@colony2/c2j 0.0.100 → 0.0.103

package/README.md

@@ -256,6 +256,10 @@ c2j init --with-op-skills
 
 The generated template can derive values from the Go module in the current repo when `base: go` is appropriate. `--stdout` prints only the config and does not install skills.
 
+`base: go` reads `go.mod` directly, with no Go installation or network access required. It derives the current repository from the `module` directive and discovers only direct dependencies: `require` entries without `// indirect`. Discovery uses declared module paths, not replacement destinations, and does not resolve versions or combine `go.work` modules. Keep `go.mod` current with `go mod tidy` during development.
+
+To retain the previous command-based discovery, use `base: gocmd`. It requires Go on `PATH` and runs `go list -m` for the current module and `go list -m all` for dependencies, including transitive dependencies. Both bases retain the same repository normalization, pattern inference, filtering, and explicit config overrides. Automatic Go project detection and `c2j init` default to `base: go`.
+
 Bundled skill install controls:
 
 ```bash
@@ -622,6 +626,21 @@ support it (JobDB `20269bd` / `v0.0.46` or later, with a compatible backend).
 Unsupported backends return an error; c2j never falls back to listing and deleting
 jobs individually.
 
+### Secret inputs and delegated permissions
+
+Secret references authored in the root recipe's repository can be resolved into
+inputs without a `perms` grant. Defaults from ops in that repository are trusted
+too. Foreign recipes and foreign op defaults require authorization.
+
+Input resolution never adds a secret to the delegated lease. For example, a node
+can receive `foo` through `${{ context.secrets.foo }}` while its `perms.jobdb`
+grant allows only runtime retrieval of `bar`. On include nodes, `perms.jobdb`
+authorizes the included recipe's input references and bounds its possible grants;
+it does not give every descendant the corresponding lease capabilities.
+
+See [recipe node permissions](GUIDE-Node-Permissions.md) for examples of explicit
+inputs, foreign op defaults, include grants, and forwarding secret inputs.
+
 ### Recipe timeouts and recovery
 
 c2j does not set default job or built-in op timeouts. Set `timeout` on a recipe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colony2/c2j",
-  "version": "0.0.100",
+  "version": "0.0.103",
   "description": "c2j job system",
   "license": "Apache-2.0",
   "homepage": "https://github.com/colony-2/c2j",