.19.1-sudo.14"
+version = "0.19.1-sudo.15"
 edition = "2024"
 
 [workspace.dependencies]
@@ -60,8 +60,8 @@ azure_identity = "1.0.0"
 azure_security_keyvault_secrets = "1.0.0"
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots"] }
 tokio = { version = "1", features = ["rt", "rt-multi-thread"] }
-secretspec-derive = { version = "0.19.1-sudo.14", path = "./secretspec-derive" }
-secretspec = { version = "0.19.1-sudo.14", path = "./secretspec" }
+secretspec-derive = { version = "0.19.1-sudo.15", path = "./secretspec-derive" }
+secretspec = { version = "0.19.1-sudo.15", path = "./secretspec" }
 rand = "0.9"
 rsa = { version = "0.9", features = ["pem"] }
 uuid = { version = "1", features = ["serde", "v4"] }

Cargo.toml

@@ -15,7 +15,7 @@ quote.workspace = true
 proc-macro2.workspace = true
 toml.workspace = true
 serde.workspace = true
-secretspec = { version = "0.19.1-sudo.14", path = "../secretspec", default-features = false }
+secretspec = { version = "0.19.1-sudo.15", path = "../secretspec", default-features = false }
 
 [dev-dependencies]
 trybuild.workspace = true

secretspec-derive/Cargo.toml

@@ -1,7 +1,7 @@
 ---
 name: sudo-secretspec
 description: Use managed credentials through the privilege-separated sudo-secretspec client instead of touching a secret store directly. Use when a task needs an API key, token, or password; when a credential must be declared, set, rotated, read, deleted, or injected into a child process; or when the boundary, drift checker, or audit ledger reports an error. Also covers what is deliberately NOT exposed and must be asked of the operator.
-version: 0.5.0
+version: 0.6.0
 author: Dan Clark (djbclark), Hermes Agent
 license: Apache-2.0
 platforms: [macos]
@@ -18,7 +18,7 @@ consumer execution. Do not access SecretSpec's provider, manifest, or protected
 backing files directly, and never invoke `secretspec` itself for a managed
 deployment.
 
-Verified against client **0.19.1-sudo.14**. `sudo-secretspec --version` is the
+Verified against client **0.19.1-sudo.15**. `sudo-secretspec --version` is the
 authority; if it reports something newer, re-read
 `sudo-secretspec/AI-GUIDANCE.md` rather than trusting this file's specifics.
 If it reports something *older*, the flags marked with a minimum version below
@@ -169,7 +169,10 @@ explicit `unknown` terminal state if restoration cannot be proven.
   present, `1` at least one missing. Against an older boundary the report is on
   stderr instead, so read *both* streams if you must support both, and never
   treat an empty stdout as a pass on its own. The report names secrets but
-  never prints values, so it is safe to log.
+  never prints values, so it is safe to log. Because it is now on a stream you
+  can close early, `check | head` ends with `IO error: Broken pipe` and a
+  non-zero exit rather than a panic — that exit status means your reader closed
+  the pipe, not that a secret is missing, so do not read it as a check failure.
 - **Lifecycle commands authenticate even under `--dry-run`.** `install`,
   `uninstall`, and `rollback` re-exec through interactive `sudo` before the
   dry-run flag is ever considered, under `timestamp_timeout=0`. Every

skills/sudo-secretspec/SKILL.md

@@ -17,7 +17,7 @@ clap.workspace = true
 rusqlite = { version = "0.31" }
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
-secretspec = { path = "../secretspec", version = "0.19.1-sudo.14", default-features = false, features = ["manifest-edit", "codegen-schema"] }
+secretspec = { path = "../secretspec", version = "0.19.1-sudo.15", default-features = false, features = ["manifest-edit", "codegen-schema"] }
 sha2.workspace = true
 thiserror.workspace = true
 toml.workspace = true