@panaversity/ksor 0.0.3 → 0.0.5

package/CHANGELOG.md

@@ -1,5 +1,100 @@
 # @panaversity/ksor
 
+## 0.0.5
+
+### Patch Changes
+
+- 995f002: feat: scaffolded projects ship a commented `.env.example` naming every
+  variable the agent surface needs — the DSN variable, the provider key, and
+  `KSOR_AUTH_DISABLED=1`, which a local run requires because `ksor serve` refuses
+  to boot unauthenticated. Copy it to `.env` and it is read automatically.
+
+  feat: standing up the agent surface is one command and one config block.
+  `ksor` now reads `./.env` automatically (Node-native, no dependency; a real
+  environment variable still wins), scaffolded projects get `pnpm up` —
+  schema → grant → ingest → serve — and `ksor schema --apply` is re-runnable
+  instead of failing on an already-provisioned database, so the whole sequence
+  is safe to repeat and doubles as the refresh after editing `knowledge/`.
+
+  fix: a scaffolded project deploys on the first try. The shipped `vercel.json`
+  pinned `--frozen-lockfile`, so an adopter's first Vercel import failed with
+  `ERR_PNPM_OUTDATED_LOCKFILE` — the scaffold declares a root dependency whose
+  stamped version the committed lockfile cannot record.
+
+  fix: the serve runbook no longer tells first-timers to declare
+  `retrieval.vector_floor: uncalibrated` before serving, which made every request
+  refuse until a floor was measured. Configuring the record needs one `database:`
+  block; the abstention gate is turned on deliberately, after it serves.
+
+- 4e84cdf: fix: `ksor serve` reports its real version to MCP clients. In 0.0.4 every
+  client saw `serverInfo.version` of `0.0.0`: the gateway read the version from
+  an environment variable at module scope, and the CLI's static import evaluated
+  that module before the CLI could set the variable. The version now travels as
+  an argument, and a test drives the bundled binary to assert it.
+
+## 0.0.4
+
+### Patch Changes
+
+- 473302a: feat: `@panaversity/ksor` now ships the whole Knowledge System of Record as ONE
+  package. The kernel (corpus store, hybrid retrieval, calibrated abstention, and
+  the MCP gateway) is bundled into the CLI, which exposes one `ksor` binary with
+  all verbs: `init`, `dev`/`build` (still exit 2), `serve` (runs the MCP server
+  in-process, reading `./instance.md`), and the corpus operations `ingest`,
+  `schema`, `calibrate`, `gc`. An adopter installs one thing and the content SoR
+  is always present. Note: the CLI is no longer zero-dependency — installing it
+  now pulls the server runtime (pg, the embedding SDK, the MCP SDK).
+
+  Because MCP serving is a core surface, `ksor init` now declares
+  `@panaversity/ksor` as a dependency of the scaffolded project — pinned to the
+  exact CLI version that scaffolded it — with `pnpm serve` and `pnpm ingest`
+  scripts, so the served tool is a first-class, version-pinned command rather
+  than an `npx` afterthought. The scaffold's first `pnpm install` is non-frozen
+  (it resolves the tool and writes the lockfile); `pnpm dev` still needs no
+  database.
+
+  The MCP surface ships on the **2026-07-28** spec revision, via SDK v2
+  (`@modelcontextprotocol/server`). Since this release is the agent surface's
+  debut, it ships current rather than one revision behind: the door serves the
+  handshake-free modern era (`server/discover`, per-request envelope) and keeps
+  serving 2025-era clients through the same stateless idiom, so nothing that
+  works today stops working.
+
+  New verb: **`ksor grant`** authorizes ingest for a corpus (and `--revoke`
+  withdraws it) — the row row-level security requires before any write. It runs
+  through the same `pg` driver every other verb uses, so finishing setup no
+  longer requires dropping out of ksor into `psql`. Idempotent, and it reports
+  the state it established rather than a bare "ok". Kept a separate act from
+  `schema --apply` on purpose: a schema step that granted itself write access
+  would make the tool its own authorizer.
+
+  Scaffold serve-rung fixes (from a multi-agent operability review): the
+  scaffolded format checker (`pnpm check`) now accepts the `database:`/`embedding:`/
+  `retrieval:`/`budgets:` blocks that `ksor serve`/`ingest` require, so a project
+  climbing to serving is no longer rejected by its own CI; the scaffold's
+  `pnpm ingest` script now `--flip`s (a first ingest without it left the server
+  answering from an unactivated generation); the kernel's build-scripted deps
+  (`@google/genai`, `protobufjs`) are denied under `allowBuilds` so the first
+  install does not exit 1; and the scaffold `AGENTS.md`/`README.md` now carry the
+  full serve runbook — the ordered `schema` → grant → `ingest` → `serve` pipeline,
+  the `instance.md` block shapes, the env contract, the generation model, and the
+  fail-closed security posture.
+
+- af53bed: fix: `ksor serve` no longer exits when the database terminates an idle
+  connection. The Postgres pool had no `'error'` listener, so an idle client
+  dropped by a restart, a failover, or an administrative `pg_terminate_backend`
+  became an uncaught exception and killed the process instead of being discarded
+  and reconnected. Long-running servers were exposed to this on any routine
+  database maintenance; the pool now logs the discarded connection's error class
+  and keeps serving.
+- 4fa4906: test(ci): make the scaffold browser e2e reliable — retry `pnpm build` once on the
+  known upstream Turbopack static-image flake (`TurbopackInternalError: Input image
+not found`), scoped to that exact signature so a real build break still fails on
+  the first try. Test-infrastructure only: the published CLI tarball is unchanged
+  (the retry helper is not reachable from the CLI entry and does not ship). The
+  durable fix — dropping the scaffold home page's static `app/icon.png` import — is
+  tracked as an owner call.
+
 ## 0.0.3
 
 ### Patch Changes

package/README.md

@@ -23,11 +23,13 @@ search and `llms.txt`, adopter CI, a dependency-free format checker
 operate it. Everything emitted is yours (the templates are MIT-0), the
 scaffold is deterministic and offline, and every refusal explains itself.
 
-> **`0.x` status:** `init` works; `dev`, `build` and `serve` are designed,
-> not implemented — each prints an honest notice and exits `2` (inside a
-> scaffolded project, `pnpm dev` / `pnpm build` cover local work).
+> **`0.x` status:** `init` works, and `serve` runs the MCP server over a built
+> record (with `ingest`/`schema`/`calibrate`/`gc` — the climbed rung, needing
+> Postgres and a provider key). Only `dev` and `build` are designed, not
+> implemented — each prints an honest notice and exits `2` (inside a scaffolded
+> project, `pnpm dev` / `pnpm build` cover local work).
 > [`docs/status.md`](https://github.com/panaversity/ksor/blob/main/docs/status.md)
-> and the released version number are authoritative for implemented
+> and the released version number are authoritative for the exact released
 > functionality.
 
 Full concept, design goals, and project status: