@tera-system/pro 0.2.14 → 0.2.16

package/MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "name": "@tera-system/pro",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "description": "Build manifest for the Tera System Pro commercial plugin component (THIN mode — content served from teranoo.com signed bundle).",
   "compatibleEnvironments": [
     "opencode"
@@ -8,20 +8,20 @@
   "minOpencodeVersion": "1.18.16",
   "mode": "thin",
   "content": {
-    "agents": 20,
+    "agents": 23,
     "commands": 11,
     "coreFiles": 112,
     "tools": 8,
     "projectControlTemplates": 1,
     "assets": 49
   },
-  "bundleRef": "core-bundle-v0.2.14.signed.json (SHA256 CF02CA7939BE55DC73B71212B53F73D6CF4CB434C4F580613BFFF3448CBA23E9)",
-  "builtAt": "2026-08-30",
+  "bundleRef": "core-bundle-v0.2.16.signed.json (pending build)",
+  "builtAt": "2026-09-02",
   "sha256": {
-    "agents": "259904c525641511d80751a66926ca92d45eddea66adbaea2147c78807223adf",
-    "commands": "c541b6664c067fac5fb85d280448159b9854cf203ecb4112153a621edb94aa90",
-    "core/tera-system": "68a2b5536a4b76a367ecfe0cad2fbd07b17d54d9c3deee0b2ea339a9749c54e3",
-    "tools": "86ec41d886f42ae0faf0ee341abf73ab6abd29380c59246dedc47bcdbb1e7358",
+    "agents": "a90160e2ee05a0b10c0786450045326f6647b14cf9b81b345cdb6e9675cc8258",
+    "commands": "f8c91dab42e41d1f8362edfd816964ceabdbd95e8ebdd02e83ea36f7f805a259",
+    "core/tera-system": "3dbb64268b62c5247cdf25a52d004465c63d0bcfb0d1b31b16c93646e4cd78c2",
+    "tools": "cea993304a3664ceac13685fbfd0bb0e51936236661689fa1fe603a14537ce5e",
     "core/project-control": "cb979181d50e54c9b9b9173ffc890ca021bfaefe9678b1cad4a2f67ceac3dfdd"
   }
 }

package/RELEASES.md

@@ -4,6 +4,35 @@
 
 ---
 
+## 0.2.16 (2026-09-02)
+
+### Security Team — 3 hacker-persona agents + Phase 7 security gate (SCP-2026-09-02-001)
+
+**What changed:**
+- **3 new agents** — `red-team-agent` (الشبح — offensive Red Team), `security-observer` (العين — concurrent observer), `security-auditor` (القاضي — independent auditor issuing the final gate decision: PASS / CONDITIONAL PASS / FAIL / INCOMPLETE)
+- **`SecurityAgent` (الدرع) upgraded** — defensive team member: prepares `defense-handoff.md` + reviews fixes `fix-review.md`
+- **Adversarial Protocol v2.0** — OWASP ASVS 5.0 Level 2 + WSTG + API Top 10: 13 mandatory attack campaigns + strict role separation (attacker ≠ auditor, observer ≠ judge)
+- **Offensive toolkit** — TOOLING_AND_MCP_POLICY §3.7 (Burp/ZAP/Nmap/ffuf/Nuclei/sqlmap/dalfox/Metasploit/John/Hydra/Wireshark/k6) + §3.8 Cloud reference (DigitalOcean — deferred)
+- **Phase 7 Security Gate** — no application delivery without the judge's decision (open Critical/High = no delivery)
+- **Standardized outputs** — `security-reports/` (outside app folder): authorization + attack surface + test log + findings + observer report + audit decision + retest + evidence
+- **Intellectual Honesty Rule §20** — mandatory information classification [Verified]/[Inferred]/[Speculative]/[Unknown]/[Needs Decision]
+
+**Bundle:** pending signed bundle `core-bundle-v0.2.16.signed.json` (requires TERA_PRIVATE_KEY_PATH — production key at Majed).
+
+**Deployment order:** publish npm `0.2.16` FIRST, then update the server bundle (same rule as 0.2.14/0.2.15).
+
+## 0.2.15 (2026-08-31)
+
+### Research library + package info persistence + website deployment info (SCP-2026-08-31-001/002/003)
+
+**What changed:**
+- **Reusable Research Library (SCP-2026-08-31-001)** — `domain-research-agent` now applies Reuse-First (checks `../Teranoo-Research/00_INDEX.md` before any websearch) + a mandatory 4-question score gate (Score≥3 → saves as DRAFT in the private `Teranoo-Research` repo; DRAFT→READY only by Majed). `DOMAIN_INTELLIGENCE_PROTOCOL.md` §10 governs the protocol. The research library is a **separate private repo outside the bundle** — not distributed.
+- **Package/website info persisted (SCP-2026-08-31-002/003)** — `TERA_DISTRIBUTION_POLICY.md` now records the official npm packages (`@tera-system/core`, `@tera-system/pro`), the origin repo `https://github.com/Alabasi1980/Teranoo-System`, the website repo `https://github.com/Alabasi1980/TeraWebsite`, and the deploy panel `https://coolify.teranoo.com/`. Fixed wrong `RepositoryUrl` in docs. `TeraSystemMaintenanceChecklist.md` gained a package-bump reminder.
+
+**Bundle:** ships updated signed bundle `core-bundle-v0.2.15.signed.json` (200 files, contentSha256 643cf7c64502baac53160fadc89dcb361a8b55f6487c1b75faf8c148209aeb09, SHA256 D8566622C3AD4A2BF4E7B2D4CD3F8DE2F1B5537FCCF35B1EA770012D7AFB52FB) to the server.
+
+**Deployment order:** publish npm `0.2.15` FIRST, then update the server bundle (same rule as 0.2.14).
+
 ## 0.2.14 (2026-08-30)
 
 ### Buyable tool access: bin entries + npx commands + sync integrity fix (SCP-2026-08-30-004)
@@ -17,7 +46,7 @@
 
 **Why:**
 - First real buyer trial proved neither `npx` (E404) nor `npm run` (Missing script) reached the package tools — the entry door to the system was broken for every buyer.
-- Bundle content changed (guard text) — this release ships the updated signed bundle `core-bundle-v0.2.14.signed.json` (200 files, contentSha256 cf165c6cb0bc1af0b55c968ae0c493a415ca52a92712b731dc61a5f2a324dfa2) to the server.
+- Bundle content changed (guard text) — this release ships the updated signed bundle `core-bundle-v0.2.14.signed.json` (200 files, contentSha256 5b49116ded49caa3479d95cf96593e6f3d00a463a9f2ab6ca61152c5baf67f67) to the server.
 
 **Deployment order (corrected):** publish npm `0.2.14` FIRST, then update the server bundle. npm-first ensures existing buyers already have the integrity-refresh fix in tera-sync before the bundle content changes; server-first would cause a temporary "modified files" scare for existing buyers running sync with old scripts.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tera-system/pro",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "description": "Tera System Pro — commercial edition (thin): system files are fetched from teranoo.com as a signed bundle; enforced license gate + heartbeat",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",