@polderlabs/bizar 8.0.0 → 9.0.0

package/.claude/worktrees/kanban-overhaul/docs/releases/v2.3.0.md

@@ -0,0 +1,96 @@
+# Release Notes — `@polderlabs/bizar@2.3.0`
+
+**Date:** 2026-06-18
+**Tag:** `v2.3.0` (CLI)
+**Companion plugin release:** `@polderlabs/bizar-plugin@0.5.4`
+
+## TL;DR
+
+**The CLI is now `bizar`.** The old `bizarharness` command is gone. New `bizar update` subcommand updates the cline CLI, `@polderlabs/bizar`, and `@polderlabs/bizar-plugin` in one go. All in-repo references are updated.
+
+The old `@polderlabs/bizarharness` package is **deprecated** — install the new one with `npm install -g @polderlabs/bizar` and use the `bizar` command.
+
+## What's in 2.3.0
+
+### Renamed: `bizarharness` → `bizar`
+
+- The CLI bin in `package.json` is now `bizar` (was `bizarharness`).
+- All help text, error messages, and examples use the new name.
+- The npm package is renamed to `@polderlabs/bizar` (was `@polderlabs/bizarharness`).
+
+### New: `bizar update` subcommand
+
+Update the cline CLI, the `@polderlabs/bizar` package, and/or the `@polderlabs/bizar-plugin` package in one command. The default mode prompts for each component; `--all` and explicit subcommands skip prompts.
+
+| Form | What it does |
+|---|---|
+| `bizar update` | Interactive: prompt for each component |
+| `bizar update --all` | Update everything non-interactively (CI-friendly) |
+| `bizar update cline` | Update only the cline CLI |
+| `bizar update bizar` | Update only `@polderlabs/bizar` |
+| `bizar update plugin` | Update only `@polderlabs/bizar-plugin` |
+| `bizar update --help` | Show the help text |
+
+Each update first reports installed vs. latest version, then runs the appropriate installer:
+- `cline upgrade` (with `npm install -g cline@latest` as fallback)
+- `npm install -g @polderlabs/bizar@latest`
+- `npm install -g @polderlabs/bizar-plugin@latest`
+
+After any package update, `bizar update` re-runs the install script (`install.sh`) so the locally deployed plugin source matches the just-installed npm version. This fixes the BUGS.md "version skew" trap — pre-2.3.0, the installed plugin could be one version behind the registry.
+
+## What's not in 2.3.0
+
+- No breaking changes for users who already used `bizarharness`. The new command is `bizar`; update your shell alias or scripts accordingly.
+- The brand name "BizarHarness" is preserved in titles, project metadata, and the GitHub repo name.
+- The `.bizar/` project directory and `plugins/bizar/` plugin directory names are unchanged.
+
+## Upgrade from `bizarharness`
+
+If you're already on the old name:
+
+```bash
+# 1. Install the new package
+npm install -g @polderlabs/bizar
+
+# 2. Verify
+bizar --help
+
+# 3. (One-time) Re-run the install script from the BizarHarness source
+#    to update the deployed plugin from bizarharness-plugin to bizar-plugin
+cd /path/to/BizarHarness
+./install.sh
+
+# 4. (Optional) Uninstall the old package
+npm uninstall -g @polderlabs/bizarharness
+npm uninstall -g @polderlabs/bizarharness-plugin
+```
+
+The old `@polderlabs/bizarharness` and `@polderlabs/bizarharness-plugin` packages are deprecated on npm — installs will print a deprecation notice pointing to the new names.
+
+## Test counts
+
+| Suite | Count |
+|---|---|
+| `@polderlabs/bizar-plugin` tests (companion release) | 502 pass, 0 fail |
+| `@polderlabs/bizar` CLI tests | n/a (this is a CLI; smoke-tested via `--help`) |
+| Demo dashboard tests (bizar-demo) | 5 pass / 4 skipped (9 with `BIZAR_HOST=1`) |
+| `npm audit` | 0 vulnerabilities |
+
+## Files changed
+
+57 files across the BizarHarness repo:
+- `package.json` (CLI), `plugins/bizar/package.json` (plugin)
+- `cli/bin.mjs` (rewrote help + dispatch), `cli/update.mjs` (NEW), `cli/install.mjs`, `cli/export.mjs`, `cli/plan.mjs`, `cli/plan-templates.mjs`, `cli/utils.mjs`
+- `install.sh`
+- `config/AGENTS.md`, `config/agents/odin.md`, `config/commands/{audit,init}.md`, `config/hooks/README.md`
+- `config/skills/bizar/{SKILL.md,README.md}` (renamed folder)
+- `plugins/bizar/src/*.ts`, `plugins/bizar/tests/*.ts`, `plugins/bizar/index.ts`, `plugins/bizar/README.md`
+- `README.md`, all 19 `wiki/*.md`, `docs/releases/v0.5.2.md`, `wiki/Changelog.md`
+
+## Related
+
+- v0.5.2 — postmortem Layer 1 fix (1s startup timeout on `client.session.list()`)
+- v0.5.0 — plan side-effects wiring
+- [Bizar Plugin wiki](../../wiki/Bizar-Plugin.md)
+- [Commands Reference wiki](../../wiki/Commands-Reference.md)
+- [Postmortem: 2026-06-18 startup hang](../postmortems/2026-06-18-plugin-state-deadlock.md)

package/.claude/worktrees/kanban-overhaul/docs/releases/v3.24.0.md

@@ -0,0 +1,155 @@
+# Release Notes — `@polderlabs/bizar@3.24.0`
+
+**Date:** 2026-06-29
+**Tag:** `v3.24.0`
+**Companion dashboard release:** `bizar-dash` v3.24.0
+
+## TL;DR
+
+**The Hindsight MCP is gone. Bizar Memory Service replaces it.** Memory is now local-first: notes are Obsidian-compatible Markdown files with strict YAML frontmatter, stored in a Git-managed vault, and synced via standard `git pull / commit / push`. No external API keys. No hosted service. No network calls between you and your memory.
+
+Phase 1 ships the full Markdown + Git stack — the `bizar memory` CLI, the `/api/memory/*` dashboard routes, schema validation, secret scanning, and back-compat with the legacy `/api/obsidian/*` surface. Phase 2 will wire the existing `mods-examples/lightrag/` server in as a derived retrieval index, rebuildable from Markdown on demand.
+
+## The three-layer model
+
+```
+   ┌─────────────────────────────────────────────┐
+   │ Layer 1: Markdown is truth                  │  ← canonical store
+   │   .obsidian/  or  ~/.local/share/bizar/…    │     (frontmatter + body)
+   ├─────────────────────────────────────────────┤
+   │ Layer 2: Git is collaboration               │  ← sync + version control
+   │   bizar memory pull / commit / push / sync  │     (branches, conflicts)
+   ├─────────────────────────────────────────────┤
+   │ Layer 3: LightRAG is derived index (P2)     │  ← semantic retrieval
+   │   bizar memory reindex                       │     (stub in Phase 1)
+   └─────────────────────────────────────────────┘
+```
+
+Markdown is canonical. Reindexing rebuilds the LightRAG index from Markdown at any time — never the other way around. You can rip out the LightRAG layer and the system keeps working: it's a cache, not a source of truth.
+
+## Two modes
+
+| Mode | Vault location | Default? |
+|---|---|---|
+| `local-only` | `<project>/.obsidian/` | **Yes** — best for single-project use |
+| `managed` | `~/.local/share/bizar/memory/<repoName>/` | Opt-in — best for cross-project sharing |
+
+Pick `managed` at `bizar init` time, or run `bizar memory link <repo>` on any existing project. The `managed` repo splits into three namespaces:
+
+| Namespace | Purpose |
+|---|---|
+| `projects/<projectId>/` | Per-project memory — conventions, ADRs, bugs, commands |
+| `global/bizar/` | Cross-project knowledge — agent patterns, Bizar internals |
+| `users/<userId>/` | Personal scratch — user preferences, todos, draft thoughts |
+
+## What's in 3.24.0
+
+### New CLI: `bizar memory <sub>`
+
+Eleven subcommands cover the full lifecycle of a memory note:
+
+| Subcommand | Purpose | Example |
+|---|---|---|
+| `init` | Create `.bizar/memory.json` and the per-project vault | `bizar memory init --memory-mode local-only` |
+| `status` | Show mode, link target, dirty files, last sync | `bizar memory status` |
+| `link` | Bind the project to a managed memory repo | `bizar memory link ~/.local/share/bizar/memory/work/` |
+| `unlink` | Detach from managed mode (vault stays on disk) | `bizar memory unlink` |
+| `pull` | `git pull` the linked memory repo | `bizar memory pull` |
+| `commit` | Stage dirty notes + run secret scan + `git commit` | `bizar memory commit -m "add auth ADR"` |
+| `push` | `git push` the linked memory repo | `bizar memory push` |
+| `sync` | pull → reindex → commit → push (the common path) | `bizar memory sync` |
+| `reindex` | Rebuild the derived LightRAG index (Phase 2 stub) | `bizar memory reindex` |
+| `conflicts` | List notes with merge conflicts awaiting resolution | `bizar memory conflicts` |
+| `doctor` | Run schema + secrets + Git health checks | `bizar memory doctor` |
+
+### New dashboard routes: `/api/memory/*`
+
+Eighteen REST endpoints for programmatic access. Legacy `/api/obsidian/*` routes are preserved with back-compat response shapes so existing integrations keep working.
+
+The full route list (18): `/status`, `/notes` (GET/POST), `/notes/:id` (GET/PUT/DELETE), `/search`, `/schema/validate`, `/secrets/scan`, `/git/pull`, `/git/commit`, `/git/push`, `/git/sync`, `/git/conflicts`, `/reindex`, `/link`, `/unlink`, `/doctor`.
+
+### Schema and secrets
+
+Required frontmatter: 8 fields (`memory_id`, `type`, `project_id`, `status`, `confidence`, `created`, `updated`, `tags`). Recognized: 11 memory types, 6 statuses (`active`, `superseded`, `stale`, `conflict`, `draft`, `archived`), 3 confidences (`verified`, `inferred`, `speculative`).
+
+Every note passing through `bizar memory sync` (or `commit`) is scanned against 12 secret patterns defined in `bizar-dash/src/server/memory-secrets.mjs`. HIGH-severity matches (PEM private keys, AWS access keys, GitHub PATs, Stripe live keys, bearer tokens) **block the commit**. MEDIUM-severity matches (test API keys, absolute paths, private IPs) **warn but allow**.
+
+## Migration from Hindsight
+
+The Hindsight MCP is disabled by default as of 3.24.0. If you're upgrading from a previous version:
+
+1. **Pull the new release** — `npm update -g @polderlabs/bizar` or `git pull && ./install.sh` from source.
+2. **Re-initialize project memory** — `bizar init` now prompts for memory mode and writes `.bizar/memory.json`. The default is `local-only`.
+3. **Migrate existing notes (optional)** — Hindsight notes are not auto-migrated. Export from the Hindsight dashboard and import as Markdown files into `<project>/.obsidian/`. The Memory Service schema requires the 8-field frontmatter; you may need to massage the imports with `bizar memory schema/validate` (or `POST /api/memory/schema/validate`).
+4. **Drop the Hindsight env var** — `HINDSIGHT_API_KEY` is no longer read. The `bizar memory` command family is the replacement.
+
+## Files added
+
+**CLI:**
+- `cli/memory.mjs` (702 lines — 11 subcommands)
+- `cli/memory-constants.mjs` (59 lines — schema enums)
+- `cli/atomic.mjs` (atomic write helpers)
+
+**Dashboard:**
+- `bizar-dash/src/server/yaml.mjs` (YAML frontmatter parser — no external dep)
+- `bizar-dash/src/server/memory-store.mjs` (CRUD over the vault)
+- `bizar-dash/src/server/memory-schema.mjs` (validator + types/statuses/confidences)
+- `bizar-dash/src/server/memory-secrets.mjs` (12 secret patterns)
+- `bizar-dash/src/server/memory-git.mjs` (pull/commit/push/conflicts)
+- `bizar-dash/src/server/routes/memory.mjs` (18 REST endpoints)
+
+**Tests:**
+- 7 new test files under `bizar-dash/tests/` — YAML parser, schema, secrets, store, git ops, sync orchestrator, back-compat.
+
+## Files modified
+
+- `cli/bin.mjs` — new `memory` dispatch wired in
+- `cli/init.mjs` — memory.json write + memory mode prompt
+- `bizar-dash/src/server/api.mjs` — lazy import + router registration
+- `bizar-dash/src/server/routes/obsidian.mjs` — back-compat rewrite (legacy response shapes preserved)
+- `install.sh` — memory service bootstrap step (creates vault on first install)
+- `config/skills/obsidian/SKILL.md` — replaced with Memory Service guide
+- `.bizar/PROJECT.md`, `.bizar/AGENTS_SELF_IMPROVEMENT.md` — memory section + entry
+
+## LightRAG status
+
+`bizar memory reindex` is a STUB for Phase 1. It returns a "not yet implemented" notice and exits cleanly. Phase 2 will integrate the existing `mods-examples/lightrag/` server as the derived retrieval index, rebuildable from Markdown at any time. Until then, retrieval is grep and full-text search over Markdown — fast, local, and dependency-free.
+
+## Test counts
+
+| Suite | Count |
+|---|---|
+| Dashboard tests (bizar-dash) | +85 pass (Phase 1 add) |
+| YAML parser | 12 tests |
+| Schema validator | 14 tests |
+| Secret scanner | 9 tests |
+| Memory store CRUD | 18 tests |
+| Git ops (pull/commit/push/conflicts) | 16 tests |
+| Sync orchestrator | 8 tests |
+| Back-compat (legacy `/api/obsidian/*`) | 8 tests |
+
+## Upgrade from `v3.23.x` and earlier
+
+```bash
+# npm path
+npm update -g @polderlabs/bizar
+
+# source path
+cd BizarHarness
+git pull
+./install.sh
+
+# Re-initialize project memory (in each project you want to keep memory for)
+cd ~/my-project
+bizar memory init
+```
+
+The installer is idempotent. If you opt into `managed` mode, the first `bizar memory sync` will create the shared repo and push the initial commit.
+
+## Related
+
+- [Commands Reference → Memory Commands](../../wiki/Commands-Reference.md#memory-commands)
+- [FAQ → Memory Service](../../wiki/FAQ.md#memory-service)
+- [Troubleshooting → Memory Service entries](../../wiki/Troubleshooting.md#memory-service-not-working-or-memory-errors)
+- [Installation → Memory bootstrap step](../../wiki/Installation.md#memory-bootstrap-step)
+- [Wiki Changelog](../../wiki/Changelog.md) — full version history

package/.claude/worktrees/kanban-overhaul/docs/releases/v4.0.0.md

@@ -0,0 +1,123 @@
+# Release Notes — `@polderlabs/bizar@4.0.0`
+
+**Date:** 2026-06-29
+**Tag:** `v4.0.0`
+**Status:** BREAKING — restructured package layout
+
+## TL;DR
+
+`@polderlabs/bizar` is now a single npm package. The dashboard server (`@polderlabs/bizar-dash`), the cline plugin (`@polderlabs/bizar-plugin`), and the typed SDK (`@polderlabs/bizar-sdk`) are no longer separately published — they ship as sub-directories of the unified root package. One install, one `node_modules/`, one lockfile.
+
+This is a major version bump because the package layout changed. Existing v3 users only need to upgrade their install command (`npm install -g @polderlabs/bizar@latest`) — every component is still bundled.
+
+## What changed
+
+- **One package instead of four.** `@polderlabs/bizar` now includes the dashboard server, the cline plugin, and the typed SDK.
+- **No more separate publishes.** `@polderlabs/bizar-dash`, `@polderlabs/bizar-plugin`, and `@polderlabs/bizar-sdk` are removed from the npm registry as standalone packages.
+- **Sub-directories stay.** `bizar-dash/`, `plugins/bizar/`, and `packages/sdk/` remain in the repo as sub-directories of the unified package. The source layout is unchanged — only the npm package boundaries moved.
+- **`workspaces` removed.** Root `package.json` no longer declares `"workspaces": ["packages/*"]`. The SDK is built with a direct `tsc -p packages/sdk/tsconfig.json` invocation.
+- **Single `node_modules/`.** Root `node_modules/` is now the single install target. The plugin's `node_modules/` is no longer bundled on deploy (the SDK is part of the same package now).
+- **`engines` declaration added.** `engines: { "node": ">=18", "bun": ">=1.1.0" }` declares bun as a runtime requirement (needed for plugin tests).
+- **`allowScripts` declaration added.** `better-sqlite3@12.11.1` is explicitly allow-listed so npm does not skip its native build step.
+- **Memory Service (Phase 1) ships.** The new `bizar memory <sub>` family, dashboard `/api/memory/*` routes, schema validator, secret scanner, and Git-backed sync (released in v3.24.0) are part of v4.0.0.
+
+## Migration
+
+### For existing v3 users
+
+```bash
+npm install -g @polderlabs/bizar@latest
+```
+
+That's it. The dashboard, plugin, and SDK are all bundled in the new package. No separate `npm install -g @polderlabs/bizar-dash` step is needed (and it would no-op anyway — the dashboard is no longer published as a standalone package).
+
+### For contributors (source layout)
+
+If you have a `git clone` checkout:
+
+1. `git pull` to fetch the v4.0.0 tag.
+2. `rm -rf node_modules` (if you previously had workspaces installed).
+3. `npm install` from the repo root to regenerate the lockfile and `node_modules/`.
+4. Re-run `./install.sh` to refresh `~/.config/cline/plugins/bizar/` and `~/.config/cline/cline.json`.
+
+### For internal imports
+
+Imports between the four former packages now use relative paths. The plugin imports the SDK via `./packages/sdk/src/index.js` style paths instead of `@polderlabs/bizar-sdk`. The dashboard server's internal imports were also rewritten.
+
+## File map (old → new)
+
+| Old (v3) | New (v4) |
+|---|---|
+| `bizar-dash/package.json` (`@polderlabs/bizar-dash`) | `package.json` (deps merged into root) |
+| `plugins/bizar/package.json` (`@polderlabs/bizar-plugin`) | `package.json` (deps merged into root) |
+| `packages/sdk/package.json` (`@polderlabs/bizar-sdk`) | `package.json` (deps merged into root) |
+| `workspaces: ["packages/*"]` in root | (removed) |
+| `node_modules/@polderlabs/bizar-sdk` (symlink) | `packages/sdk/` (consumed as relative import) |
+| `node_modules/@polderlabs/bizar-dash/` (post-install copy) | (no longer needed; SDK ships inside the same package) |
+| `install.sh` npm-installs 2 packages | `install.sh` installs 1 package |
+| `install.sh` copies plugin's bundled `node_modules/` | (removed — SDK is internal) |
+| `install-state.json` tracks `bizar-dash` version | `install-state.json` only tracks `bizar` version |
+
+## Test counts
+
+- **Plugin tests** (`bun test`): 13 test files covering loop detection, block reasoning, stall detection, background delegation, plan actions, command dispatch, key rotation, and reasoning cleanup.
+- **SDK tests** (`vitest run`): SDK contract tests for HTTP + SSE protocol types.
+- **Dashboard tests** (`node --test`): 18 test files covering YAML parser, memory store, schema, secrets, Git ops, sync, back-compat, mod lifecycle, dashboard ports, and submit-feedback.
+- **Total**: 85 new tests in v3.24.0 (Memory Service Phase 1), all passing. v4.0.0 itself adds no new tests — the restructure is mechanical.
+
+## Notes for contributors
+
+### Bun requirement
+
+Plugin tests use `bun test`. The new `engines` declaration makes this an explicit requirement:
+
+```bash
+# Install bun (one-time)
+curl -fsSL https://bun.sh/install | bash
+
+# Run plugin tests
+bun test plugins/bizar/tests/loop.test.ts
+```
+
+Node alone cannot execute the plugin tests — they depend on Bun's `bun:test` API and Bun-specific module resolution.
+
+### Lockfile regeneration
+
+After editing the consolidated root `package.json`, regenerate the lockfile from the repo root:
+
+```bash
+rm -f package-lock.json
+npm install --package-lock-only
+```
+
+The lockfile is gitignored (`.gitignore` line 2), so it is not committed. Each developer regenerates it locally.
+
+### Building the SDK
+
+The SDK is built with a direct `tsc` invocation:
+
+```bash
+npm run build:sdk         # tsc -p packages/sdk/tsconfig.json
+```
+
+Or run the SDK tests directly:
+
+```bash
+npm run test:sdk          # vitest run, via packages/sdk/package.json
+```
+
+### `package.json` scripts
+
+The root `package.json#scripts.test` now runs every test suite in one command:
+
+```bash
+npm test                  # typecheck + SDK tests + bun plugin tests + node dashboard tests
+```
+
+This replaces the old workspace-scoped commands (`npm run test -w @polderlabs/bizar-sdk`) which no longer work without workspaces.
+
+## What's next
+
+v4.0.0 is a structural release — no new features. The Memory Service Phase 1 (already shipped in v3.24.0) is the headline feature; v4.0.0 just consolidates the package layout to make the codebase easier to install and contribute to.
+
+Phase 2 of the Memory Service (wire the `mods-examples/lightrag/` server as the derived retrieval index) will be the next major addition.

package/.claude/worktrees/kanban-overhaul/docs/releases/v7.0.0.md

@@ -0,0 +1,173 @@
+# Release Notes — `@polderlabs/bizar@7.0.0`
+
+**Date:** 2026-07-12
+**Tag:** `v7.0.0`
+**Status:** MAJOR — dashboard redesign + carried v6.5.0 work
+
+## TL;DR
+
+v7.0.0 lands the F-040 dashboard redesign: a custom `ui/` design
+system under `bizar-dash/src/web/ui/` (controls, data, feedback,
+layout, navigation, primitives, theme, tokens) plus three view
+rewrites (Overview, Agents, Tasks). It also carries the v6.5.0
+work (F-037 migration gap cleanup, F-038 federation skeleton,
+F-039 Byzantine consensus) that had been prepared but not
+published.
+
+> **Honest scope note:** the *infrastructure* for live agent
+> status and history (REST API, agents-store with on-disk
+> persistence, WebSocket broadcast, 11 `/api/agents/*` endpoints,
+> `/api/history` aggregator) is fully present and exercised by
+> the UI. The *hook-driven auto-feed* — hooks that POST to
+> `/api/agents/:name/status` as Claude Code tools fire — is **not**
+> wired in this release. That was the deferred PR #2. Until that
+> lands, agents show "idle" by default; the Agents and History
+> views surface data from manual `status` POSTs and CLI
+> operations, not from the live Claude Code session loop.
+
+## What changed
+
+### F-040 — Dashboard redesign (PR #3)
+
+- **New design system.** `bizar-dash/src/web/ui/` ships with 42
+  components across 7 categories (10 controls, 8 data widgets,
+  6 feedback, 7 layout, 3 navigation, 6 primitives, theme +
+  tokens + utilities). All tokenized via
+  `bizar-dash/src/web/ui/styles/tokens.css`; themeable via
+  `bizar-dash/src/web/ui/theme/ThemeProvider.tsx`.
+- **Three view rewrites.** `Overview.tsx`, `Agents.tsx`,
+  `Tasks.tsx` rewritten on the new design system.
+- **123 dashboard test files.** 41 component tests under
+  `tests/ui/`, 82 view + integration tests under `tests/`.
+- **Diff:** 113 files changed, +13,358 / −987 lines (per
+  F-040 commit `68bd713`).
+- **Migration guide:** `docs/dashboard-ui-migration.md` covers
+  what changed for mod authors and how the new tokens replace
+  the legacy `styles/` ad-hoc CSS.
+
+### v6.5.0 carryover (F-037 / F-038 / F-039)
+
+These were prepared and committed before v7.0.0 but never
+published. v7.0.0 ships them:
+
+- **F-037 — Migration gap cleanup.** Stale Cline-era docstrings
+  removed; two pre-existing SDK TS errors fixed
+  (`federation/trust.ts` unused `_now`, `federation/index.ts`
+  dropped redundant re-imports).
+- **F-038 — Cross-installation agent federation skeleton.**
+  Eight modules under `packages/sdk/src/federation/`:
+  `envelope.ts`, `hmac.ts`, `pii.ts`, `trust.ts`, `policy.ts`,
+  `audit.ts`, `budget.ts`, `index.ts`. Plus the
+  `federation_status` MCP tool.
+- **F-039 — Hive-mind Byzantine consensus.** Four modules under
+  `packages/sdk/src/consensus/` plus the `consensus_propose`
+  MCP tool. 3-of-5 majority for review/decision steps; PBFT
+  pre-prepare/prepare/commit/reply phases.
+
+### Version bumps
+
+| Manifest | Was | Now |
+|---|---|---|
+| `package.json` (`@polderlabs/bizar`) | 6.5.0 | 7.0.0 |
+| `plugins/bizar/package.json` (`@polderlabs/bizar-plugin`) | 6.3.0 | 7.0.0 |
+| `packages/sdk/package.json` (`@polderlabs/bizar-sdk`) | 0.4.0 | 0.5.0 |
+
+SDK bumps minor (0.4.0 → 0.5.0) because F-040 is UI-only; no
+breaking SDK API changes.
+
+## Dashboard surface (v7.0.0)
+
+- **18 built-in tabs:** Overview, Chat, Agents, Glyphs, Tasks,
+  Activity, Active, Skills, Memory, Mods, Schedules, History,
+  Usage, Eval, Doctor, Harness, Goals, Settings.
+- **24 view files** under `bizar-dash/src/web/views/`.
+- **46 server route modules** under `bizar-dash/src/server/routes/`.
+- **23 MCP tools** in `BIZAR_TOOLS` (memory, plan, loop, graph,
+  danger, agent, swarm, route, distill, hooks, consensus,
+  federation, etc.).
+- **7 hook scripts** under `.claude/hooks/`: `pretooluse-bash`,
+  `pretooluse-editwrite`, `posttooluse-editwrite`,
+  `sessionstart-prime`, `sessionend-recall`,
+  `userpromptsubmit-tag`, `worker-suggest`.
+- **11 `/api/agents/*` endpoints** with on-disk status
+  persistence (`~/.config/bizar/agent-status.json`) and
+  WebSocket broadcast on every mutation.
+- **13-agent hierarchy** (Odin → Tyr/Thor/Hermod/Baldr/Mimir
+  → Heimdall/Frigg/Vor, plus Forseti as auditor peer, Vidarr
+  as fallback, Quick as standalone).
+
+### Agent + History live data — current state
+
+| Surface | Status | Source |
+|---|---|---|
+| Agents view (UI) | ✅ Wired | reads `/api/agents`, polled via parent snapshot |
+| Agent status persistence | ✅ Wired | on-disk JSON, survives restart |
+| Hierarchy + tags + stuck detection | ✅ Wired | server-side, no client work |
+| `/api/agents/:name/status` POST | ✅ Wired | accept status updates from anywhere |
+| **Hook-driven status updates** | ❌ **NOT wired** | no hook POSTs as tools fire |
+| **Hook-driven heartbeat** | ❌ **NOT wired** | no hook bumps `/heartbeat` |
+| **Session-end stuck cleanup** | ❌ **NOT wired** | no hook flips stuck→idle on session end |
+| History view (UI) | ✅ Wired | reads `/api/history` |
+| `/api/history` aggregator | ✅ Wired | activity-log + tasks + plans + projects |
+| **Hook-driven activity entries** | ⚠️ **Partial** | `worker-suggest.mjs` writes suggestions; general activity log is populated by manual operations |
+
+The hooks needed to populate the running-agents feed without
+manual intervention are exactly what was in PR #2. That PR was
+closed during v7.0.0 release scoping and is the next feature
+to land.
+
+## Test counts (post-v7.0.0)
+
+- **SDK tests** (`vitest run`): 294 / 294 passing across 18 files.
+- **CLI tests** (`node --test`): 109 / 109 passing across 36 files.
+- **Path-safe test**: 9 / 9 passing.
+- **Web tests** (`vitest run`): 582 / 586 passing.
+  - **4 pre-existing failures** in `tests/a11y/forms.test.tsx`,
+    last touched in v5.3.0 (`a7b0b3d`), unrelated to F-040.
+    Documented in PROGRESS.md as baseline failures.
+- **Build (`npm run build`)**: typecheck 0 errors,
+  `vite build` clean in ~2.1s.
+
+## Notes for contributors
+
+### New design system
+
+Mod authors: the legacy `styles/main.css` is auto-merged but the
+new design system is at `bizar-dash/src/web/ui/`. New mods should
+import from the design system, not hand-roll CSS. See
+`docs/dashboard-ui-migration.md` for the mapping.
+
+### Agent data plumbing
+
+To push status updates from anywhere in v7.0.0, POST to:
+
+```
+POST /api/agents/:name/status
+{ "status": "idle|working|error|stuck", "currentTaskId": "..." }
+POST /api/agents/:name/heartbeat
+```
+
+The `agents-store` persists to `~/.config/bizar/agent-status.json`
+and the route broadcasts `agents:change` on the WebSocket. The
+`Agents` view re-renders on the next snapshot poll.
+
+### Federation + consensus
+
+`@polderlabs/bizar-sdk@0.5.0` exposes the federation and consensus
+modules. See `packages/sdk/src/federation/index.ts` and
+`packages/sdk/src/consensus/index.ts` for the public surface, and
+`docs/decisions/` for the design records.
+
+## What's next
+
+- **v7.1 (or v7.0.1)** — Live agent data feed. Re-open the
+  agent-tool-detect and session-end-cleanup hooks from PR #2.
+  This is the prerequisite for the Agents view to show running
+  agents without manual `status` POSTs.
+- **Goal Planner wire-up** — the Goals tab UI is in
+  `GoalPlanner.tsx` (F-036); the underlying planner routes are
+  present but the live link to MCP `agent_spawn` is still
+  partial.
+- **Mods SDK refresh** — the F-040 design system exposes a
+  cleaner surface for mod authors; current mods still ship
+  legacy CSS alongside.