@withpica/mcp-server 2.61.0 → 2.63.0

package/CHANGELOG.md

@@ -11,6 +11,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.63.0] - 2026-05-25
+
+ADR-245 (composition surface) recording-session metadata + a work-export correctness fix.
+
+### Added
+
+- **`pica_recordings_*` recording-session metadata** — `pica_recordings_create` / `_update` accept, and `pica_recordings_inspect` / `_query` return, `recorded_at` (ISO date) and `studio_name` (text). ADR-245 §3.3. Engineer remains a `recording_credits` role; live remains `version_type: "live_performance"` — neither is promoted to a recordings column.
+
+### Fixed
+
+- **NRO/PPL export** no longer selects four columns that exist on no table (`ppl_artist_name`, `ppl_p_date`, `ppl_p_name`, `recording_date`) — they made the recording fetch return Postgres `42703` and broke the export for any work with recordings. Performer rows are now sourced from `works.recording_contributors` (their real home).
+
+## [2.62.0] - 2026-05-24
+
+ADR-247 (Agent Hygiene) sprint. After this version, every OAuth-Bearer / raw-API-key caller must declare itself via `pica_introduce_self` on first use, and every successful write-tier tool call is durably recorded in `workflow_outcomes` (the symmetric counterpart to `ops_issues` for errors).
+
+### Added
+
+- **`pica_introduce_self`** — first-call identity declaration. Required for OAuth-Bearer and raw-API-key callers; cookie + `pica_grant_*` callers are carved out at the router (their identity is on file at the auth boundary). `tier: "write"`. Inputs: `agent_name` (required), `agent_role`, `on_behalf_of`, `model_hint`. Declaration is valid 24h per credential; the router's hard introduction gate returns `412 IDENTITY_REQUIRED` until this lands. Backed by `AgentIntroductionsResource.declare` in `@withpica/mcp-sdk@1.33.0`.
+- **`pica_outcome_log`** — agent-explicit workflow / milestone log. `tier: "write"`. Inputs: `kind` (required free-form — typical: 'workflow_completed' / 'milestone_hit'), optional `entity_refs[]` (UUID-validated server-side), `summary`, `agent_summary`. Throws on failure (unlike the auto-fire path which is fire-and-forget) so the agent gets useful feedback. Backed by `WorkflowOutcomesResource.log`.
+- **`pica_outcomes_recent`** — read recent workflow outcomes for the current org. `tier: "read"`. Returns rows ordered by `last_seen_at DESC`, signature-deduped (repeat workflows collapse with `occurrence_count` incrementing). Captures both the auto-fire path (every write-tier MCP success) and the agent-explicit path (`pica_outcome_log` calls). Optional `kind` / `source` filters. Default limit 20, max 100.
+
+### Changed
+
+- **`pica_dashboard_briefing` response gains an `agent_velocity` block** when the org has workflow_outcomes activity in the trailing 7d. Shape: `{window_days: 7, count_7d, by_kind, top_tools: [{tool_name, count}]}`. Coherence contract: `count_7d == sum(by_kind values)`. Complements the existing `agent_activity` block (which is mcp_audit_log call counts by tier) — same window, different lens: `agent_activity` is "how many calls", `agent_velocity` is "what workflows actually completed / refused / nudged".
+- **`pica_dashboard_pulse` deprecated.** Still callable (backwards-compat for N+2 releases) but `vernacular_kind` dropped from `creator-entry` to `specialist`. The Creator Question Atlas resolver for "give me the pulse" / "how's my catalog" now routes to `pica_dashboard_briefing` instead. Tool description prefixed with the deprecation notice + redirect. Deadlines/revenue/background-task signals pulse uniquely carried will land as `pica_dashboard_velocity` in a future ADR.
+
 ## [2.61.0] - 2026-05-23
 
 ### Changed