Verdict 0.5.0 release: MCP read-only tightening, skill install --detect, and schema path move

What they did

The author merged a Changesets-generated release PR for @stainless-code/verdict, bumping it to 0.5.0 and publishing to npm automatically via the changesets/action GitHub Action. The release bundles three minor changes and a batch of patches. Minor: the experimental MCP server under `verdict mcp --read-only` no longer exposes a `threads` tool, and `report` drops its `--output`/`--sarif` arguments and reports `readOnlyHint: false` instead of claiming to write nothing, leaving seven tools (report, next, show, trend, ready, doctor, check-tree); published schemas moved with the skill so every `$id` base path is now `skills/verdict/schemas/`; and `verdict skill install --detect` now adds the review skill to every coding agent already set up on the machine, naming each target and result, with `--json` listing status, path, and files written, refusing when no agent is set up, and being mutually exclusive with `--dir` and `--agent`. Patches: the docs site publishes its guide as `verdict-docs` instead of a second skill named `verdict`, with the docs build failing if two published skills share a `name:`; global flags work anywhere on the command line and a bare `--` ends positional parsing; signed installs no longer abort when `cosign` is on PATH because verification now checks the certificate identity the Release workflow actually mints (a push to main, not a tag); the shipped review prompts had malformed fenced blocks that are now well-formed; `npx skills add stainless-code/verdict` installs just the skill rather than copying over a thousand files; the skill triggers on pull requests, branches, commit ranges, and staged changes, with upstream MIT notice pinned to a commit; the TypeScript client renders `anyOf` as a union instead of `unknown`; `verdict upgrade` reads the installer receipt beside the running binary but defers to npm, Homebrew, node_modules, or skill copies that own the directory; and shell completion offers `threads` with `--provider` and `--json`.

How it went

The release PR was opened automatically and is ready to merge, after which npm publishes the packages. The changelog is detailed and well-scoped, with breaking changes called out explicitly and migration notes for hosts pinning the old read-only `report` hint or resolving schemas by URL. Polish is high: each patch names the concrete bug and the fix, and the docs build now guards against duplicate skill names.

Worth knowing

This is a release PR, not a feature build, so it assumes the underlying changes already landed on main and that Changesets, npm publishing credentials, and the Release workflow are configured. The MCP and schema changes are breaking for hosts and validators, and the read-only `report` hint change means hosts should stop trusting that hint. The post does not show CI results or the actual publish step.

Wiring

Changesets drives the flow: contributors add changeset files to main, the changesets/action GitHub Action opens or updates a release PR, and merging it triggers npm publish. The skill payload lives in `skills/verdict/` alongside `SKILL.md`, and `verdict skill install` writes exactly those files; `--detect` scans for configured coding agents and installs into each, while `--dir` and `--agent` remain explicit alternatives. Schemas are served from `skills/verdict/schemas/` and referenced by `$id` URLs. The docs site publishes `verdict-docs` and exposes it via `/.well-known/agent-skills/index.json`, with a build check rejecting duplicate skill names. Install scripts and `verdict upgrade` verify cosign certificate identity against a push to main, and `upgrade` reads the installer receipt next to the binary before deferring to npm, Homebrew, node_modules, or skill copies.

Try it yourself

Read the pending changesets in this repo and draft the release notes for the next version bump. Group entries into Breaking, Minor, and Patch, and for each breaking item state exactly what downstream users must change (for example, a moved schema `$id` base path or a dropped MCP tool). Then check that `verdict skill install --detect` is documented in the README and that install.sh and install.ps1 close a successful install by pointing at it. Finally, confirm the docs build fails when two published skills share a `name:`, and list any skill directories that would collide.