fix(skill-quality): drop the duplicate version member from plugin.json

[kyle-sexton]

Summary

plugins/skill-quality/.claude-plugin/plugin.json carried two version members on main:

4:  "version": "0.11.0",
5:  "version": "0.12.0",

The advertised release was therefore parser-dependent — last-wins readers (jq, Python json.load) resolve 0.12.0, first-wins readers retain 0.11.0, and duplicate-rejecting consumers can reject the manifest outright. Any of those can misidentify or block a plugin update.

Why 0.12.0 is correct. main carried 0.11.0 before #1096, released in #1450, and this plugin's CHANGELOG has ## [0.12.0] above main's ## [0.11.0]. The 0.11.0 member is the stale one, and it is what this PR deletes.

Scope. One file, one deletion. Nothing else in the manifest and nothing else in the repo.

How it happened. Introduced while resolving a main merge in #1096. Both sides of that conflict carried "version": "0.11.0" — main had released 0.11.0 in #1450 and the branch also claimed 0.11.0 — so git treated the version line as common context outside the conflict region and placed only the differing description inside it. A scripted replacement of the conflict region then emitted a fresh version + description pair above the surviving common-context one.

Test plan

A duplicate-key-aware parse is the only check that observes this, and it is clean after the change:

$ python -c "... json.load(..., object_pairs_hook=<duplicate detector>) ..."
duplicate keys: NONE
version: 0.12.0

Also confirmed:

• git diff --stat is exactly 1 file changed, 1 deletion(-).
• The CHANGELOG's top section is still ## [0.12.0], so the manifest and the release notes agree.
• changelog-parity-gate and plugin-gate pass in CI on this branch.

Worth flagging for reviewers: json.load, jq, and JSON Schema validation all resolve duplicate keys last-wins, so every one of them reports 0.12.0 whether or not the duplicate is present. That is why this defect passed a fully green 27-context suite on #1096, and it is why the fix is verified with a duplicate-key hook rather than a plain parse.

Related

• feat(skill-quality): fresh-eyes delegation doctrine + conformance gate (check 21) #1096 — the PR whose merge-conflict resolution introduced the duplicate member.
• feat(skill-quality): add the shared listing-budget report, fix check 2's joiner #1450 — released skill-quality 0.11.0 on main, the collision that produced the conflict shape.
• ci: no gate detects a duplicate key in a plugin manifest — schema validation cannot, and every consumer is last-wins #1498 — follow-up covering the gate gap: no CI check detects a duplicate key in a plugin manifest
  (verified: schema validation cannot express key uniqueness, and every consumer resolves last-wins).
• skill-quality: narrow what check 21 claims to parse (follow-up to the #1096 parsing contract) #1493 — follow-up narrowing what check 21 claims to parse.

Closes #1492

[claude]

Claude finished @kyle-sexton's task in 51s —— View job

---

Review

• Read changed file
• Verify diff and correctness
• Check CHANGELOG alignment
• Post findings

---

LGTM. The fix is correct, minimal, and well-reasoned.

Diff:

The deletion removes "version": "0.11.0" (the stale duplicate that appeared first in the object). The surviving entry is "version": "0.12.0" at line 4 of the post-fix file, which matches the current top-level entry in the CHANGELOG (## [0.12.0] at line 6, above ## [0.11.0] at line 70).

Correctness:

• 0.12.0 is the right value — confirmed by CHANGELOG ordering.
• The remaining JSON is structurally valid; no other fields are affected.
• Root-cause explanation (merge conflict resolution in feat(skill-quality): fresh-eyes delegation doctrine + conformance gate (check 21) #1096 emitting a fresh version pair above the common-context survivor) is accurate and consistent with the diff.

Scope: Single-file, single-deletion, no test or documentation changes needed — the manifest carries no executable logic.

Verification note: The PR body's observation that jq, json.load, and JSON Schema validation are last-wins resolvers (and therefore masked this defect) is correct. The duplicate-key-aware parse cited as the actual check is the appropriate gate. Tracking the missing CI gate separately (#1492 / mentioned in the body) is the right call for this PR.

No issues. Ready to merge.

[claude]

Claude finished @kyle-sexton's task in 35s —— View job

---

Security Review

• Gather context and understand the request
• Fetch the PR diff
• Read changed file(s)
• Analyze for security issues
• Post findings

---

No security issues found.

The sole change is a one-line deletion from a static JSON manifest:

-  "version": "0.11.0",
   "version": "0.12.0",

plugins/skill-quality/.claude-plugin/plugin.json

There is nothing security-relevant to flag:

• No code execution surface. The file is a declarative JSON manifest. No scripts, hooks, or executable paths are modified.
• No secrets or credentials. No tokens, passwords, or sensitive values appear anywhere in the diff or in the post-change file.
• No GitHub Actions changes. No workflow files are touched; no pull_request_target, workflow_run, or permissions: mutations.
• No dependency or action pins loosened. No package versions or action refs changed.
• No injection surface. The $schema reference (https://json.schemastore.org/claude-code-plugin-manifest.json) is unchanged and points to a well-known public registry.
• No path traversal or plugin-isolation risk. The file sits inside the plugin's own directory tree; no ../ reach-outs are introduced.

The change is a correctness fix (removing a parser-dependent duplicate key) with no security footprint.