@mytegroupinc/myte-core 0.0.45 → 0.0.46

package/README.md

@@ -18,10 +18,9 @@ This package exists so the public wrapper can stay small and versioned cleanly.
 - `git` only when using `query --with-diff`
 - No runtime npm dependencies. The CLI uses Node 18+ built-ins for env loading, argument parsing, HTTP, and local context serialization.
 
-## Behavior Summary
-
-- Snapshot-style commands such as `bootstrap`, `sync-qaqc`, `feedback-sync`, and `suggestions sync` write local `MyteCommandCenter` data.
-- Live project-key mutations require explicit user approval before the CLI sends them. Create a local approval artifact, show it to the user, then rerun with `--confirm-write --approval-artifact <path>`.
+## Behavior Summary
+
+- Snapshot-style commands such as `bootstrap`, `sync-qaqc`, `feedback-sync`, and `suggestions sync` write local `MyteCommandCenter` data.
 - `feedback status|edit|assign|archive` writes reviewable local YAML artifacts; `feedback submit|revise|reviews|review` routes them through the backend owner-review membrane.
 - `feedback move|comment|undo|prd-versions|prd-diff|history` calls the project-key Feedback API while leaving lifecycle rules and permissions server-side. `feedback move --feedback-ids` sends one batch move request.
 - `feedback validate|apply` remains available for validation and owner-direct apply paths; live authorization, stale checks, and history stay server-side.
@@ -35,10 +34,19 @@ This package exists so the public wrapper can stay small and versioned cleanly.
   gateway, and `MYTEAI_API_KEY`. Normal coding runs use the branded Codex
   harness with Myte context hardening; the experimental controller is not the
   default product path.
-- `mytecody doctor` reports both the signed MyteCody engine state and this npm
-  package version. `mytecody update` updates the engine only. Use
-  `npm install -g myte@latest` to update the launcher and the Myte API CLI
-  commands shipped by npm.
+- `mytecody doctor` reports both the signed MyteCody engine state and this npm
+  package version. `mytecody update` updates the engine only. Use
+  `npm install -g myte@latest` to update the launcher and the Myte API CLI
+  commands shipped by npm.
+
+## Live Write Approval
+
+Project-key write commands add a server-validated approval envelope only after the caller supplies `--confirm-write --approval-artifact <path>`.
+
+- The approval artifact must be a local `.md`, `.yml`, `.yaml`, or `.json` file shown to and approved by the user.
+- The artifact must list the exact operation, proposed change, and every target id or PRD item.
+- Batch writes must enumerate every item and the CLI sends the matching batch count to the API.
+- The API validates the payload hash after stripping transport metadata, so direct HTTP writes with only the API key do not bypass approval.
 - The package does not bundle the large MyteCody engine binary or the async
   Responses bridge implementation. See `THIRD_PARTY_NOTICES.md` and
   `TRADEMARKS.md` for Codex lineage and Myte brand notices.
@@ -49,10 +57,6 @@ Coding agents should treat `MYTE_API_KEY` as a project-scoped Project Assistant
 
 - Load it from the workspace `.env` or environment. `MYTE_PROJECT_API_KEY` is accepted as a compatibility fallback.
 - Call `myte config --json` first when project identity or local repo detection is uncertain.
-- Before any live write, create a local approval artifact, show it to the user, and get explicit approval. Use `.md` for comments, human updates, and PRD markdown; use `.yml`/`.yaml` or `.json` for structured mission/feedback decisions and batch writes.
-- After approval, rerun the mutation with `--confirm-write --approval-artifact <path>`. Batch artifacts must enumerate every feedback id, mission id, suggestion id, request id, or PRD item.
-- Direct HTTP calls with `MYTE_API_KEY` cannot bypass this gate on live project-content mutations. The API returns `428` with agent instructions when approval metadata is missing or mismatched.
-- Read/sync/query/validate commands, `--print-context`, and `--dry-run` do not require write approval.
 - Hydrate mission context with `bootstrap` first instead of scraping the web UI. `bootstrap` writes mission cards and mission suggestion thread state.
 - Use `suggestions sync` only when you need to refresh mission review-thread state without refreshing the full board.
 - Use `query --with-diff` for project-scoped code review, planning, and implementation questions.
@@ -192,7 +196,7 @@ The harness creates five disposable `TEST` feedback items from markdown, verifie
 
 ## Direct Project API Surface
 
-All routes use `Authorization: Bearer <MYTE_API_KEY>`. The CLI adds idempotency and client-session headers on mutation routes. Live project-content mutation routes also require write-approval headers; the official CLI supplies them from `--confirm-write --approval-artifact <path>`.
+All routes use `Authorization: Bearer <MYTE_API_KEY>`. The CLI adds idempotency and client-session headers on mutation routes.
 
 Read/sync routes:
 
@@ -209,11 +213,10 @@ Read/sync routes:
 - `GET /api/project-assistant/feedback/<feedback_id>/prd/versions/<version_id>/diff`
 - `GET /api/project-assistant/suggestions`
 - `GET /api/project-assistant/run-qaqc/<batch_id>`
-- `POST /api/project-assistant/query`
-- `POST /api/project-assistant/feedback/<feedback_id>/refinement/validate`
 
-Live project-content mutation routes:
+Mutation routes:
 
+- `POST /api/project-assistant/query`
 - `POST /api/project-assistant/run-qaqc`
 - `POST /api/project-assistant/mission-status-update`
 - `POST /api/project-assistant/mission-archive`
@@ -222,6 +225,7 @@ Live project-content mutation routes:
 - `POST /api/project-assistant/client-update-drafts`
 - `POST /api/project-assistant/create-prd`
 - `POST /api/project-assistant/create-prds`
+- `POST /api/project-assistant/feedback/<feedback_id>/refinement/validate`
 - `POST /api/project-assistant/feedback/<feedback_id>/refinement/requests`
 - `POST /api/project-assistant/feedback-review-requests/<request_id>/revise`
 - `POST /api/project-assistant/feedback/<feedback_id>/refinement/apply`

package/THIRD_PARTY_NOTICES.md

@@ -1,21 +1,21 @@
-# Third-Party Notices
-
-This package includes the Myte CLI launcher and MyteCody distribution client.
-
-The branded MyteCody engine installed by the launcher is derived from the
-OpenAI Codex open-source project. OpenAI Codex is licensed under the
-Apache License, Version 2.0.
-
-Source lineage tracked for this slice:
-
-- Project: OpenAI Codex
-- Version baseline: `0.139.0`
-- License: Apache-2.0
-- Upstream: https://github.com/openai/codex
-
-The MyteCody engine and signed client assets are distributed separately from
-this npm package through a Myte release manifest. This package verifies release
-artifacts before installing them into the user's Myte-owned local cache.
-
-Myte names, marks, logos, terminal branding, and product design are not part of
-the OpenAI Codex project and remain Myte-owned brand assets.
+# Third-Party Notices
+
+This package includes the Myte CLI launcher and MyteCody distribution client.
+
+The branded MyteCody engine installed by the launcher is derived from the
+OpenAI Codex open-source project. OpenAI Codex is licensed under the
+Apache License, Version 2.0.
+
+Source lineage tracked for this slice:
+
+- Project: OpenAI Codex
+- Version baseline: `0.139.0`
+- License: Apache-2.0
+- Upstream: https://github.com/openai/codex
+
+The MyteCody engine and signed client assets are distributed separately from
+this npm package through a Myte release manifest. This package verifies release
+artifacts before installing them into the user's Myte-owned local cache.
+
+Myte names, marks, logos, terminal branding, and product design are not part of
+the OpenAI Codex project and remain Myte-owned brand assets.

package/TRADEMARKS.md

@@ -1,10 +1,10 @@
-# Trademarks
-
-Myte, Myte AI, MyteCody, "MYTE CODY - Your Tech Your Way", logo assets, terminal
-animation assets, and related product branding are Myte-owned marks and brand
-assets.
-
-OpenAI and Codex are trademarks or project names of their respective owners.
-MyteCody uses a Codex-derived open-source engine under the applicable open
-source license, but MyteCody is a Myte product surface and is not presented as
-an official OpenAI product.
+# Trademarks
+
+Myte, Myte AI, MyteCody, "MYTE CODY - Your Tech Your Way", logo assets, terminal
+animation assets, and related product branding are Myte-owned marks and brand
+assets.
+
+OpenAI and Codex are trademarks or project names of their respective owners.
+MyteCody uses a Codex-derived open-source engine under the applicable open
+source license, but MyteCody is a Myte product surface and is not presented as
+an official OpenAI product.