@vaur94/agz-memory 0.4.0 → 0.5.0

package/docs/backup-restore-runbook.tr.md

@@ -2,7 +2,7 @@
 
 [English](backup-restore-runbook.md) | Türkçe
 
-Bu runbook `@vaur94/agz-memory@0.4.0` ve SQLite schema v10 için geçerlidir.
+Bu runbook `@vaur94/agz-memory@0.5.0` ve SQLite schema v11 için geçerlidir.
 
 ## Ön Koşullar
 
@@ -25,19 +25,19 @@ Tahmin edilmiş veya boş bir yolla devam etmeyin.
 Önce salt-okunur sağlık raporu alın:
 
 ```sh
-bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin doctor
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin doctor
 ```
 
 `ok` değeri `true` olmalıdır. `schemaVersion`, satır sayıları ve değişmez kural
 sayılarını kaydedin. Sonra bağımsız doğrulanmış yedek oluşturup yükseltin:
 
 ```sh
-bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin backup
-bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin upgrade --to 10
-bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin doctor
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin backup
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin upgrade --to 11
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin doctor
 ```
 
-Veritabanı v10'dan eskiyse yükseltme ayrıca değişiklikten önce doğrulanmış yedek
+Veritabanı v11'den eskiyse yükseltme ayrıca değişiklikten önce doğrulanmış yedek
 oluşturur. Yazdırılan her manifest yolunu ve SHA-256 değerini saklayın. Son rapor
 `ok: false` ise yazıcı başlatmayın.
 
@@ -54,16 +54,16 @@ Manifest formatı `agz-memory-backup/1` olur. `agz-memory-admin restore`, manife
 ile veritabanının aynı yedek dizinindeki normal dosyalar olduğunu doğrular;
 ardından boyut, SHA-256, SQLite bütünlüğü, foreign key ve satır sayılarını denetler.
 
-Final `0.4.0` ön sürüm manifest formatlarını kabul etmez. Böyle bir yedeği onu
+Final `0.5.0` ön sürüm manifest formatlarını kabul etmez. Böyle bir yedeği onu
 oluşturan ön sürümle geri yükleyin, o sürümün doctor kontrolünü çalıştırın ve
-yalnız bundan sonra geri yüklenen veritabanını `0.4.0` ile yükseltin.
+yalnız bundan sonra geri yüklenen veritabanını `0.5.0` ile yükseltin.
 
 ## Geri Yükleme Provası
 
 Tüm yazıcıları kapalı tutun. Önce onay vermeden deneme yapın:
 
 ```sh
-bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin restore \
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin restore \
   "$OPENCODE_MEMORY_DATABASE_PATH.backup/<backup>.manifest.json"
 ```
 
@@ -71,7 +71,7 @@ bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin restore \
 değerlerini kaydedilen yedekle karşılaştırın. Sonra tam manifest özetini kullanın:
 
 ```sh
-bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin restore \
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin restore \
   "$OPENCODE_MEMORY_DATABASE_PATH.backup/<backup>.manifest.json" \
   --sha256 <manifest-database-sha256> \
   --confirm RESTORE_DATABASE_FROM_VERIFIED_BACKUP
@@ -84,9 +84,9 @@ veritabanı tüm kontrollerden geçmeden bunu silmeyin.
 ## Geri Yükleme Sonrası Doğrulama
 
 ```sh
-bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin doctor
-bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin capture status
-bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin outbox status
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin doctor
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin capture status
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin outbox status
 ```
 
 Yalnız MCP sunucusunu başlatın ve salt-okunur `project_list`, `memory_recall` ve
@@ -94,6 +94,26 @@ Yalnız MCP sunucusunu başlatın ve salt-okunur `project_list`, `memory_recall`
 OpenCode'u ancak bu kontroller geçince yeniden başlatın. Ayrı devreye alma kararı
 verilene kadar eklentiyi `off` tutun.
 
+## Korunan Bakım Kapısı
+
+`<database>.maintenance/owner.json` içindeki `state: recovery-required`, önceki
+bir geri yüklemenin geri alma sonucunu doğrulayamadığını gösterir. Bu kapı
+otomatik kaldırılmaz. Tüm MCP/eklenti süreçlerini durdurun; veritabanını, yan
+dosyaları, kapıyı ve geri yükleme kalıntılarını koruyun; ardından doğrulanmış bir
+yedek seçin. Kayıtlı tam sahip kimliğini yalnız geri yükleme komutunda verin:
+
+```sh
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin restore <manifest> \
+  --sha256 <manifest-sha256> \
+  --confirm RESTORE_DATABASE_FROM_VERIFIED_BACKUP \
+  --maintenance-owner <owner-id> \
+  --maintenance-confirm RECOVER_RETAINED_MAINTENANCE_GATE
+```
+
+Uzak, canlı, bozuk veya başka biçimde doğrulanamayan sahipler engelli kalır.
+Kapıyı elle silmeyin; kurtarma geri yüklemesi kapı dizini kesintisiz yerindeyken
+sahipliği atomik olarak devralır.
+
 ## Eski Geçiş Kilidi
 
 Kilit `<database>.migration.lock/owner.json` konumundadır. Kayıtlı süreç yaşıyor
@@ -103,7 +123,7 @@ Sahip dosyasındaki PID, makine ve başlangıç zamanını doğrulayın. Yalnız
 kanıtlanan kilidi tam sahip ID'si ve onayla kırın:
 
 ```sh
-bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin unlock \
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin unlock \
   --owner <owner-id> \
   --confirm BREAK_STALE_MIGRATION_LOCK
 ```
@@ -116,14 +136,14 @@ kanıtıdır; veritabanı doğrulamasını atlama izni değildir.
 İlk komut silme yapmaz ve tam yedek kümesinin özetini döndürür:
 
 ```sh
-bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin backup prune
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin backup prune
 ```
 
 Listelenen her manifest/veritabanı çiftini inceleyin. Yalnız değişmemiş kümeyi
 silin:
 
 ```sh
-bunx --package @vaur94/agz-memory@0.4.0 agz-memory-admin backup prune \
+bunx --package @vaur94/agz-memory@0.5.0 agz-memory-admin backup prune \
   --digest <dry-run-digest> \
   --confirm DELETE_VERIFIED_BACKUPS
 ```

package/docs/repository-hardening.md

@@ -0,0 +1,125 @@
+# Repository Hardening Checklist
+
+Repository: `ugur-murat-alt/agz-memory`
+
+Verified on: 2026-09-02
+
+The checks below are GitHub repository controls and cannot be enforced by the package source alone. The verification performed for 0.5.0 found that `main` had no classic branch protection, no repository ruleset, no deployment environment, and Actions allowed all actions without repository-level SHA-pinning enforcement. Workflow actions in this repository are nevertheless pinned by commit SHA.
+
+## Required `main` Ruleset
+
+GitHub screen: **Settings > Rules > Rulesets > New branch ruleset**
+
+Target: default branch, `main`
+
+Enable:
+
+- Restrict deletions.
+- Block force pushes.
+- Require a pull request before merging.
+- Require at least one approval.
+- Dismiss stale approvals when new commits are pushed.
+- Require review from Code Owners when a `CODEOWNERS` file is introduced.
+- Require conversation resolution.
+- Require status checks to pass.
+- Require branches to be up to date before merging.
+- Require signed commits.
+- Require linear history.
+
+Required status checks should include every 0.5.0 CI gate rather than only the aggregate job name:
+
+- Linux minimum Bun type/test/build/package gate.
+- Linux current Bun type/test/build/package gate.
+- macOS current Bun gate.
+- Windows current Bun gate.
+- Property/security tests.
+- Multiprocess stress tests.
+- Restore fault tests.
+- Benchmark gate.
+- Packed install and audit.
+- CodeQL.
+- Dependency review for pull requests.
+
+Do not grant bypass permission to ordinary contributors. Keep the repository administrator bypass limited to documented emergency recovery.
+
+## Signed Commits and Tags
+
+GitHub screen: **Settings > Rules > Rulesets > Require signed commits**
+
+Local verification:
+
+```sh
+git log --show-signature -1
+git tag -v v0.5.0
+```
+
+Create the release tag from the reviewed merge commit. Do not move an existing release tag.
+
+## Release Environment
+
+GitHub screen: **Settings > Environments > New environment**
+
+Name: `npm-release`
+
+Configure:
+
+- Required reviewer.
+- Deployment branch restricted to protected `main` and version tags.
+- No long-lived npm token when trusted publishing is available.
+
+The publish workflow should use npm trusted publishing with OpenID Connect and provenance:
+
+```yaml
+permissions:
+  contents: read
+  id-token: write
+```
+
+```sh
+npm publish --provenance --access public
+```
+
+Verify the published package exposes provenance and that npm `gitHead`, Git tag SHA, GitHub Release SHA, and reviewed merge commit all match.
+
+## Actions Policy
+
+GitHub screen: **Settings > Actions > General > Actions permissions**
+
+Prefer **Allow enterprise actions and select non-enterprise actions** if the account plan supports it. Require full-length commit SHA pinning for third-party actions. Keep workflow token permissions read-only by default and grant narrower write permissions per job.
+
+Repository verification commands:
+
+```sh
+gh api repos/ugur-murat-alt/agz-memory/branches/main/protection
+gh api repos/ugur-murat-alt/agz-memory/rulesets
+gh api repos/ugur-murat-alt/agz-memory/actions/permissions
+gh api repos/ugur-murat-alt/agz-memory/environments
+```
+
+Expected release condition:
+
+- The protection endpoint or active ruleset reports required pull requests, reviews, signed commits, required status checks, no force push, and no deletion.
+- At least one protected `npm-release` environment exists.
+- Actions policy and workflow files both enforce immutable action versions.
+
+## npm Package Policy
+
+- Enable npm two-factor authentication for authorization and writes.
+- Enable trusted publishing for both `@vaur94/agz-memory` and `@vaur94/agz-memory-plugin`.
+- Require provenance on both packages.
+- Deprecate, do not overwrite, a compromised version.
+- Test the packed artifacts together in a clean directory before publish.
+- Verify registry integrity, package contents, imports, exact nine-tool MCP catalog, and inert plugin defaults after publish.
+
+## Release Evidence
+
+Attach or link:
+
+- Ruleset export or settings screenshots.
+- Required-check list and successful run URLs.
+- Signed merge commit and tag verification.
+- Release environment protection.
+- npm provenance statement for both packages.
+- Pack SHA-256 values and clean-install smoke output.
+
+Repository setting changes remain a release blocker until independently verified. Source documentation does not itself close AGZ-064.

package/docs/review-resolution.md

@@ -0,0 +1,78 @@
+# AGZ 0.5.0 Review Resolution
+
+This record maps every AGZ-001 through AGZ-068 review finding to its 0.5.0
+resolution and durable source or regression evidence. `Fixed` means the source
+change and cited local test or release gate exist in this branch. Repository
+settings are external state; AGZ-064 remains explicitly deferred and blocks a
+release-ready claim until the controls in `repository-hardening.md` are verified.
+
+| Finding | Priority | Resolution | Evidence |
+|---|---|---|---|
+| AGZ-001 | P1 | Fixed | Note update and pin compare-and-swap under multiprocess contention: `src/store.ts`, `test/concurrency/note-update-multiprocess.test.ts`. |
+| AGZ-002 | P1 | Fixed | Project deletion binds the immutable ID and confirmed current name in one transaction: `src/store.ts`, `test/concurrency/project-delete-rename.test.ts`. |
+| AGZ-003 | P1 | Fixed | Revision snapshots and provenance use the row returned by the successful mutation: `src/store.ts`, `test/store/lifecycle.test.ts`. |
+| AGZ-004 | P1 | Fixed | Required outbox insertion shares the canonical transaction and cannot be ignored: `src/store.ts`, `test/store/lifecycle.test.ts`. |
+| AGZ-005 | P1 | Fixed | Concurrent project and binding creation distinguishes duplicates from conflicts: `src/store.ts`, `src/store/capture.ts`, `test/concurrency/binding-race.test.ts`. |
+| AGZ-006 | P1 | Fixed | Domain-separated, length-prefixed UTF-8 tuple hashing removes delimiter and Unicode collisions: `src/hash.ts`, `test/capture/capture-contract-v2.test.ts`. |
+| AGZ-007 | P1 | Fixed | Reused capture identities with different source or payload fail as `idempotency_conflict`: `src/store/capture.ts`, `test/capture/capture-contract-v2.test.ts`. |
+| AGZ-008 | P1 | Fixed | Shared MCP/core identities retain the exact nine-tool and fail-closed contract: `src/tools.ts`, `test/contract/mcp-surface.test.ts`. |
+| AGZ-009 | P1 | Fixed | Normal handles publish lifetime database leases before opening SQLite: `src/db/maintenance.ts`, `test/db/maintenance.test.ts`. |
+| AGZ-010 | P1 | Fixed | Maintenance uses one exclusive gate and rejects active or unverifiable handles: `src/db/maintenance.ts`, `test/db/maintenance.test.ts`. |
+| AGZ-011 | P1 | Fixed | Restore refuses to replace a database held by a live writer: `src/db/backup.ts`, `test/db/restore-live-writer.test.ts`. |
+| AGZ-012 | P1 | Fixed | Restore copies and hashes one opened source inode instead of reopening a verified path: `src/db/backup.ts`, `test/db/restore-toctou.test.ts`. |
+| AGZ-013 | P1 | Fixed | Database, backup, sidecar, gate, lease, and manifest paths reject symbolic links: `src/db/maintenance.ts`, `src/db/backup.ts`, `test/db/path-symlink-matrix.test.ts`. |
+| AGZ-014 | P1 | Fixed | `application_id` and `agz_meta` bind product, database UUID, schema, and hash policy: `src/db/schema.ts`, `docs/schema-v11.md`. |
+| AGZ-015 | P1 | Fixed | Exact application-object fingerprint detects same-version schema drift: `src/db/schema.ts`, `test/db/schema-drift-failclosed.test.ts`. |
+| AGZ-016 | P1 | Fixed | Nonempty unsigned databases fail closed while a zero-object database may initialize: `src/db.ts`, `test/db/unrecognized-database.test.ts`. |
+| AGZ-017 | P1 | Fixed | Projection reports truncation into the redaction boundary instead of hiding removed suffixes: `src/capture/projection.ts`, `test/security/redaction-property.test.ts`. |
+| AGZ-018 | P1 | Fixed | Credential/private-key/high-entropy redaction fails closed across boundaries and punctuation: `src/capture/redact.ts`, `test/security/redaction-corpus.test.ts`. |
+| AGZ-019 | P1 | Fixed | Capture event kinds enforce required and forbidden native source identity fields: `src/capture/contract.ts`, `test/capture/capture-contract-v2.test.ts`. |
+| AGZ-020 | P1 | Fixed | Composite foreign keys reject cross-project binding, capture, checkpoint, note, and outbox references: `src/db/schema.ts`, `test/capture/capture-contract-v2.test.ts`. |
+| AGZ-021 | P1 | Fixed | Quarantined events retain no payload and cannot materialize notes: `src/store/capture.ts`, `test/capture/capture.test.ts`. |
+| AGZ-022 | P1 | Fixed | Extraction admits terminal text/status only and excludes tool payloads and reasoning: `packages/opencode-plugin/src/extract.ts`, `test/capture/capture.test.ts`. |
+| AGZ-023 | P1 | Fixed | Checkpoints use `(binding_key, session_id)` so native session IDs can repeat safely: `src/db/schema.ts`, `test/capture/capture-contract-v2.test.ts`. |
+| AGZ-024 | P1 | Fixed | Startup/hourly retention drains bounded terminal, quarantined, and checkpoint backlogs: `src/store/capture.ts`, `test/capture/capture.test.ts`. |
+| AGZ-025 | P2 | Fixed | Reconciliation resumes only after the persisted binding/session checkpoint: `packages/opencode-plugin/src/runtime.ts`, `test/plugin/reconcile-incremental.test.ts`. |
+| AGZ-026 | P2 | Fixed | Reconciliation has bounded global concurrency and coalesces same-session reruns: `packages/opencode-plugin/src/runtime.ts`, `test/plugin/reconcile-backpressure.test.ts`. |
+| AGZ-027 | P1 | Fixed | Shutdown aborts without awaiting hung event, session, or context calls: `packages/opencode-plugin/src/runtime.ts`, `test/plugin/hung-context-stop.test.ts`. |
+| AGZ-028 | P1 | Fixed | Turn opt-out remains effective across every supported hook order: `packages/opencode-plugin/src/runtime.ts`, `test/plugin/optout-hook-permutations.test.ts`. |
+| AGZ-029 | P2 | Fixed | Concurrent opt-out history probes share one bounded request: `packages/opencode-plugin/src/runtime.ts`, `test/plugin/optout-hook-permutations.test.ts`. |
+| AGZ-030 | P2 | Fixed | Reconciliation, terminal-event, and opt-out preflight calls have bounded abortable timeouts: `packages/opencode-plugin/src/runtime.ts`, `packages/opencode-plugin/test/plugin.test.ts`. |
+| AGZ-031 | P2 | Fixed | Runtime errors are reduced to safe codes and do not log payload text: `packages/opencode-plugin/src/runtime.ts`, `packages/opencode-plugin/test/plugin.test.ts`. |
+| AGZ-032 | P1 | Fixed | Location and binding checks fail closed on missing, mismatched, or conflicting identity: `packages/opencode-plugin/src/binding.ts`, `packages/opencode-plugin/test/plugin.test.ts`. |
+| AGZ-033 | P2 | Fixed | First run creates the private default database hierarchy below `HOME`: `src/config.ts`, `test/plugin/first-run-home.test.ts`. |
+| AGZ-034 | P1 | Fixed | Injection remains bounded, escaped, and explicitly marked untrusted: `src/retrieval/formatter.ts`, `test/retrieval/retrieval.test.ts`. |
+| AGZ-035 | P1 | Fixed | Plugin defaults remain off/empty and exact OpenCode version mismatch disables startup: `packages/opencode-plugin/src/config.ts`, `packages/opencode-plugin/test/plugin.test.ts`. |
+| AGZ-036 | P1 | Fixed | Backend hits use the redacted derived-document hash, not canonical note hash: `src/retrieval/derived.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-037 | P1 | Fixed | Backend responses have strict keys/types/count bounds and malformed data falls back lexically: `src/retrieval/contract.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-038 | P2 | Fixed | One deadline covers backend, canonical validation, graph expansion, and formatting: `src/store/retrieval.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-039 | P2 | Fixed | Backend hit validation uses bounded batch SQL rather than per-hit queries: `src/store/retrieval.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-040 | P2 | Fixed | Reciprocal-rank fusion is deterministic under channel permutation: `src/retrieval/fusion.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-041 | P1 | Fixed | Directed graph retrieval preserves source and target endpoints: `src/store/retrieval.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-042 | P2 | Fixed | Context truncation never splits a Unicode code point: `src/retrieval/formatter.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-043 | P1 | Fixed | Stale and cross-project backend hits are rejected against canonical rows: `src/store/retrieval.ts`, `test/retrieval/retrieval.test.ts`. |
+| AGZ-044 | P1 | Fixed | Outbox backend calls hard-time out even when `AbortSignal` is ignored: `src/store/outbox.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-045 | P1 | Fixed | Heartbeat, lease generation, and fence condition every final outbox transition: `src/store/outbox.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-046 | P1 | Fixed | Operation-specific checks and tuple-hashed operation keys reject malformed queue rows: `src/db/schema.ts`, `src/store/outbox.ts`, `test/store/outbox.test.ts`. |
+| AGZ-047 | P1 | Fixed | Each reindex generation queues purge plus a transactional active-note snapshot: `src/admin/index.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-048 | P2 | Fixed | Dead work retries explicitly and bounded exponential backoff preserves FIFO: `src/admin/index.ts`, `src/store/outbox.ts`, `test/store/outbox.test.ts`. |
+| AGZ-049 | P1 | Fixed | Project deletion and rebuild enqueue purge so derived stores cannot retain omitted content: `src/store.ts`, `src/admin/index.ts`, `test/store/outbox.test.ts`. |
+| AGZ-050 | P1 | Fixed | Backup publication and migration occur only under the maintenance gate with verified rollback: `src/db.ts`, `src/db/backup.ts`, `test/db/maintenance.test.ts`, `test/db/backup-restore.test.ts`. |
+| AGZ-051 | P2 | Fixed | Batch mutations remain ordered, independently committed, and return every result: `src/tools.ts`, `test/contract/mcp-surface.test.ts`. |
+| AGZ-052 | P1 | Fixed | Schema-10 migration preserves valid legacy bindings, events, tombstones, and orphaned outbox history: `src/db/migrations/v011.ts`, `test/db/migration-v11.test.ts`. |
+| AGZ-053 | P1 | Fixed | Migration verifies counts, revisions, hashes, FTS, foreign keys, identity, and fingerprint before publish: `src/db/migrations/v011.ts`, `src/admin/doctor.ts`, `test/db/migration-v11.test.ts`. |
+| AGZ-054 | P2 | Fixed | Public query and batch inputs retain explicit hard cardinality bounds: `src/tools.ts`, `test/contract/mcp-surface.test.ts`. |
+| AGZ-055 | P1 | Fixed | Semantic query bytes and retrieval card requests clamp to hard limits: `src/store/retrieval.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-056 | P2 | Fixed | Store conflicts and lease loss return stable typed error codes rather than raw SQLite errors: `src/store.ts`, `src/store/outbox.ts`, concurrency regressions. |
+| AGZ-057 | P1 | Fixed | Doctor checks database identity, exact fingerprint, tenant references, hashes, revisions, FTS, and operation keys: `src/admin/doctor.ts`, `test/db/migration-v11.test.ts`. |
+| AGZ-058 | P2 | Fixed | Admin reindex/status/retry responses are bounded and payload-free: `src/admin/index.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-059 | P2 | Fixed | Retrieval metrics deduplicate rankings and clamp recall, MRR, and NDCG to the unit interval: `benchmark/evaluate.ts`, `test/retrieval/hardening.test.ts`. |
+| AGZ-060 | P2 | Fixed | `benchmark:gate` enforces the documented p99 latency ceiling: `benchmark/run.ts`, `package.json`. |
+| AGZ-061 | P3 | Fixed | Baseline manifest, timings, logs, platform, commit, and benchmark artifacts are committed in `artifacts/baseline/manifest.json` and its listed files. |
+| AGZ-062 | P2 | Fixed | CI covers minimum/current Bun on Linux plus current Bun on macOS and Windows: `.github/workflows/ci.yml`. |
+| AGZ-063 | P2 | Fixed | CI has separate property, stress, restore, benchmark, CodeQL, and dependency-review gates with immutable action pins: `.github/workflows/ci.yml`. |
+| AGZ-064 | P2 | Deferred | `main` protection/ruleset and `npm-release` environment are absent external repository settings; required controls and verification are in `docs/repository-hardening.md`. |
+| AGZ-065 | P2 | Fixed | Package smoke derives both tarball names from the manifest version instead of a stale literal: `.github/workflows/ci.yml`. |
+| AGZ-066 | P3 | Fixed | Runtime ranges, exact plugin compatibility, frozen lock installs, audits, and Dependabot policy are explicit: `package.json`, `packages/opencode-plugin/package.json`, `.github/dependabot.yml`. |
+| AGZ-067 | P3 | Fixed | English/Turkish README and recovery sections are release-verified as mapped contracts: `scripts/verify-release.ts`, `test/release/release-surface.test.ts`. |
+| AGZ-068 | P2 | Fixed | Release verification requires exactly this ordered 68-row record and forbids deferred P0/P1 findings: `scripts/verify-release.ts`, `test/release/release-surface.test.ts`. |

package/docs/schema-v11.md

@@ -0,0 +1,75 @@
+# SQLite Schema 11
+
+Schema 11 is the canonical storage contract for AGZ Memory 0.5.0. SQLite remains the source of truth. Search backends are derived, redacted, disposable indexes rebuilt through the durable outbox.
+
+## Database Identity
+
+- `PRAGMA application_id` is the AGZ Memory application identifier.
+- `agz_meta` contains exactly one row with the database UUID, product identifier, schema version, schema fingerprint, hash policy, and creation time.
+- `schema_state` contains exactly one row with version `11`.
+- A zero-object SQLite database can be initialized. A nonempty unsigned database is rejected by normal open.
+- Existing schema 11 databases are verified, not repaired. Missing, changed, or unexpected application objects fail with `schema_fingerprint_mismatch`.
+
+## Hash Policy
+
+All new persisted hashes use the version 2 tuple encoder described in [`adr/hash-identity-v2.md`](adr/hash-identity-v2.md). Canonical note hashes and derived-document hashes use separate domains. A derived backend hit is valid only when its revision and derived hash match a fresh `deriveDocument()` result from the same active project note.
+
+## Tenant Constraints
+
+- Notes and edges retain composite project foreign keys.
+- `notes(project_id, supersedes_id)` references `notes(project_id, id)` with `ON DELETE RESTRICT`. A referenced superseded note must not be deleted until the relationship is explicitly resolved.
+- `project_bindings(binding_key, project_id)` is a composite parent key.
+- Capture events and checkpoints use the binding/project composite foreign key.
+- Checkpoints are identified by `(binding_key, session_id)`, so native session IDs may repeat under independent bindings.
+
+## Capture Contract
+
+The schema 11 writer stores `agz-memory.capture/2` events. Event identities are strict:
+
+| Kind | Required identity | Forbidden identity |
+|---|---|---|
+| user candidate | message ID | ordinal, tool call, terminal status |
+| assistant candidate | message ID and ordinal | tool call, terminal status |
+| tool signal | message ID, tool call ID, terminal status | ordinal |
+| session summary | checkpoint message ID | ordinal, tool call, terminal status |
+
+Ingestion recomputes the idempotency key. An identical retry is `duplicate`; a reused key with different source or payload is `idempotency_conflict`.
+
+## Revision and Mutation Invariants
+
+- A note's `current_revision` is monotonically increasing.
+- Updates and pin changes use optimistic compare-and-swap: `UPDATE ... WHERE current_revision = ? RETURNING *`.
+- A retry reloads the current row and reapplies the original patch.
+- The returned row is the only source for revision snapshots, provenance, derived hashes, and outbox generation.
+- Revision/provenance/outbox insertion happens in the same immediate transaction as the canonical mutation.
+- A canonical commit never depends on backend availability. A required outbox insertion cannot be silently ignored.
+- Manual title or kind changes clear `subject_key`; manual edits must not retain an automatic capture identity for a changed subject.
+
+## Outbox
+
+Schema 11 adds operation identity, reindex generation, lease generation/fence, and heartbeat fields. Operation-specific checks require:
+
+- `upsert-note`: note ID, positive revision, and derived SHA-256.
+- `delete-note`: note ID and positive revision; no document payload.
+- `purge-project`: no note ID, revision, or content hash.
+
+Partial unique indexes prevent duplicate active upsert, delete, purge, and reindex-generation operations without allowing historical terminal rows to block a new rebuild. Backends receive an idempotency operation key and monotonically increasing fence. Lease heartbeat and final state transitions are owner/fence conditional; zero changed rows is `lost_lease`.
+
+## Reindex
+
+Each reindex command transactionally creates a new generation of durable outbox operations. Every selected project queues one purge before its bounded active-note upserts. Progress is represented by the persisted outbox states. A repeated reindex uses a new generation and is not blocked by old succeeded rows. Quarantined derived documents are omitted after purge and counted by reason code.
+
+## Migration From Schema 10
+
+Before migration, AGZ Memory creates and verifies one source-schema-10 backup while holding the maintenance gate. Migration then:
+
+1. Validates source health, tenant relationships, supersession references, capture source identities, and outbox rows.
+2. Builds schema 11 replacement tables.
+3. Recomputes version 2 canonical, revision, derived, binding, payload, event, checkpoint, and outbox identities.
+4. Records aggregate old/new mapping counts without private content.
+5. Verifies row counts, foreign keys, current-revision agreement, hashes, FTS, application identity, and the exact schema fingerprint.
+6. Publishes version 11 only after all checks pass.
+
+Cross-project, malformed, or ambiguous legacy rows stop migration. Documented compatibility normalization resets checkpoint watermarks, canonicalizes retained payloadless capture identities, and repairs valid historical outbox tombstone fields without dropping rows. The error identifies only the safe table/row identity and an error code; the verified backup path is included in the operator-facing migration report.
+
+Reopening a valid schema 11 database is idempotent and does not execute `CREATE IF NOT EXISTS`. A 0.4.1 binary observes version 11 and rejects it as newer before writing application DDL.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaur94/agz-memory",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Project-scoped persistent linked memory MCP server for OpenCode V2",
   "type": "module",
   "main": "./dist/server.js",
@@ -18,6 +18,8 @@
   "files": [
     "README.md",
     "README.tr.md",
+    "skills/index.json",
+    "skills/agz-memory/agz-memory.md",
     "dist/server.js",
     "dist/core.js",
     "dist/admin.js",
@@ -26,14 +28,22 @@
     "CHANGELOG.md",
     "docs/backup-restore-runbook.md",
     "docs/backup-restore-runbook.tr.md",
+    "docs/schema-v11.md",
+    "docs/review-resolution.md",
+    "docs/repository-hardening.md",
+    "docs/adr/*.md",
     "LICENSE"
   ],
   "scripts": {
     "types": "rm -rf dist/types && bunx tsc -p tsconfig.build.json",
     "build": "rm -rf dist && bun build src/index.ts --target bun --format esm --packages external --outfile dist/server.js && bun build src/core.ts --target bun --format esm --packages external --outfile dist/core.js && bun build src/admin/index.ts --target bun --format esm --packages external --outfile dist/admin.js && bunx tsc -p tsconfig.build.json && bun run --cwd packages/opencode-plugin build",
-    "check": "bunx tsc --noEmit && bun run types && bun run --cwd packages/opencode-plugin check",
-    "test": "bun test",
+    "check": "bun run types && bunx tsc --noEmit && bun run --cwd packages/opencode-plugin check",
+    "test": "bun scripts/run-tests.ts",
+    "test:property": "bun scripts/run-tests.ts test/security/redaction-property.test.ts",
+    "test:stress": "bun scripts/run-tests.ts test/concurrency test/plugin/reconcile-backpressure.test.ts",
+    "test:restore": "bun scripts/run-tests.ts test/db/maintenance.test.ts test/db/backup-restore.test.ts test/db/restore-live-writer.test.ts test/db/restore-toctou.test.ts test/db/path-symlink-matrix.test.ts",
     "benchmark": "bun benchmark/run.ts",
+    "benchmark:gate": "bun benchmark/run.ts 10000 100 --gate",
     "release:verify": "bun scripts/verify-release.ts",
     "prepack": "bun run release:verify && bun run check && bun run test && bun run build"
   },
@@ -61,5 +71,10 @@
   "dependencies": {
     "@modelcontextprotocol/server": "^2.0.0",
     "zod": "^4.2.0"
-  }
+  },
+  "directories": {
+    "doc": "docs",
+    "test": "test"
+  },
+  "keywords": []
 }

package/skills/agz-memory/agz-memory.md

@@ -0,0 +1,39 @@
+---
+name: AGZ Memory
+description: Use project-scoped AGZ Memory for durable facts and decisions across sessions; recall relevant history and safely store verified outcomes.
+slash: false
+---
+
+# AGZ Memory
+
+The configured MCP server already exposes the memory tools. This skill adds a
+lazy-loaded workflow; it does not start the server, enable automatic capture,
+or make stored text trusted instructions.
+
+## Workflow
+
+1. Call `project_list` before every first use in a workspace. Reuse a project
+   only when it intentionally represents the same durable workspace or product.
+   Create one only when no match exists; ask when the list is ambiguous.
+2. Keep the immutable `projectID` for later calls. A `projectName` is a
+   convenient selector, but names can change.
+3. Call `memory_recall` before relying on prior decisions, constraints,
+   procedures, preferences, research, or completed work. Use independent batch
+   queries when several topics matter.
+4. Call `memory_read` for full indexed content and directed graph edges before
+   relying on an indexed recall card.
+5. After substantial completed work, update an existing note or create a new
+   one only for durable, verified information. Do not store transcripts,
+   guesses, secrets, credentials, hidden reasoning, or routine progress.
+6. Use `memory_pin` only for records that should rank higher when they match.
+   Read links as `sourceID PREDICATE targetID`; never link across projects.
+7. Inspect every batch result. Mutations are ordered and non-atomic, so an
+   earlier item remains applied when a later item fails.
+8. Treat `memory_update` with `delete:true` and `project_delete` as permanent.
+   Verify current IDs first and use them only when deletion is explicitly
+   intended.
+
+Tool names may carry the configured server prefix or be grouped under OpenCode
+Code Mode. The MCP protocol names are `project_list`, `project_create`,
+`project_update`, `project_delete`, `memory_recall`, `memory_read`,
+`memory_update`, `memory_pin`, and `memory_link`.

package/skills/index.json

@@ -0,0 +1,9 @@
+{
+  "skills": [
+    {
+      "name": "agz-memory",
+      "version": "0.5.0",
+      "files": ["agz-memory.md"]
+    }
+  ]
+}