@mean-weasel/lineage 0.1.2 → 0.1.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.4
+
+- Implement target-scoped agent claims for lineage and content-post agent writes, including claim lifecycle CLI/API commands, heartbeat/release/revoke/transfer controls, and token-redacted read APIs.
+- Add claim-aware handoff packets, workspace/content occupancy badges, and a read-only Agents view so humans can see active, idle, stale, and closed claims without exposing raw tokens.
+- Enforce matching claim tokens for claimed lineage/content mutations and document the `LINEAGE_CLAIM_TOKEN` operator flow, including rare `project_channel` ownership.
+
+## 0.1.3
+
+- Add a managed Swissifier rich-demo media download flow that verifies the release archive and restored PNG checksums before loading the demo.
+- Add durable local startup helpers and default Lineage CLI hosts for `lineage.localhost` and `lineage-dev.localhost`.
+- Ship the lightweight Swissifier fixture manifest while keeping generated demo media outside git and package contents.
+
 ## 0.1.2
 
 - Fix packaged Lineage handoff commands so copied `next`, `inspect`, and `link-child` commands run through the published package.

package/README.md

@@ -34,12 +34,60 @@ lineage start
 lineage-dev start
 ```
 
-By default, `lineage start` listens on `127.0.0.1:5197` and stores SQLite state in a stable Lineage runtime directory. `lineage-dev start` listens on `127.0.0.1:5198` and uses a separate development SQLite file. Override those defaults with `--port`, `--host`, `--db`, or `LINEAGE_HOME`:
+By default, `lineage start` listens on `lineage.localhost:5197` and stores SQLite state in a stable Lineage runtime directory. `lineage-dev start` listens on `lineage-dev.localhost:5198` and uses a separate development SQLite file. Override those defaults with `--port`, `--host`, `--db`, or `LINEAGE_HOME`:
 
 ```bash
 lineage start --port 6123 --db ~/.lineage/lineage.sqlite
 ```
 
+## Agent Claims
+
+Mutating agent writes use target-scoped claim tokens. Read-only inspection stays
+available without a claim, but confirmed writes such as lineage `link-child` and
+claimed content post attach/phase actions require a matching token when a target
+is already claimed.
+
+Create a claim and copy the raw token at creation time:
+
+```bash
+lineage agent claim --project demo-project --scope lineage_workspace --target demo-project:lineage-workspace:<root-asset-id> --target-title "TikTok hook lineage" --agent-name "Codex thread 123" --ttl 20m --json
+export LINEAGE_CLAIM_TOKEN='claim_abc.secret_xyz'
+```
+
+Keep the claim fresh and pass it to mutating commands:
+
+```bash
+lineage agent heartbeat --claim-token "$LINEAGE_CLAIM_TOKEN" --json
+lineage link-child --project demo-project --root <root-asset-id> --child <child-asset-id> --claim-token "$LINEAGE_CLAIM_TOKEN" --confirm-write --json
+lineage agent release --claim-token "$LINEAGE_CLAIM_TOKEN" --json
+```
+
+The app-created claim-aware handoff packet includes the same token export,
+heartbeat, inspect, and write commands. Raw claim tokens are not shown in the
+read-only Agents view.
+
+Use `project_channel` only for rare work that intentionally owns an entire
+project/channel lane. Prefer `lineage_workspace` or `content_post` claims for
+normal target-scoped agent work:
+
+```bash
+lineage agent claim --project demo-project --scope project_channel --target demo-project:channel:tiktok --channel tiktok --agent-name "Channel owner" --ttl 20m --json
+```
+
+## Codex Plugin
+
+The versioned Codex plugin lives in `plugins/lineage-codex-plugin`. Install the
+plugin that matches the resolved `@mean-weasel/lineage` package version with:
+
+```bash
+npx @mean-weasel/lineage-plugin-installer install --channel latest
+```
+
+The installer verifies the plugin artifact checksum and rejects plugin manifests
+whose version or `lineage.version` does not exactly match the resolved Lineage
+package version. The plugin artifact and installer package are released from
+this public repository.
+
 ## Local Development
 
 ```bash
@@ -50,6 +98,23 @@ npm run ci
 
 `npm run dev` starts the local development server from source. `npm run ci` runs the full local verification gate.
 
+## Command Shortcuts
+
+The root `Makefile` provides memorable wrappers for common setup, startup, and
+verification commands. Run `make` or `make help` to list the available targets.
+
+```bash
+make install-prod
+make install-plugin-prod
+make start-prod
+make check
+make smoke
+```
+
+The Makefile is only a convenience layer. npm scripts, the packaged CLIs, and
+GitHub release workflows remain the source of truth for build, test, and release
+behavior.
+
 ## Release Checks
 
 Use `next` for candidate builds and `latest` for the stable public channel. Check the current local, npm, and workflow state with:
@@ -83,6 +148,22 @@ Source checkouts and installed packages include a synthetic public demo catalog
 
 If you create a real `demo-project/assets/catalog.json`, that root project catalog overrides the packaged fixture. The fixture keeps S3-shaped metadata for realistic catalog structure, but default previews are generated local SVG data URLs and do not call storage.
 
+Lineage also includes a lightweight Swissifier rich-demo manifest at `fixtures/demo-project/lineage/swissifier-rich-demo.json`. The manifest stores only synthetic metadata, checksums, graph edges, layout positions, and selected next-variation bases. It does not include generated PNG media or any local SQLite state.
+
+To hydrate the Swissifier demo with real images, use the Demo seed menu's Swissifier `Download media` control. Lineage downloads `swissifier-rich-demo-v1.tar.gz` from the [v0.1.2 GitHub release](https://github.com/mean-weasel/lineage/releases/tag/v0.1.2), verifies the archive checksum, safely unpacks the PNGs into local scratch storage, and then verifies each PNG checksum before loading the rich demo.
+
+Future rich-demo media packs should follow the same split: commit only the lightweight manifest changes, attach the generated media archive to the GitHub release for the app version that first references that archive, then pin the public release URL, archive size, and SHA-256 in the manifest. If a later app release reuses an unchanged media pack, keep the manifest pointed at the original release asset instead of duplicating the archive.
+
+For manual verification or offline restore, the expected archive checksum is:
+
+```sh
+shasum -a 256 swissifier-rich-demo-v1.tar.gz
+```
+
+`24edc5307d0932ddc8a151c6a8c1001a08c45075e3ae198082038c44519be0de`
+
+The previous manual path remains available: unpack the media pack yourself, set `LINEAGE_SWISSIFIER_MEDIA_DIR` to that folder, then use the Demo seed menu to restore media and load Swissifier.
+
 ## Data And Privacy
 
 Lineage stores local workspace state in a SQLite database on your machine. Public fixtures are synthetic and must not contain private names, credentials, presigned URLs, real customer content, private campaign data, or real media. Keep private catalogs and media outside public package fixtures.