atris 3.1.0 → 3.2.0

package/README.md

@@ -83,7 +83,7 @@ cd ~/arena/atris-business/blondish
 atris align --fix
 ```
 
-That creates the cloud business, writes `.atris/business.json`, and scaffolds the canonical local `atris/` workspace under `~/arena/atris-business/<slug>/`.
+That creates the cloud business, writes `.atris/business.json`, initializes `.atris/state/` for events, episodes, and scorecards, and scaffolds the local `atris/` workspace under `~/arena/atris-business/<slug>/` with starter team lanes, a default recap artifact, and a first-loop starter queue in `atris/TODO.md`.
 
 If you already have a folder full of source material, run it from there with `atris business init "BLOND:ISH" --here`.
 
@@ -111,6 +111,7 @@ If you already have a folder full of source material, run it from there with `at
 
 - `atris learn` stores structured project memory in `atris/learnings.jsonl`
 - `atris wiki` keeps repo memory in `atris/wiki/` by default, with `--cloud` when you want the remote workspace path
+- `atris wiki --private` uses `.atris/presidio/` for local-only sensitive notes and operating memory
 - `atris loop` refreshes `atris/wiki/STATUS.md` and `atris/wiki/log.md`, flags stale/orphan pages, and suggests the next ingest
 - `atris activate` loads the current wiki status so the next session starts with project memory, not just tasks
 - `atris experiments` runs Karpathy-style keep/revert loops in `atris/experiments/`
@@ -121,7 +122,7 @@ If you already have a folder full of source material, run it from there with `at
 Under the hood, Atris can keep score on real repo work.
 
 - Endgame tasks can carry a `Verify:` command, so work can end on a deterministic check instead of pure prose.
-- `atris autopilot` can run that check after review, record a reward in the journal, and append a scorecard when a horizon closes.
+- `atris autopilot` can run that check after review, record a reward in the journal, and append a local scorecard when a horizon closes.
 - Future horizon picks can weight against recent scorecards, so the loop learns from repo-local history without claiming model retraining.
 
 ## Benchmark Harness
@@ -178,6 +179,14 @@ atris skill link [--all]
 
 For Codex, copy any skill folder into `~/.codex/skills/`.
 
+## v3.2.0
+
+- **Staleness gate** — tasks tagged `[unverified]` are skipped at the moment of use, not pruned eagerly. Three-state model: actionable / unverified / deleted.
+- **Lesson gate** — `isLessonResolved` checks whether a lesson already shipped before proposing new horizons from it. Prevents the loop from re-solving solved problems.
+- **`atris release`** — new command: tags the version, bumps package.json, creates a GitHub release, and drafts a `/launch` post in one shot.
+- **Shell injection fix** — `checkStaleness` switched from `execSync` string interpolation to `execFileSync` with args arrays. Markdown-derived content (task titles, inbox items) no longer reaches a shell.
+- **Codex hardening** — `atris activate` and `atris` entry point detect Codex environments and write `AGENTS.md` so Codex sessions start with workspace context.
+
 ## Update
 
 ```bash

package/atris/skills/improve/SKILL.md

@@ -23,7 +23,7 @@ This is the product. The thing the user pays for. One call, one verifiable resul
   → POST /api/improve { workspace: ".", mode: "full" }
   → backend picks a task, plans, builds, reviews, verifies
   → returns { task, reward, files_changed, verify_pass, summary }
-  → CLI writes scorecard to atris/scorecards.md
+  → CLI writes scorecard to .atris/presidio/scorecards.md
   → CLI reports result to user
 ```
 
@@ -45,7 +45,7 @@ The inference is Claude Code (or whatever model the backend uses). The environme
 5. On success:
    - Show what shipped (task name, files changed, verify result)
    - Show the reward score
-   - Write scorecard to `atris/scorecards.md`
+   - Write scorecard to `.atris/presidio/scorecards.md`
    - Append tick to today's journal
 6. On failure:
    - Show the error

package/bin/atris.js

@@ -237,6 +237,7 @@ function showHelp() {
   console.log('  search     - Search journal history (atris search <keyword>)');
   console.log('  clean      - Housekeeping (stale tasks, archive journals, broken refs)');
   console.log('  verify     - Validate work is done (tests, MAP.md, changes)');
+  console.log('  release    - Tag release, bump version, create GitHub release, draft /launch');
   console.log('  learn      - Project learnings (patterns, pitfalls, preferences)');
   console.log('  ingest     - Local-first wiki ingest into atris/wiki/');
   console.log('  query      - Local-first wiki query against atris/wiki/');
@@ -424,7 +425,7 @@ const { planAtris: planCmd, doAtris: doCmd, reviewAtris: reviewCmd } = require('
 // All other commands are lazy-loaded inline (require() only when invoked)
 
 // Check if this is a known command or natural language input
-const knownCommands = ['init', 'log', 'status', 'analytics', 'visualize', 'brainstorm', 'autopilot', 'run', 'plan', 'do', 'review',
+const knownCommands = ['init', 'log', 'status', 'analytics', 'visualize', 'brainstorm', 'autopilot', 'run', 'plan', 'do', 'review', 'release',
                        'activate', '_activate', 'agent', 'chat', 'console', 'login', 'logout', 'whoami', 'switch', 'use', 'accounts', '_resolve', '_profile-email', '_switch-session', 'shell-init', 'update', 'upgrade', 'version', 'help', 'next', 'atris',
                        'clean', 'verify', 'search', 'skill', 'member', 'learn', 'plugin', 'experiments', 'pull', 'push', 'align', 'terminal', 'diff', 'business', 'sync',
                        'ingest', 'query', 'lint', 'loop',
@@ -1002,6 +1003,11 @@ if (command === 'init') {
 } else if (command === 'verify') {
   const taskId = process.argv[3] || null;
   require('../commands/verify').verifyAtris(taskId);
+} else if (command === 'release') {
+  const dryRun = process.argv.includes('--dry-run');
+  require('../commands/release').releaseAtris({ dryRun })
+    .then(() => process.exit(0))
+    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
 } else if (command === 'search') {
   const keyword = process.argv.slice(3).join(' ');
   searchJournal(keyword);