@passioncode-ai/passioncode 0.1.24 → 0.1.26

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.1.26 - 2026-10-04
+
+### Changed
+
+- **Observatory Log is pinned at `v0.15.0`** (plugin 0.15.0; it was `v0.13.0`, plugin 0.14.0),
+  the Project Observatory 0.15.0 skills. `handling-secrets` gains the header door: `use_secret.py
+  header` hands one HTTP MCP server's bearer to Claude Code's `headersHelper`, from the vault only
+  and only to the server the slot is bound to with `vault.py bind --header-for`. Agents and
+  services take every credential from Observatory by name (`use_secret.py run --vault-only`).
+
+## 0.1.25 - 2026-10-03
+
+### Changed
+
+- **`working-in-passioncode` follows the amended release-approval rule** (knowledge rules §11,
+  operator decision 2026-10-03): any member of `release-approvers` may approve a release run,
+  including the person who pushed the tag. Unchanged: approval is a person's act and an agent
+  never approves a release run, signing happens only in CI, admins cannot bypass, `v*` tags
+  only, and a published release is never rewritten.
+
 ## 0.1.24 - 2026-10-03
 
 ### Changed

package/family.json

@@ -22,7 +22,7 @@
       "name": "observatory-log",
       "displayName": "Observatory Log",
       "repo": "passioncode-ai/project-observatory-dashboard",
-      "ref": "v0.13.0",
+      "ref": "v0.15.0",
       "kind": "plugin",
       "path": "observatory/engine/skill/plugins/observatory-log",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -23,7 +23,7 @@
       "name": "observatory-log",
       "displayName": "Observatory Log",
       "source": "./plugins/observatory-log",
-      "version": "0.14.0",
+      "version": "0.15.0",
       "description": "Records what changed in a watched project at the end of every turn, and asks for the one thing a diff cannot contain: why.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.24",
+      "version": "0.1.26",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,6 +1,6 @@
 {
   "family": "passioncode",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "release": true,
   "members": [
     {
@@ -34,9 +34,9 @@
       "name": "observatory-log",
       "displayName": "Observatory Log",
       "repo": "passioncode-ai/project-observatory-dashboard",
-      "ref": "v0.13.0",
-      "commit": "c7a89125edcd5ee1a8141feb55d4aca2c828e834",
-      "version": "0.14.0",
+      "ref": "v0.15.0",
+      "commit": "acca5c9d293a388cd53d3a2cbdbfabf574308bb4",
+      "version": "0.15.0",
       "via": "clone of https://***@github.com/passioncode-ai/project-observatory-dashboard.git",
       "skills": [
         "explaining-changes",
@@ -49,7 +49,7 @@
       "legacyMarketplaces": [
         "observatory-log"
       ],
-      "contentHash": "sha256:3e1218586122889649881d94fdf892f6a51782dc748c26127a9969376ecdf1eb",
+      "contentHash": "sha256:523f50d6be43845f0ed2b5d497bac17752cbfd3333627a235ab457618cd86dd3",
       "description": "Records what changed in a watched project at the end of every turn, and asks for the one thing a diff cannot contain: why.",
       "author": {
         "name": "PassionCode.ai",
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.24",
+      "ref": "v0.1.26",
       "commit": null,
-      "version": "0.1.24",
+      "version": "0.1.26",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:e754ad6eab6581d2fba7c887b903c4676239a85ceed74010ccec87b631586816",
+      "contentHash": "sha256:01035ebeb36b330a3eabad618a5dbd6f8b826b0d008ffc3651db1c9dca932deb",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/observatory-log/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "observatory-log",
   "displayName": "Observatory Log",
   "description": "Records what changed in a watched project at the end of every turn, and asks for the one thing a diff cannot contain: why.",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "license": "AGPL-3.0-only OR LicenseRef-PassionCode-Commercial",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/observatory-log/skills/explaining-changes/SKILL.md

@@ -15,7 +15,7 @@ description: >-
   decision with different evidence.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.14.0"
+  version: "0.15.0"
 compatibility: >-
   Requires an initialized full Project Observatory installation to persist
   records. Uses its MCP server when available in the current host; the bundled

package/payload/plugins/observatory-log/skills/handling-secrets/SKILL.md

@@ -3,13 +3,14 @@ name: handling-secrets
 description: >-
   Use when an agent needs to store, use, rotate or record exposure of a project's
   credentials through Project Observatory: "use a secret", "rotate a key",
-  "record a leak", «используй ключ», «ротируй ключ», «запиши утечку».
+  "record a leak", "give an agent its keys", «используй ключ», «ротируй ключ»,
+  «запиши утечку», «ключи для агента».
   Keeps credential values out of prompts and command arguments, uses named slots,
   and records changes without copying values into reports. NOT for granting
   provider permissions or choosing a project's authentication architecture.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.14.0"
+  version: "0.15.0"
 compatibility: >-
   Requires an initialized full Project Observatory installation, Python 3.11+
   and local shell access on macOS or Linux. Provider operations additionally
@@ -29,7 +30,7 @@ names. Never ask the user to paste a credential into the conversation.
 2. Select the user's initialized `OBSERVATORY_HOME`. Run
    `project-observatory full doctor`. A missing workspace
    needs the documented onboarding before secret operations.
-3. Run `"$OBSERVATORY_PYTHON" "$OBSERVATORY_ROOT/tools/skill_check.py" handling-secrets 0.14.0`
+3. Run `"$OBSERVATORY_PYTHON" "$OBSERVATORY_ROOT/tools/skill_check.py" handling-secrets 0.15.0`
    (`full agent install` records that interpreter; the stock macOS `python3` is too old).
    If stale, read the installed skill once and follow its compatible commands.
    Do not turn an unavailable version check into a retry loop.
@@ -50,8 +51,10 @@ for it. A name or note shaped like a credential is refused, never stored.
 |---|---|
 | Store a credential supplied locally | `vault.py put PROJECT ENV NAME`, value on stdin |
 | List slots | `vault.py list PROJECT ENV` |
-| Run a command using a slot | `use_secret.py run [--env ENV] PROJECT NAME -- COMMAND ARGUMENTS` (flags before PROJECT) |
+| Run a command using a slot | `use_secret.py run [--env ENV] [--vault-only] PROJECT NAME -- COMMAND ARGUMENTS` (flags before PROJECT) |
 | Receive a value from another local command | `use_secret.py pipe NAME -- COMMAND ARGUMENTS` |
+| Bind a slot to the one MCP server allowed to receive it as a header (the operator, once) | `vault.py bind PROJECT ENV NAME --header-for https://HOST[:PORT]` (a bare host means https); `--clear` removes it; both are journalled |
+| Give an HTTP MCP server its bearer through Claude Code's `headersHelper` | `use_secret.py header [--env ENV] [--name Authorization] [--scheme Bearer] PROJECT NAME`, written into the server's `headersHelper` entry, never run by hand |
 | Populate a project's ignored environment file | `vault.py inject PROJECT ENV DIRECTORY` |
 | Record an exposure | `vault.py leak PROJECT ENV NAME --where "location and evidence, no value"` |
 | Replace a stored value | `vault.py rotate PROJECT ENV NAME`, replacement on stdin |
@@ -77,10 +80,50 @@ not a sandbox: a child process can encode a value, transmit it, or write it to
 another file. Only run the command authorized by the task. Do not claim this
 filter prevents every leak.
 
+**The header door prints a value, so it serves only Claude Code.** `use_secret.py
+header` writes one JSON object (`{"Authorization": "Bearer …"}`) for a
+`headersHelper`, which Claude Code merges into the MCP request rather than the
+conversation. It reads the vault only (never an env file or the environment), and
+refuses unless stdout is a program, `CLAUDE_CODE_MCP_SERVER_URL` names the scheme,
+host and port the slot is bound to, and the value has no control character. Never
+run it yourself, pipe it, or set `CLAUDE_CODE_MCP_SERVER_URL` to make it answer:
+that prints the value into your transcript. Each call is audited. Binding is the
+operator's decision; ask for it, do not run `bind` to make a call succeed.
+
 **Stdin carries one thing.** Never pipe a secret into `python3 -`, `node -` or
 `sh -s`, or combine a secret pipe with a heredoc program. A program goes in a
 file; the secret goes through the named runner. A parse error can echo input.
 
+## Building an agent or a service
+
+**Every credential an agent or a service uses comes from Project Observatory, by
+name.** That holds for a one-shot agent, a long-running agent service and code an
+agent writes for one. Concretely:
+
+- **Issue or store it here.** A provider door issues straight into a slot; a value
+  the user has goes in with `vault.py put PROJECT ENV NAME` (value on stdin).
+- **Discover it by name.** `observatory_credentials` (MCP) or `use_secret.py names
+  PROJECT` list what exists; neither returns a value.
+- **Inject it at run time, from the vault only.** A command: `use_secret.py run
+  --vault-only [--env ENV] PROJECT NAME -- COMMAND`. A long-running service (a launchd
+  job): `use_secret.py serve [--env ENV] --consumer LABEL PROJECT NAME[,NAME] -- COMMAND` in
+  its plist — it replaces itself with the service and records the consumer, so `vault.py
+  rotate` names the services to restart. Set `OBSERVATORY_VAULT_ONLY=1` in an agent's
+  environment so every command it runs refuses a project's `.env` fallback.
+- **No copies.** No `.env` of the agent's own, no key file beside its data, no value
+  in code, configuration, a commit, a prompt, a log or agent memory. A remote
+  platform's copy is recorded with `vault.py moved PROJECT ENV NAME --at PROVIDER`.
+- **Declare what a workflow needs.** A checkpoint carries `credentials: [{project,
+  env, name, purpose}]` — names only, a value is refused. A handoff and its
+  acceptance report each one as `vault`, `env-only` (works, and breaks this rule)
+  or `missing`, with the command to use or store it, and `credentialsMissing` stops
+  the next executor before the step that would fail.
+
+A value written into agent memory by mistake is replaced on the way in by a
+marker that names its slot (`[redacted:vault:PROJECT/ENV/NAME]`); treat that as an
+exposure and record it with `vault.py leak`. The design is
+[AGENT-SECRETS.md](https://github.com/passioncode-ai/project-observatory-dashboard/blob/main/docs/design/AGENT-SECRETS.md).
+
 ## Provider integrations
 
 Cloudflare and OpenRouter have separate tools, `cloudflare.py` and

package/payload/plugins/observatory-log/skills/tracking-resources/SKILL.md

@@ -15,7 +15,7 @@ description: >-
   the repository.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.14.0"
+  version: "0.15.0"
 compatibility: >-
   Requires a full Project Observatory installation with organizations.json
   configured; the observatory MCP server or its local CLI. Creating the resource

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/passioncode/skills/working-in-passioncode/SKILL.md

@@ -211,10 +211,12 @@ to a public surface.
 - **Signing (knowledge rules §11).** A published build is signed only in CI, in the
   repository's protected `release` environment, through `passioncode-ai/.github@v1`
   (`apple-signing`, `notarize`, `sign-sums`, `release-publish`). A member of
-  `release-approvers` who is not the tag's author approves it. No release key lives on a
-  laptop, and a locally signed build is a debug build: never attach it. You act as the person
-  whose account you use, so never approve a release you started; start it and say whose
-  approval is pending. A published release is never rewritten. Rehearse on `vX.Y.Z-rc.N` with
+  `release-approvers` approves it, and that may be whoever pushed the tag (operator,
+  2026-10-03; `prevent_self_review: true` in `.github` `release-signing/products.json`
+  restores four eyes). Admins cannot bypass, and only `v*` tags deploy. No release key lives
+  on a laptop, and a locally signed build is a debug build: never attach it. Approval is a
+  person's act: an agent never approves a release run, even when the account it uses could;
+  start it and say whose approval is pending. A published release is never rewritten. Rehearse on `vX.Y.Z-rc.N` with
   `publish=false`.
 - **Engine** (`project-observatory-dashboard`): contributors send PRs. A `vX.Y.Z` tag on the
   reviewed release commit runs its `release.yml`, which signs and publishes in CI. Machines then