@ssheleg/agent-sync 1.19.2 → 1.19.3

package/CHANGELOG.md

@@ -1,3 +1,34 @@
+## v1.19.3 — the boundary ships with the skill, and two descriptions stop looking like drift
+
+Close-out of the 2026-09-06 family audit (wave AUDIT-WAVE-0906). One bullet
+enters the skill body, one decision gets a written home; no behaviour changes.
+
+- **The refusal the operator's routing block promises now travels with the
+  skill.** The routing doctrine names this router's boundary — a file in a
+  project where coordination is on — and a waiver, **"no coordination" /
+  «без координации»**, and neither phrase appeared anywhere in the shipped
+  `SKILL.md`: a standalone install advertised no refusal at all. One bullet in
+  Non-negotiables now carries both. The body had **3 tokens of headroom**
+  (~4747/4750 against the house working limit), so the line displaced prose
+  rather than joining it — standing instruction 7 — and the auditor was watched
+  refusing both oversteps on the way: a first draft measured 4753
+  (`GAP BODY_HEADROOM`), the second exactly 4750 and still refused, the shipped
+  text ~4746/4750 after trimming one motivational sentence from the `status`
+  section and three words from the `$SKILL_DIR` paragraph. `audit_skill.py
+  --house`: **0 GAP, 15 PASS**.
+- **`plugin.json` and `marketplace.json` describe this plugin in two entirely
+  different texts — now recorded as deliberate, which is what makes it
+  distinguishable from drift.** The audit's finding was not that the texts
+  differ but that nothing RECORDED whether they should, and a sibling shipped
+  accidental manifest drift this same week. They should: the marketplace entry
+  is the storefront read before install and carries the lease doctrine in full —
+  that surface is where the 1.5.2 audit caught this repo selling the refuted
+  no-CAS design, and `check_doctrine_is_current` still watches it — while
+  `plugin.json` is the installed listing's one-line layer summary. JSON takes no
+  comment, so the decision lives where this board's decisions live
+  (`docs/evidence/backlog.md`, beside B-002 and B-004), naming both texts and
+  which surface reads which.
+
 ## [1.19.2] - 2026-09-04
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/agent-sync",
-  "version": "1.19.2",
+  "version": "1.19.3",
   "description": "Let concurrent coding agents share one project without colliding — leases with TTL, race-free id reservation, a run journal and a generated board, over a pluggable knowledge cloud.",
   "bin": {
     "agent-sync": "bin/agent-sync.js"

package/plugins/agent-sync/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "agent-sync",
   "displayName": "Agent Sync",
-  "version": "1.19.2",
+  "version": "1.19.3",
   "description": "Coordination layer for multi-agent repositories — leases with TTL, race-free ID reservation, a run journal, a cross-repo signal feed and a generated board, over a pluggable knowledge cloud.",
   "author": {
     "name": "ssheleg",

package/plugins/agent-sync/skills/agent-sync/SKILL.md

@@ -4,7 +4,7 @@ description: "Use when several coding agents work one repository at the same tim
 compatibility: "Requires the task-pipeline skill for its stages (npx sshlg-skills install). Needs python3 3.9+ (stdlib only, HTTP included - nothing to pip install) and bash for the hooks. The knowledge backend is configured per project; with none configured it degrades to git-file leases. Enforcement hooks are Claude Code only - on other agents the same checks run as a self-check."
 license: MIT
 metadata:
-  version: "1.19.2"
+  version: "1.19.3"
   author: ssheleg
 ---
 
@@ -145,9 +145,6 @@ cannot give two answers about one project.
   away — watermarked per run, so it stays quiet until something changes. A dependency that
   moved may unblock what you planned, or invalidate it.
 
-An agent that skips this block will re-derive work someone else is doing and act on a
-dependency state that changed an hour ago.
-
 What else `status` decides: no credentials → degraded mode, reported, and it continues;
 `task-pipeline` absent → it prints the install line and stops. Do not improvise a substitute
 flow — without those stages there is nothing to bind to.
@@ -187,7 +184,7 @@ npx sshlg-skills install
 
 `$SKILL_DIR` is this skill's own directory: `${CLAUDE_PLUGIN_ROOT}/skills/agent-sync` under
 the Claude Code plugin, `~/.agents/skills/agent-sync` elsewhere. Resolve it once per session
-and reuse it — do not guess. Every command reads `.claude/agent-sync.json` from the project
+and reuse it. Every command reads `.claude/agent-sync.json` from the project
 root and needs no arguments beyond those listed.
 
 ## One identity per session, and how it is decided
@@ -326,6 +323,8 @@ the parent; a service repo listing the parent's decision register is a config de
 - Two agents in one checkout are two identities, or the lease is decoration.
 - A submodule commit is unfinished until the parent points at it — run `finish`.
 - Everything the cloud holds about a durable fact is a link to git, never a substitute.
+- Boundary: `.claude/agent-sync.json`. None, or one agent alone — route past. The
+  operator's waiver: "no coordination" / «без координации».
 
 ## References
 

package/plugins/agent-sync/skills/agent-sync/scripts/agent_sync.py

@@ -33,7 +33,7 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
-VERSION = "1.19.2"
+VERSION = "1.19.3"
 
 CONFIG_PATH = Path(".claude/agent-sync.json")
 ENV_FILE = Path(".env.agent-sync")