@engineeros/connector 0.16.1 → 0.19.1

package/README.md

@@ -30,7 +30,8 @@ Connect a local Codex CLI workspace to EngineerOS through an outbound WebSocket.
 
 The selected ACP or Codex agent is the execution engine. EngineerOS chooses a provider-neutral role for each activity and the connector injects only that role's bundled skill:
 
-- `research` uses `codebase-research` with read-only access for questions and workspace assessment.
+- `research` uses `codebase-research` with read-only access for questions.
+- `assessment` uses `assessment-editing` to inspect source without changing it and edit only the assigned assessment Markdown document.
 - `planning` uses `change-planning` with read-only access for shaping, specifications, architecture, and design work.
 - `implementation` uses `goal-execution` with workspace-write access only for a registered Goal.
 - `verification` uses `change-verification` with read-only access for artifact review and independent Goal proof.
@@ -47,7 +48,7 @@ npx --yes @engineeros/connector@latest pair PAIRING-CODE --url https://your-engi
 
 The connector uploads a bounded ZIP snapshot for a safe file inventory, then stays online for deep assessments, rescans, and Goal Runs. Inventory never executes repository code. It excludes known secrets, dependency directories, build output, compiled binaries, files larger than 5 MB, agent-tool caches, Git metadata, and connector state before upload.
 
-From **Project steering -> Workspace**, run the workspace assessment to use the connected agent subscription already authenticated on that computer. Select any combination of fifteen brownfield assessment domains, collectively covering 133 internal checks from product and architecture through security, privacy, project-specific compliance, delivery, reliability, governance, and modernization planning. Reports include only material conclusions and actions; routine healthy checklist rows are not published. Capability entries state what they own, what they link to, and what they depend on. Connector `0.16.1` starts assessments with three parallel workers and accepts the run's UI-selected limit from three through eight for every coding-agent provider. It keeps one local assessment area at `.engineeros/assessment`: the initial accepted run creates `assessment.md`, later code revisions create one consolidated file under `changes/`, and in-progress reports plus resumable agent-session checkpoints stay under `.work/` until final acceptance. ACP agents such as OpenCode use isolated stage sessions within one persistent coding-agent process. The connector owns the worker pool and sends one aggregate heartbeat containing every active worker's phase, progress, last activity, and event count; report content is no longer streamed over the WebSocket or written into backend assessment JSON. The backend validates stage checkpoints so dependency fan-out remains authoritative, while the connector retains completed reports and reloads interrupted ACP or Codex sessions after reconnect when the coding agent supports session restoration. Transient ACP, app-server, provider-availability, and rate-limit failures receive two bounded attempts to continue the saved session without repeating completed inspection. A changed Git commit updates the same durable assessment, retains the prior commit in assessment history, and updates published artifacts in place. Connector reports and session checkpoints are tagged with their target commit so an earlier revision cannot leak into the update. If no assessment exists, EngineerOS creates the initial assessment identity. Capability detail and project-specific compliance controls fan out after their catalogs. Final synthesis reads the connector-local Markdown files, then one completed bundle is revalidated, persisted, published as canonical artifacts, and archived locally. Compliance findings describe repository-verifiable engineering readiness and missing external context, never legal compliance or certification. The connector prints each worker's safe activity and elapsed time every 30 seconds, stops a worker that produces no agent activity for ten minutes instead of waiting indefinitely, and applies separate bounded structure, semantic, and corrected-response formatting repairs before failing a stage. Assessment cannot modify tracked workspace source.
+From **Project steering -> Workspace**, run the workspace assessment to use the connected agent subscription already authenticated on that computer. Select any combination of fifteen brownfield assessment domains, collectively covering 133 internal checks from product and architecture through security, privacy, project-specific compliance, delivery, reliability, governance, and modernization planning. Reports include only material conclusions and actions; routine healthy checklist rows are not published. Capability entries state what they own, what they link to, and what they depend on. Connector `0.17.0` starts assessments with three parallel workers and accepts the run's UI-selected limit from three through eight for every coding-agent provider. It keeps one local assessment area at `.engineeros/assessment`: `assessment.md` is the canonical document, `sections/` holds the independently editable stage documents, `.work/` is the resumable transaction area, and an accepted update adds only a concise derived entry under `changes/`. A new run seeds each stage from its durable document, and a reconnect preserves any partially edited `.work` copy, so the coding agent updates affected content instead of regenerating the assessment. ACP agents such as OpenCode use isolated stage sessions within one persistent coding-agent process. The connector owns the worker pool and sends one aggregate heartbeat containing every active worker's phase, progress, last activity, and event count; report content is no longer streamed over the WebSocket or written into backend assessment JSON. The backend validates stage checkpoints so dependency fan-out remains authoritative, while the connector retains completed reports and reloads interrupted ACP or Codex sessions after reconnect when the coding agent supports session restoration. Transient ACP, app-server, provider-availability, and rate-limit failures receive two bounded attempts to continue the saved session without repeating completed inspection. A changed Git commit edits the same durable assessment, retains the prior commit in assessment history, and updates published artifacts in place. Connector reports and session checkpoints are tagged with their target commit so an earlier revision cannot leak into the update. If no assessment exists, EngineerOS creates the initial assessment identity and documents. Capability detail and project-specific compliance controls fan out after their catalogs. Final synthesis reads the connector-local Markdown files, then one completed bundle is revalidated, persisted, published as canonical artifacts, and archived locally. Compliance findings describe repository-verifiable engineering readiness and missing external context, never legal compliance or certification. The connector prints each worker's safe activity and elapsed time every 30 seconds, stops a worker that produces no agent activity for ten minutes instead of waiting indefinitely, and asks the same agent session to repair the same document when structure or backend validation fails. Assessment cannot modify tracked workspace source outside its assigned document.
 
 Every backend `422` content-validation response is returned to the stage agent with the exact failed item. Distinct validation failures continue through correction and resubmission until the complete stage is accepted. Three repetitions of the same unresolved validation error stop the automatic loop while preserving the latest local report for retry. Authentication, cancellation, source drift, and transport failures remain operational errors rather than agent-correction prompts.
 
@@ -72,7 +73,15 @@ Keep the connector online to receive Goals assigned from EngineerOS. Each Goal r
 
 During the writable implementation phase, Codex receives an authenticated EngineerOS MCP server automatically. It can list, read, create, update, reclassify, soft-delete, and materialize project artifacts into canonical Product records through the same repository boundary used by Copilot. The backend accepts those calls only while the assigned Goal is running. Read-only project prompts and the independent verification phase do not receive mutation tools.
 
-Requirements: Node.js 22 or newer, Git, and an authenticated agent. `npx` distributions use npm, `uvx` distributions require uv, and binary archives require `tar` (`unzip` for ZIP files on Linux). Registry agents report their own authentication prerequisites when they start.
+## Local context engine
+
+The connector keeps a local index of the workspace under `~/.engineeros/context/<connector id>`: file classifications, symbols, document headings, and import relationships for every safe file. It is built at onboarding, refreshed incrementally from file digests when EngineerOS triggers a workspace refresh, and re-checked before every assignment.
+
+Every role prompt arrives with a ranked `Workspace Context` section listing the files most relevant to that assignment and their key symbols, stamped with the head revision the index was built from. The full ranked outline is written under `.engineeros/context/packs/` inside the workspace, and the prompt points the Agent to that file for deeper detail. Resumed project sessions also receive a bounded `Session Memory` digest of earlier turns in the same session, kept under `~/.engineeros/context/<connector id>/sessions/`, so follow-up prompts build on prior conclusions instead of re-deriving them. Injection is relevance-gated to the new assignment, entries carry a derived kind (fix, decision, change, or conclusion), and cross-session recall is stamped with its source session and last-active time. The files packed for each turn also feed a per-session interest set that ranks previously touched files higher in later turns of the same session, so context compounds across a conversation. During a Goal run, the Codex CLI also receives a local read-only MCP server exposing `engineeros_search`, `engineeros_outline`, `engineeros_read_symbol`, `engineeros_blast_radius`, and `engineeros_recall` against the isolated Goal worktree, so the Agent can query the correct revision — including which files import a file it is about to change — and remembered session context directly instead of scanning the raw tree. The independent verification phase additionally receives a bounded `Change Impact` section naming each changed file's direct importers and candidate tests, with test candidates constrained to the same package and source area or linked through an indexed import. Stored symbol outlines omit literal constant values, and MCP search responses are capped at one hundred files. The index, packs, and session memory never leave the computer; they only feed local prompts and the local tools.
+
+## Requirements
+
+Node.js 22 or newer, Git, and an authenticated agent. `npx` distributions use npm, `uvx` distributions require uv, and binary archives require `tar` (`unzip` for ZIP files on Linux). Registry agents report their own authentication prerequisites when they start.
 
 ## Execution profiles
 
@@ -93,14 +102,4 @@ configured model requires a newer CLI, update Codex and restart the connector:
 npm install -g @openai/codex@latest
 codex --version
 npx @engineeros/connector start --workspace .
-```
-
-## Publish the connector
-
-Run the release workflow from this package instead of calling `npm publish` directly:
-
-```sh
-npm run release:patch
-```
-
-The workflow checks the versions already present on npm, keeps the current version when it is unpublished, or advances to the next unused patch version when necessary. It then runs the connector tests, syntax checks, and package dry run before publishing. A direct `npm publish` now stops early with the corrective command when its version already exists.
+```