kairos-chain 3.93.0 → 3.95.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1624b7fa2adf2856c0f55ca0012dc527870d5649cdcad7ebe2d8ae90cda1d4a
-  data.tar.gz: 12cdc74b57b87266ca3364654468fa077774665e9b1bef090dea9806907c4b1b
+  metadata.gz: 3bce3f299f0bb91ecbb6199e464a2ea24602ede6e9d4e972c1a7b5905ec447c5
+  data.tar.gz: 4986b9e4f8c87ff233b67586791d8b3068aed4decaecb1319f5c0553b4a5445c
 SHA512:
-  metadata.gz: 9e47baf8089acd2fb9cc4f7f5fc4264d55d4096f8ed21aacb1a736ab27099beebda372d429de1e5a424e66307ccda5a274f5532073e7e21eaa4bc5d58684a718
-  data.tar.gz: 4deb91c26655f7c6e11a72802635a7c088aa0a7246124785984d2fe2f20fbb0ab02e0b2d27e425948a8107be69fe5cd1f72d4ca90efc069f12731bef9ec36e79
+  metadata.gz: a4af517774c9e5e90299d4877190d83659932acf7851bf04275d5c3066298411ca628084a490cfef6348b327d550c05d5cc4f96cab086e5c297e2a169e1f72b3
+  data.tar.gz: ba67dc90461e4350615a4ba9e232702efc27b241fa853a2934a80714bb5753c2aa1ebba06921ebe58e4db7145d8f3fb5d747be4ab37f8ad5da25150ab8c7ce8d

data/CHANGELOG.md

@@ -6,6 +6,103 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [3.95.0] - 2026-10-21
+
+### Changed — the `agent` SkillSet is rebuilt (1.0): long runs in the host session, a stand-in instead of terminal approvals
+
+The 0.x agent could not carry the operator's ordinary request (design → design review → implement →
+implementation review): its act route wrote only `docs/drafts/draft_*`, could not reach multi-LLM review or
+tests, and counted only terminal-attested answers (0 counted pairs). Design:
+`log/agent_skillset_rebuild_design_v0.5.1_20261020.md` (five review rounds, frozen as the author's proposal)
+and its delta `log/agent_skillset_rebuild_design_v0.6.3_20261020.md`.
+
+- The host session (Claude Code) is the only body. The SkillSet supplies a plan from a Ruby-DSL template, a
+  stand-in (isolated `claude -p --safe-mode --tools ""`, Opus 5.5) that answers decision points from the
+  operator's own words and the instruction mode, a guard (host hooks: `PreToolUse` on every tool, fail-closed)
+  that lets through only what the run created or its worktree and branch hold, a hash-chained journal, and a
+  report check. Six tools: `agent_start`, `agent_status`, `agent_advance`, `agent_items`, `agent_finish`,
+  `agent_stop`.
+- Runs need an adopted policy (the operator's mandate, `config/policies/*.rb`), adopted by the operator's own
+  typed words naming its digest; the adoption is recorded on the chain.
+- Templates: `dev_cycle`, `impl_cycle`, `design_only`, `doc_cycle` (a document kept in git, revised in place,
+  optional build check), `survey` (versioned survey files from local sources), `general`.
+- A review closes only when no (a)/(b) P0 is open. Each review may take the policy's `review_rounds`
+  (10), counted for that review alone; at the cap it waits for the operator, who grants more rounds or
+  freezes it. Revisions follow L1 multi_llm_review_workflow § Revision
+  Discipline: each round says which new P0s the actor's last addition drew, and the next step is to undo it.
+  Design reviews stay at the design level; implementation-only findings are deferred to the implementation
+  review and are operator items at once.
+- Every run ends with a layered-deck report (`report_kit/`, the kit of L1 `layered_visual_pitch_deck`).
+- `bin/agent_harvest.rb` harvests the operator's own answers from host transcripts (hook output, peer
+  messages and pasted host output excluded).
+- Removed: the in-server OODA loop, act-route table and terminal rulings, shadow judge, distillation,
+  native body, `agent_execute`, `agent_step`, `agent_wait`, `operator_report`, the `agent-monitor` subagent.
+- `agent` is no longer installed automatically in new instances (it needs a policy and projects hooks).
+  An installed 0.x agent becomes 1.0 on upgrade. 1.0 needs `multi_llm_review` and `llm_client` >= 0.3.0 in
+  the same instance; upgrade does not install a missing one (`kairos-chain skillset install multi_llm_review`).
+
+### Added — `removed_files` in `skillset.json`; `system_upgrade` archives them
+
+`upgrade_apply` copied changed files and never deleted one, so a SkillSet that dropped files left them to be
+loaded. A template may now list `removed_files`; upgrade moves each from the installed copy to
+`storage/skillset_removed/<name>/<time>/`, and a forced reinstall no longer restores a retired config file.
+
+### Added — `llm_call` options `no_fallback` and `isolated`
+
+`no_fallback` makes an authentication failure on the configured provider a failure instead of a silent switch
+to `claude_code`. `isolated` (claude_code) runs `claude -p --safe-mode --tools ""` in an empty directory, so
+no CLAUDE.md, skills, plugins, hooks, memory or MCP servers reach the call. An isolated call's payload carries
+`isolation` (`safe_mode`, `tools`, `cwd`, as `claude -p` was spawned); llm_client is 0.3.0. The agent's
+stand-in refuses any reply without that evidence (and refuses to call an llm_client too old to isolate), and the
+agent SkillSet declares `llm_client >= 0.3.0`; upgrade both together.
+
+### Added — `user_level_conflicts` in `skillset.json`; install and upgrade report them
+
+A SkillSet may list files an earlier version left at user level that it cannot remove itself (e.g. a personal
+skill that shadows the project's). `install`, `upgrade_apply`, `system_upgrade` and `kairos-chain skillset
+install/upgrade` print the ones present as warnings, with a command that moves them to a timestamped backup.
+agent 1.0 lists the 0.x personal skill `~/.claude/skills/agent/SKILL.md` and `~/.claude/agents/agent-monitor.md`.
+
+### Changed — the shipped agent policy needs a new adoption
+
+`masa_2026_10_20.rb` sets `review_rounds` to 10 rounds for each review (counted apart, no longer shared by a
+run's reviews) and drops the lookup consent comment (runs never look things up on the web). Its digest
+changed: adopt it with `adopt policy masa_2026_10_20 8846b67e`.
+
+### Changed — L1 `multi_llm_review_workflow` 3.16.0 and `design_to_implementation_workflow` 1.3
+
+A new entry-level clause, § Provisional delegation under a mandate: under a pinned, journaled operator policy a
+named delegate — never the context whose work is judged — answers reserved judgments provisionally, and nothing
+resolves, closes, freezes or demotes beyond the run until the operator confirms it in their own words. Pointers
+from INV-U2, INV-U4, INV-U5, Step 0.25 and § Convergence Rules, and from the merge criteria of
+`design_to_implementation_workflow`. An instance's own L1 copy is not rewritten by upgrade.
+
+## [3.94.0] - 2026-10-20
+
+### Added — L0 changes proposed for later approval, L0 restores on the record, L1 body history
+
+- **L0 proposals.** `skills_evolve` keeps a pending L0 change as (base, result,
+  content) without evaluating it; `command: "pending"` lists the proposals and
+  `apply` takes a `proposal_id`. Applying writes exactly the stored bytes under
+  an exclusive lock, only while the base is still the L0 in force and the
+  content hashes to its result. A failed load, an interrupt or a killed thread
+  never leaves an unrecorded L0 on disk.
+- **L0 restore on the record.** `skills_rollback` restores a snapshot only if
+  its hash appears in a transition recorded on the chain. Without
+  `approved: true` it writes nothing and returns a pending proposal; with
+  `proposal_id` the approval applies exactly the proposal that was shown.
+- **L1 body history.** `knowledge_update` gains `history`, `restore` and
+  `erase_body` (the last is irreversible and needs `approved: true`). Bodies
+  are kept by content address from a recorded activation point, and restore and
+  erasure decide from the chain whether their record landed.
+
+### Changed — read before upgrading
+
+- `VersionManager.rollback` is removed; nothing shipped calls it. Code that
+  called it should use `skills_rollback` with a `proposal_id`.
+- `chain_import` never overwrites an existing chain: it is refused when the
+  target already holds chain data. Import into a new data directory instead.
+
 ## [3.93.0] - 2026-10-19
 
 ### Added — `proactive_tutorial`, an opt-in mode that suggests KairosChain's own workflow

data/bin/kairos-chain

@@ -102,6 +102,7 @@ when 'skillset'
     result = manager.install(source, layer_override: layer_override, force: force)
     puts "Installed SkillSet '#{result[:name]}' v#{result[:version]} [#{result[:layer]}]"
     puts "Path: #{result[:path]}"
+    manager.user_level_conflicts(KairosMcp::Skillset.new(result[:path])).each { |w| puts "  [WARNING] #{w}" }
 
   when 'enable'
     name = ARGV.shift
@@ -162,6 +163,7 @@ when 'skillset'
       puts "## SkillSets"
       results.each do |r|
         puts "  [UPGRADED]  #{r[:name].ljust(22)} v#{r[:from]} -> v#{r[:to]} (#{r[:files_updated]} files)"
+        Array(r[:warnings]).each { |w| puts "    [WARNING] #{w}" }
       end
       checkable.reject { |ss| upgraded_names.include?(ss.name) }.each do |ss|
         puts "  [UNCHANGED] #{ss.name.ljust(22)} v#{ss.version}"

data/lib/kairos_mcp/kairos_chain/landed_probe.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require 'json'
+require_relative 'chain'
+
+module KairosMcp
+  module KairosChain
+    # Answers "did this exact entry reach the ledger?" after an append did not
+    # return normally.
+    #
+    # Chain#add_block raises Storage::Error when it cannot tell whether the
+    # write landed, and a thread can be interrupted after the write but before
+    # add_block returns. Either way the caller holds a change it must keep
+    # (the record is on the chain) or undo (it is not). Looking only at the last
+    # block answers wrongly once anything else has been appended since, so the
+    # caller takes a mark before appending and the probe scans every block after
+    # that mark for an entry equal to the one the caller tried to append.
+    module LandedProbe
+      # The ledger length now, i.e. the index from which the caller's block can
+      # appear. nil when the ledger cannot be read; every later status is then
+      # :unknown.
+      def self.mark(storage_backend: nil)
+        chain = Chain.new(storage_backend: storage_backend)
+        case chain.load_state
+        when :readable then chain.chain.length
+        when :absent then 0
+        end
+      rescue StandardError
+        nil
+      end
+
+      # :landed  -- a block after the mark carries an entry equal to entry_json
+      # :absent  -- the ledger is readable (or absent) and no such entry is there
+      # :unknown -- the mark or the ledger could not be read
+      #
+      # Equality is on the parsed entry, so a backend that re-serialises the JSON
+      # still matches. Only StandardError is absorbed: an interrupt during the
+      # probe propagates, and callers run their undo in an ensure for that case.
+      def self.status(mark, entry_json, storage_backend: nil)
+        return :unknown if mark.nil?
+
+        expected = JSON.parse(entry_json)
+        chain = Chain.new(storage_backend: storage_backend)
+        return :absent if chain.load_state == :absent
+        return :unknown unless chain.load_state == :readable
+
+        found = chain.chain.drop(mark).any? do |block|
+          Array(block.data).any? do |raw|
+            begin
+              JSON.parse(raw.to_s) == expected
+            rescue JSON::ParserError
+              false
+            end
+          end
+        end
+        found ? :landed : :absent
+      rescue StandardError
+        :unknown
+      end
+    end
+  end
+end