agent-bios 0.19.1 → 0.19.3

package/docs/setup.md

@@ -1,8 +1,8 @@
 # Setup, app connection, and personal instructions
 
-[← Overview](../README.md) · [Corpus](corpus.md) · [Sessions](session-model.md) · [Recovery](recovery.md)
+[← Overview](../README.md) · [Instructions](instructions.md) · [Sessions](session-model.md) · [Recovery](recovery.md)
 
-Install `agent-bios@0.19.1` through the [README quick start](../README.md#quick-start)
+Install `agent-bios@0.19.0` through the [README quick start](../README.md#quick-start)
 to use the guided installer, conversation setup, app bridge and instruction import.
 Commands below use the installed `agent-bios` CLI. From a source checkout, run
 `bash install.sh <command>` at its root instead.
@@ -33,7 +33,7 @@ older installation mode.
 Install the exact package version, then start setup:
 
 ```bash
-npm install -g agent-bios@0.19.1
+npm install -g agent-bios@0.19.0
 agent-bios install
 ```
 
@@ -43,33 +43,33 @@ For the source alternative, obtain the repository through its Code menu and run
 `install` and `onboard` open the wizard by default. After the language choice,
 four stages collect the choices:
 
-1. **Corpus:** no active corpus, all available corpus, selected packages/domains,
+1. **Instructions:** no active instructions, all available instructions, selected packages/domains,
    or saved policy on an existing installation. **Connect to the Codex app** is
    an independent option for adding `$agent-bios` to app conversations.
 2. **Personal instructions:** optionally add project folders and select detected
-   global/project instruction files for capture. This is independent of corpus use.
+   global/project instruction files for capture. This is independent of instructions use.
 3. **Dependencies:** inspect the full inventory. Ready dependencies are checked
    and cannot be toggled; only missing dependencies with a supported recipe can
    be selected for installation. Leaving those unselected installs none.
 4. **Review:** inspect the effects and, when useful, expand exact commands and
    paths before Apply.
 
-The fresh wizard starts with no active corpus. Reinstalling keeps saved choices
-unless you change them. No active corpus retains the library privately but delivers
-no corpus instruction text or management bootstrap. Explicit selected mode includes
+The fresh wizard starts with no active instructions. Reinstalling keeps saved choices
+unless you change them. Selecting **No active instructions** retains the library privately but delivers
+no agent-bios instruction text or management bootstrap. Explicit selected mode includes
 only its targets within applicable host/project scope; it does not add unrelated
 enabled items or implicit core content.
 
 Personal instructions and host learning records already on this device appear in
 a separate checked, read-only list with stored item counts. These entries describe
-retained content across project scopes, not the active corpus policy or new installation
-choices. No active corpus preserves them. Use Corpus Studio for personal content and
+retained content across project scopes, not the active instructions policy or new installation
+choices. Selecting **No active instructions** preserves them. Use Instructions Studio for personal content and
 selection changes; merely displaying stored content does not activate it. The list
 can also show retained content after private runtime removal.
 
-The installer, launcher and Corpus Studio use a verified UI bundle without downloading or installing
+The installer, launcher and Instructions Studio use a verified UI bundle without downloading or installing
 Textual. Its extraction is temporary and removed on exit. Missing or damaged
-bundled UI fails explicitly. Language changes presentation, not corpus text,
+bundled UI fails explicitly. Language changes presentation, not instructions text,
 identifiers or host settings.
 
 Back preserves your choices. Cancelling before Apply performs no planned setup
@@ -81,8 +81,8 @@ before retrying rather than assuming everything rolled back.
 Selection flags seed the wizard; they do not skip it:
 
 ```bash
-agent-bios install --corpus none
-agent-bios install --corpus selected --select '@agent-bios/core/builder-base'
+agent-bios install --instructions none
+agent-bios install --instructions selected --select '@agent-bios/core/builder-base'
 agent-bios install --dry-run
 ```
 
@@ -90,15 +90,15 @@ agent-bios install --dry-run
 machine route. Direct storage-only examples are:
 
 ```bash
-agent-bios install --non-interactive --corpus none
-agent-bios install --non-interactive --corpus all
-agent-bios install --non-interactive --corpus selected --select '@agent-bios/core/builder-base'
+agent-bios install --non-interactive --instructions none
+agent-bios install --non-interactive --instructions all
+agent-bios install --non-interactive --instructions selected --select '@agent-bios/core/builder-base'
 ```
 
 Those direct commands do not collect dependency, app or import choices. Use the
 shared conversation protocol below for a complete machine setup plan. The legacy
 `--domains` flag requires `--non-interactive` and retains its implicit core/infra
-meaning; `--domains none` is different from `--corpus none`.
+meaning; `--domains none` is different from `--instructions none`.
 
 ## Setup through conversation or automation
 
@@ -119,7 +119,7 @@ agent-bios setup resume --review-id REVIEW_ID
 `start` returns the supported languages, execution target and guide without
 dependency probes or private setup writes. Choose the language before `inspect`.
 The agent produces the six choice fields from your answers and saves the entire
-engine-issued review. It shows the selected commands, destinations, corpus policy,
+engine-issued review. It shows the selected commands, destinations, instructions policy,
 app change and capture sources before applying authorized effects. The engine
 rejects a changed source, environment, plan or state; `--yes` alone is not evidence
 that the effects were reviewed.
@@ -127,7 +127,8 @@ that the effects were reviewed.
 Dependency readiness and installation intent are separate: an already available
 dependency never belongs in the requested `dependencies` list or new install actions.
 The separate `retained_corpus` inventory contains `{target, label, item_count}` rows,
-with localized labels in `display.retained_corpus`, and no instruction bodies. Source
+with localized labels in `display.retained_corpus`, and no instruction bodies. These
+serialized names remain for [compatibility](instructions-compatibility.md). Source
 package choices and the selected activation policy remain independent of that storage
 view; retained entries are not added to `targets` by being displayed.
 
@@ -139,7 +140,43 @@ it does not replay uncertain operations. The agent follows the full procedure in
 [START.md](../compose/setup/START.md), including exact review preservation and verified
 entrypoint handoff. Source and reviewed artifacts remain available for recovery.
 
-## Use corpus in a Codex app task
+## Use instructions in Claude Desktop
+
+Claude Desktop has no launcher to start its conversations and no skill folder an
+installer can reach, so agent-bios reaches it through a local extension:
+
+```bash
+agent-bios app desktop --dry-run --json
+agent-bios app desktop
+```
+
+The command writes `agent-bios.mcpb` under the private state root and prints its path.
+Open that file with Claude Desktop and confirm the installation dialog; agent-bios never
+writes into Desktop's own folders or configuration. The extension runs Python at the
+absolute path the file names — the interpreter that ran the command, which must be 3.11
+or newer. Run the command again after changing that Python; an agent-bios update alone
+needs no new file, because the extension finds the current installation on every call.
+
+In a conversation, ask for your agent-bios instructions. The assistant calls `use`, which
+returns your saved installation selection, or a selection you name in the request.
+Desktop sends no conversation identity, so the first preview or use returns a
+`session_id` that later calls in the same conversation pass back. Desktop delivery has
+no project scope: imported instructions scoped to a project folder are not included.
+
+The returned text ends with a line beginning `agent-bios end`. When the assistant reports
+that line through `status`, the receipt records that the text was read to its end. It
+does not show whether Desktop kept the text in the message or saved it to a file, and a
+delivery never reported back stays unconfirmed. Off stops further use in that
+conversation but cannot remove text already returned; start a new conversation for clean
+exclusion.
+
+The extension adds four tools to every Desktop conversation, in chat and in the Code tab.
+Remove it from Desktop's extension settings to stop that cost. The Code tab also has a
+working folder, but the extension cannot see it, so project-scoped instructions stay
+excluded there as well. This route was measured on Claude Desktop 2.16120.0 for macOS;
+Windows is not supported yet.
+
+## Use instructions in a Codex app task
 
 Choose **Connect to the Codex app** during setup, or explicitly run:
 
@@ -155,7 +192,7 @@ entry is preserved. Registration on disk does not prove the app discovered it;
 setup can return a usable helper path to continue before discovery refreshes.
 
 Once discovered, use `$agent-bios` in the chosen task. Ask it to manage the library,
-change setup, show task status, or explicitly use selected corpus in this task.
+change setup, show task status, or explicitly use selected instructions in this task.
 A setup or management request does not activate content. Each task starts with
 managed delivery off and requires its own explicit use.
 
@@ -165,13 +202,13 @@ Use previews a `ContentRef` and then returns the exact snapshot's
 Session operations require the real task ID, normally `CODEX_THREAD_ID`. Setup and
 management do not require that ID. App use enables no hooks, agents or permissions.
 
-Ask `$agent-bios` to turn corpus delivery off to stop consulting it in subsequent
+Ask `$agent-bios` to turn instructions delivery off to stop consulting it in subsequent
 work. Text already returned cannot be erased; a fresh task is needed for clean
 exclusion. A resumed or forked conversation can carry earlier content independently
 of the new task's receipt. Native global/project instructions still follow host rules.
 
 `agent-bios app unregister` removes only the owned discovery link. It does not erase
-prior task context or personal corpus data. Corpus Studio can also run in the app's
+prior task context or personal instructions data. Instructions Studio can also run in the app's
 integrated terminal; editing it changes future snapshots, not current task context.
 
 ## Import existing instructions
@@ -190,14 +227,14 @@ agent-bios import apply PLAN_ID --expected-revision REV --json
 Discovery checks known global locations and fixed filenames in chosen project
 roots. It does not crawl the home directory or follow instruction references.
 Capture preserves originals and stores redacted evidence with source digests
-privately. It is pending review, not an automatically optimized personal corpus.
+privately. It is pending review, not an automatically optimized personal instructions.
 
 In an app task, ask `$agent-bios` to review the returned capture ID. The agent
 proposes content, `always`/`relevant`/`requested` placement, rationale, and source-line
 coverage or exclusions. The runtime checks the evidence and structure, and Apply
 requires the reviewed revision. Changed originals or conflicting edits require
 fresh review. Project-scoped imports remain limited to their recorded root and
-applicable hosts, even when all corpus or an enable override is selected.
+applicable hosts, even when all instructions or an enable override is selected.
 
 Native hosts may still read the untouched originals. Importing a procedure as
 requested content does not suppress the same rule in a native file, and changing

package/docs/understand.md

@@ -1,8 +1,8 @@
-# Understand why the corpus works this way
+# Understand why the instructions work this way
 
-[← Overview](../README.md) · [Setup](setup.md) · [Corpus](corpus.md) · [Sessions](session-model.md) · [Recovery](recovery.md) · [Launch](advanced-launch.md) · [Understand!](understand.md)
+[← Overview](../README.md) · [Setup](setup.md) · [Instructions](instructions.md) · [Sessions](session-model.md) · [Recovery](recovery.md) · [Launch](advanced-launch.md) · [Understand!](understand.md)
 
-Understand! is learning for the person using the corpus, not model training. It explores reasons and limits through a conversation rather than asking you to memorize files.
+Understand! is learning for the person using the instructions, not model training. It explores reasons and limits through a conversation rather than asking you to memorize files.
 
 ## Start a learning session
 
@@ -16,7 +16,7 @@ agent-launch --understand core-purpose claude   # or codex
 
 The selection is a coherent bundle, not an individual file: core groups cover goals
 and scope, decision support, adaptation, evidence/safety, and retained learning;
-domain and personal bundles come from the effective corpus. A session freezes its
+domain and personal bundles come from the effective instructions. A session freezes its
 selected source references and edited content. The tutor explains the purpose,
 background, mechanisms, tradeoffs, and limits, distinguishing documented rationale
 from inference. The tutor chooses a small finite set of core points and tracks their
@@ -74,11 +74,11 @@ ordering, and asks for a later exact save confirmation. Unsupported provenance l
 the award pending, without blocking learning. Significance and semantic originality
 remain explicit tutor/user judgments; transcript validation does not prove them or
 authenticate against an owner who can edit local files. Only a successfully saved
-requested-only personal corpus note can unlock the trophy. The CLI prints it, and the
+requested-only personal instructions note can unlock the trophy. The CLI prints it, and the
 TUI shows it when there is room. Retries do not duplicate the note; updates and note
 deletion retain the trophy. Full reset archives the active unlock generation and clears
 the display; older discovery records cannot reactivate it. Native global files and
-corpus source rules are not rewritten by learning.
+instructions source rules are not rewritten by learning.
 
 The runtime checks a new proposal's complete review-response size before storing
 its candidate. An oversized proposal can be shortened and retried without leaving

package/docs/windows.md

@@ -0,0 +1,99 @@
+# Windows native installation
+
+The Windows build provides a per-user installer and `agent-bios.exe` with its own
+Python runtime. Node.js, npm, a system Python installation and WSL are not required
+for the Instructions library and setup. Model host CLIs remain separate dependencies.
+
+Run the Windows x64 setup executable, then open setup from the final page or the
+Start menu. A newly opened PowerShell can run `agent-bios install` or
+`agent-bios instructions`. Existing terminal processes need restarting to pick up
+user PATH changes. The installer does not change PowerShell execution policy or
+intercept bare model commands.
+
+Re-running the installer updates program files. `agent-bios install` refreshes the
+private library while retaining saved selection and personal authoring. Removing
+the application removes its owned PATH entry; private instructions and session
+records remain in the user's home. Windows and WSL have separate homes and stores.
+
+The native build is experimental until the Windows workflow's artifact and lifecycle
+checks pass for the exact candidate. Fixture tests do not establish live host login,
+model execution, app skill discovery or interactive Korean IME behavior. Native
+hooks and the shell-based multi-model worker adapters require separate Windows
+qualification. File contents are flushed; process-recovery tests are not proof of
+power-loss durability on Windows.
+
+## Script distribution with an approved Python
+
+A second Windows route installs agent-bios as scripts and data without a custom
+EXE launcher or an EXE installer. It targets organizations whose application
+control permits PowerShell and CPython but blocks unrecognized executables. The
+Windows workflow builds and exercises this route on every change; the Windows
+script release workflow publishes it as a GitHub release whose page carries the
+one-line PowerShell command for that exact release.
+
+The repository's GitHub Pages installation page also provides a shorter command
+at a fixed address. It names `powershell` and relaxes that process's execution
+policy, so it runs from the Command Prompt and the Run box as well as from an open
+PowerShell, and on a machine whose policy nobody changed. It saves the script to a
+fixed name under the temporary directory and invokes that file, rather than
+evaluating the downloaded text: the bootstrap authenticates itself through its own
+file path, which text piped into the shell does not have. The command carries no
+PowerShell variable, because a command pasted into PowerShell is expanded by that
+shell before the child starts. This convenience command trusts the HTTPS
+site for the initial script; it does not check that script's hash before execution.
+Dependent downloads still undergo the installer's checks. The fixed address
+serves an explicitly promoted release, so publishing another release does not
+silently change it. Preview commands retain `-AcceptUnsignedPreview`.
+
+The same page carries a `curl` one-liner for macOS and Linux. That route is not
+this Windows distribution: it installs the published npm package, which needs
+Node.js and python3 already present, and then names the command that deploys the
+work environment rather than opening its chooser over a pipe.
+
+Releases come in two channels. A stable release is Authenticode-signed with the
+project's release signing identity. Copy the version-specific command from its
+release page: the command carries the SHA-256 of that final bootstrap and the
+approved signer thumbprint, and checks both before invoking the saved script.
+The generic latest URL is not an execution command: a moving asset cannot match
+a fixed digest indefinitely. Release publication generates the command only after
+all script signing is complete.
+
+A preview release is published as a prerelease without a signing identity. Its
+bootstrap refuses to run unless the caller adds `-AcceptUnsignedPreview`, and
+it prints a warning when accepted; the manifest and asset hashes pinned inside
+the script are still enforced. New preview release pages carry a tag-pinned command with that flag and a
+bootstrap digest check before execution. Older preview pages may require the user
+to compare the published bootstrap digest separately; their assets are not rewritten. Each published
+command relaxes the execution policy for the process it starts, because a machine
+nobody configured refuses scripts under the default Restricted policy. Neither
+that relaxation nor anything installed edits the machine's saved policy, and a
+policy imposed by a domain still refuses: the invocation's own error names it.
+
+After caller-side verification, the bootstrap verifies the pinned release manifest
+and dependent archives before running downloaded application or runtime code. It reuses an approved
+CPython 3.13 x64 installation found on the machine, or provisions the pinned
+official embeddable runtime into an application-private folder. Neither an
+existing Python nor its packages are modified. The bootstrap adds the command
+directory to the current PowerShell session, so `agent-bios` and `agent-launch`
+work without reopening the terminal; other open terminals are unaffected.
+
+The installed commands are static signed wrappers, `agent-bios.ps1` and
+`agent-launch.ps1`, that read a local deployment binding and run the bundled
+application through the bound interpreter. Beside each one the installer writes a
+generated `.cmd` shim, because Windows does not treat `.ps1` as executable: without
+the shim the PATH entry serves PowerShell alone and `agent-bios` is unavailable in
+the Command Prompt, the Run box, and to any program that spawns a command. The
+shim is generated rather than shipped since Authenticode cannot sign a `.cmd`; its
+bytes are fixed and recorded in the deployment's ownership inventory, so a modified
+shim is refused exactly like a modified command. `agent-bios uninstall` removes owned
+commands, shims, shortcuts and the owned PATH entry; private instructions, session
+records and any preexisting Python are retained.
+
+This route is qualified on the Windows workflow runner in PowerShell 5.1 and 7
+with runner-only test signing, and the release workflow re-runs that
+qualification on the exact assets before it publishes them and then verifies
+the published command anonymously. Validation on a policy-managed machine is a
+separate step that no workflow establishes. Executable code still runs:
+PowerShell, curl and Python, plus native modules inside the dependency bundle.
+Migration of an existing EXE installation into this route is refused rather
+than attempted.