blun-king-cli 9.1.485 → 9.1.488

package/agent-spine-plugin/LICENSE

@@ -0,0 +1,186 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the
+copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other
+entities that control, are controlled by, or are under common control with
+that entity. For the purposes of this definition, "control" means (i) the
+power, direct or indirect, to cause the direction or management of such
+entity, whether by contract or otherwise, or (ii) ownership of fifty percent
+(50%) or more of the outstanding shares, or (iii) beneficial ownership of
+such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation source, and
+configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation
+or translation of a Source form, including but not limited to compiled object
+code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that is
+included in or attached to the work (an example is provided in the Appendix
+below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form,
+that is based on (or derived from) the Work and for which the editorial
+revisions, annotations, elaborations, or other modifications represent, as a
+whole, an original work of authorship. For the purposes of this License,
+Derivative Works shall not include works that remain separable from, or merely
+link (or bind by name) to the interfaces of, the Work and Derivative Works
+thereof.
+
+"Contribution" shall mean any work of authorship, including the original
+version of the Work and any modifications or additions to that Work or
+Derivative Works thereof, that is intentionally submitted to Licensor for
+inclusion in the Work by the copyright owner or by an individual or Legal
+Entity authorized to submit on behalf of the copyright owner. For the purposes
+of this definition, "submitted" means any form of electronic, verbal, or
+written communication sent to the Licensor or its representatives, including
+but not limited to communication on electronic mailing lists, source code
+control systems, and issue tracking systems that are managed by, or on behalf
+of, the Licensor for the purpose of discussing and improving the Work, but
+excluding communication that is conspicuously marked or otherwise designated
+in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on
+behalf of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this
+section) patent license to make, have made, use, offer to sell, sell, import,
+and otherwise transfer the Work, where such license applies only to those
+patent claims licensable by such Contributor that are necessarily infringed by
+their Contribution(s) alone or by combination of their Contribution(s) with
+the Work to which such Contribution(s) was submitted. If You institute patent
+litigation against any entity (including a cross-claim or counterclaim in a
+lawsuit) alleging that the Work or a Contribution incorporated within the Work
+constitutes direct or contributory patent infringement, then any patent
+licenses granted to You under this License for that Work shall terminate as of
+the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and in
+Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy
+of this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that
+You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from the
+Source form of the Work, excluding those notices that do not pertain to any
+part of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution,
+then any Derivative Works that You distribute must include a readable copy of
+the attribution notices contained within such NOTICE file, excluding those
+notices that do not pertain to any part of the Derivative Works, in at least
+one of the following places: within a NOTICE text file distributed as part of
+the Derivative Works; within the Source form or documentation, if provided
+along with the Derivative Works; or, within a display generated by the
+Derivative Works, if and wherever such third-party notices normally appear.
+The contents of the NOTICE file are for informational purposes only and do not
+modify the License. You may add Your own attribution notices within Derivative
+Works that You distribute, alongside or as an addendum to the NOTICE text from
+the Work, provided that such additional attribution notices cannot be
+construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide
+additional or different license terms and conditions for use, reproduction,
+or distribution of Your modifications, or for any such Derivative Works as a
+whole, provided Your use, reproduction, and distribution of the Work otherwise
+complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any
+Contribution intentionally submitted for inclusion in the Work by You to the
+Licensor shall be under the terms and conditions of this License, without any
+additional terms or conditions. Notwithstanding the above, nothing herein
+shall supersede or modify the terms of any separate license agreement you may
+have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as required
+for reasonable and customary use in describing the origin of the Work and
+reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work (and each Contributor provides its
+Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied, including, without limitation, any warranties
+or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any risks
+associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in
+tort (including negligence), contract, or otherwise, unless required by
+applicable law (such as deliberate and grossly negligent acts) or agreed to in
+writing, shall any Contributor be liable to You for damages, including any
+direct, indirect, special, incidental, or consequential damages of any
+character arising as a result of this License or out of the use or inability to
+use the Work (including but not limited to damages for loss of goodwill, work
+stoppage, computer failure or malfunction, or any and all other commercial
+damages or losses), even if such Contributor has been advised of the
+possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work
+or Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations
+and/or rights consistent with this License. However, in accepting such
+obligations, You may act only on Your own behalf and on Your sole
+responsibility, not on behalf of any other Contributor, and only if You agree
+to indemnify, defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason of your
+accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate
+notice, with the fields enclosed by brackets "[]" replaced with your own
+identifying information. (Don't include the brackets!) The text should be
+enclosed in the appropriate comment syntax for the file format. We also
+recommend that a file or class name and description of purpose be included on
+the same "printed page" as the copyright notice for easier identification
+within third-party archives.
+
+Copyright 2026 Mayk Biletti
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/agent-spine-plugin/README.md

@@ -0,0 +1,342 @@
+<p align="center">
+  <img src="assets/agentspine-banner.svg" alt="AgentSpine — identity that persists, memory that stays grounded" width="100%">
+</p>
+
+<p align="center">
+  <a href="https://github.com/Maykbiletti/AgentSpine/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/Maykbiletti/AgentSpine/ci.yml?branch=main&amp;style=flat-square&amp;label=CI" alt="CI status"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-22c55e?style=flat-square" alt="Apache-2.0 license"></a>
+  <img src="https://img.shields.io/badge/Node.js-%E2%89%A520.9-3c873a?style=flat-square" alt="Node.js 20.9 or newer">
+  <img src="https://img.shields.io/badge/sources-read--only-67e8f9?style=flat-square" alt="Source documents are read-only">
+</p>
+
+<p align="center">
+  A local-first, host-neutral context spine for agents that already have a history.
+</p>
+
+AgentSpine discovers the Markdown files an agent already relies on, fingerprints them, preserves the host's native hierarchy, follows explicit links, and serves only the relevant context through a CLI, lifecycle hooks, and MCP.
+
+It does **not** replace your agent. It gives existing identity and memory a dependable structure without rewriting a single source byte.
+
+## Why AgentSpine
+
+Most agent memory systems begin by asking you to migrate everything into a new database or a new canonical file. AgentSpine begins with a stricter promise:
+
+> Your existing `SOUL.md`, `AGENTS.md`, `CLAUDE.md`, `MEMORY.md`, and linked Markdown remain where they are, exactly as they are.
+
+That makes AgentSpine suitable for long-lived agents, mixed Claude Code/Codex environments, repositories with nested instruction files, and teams that cannot afford silent identity drift.
+
+## How it fits together
+
+```mermaid
+flowchart TB
+    A["Existing Markdown sources"] --> B["Read-only discovery"]
+    B --> C["Provenance catalog"]
+    C --> D["Host-aware resolver"]
+    F["Relationships + attention + safe learning + tasks + reviewed sharing"] --> G["Budgeted session briefing"]
+    D --> G
+    P["Separate default-deny delegation policy"] --> F
+    Y["Exact local execution policy"] --> J["Leased job + atomic checkpoint"] --> G
+    W["Authenticated channel event"] --> K["Exact route + durable lease"] --> G
+    X["Optional provider-neutral adapter"] --> S["Optional Ed25519 origin check"] --> Q["Local import quarantine"] --> F
+    G --> E["Claude Code · Codex · MCP"]
+```
+
+The resolver keeps three concerns separate:
+
+| Layer | Purpose | Typical sources | Can grant rights? |
+|---|---|---|---|
+| Constitution | Fixed instructions and dated directives | `CLAUDE.md`, `AGENTS.md`, `RULES.md` | Only the real host policy can |
+| Soul | Stable voice, identity, goals, character | `SOUL.md`, existing persona files | No |
+| Memory | Small linked facts and an index | `MEMORY.md`, `memory/**/*.md` | Never |
+
+Other Markdown remains discoverable as reference material. Names and folders provide initial hints only: the agent itself can classify documents and connect them in a reversible overlay graph. A document becomes protected when it is a native instruction, soul, memory source, or is explicitly linked from one.
+
+## Quick start
+
+Requires Node.js 20.9 or newer.
+
+```bash
+git clone https://github.com/Maykbiletti/AgentSpine.git
+cd AgentSpine
+npm install
+npm test
+npm link
+```
+
+Then point AgentSpine at any existing project:
+
+```bash
+agentspine scan /path/to/project
+agentspine context /path/to/project --host codex
+agentspine briefing /path/to/project --host codex --max-bytes 16384
+agentspine verify /path/to/project
+agentspine audit /path/to/project
+```
+
+The generated catalog is written to the operating system's user state directory, never into the scanned project. Set `AGENTSPINE_STATE_DIR` if you want a custom location.
+
+## Install for Claude Code
+
+Add this repository as a marketplace and install the plugin:
+
+```text
+/plugin marketplace add Maykbiletti/AgentSpine
+/plugin install agent-spine@agent-spine
+```
+
+For local development:
+
+```bash
+claude --plugin-dir .
+```
+
+Claude Code discovers the bundled skill, hooks, and MCP server. Review and trust executable components when the host asks.
+Version `0.8.0` explicitly registers `.mcp.json`, ships one native `hooks/hooks.json`, and invalidates Claude Code's earlier `0.7.0` plugin cache. The unreleased BLUN adapter adds `blun.plugin.json` with native MCP and lifecycle registrations. Fresh-install and upgrade checks prove package containment and entrypoint behavior; actual hook discovery and trust remain host-controlled and must be inspected in the live host. Claude project memory is `MEMORY.md`-indexed, lazy, race-safe, persistently cached outside the project, and independent of unrelated file count; the live path performs no memory-directory enumeration.
+
+Verify the installed registration from a checkout with:
+
+```bash
+npm run host:check
+npm run host:install-check
+claude plugin list
+claude mcp list
+```
+
+If AgentSpine is installed but absent from `/mcp`, refresh the cached marketplace copy, reinstall the plugin, start a new Claude Code session, and approve the `agent-spine` server in `/mcp`:
+
+```bash
+claude plugin marketplace update agent-spine
+claude plugin uninstall agent-spine@agent-spine
+claude plugin install agent-spine@agent-spine
+claude mcp list
+```
+
+An unapproved server may appear as `Pending approval`; approval remains a user action and AgentSpine never bypasses Claude Code's trust boundary.
+
+After that one host trust decision, enable automatic continuity once for a known local identity:
+
+```bash
+agentspine entity person:me --kind person --name "Me" --privacy shared
+agentspine continuity-config /path/to/project --enabled true --entity person:me --confirm-local-opt-in
+```
+
+From the next prompt onward, installed lifecycle hooks scan and inject the real scoped `session_briefing` at start, resume, prompt submission, and compaction boundaries. The model does not need to choose `scan`, `context`, or `session_briefing`. The opt-in is separate from host trust because learning conversation signals is a user-controlled privacy decision.
+
+Source discovery is independent of the installation `cwd`: Claude uses `CLAUDE_CONFIG_DIR` plus the active project and evidenced project-memory binding; Codex uses `CODEX_HOME` plus its native root-to-`cwd` instruction chain. Inspect the result with `agentspine source-status --host claude|codex --cwd /active/project --json`. See [host-native source roots](docs/source-roots.md).
+
+## Install for Codex
+
+AgentSpine ships a native `.codex-plugin/plugin.json`. Add the repository to a configured marketplace, open the Codex plugin browser with `/plugins`, install AgentSpine, and start a fresh session. For development, the CLI and MCP server can be used directly:
+
+```bash
+npm link
+agentspine-mcp
+```
+
+See [host integration](docs/host-integration.md) for exact component paths and trust behavior.
+
+## Preservation contract
+
+AgentSpine's first release is intentionally narrow and testable:
+
+- source Markdown is opened read-only;
+- symlinks are not followed during discovery;
+- generated state is stored outside the project;
+- every source receives a SHA-256 fingerprint, byte size, path, layer, and provenance;
+- native host precedence is retained rather than flattened;
+- broken links and competing candidates are exposed as findings, never auto-resolved;
+- linked files are resolved transitively without loading unrelated Markdown;
+- oversized context stays available through exact ranged reads;
+- agent write tools are blocked from protected sources by lifecycle hooks;
+- uninstalling AgentSpine leaves every source file untouched.
+
+Read the full [preservation contract](docs/preservation-contract.md), including threat boundaries and deliberate non-goals.
+
+## CLI
+
+| Command | Outcome |
+|---|---|
+| `agentspine scan [root]` | Discover, classify, fingerprint, and save an external catalog |
+| `agentspine context [root] --host …` | Resolve relevant sources in deterministic order |
+| `agentspine briefing [root] …` | Assemble one scoped, privacy-filtered, byte-budgeted session packet |
+| `agentspine read <path>` | Read an indexed source range with SHA-256 provenance |
+| `agentspine verify [root]` | Report added, removed, or byte-changed Markdown |
+| `agentspine link …` | Add an agent-inferred document relationship to the overlay graph |
+| `agentspine annotate …` | Add a reversible semantic classification with confidence |
+| `agentspine entity …` | Add or update a person, agent, group, channel, or project |
+| `agentspine relate …` | Connect two known entities with privacy and confidence |
+| `agentspine relationships …` | Read one privacy-filtered relationship neighborhood |
+| `agentspine attention [root]` | Read sparse due cues after privacy, focus, quiet-hour, and repeat filters |
+| `agentspine attention-add …` | Record an unanswered question, promise, check-in, or meaningful change |
+| `agentspine attention-touch …` | Record only that an entity interaction occurred |
+| `agentspine attention-config …` | Configure limits, quiet hours, silence threshold, or disable attention |
+| `agentspine attention-delete …` | Permanently remove a cue and its retained attention history |
+| `agentspine attention-events …` | Inspect durable heartbeat, promise, and blocker events plus optional history |
+| `agentspine attention-event-delete …` | Permanently remove one lifecycle event, its receipts, history, and presentation state |
+| `agentspine learn-propose …` | Store an evidence-backed candidate outside accepted context |
+| `agentspine learn-evidence …` | Append evidence while retaining the previous candidate version |
+| `agentspine learn-review …` | Explicitly accept or reject a candidate |
+| `agentspine learn-context …` | Read only accepted, privacy-filtered learning |
+| `agentspine learn-evaluate …` | Run the default-off low-risk automatic policy |
+| `agentspine learn-rollback …` | Restore the accepted fact replaced by a learning |
+| `agentspine learn-config …` | Configure auto-promotion thresholds and context limits |
+| `agentspine learn-delete …` | Permanently remove one candidate and its learning history |
+| `agentspine continuity-config …` | Enable, disable, scope, and budget automatic continuity after local opt-in |
+| `agentspine continuity-status …` | Inspect configuration and minimal signal counts without transcript content |
+| `agentspine continuity-purge …` | Permanently remove one identity's automatic signals and learned context |
+| `agentspine source-status …` | Inspect host-native user, project, and memory roots without exposing source contents |
+| `agentspine source-bind …` | Bind existing user-wide continuity after an explicit local confirmation |
+| `agentspine source-rollback …` | Disable one source binding while retaining its append-only audit history |
+| `agentspine source-purge …` | Permanently remove one binding while retaining only its non-reversible digest receipt |
+| `agentspine delegation-check …` | Check explicit actor/action/target coordination policy; default deny |
+| `agentspine delegation-grant …` | Owner-confirmed local CLI grant for task coordination only |
+| `agentspine delegation-revoke …` | Revoke future coordination and retain policy history |
+| `agentspine task-create …` | Create a context-only task, open thread, or handoff |
+| `agentspine task-update …` | Update status, assignee, or details while retaining the prior version |
+| `agentspine tasks …` | Read privacy-filtered current coordination context |
+| `agentspine execution-grant …` | Create one exact local owner-confirmed job grant; never inferred from context |
+| `agentspine execution-revoke …` | Revoke future start, resume, and effects while retaining policy history |
+| `agentspine job-register …` | Register a waiting job with its initial content-bound checkpoint |
+| `agentspine jobs …` | Inspect durable status, retry, blocker, lease, and checkpoint metadata |
+| `agentspine job-cancel …` | Stop a job through an explicit local owner decision |
+| `agentspine job-delete …` | Permanently purge an unleased job, history, and receipts |
+| `agentspine channel-bind …` | Create or replace one exact locally confirmed provider-to-agent route |
+| `agentspine channel-revoke …` | Revoke a route and cancel its pending or leased events |
+| `agentspine channel-policy …` | Inspect local channel bindings without exposing secret values |
+| `agentspine channel-events …` | Inspect the exact-scope durable ingress queue and leases |
+| `agentspine persona-sync …` | Synchronize an explicitly approved external authenticated roster |
+| `agentspine personas …` | Inspect active and historical persona identities and provenance |
+| `agentspine goal-assign …` | Assign one authenticated focused goal to an active agent |
+| `agentspine gateway-control …` | Enable, stop, or kill-switch the local worker under explicit owner control |
+| `agentspine gateway-status …` | Inspect goals, queue, delivery receipts, and independent health gates |
+| `agentspine share-init …` | Initialize an optional provider-neutral directory adapter outside the project |
+| `agentspine share-keygen …` | Create or explicitly rotate a local Ed25519 signing identity |
+| `agentspine share-trust …` | Trust one exported public identity for the current project |
+| `agentspine share-trust-revoke …` | Revoke a trusted key without turning signatures into authority |
+| `agentspine share-publish …` | Publish one explicitly selected accepted, non-private learning |
+| `agentspine share-pull …` | Import immutable events into local quarantine, never active context |
+| `agentspine share-snapshot-export …` | Export one immutable signed snapshot outside the scanned project |
+| `agentspine share-https-publish …` | Create a content-addressed HTTPS object and verify it by read-back |
+| `agentspine share-https-pull …` | Fetch a bounded signed snapshot through hardened HTTPS into quarantine |
+| `agentspine share-feed-publish …` | Append one immutable snapshot to a signed ETag-protected feed |
+| `agentspine share-feed-pull …` | Verify feed continuity and import its latest snapshot into quarantine |
+| `agentspine share-feed-state …` | Inspect local rollback-protection receipts and retained history |
+| `agentspine share-peer-serve …` | Answer one live signed snapshot challenge over stdin/stdout |
+| `agentspine share-peer-pull …` | Pull through an owner-selected executable without invoking a shell |
+| `agentspine share-sqlite-init …` | Bind an external SQLite file to one authenticated adapter |
+| `agentspine share-sqlite-publish …` | Append a verified snapshot and atomically advance its hash-linked head |
+| `agentspine share-sqlite-inspect …` | Validate and inspect the complete local database history |
+| `agentspine share-sqlite-pull …` | Import the latest fully verified database snapshot into quarantine |
+| `agentspine share-inbox …` | Review pending, accepted, rejected, superseded, or rolled-back imports |
+| `agentspine share-review …` | Accept or reject one import through a second local decision |
+| `agentspine share-context …` | Read only locally accepted, privacy-filtered shared memory |
+| `agentspine share-rollback …` | Roll back shared supersession and restore the prior record |
+| `agentspine audit [root]` | Run ten deterministic quality and preservation gates |
+| `agentspine acceptance` | Run the visible synthetic Claude/Codex lifecycle acceptance and print reproducible receipts |
+| `agentspine doctor` | Check runtime and preservation mode |
+| `agentspine mcp` | Start the stdio MCP server |
+
+Every command supports `--json` where structured output is useful.
+
+The optional SQLite commands use Node.js `node:sqlite` and therefore require Node.js 22.13 or newer; core discovery, CLI, MCP, and the other transports retain the package's declared Node.js support. See the [SQLite transport contract](docs/sqlite-transport.md).
+
+## MCP tools
+
+```mermaid
+flowchart LR
+    S["scan"] --> R["resolve_context"]
+    R --> B["session_briefing"]
+    B --> Q["read_document"]
+    Q --> V["verify"]
+    E["upsert_entity"] --> L["link_entities"]
+    L --> C["relationship_context"]
+```
+
+- `scan` builds the source map.
+- `resolve_context` selects constitution, soul, memory index, and linked facts for the current host and directory.
+- `session_briefing` combines only the relevant native sources, current tasks, relationships, accepted learning, reviewed shared memory, and optional cues within a hard compact-JSON byte budget.
+- `read_document` retrieves exact byte ranges that did not fit the context budget.
+- `verify` proves whether source bytes changed since the last scan.
+- `link_documents` and `annotate_document` let agents build their own semantic map without editing sources.
+- `upsert_entity`, `link_entities`, and `relationship_context` maintain a privacy-scoped social and responsibility map outside the project.
+- `upsert_attention`, `record_activity`, `attention_context`, `resolve_attention`, `configure_attention`, and `delete_attention` provide sparse follow-up suggestions without sending messages or granting authority.
+- `propose_learning`, `add_learning_evidence`, `review_learning`, `learning_context`, `evaluate_learning`, `rollback_learning`, `configure_learning`, and `delete_learning` keep observations separate from accepted context and preserve every relevance change.
+- `check_delegation`, `create_task`, `update_task`, and `task_context` coordinate work under a separate default-deny policy. MCP intentionally has no policy grant, revoke, or permanent task-delete tool.
+- `shared_context` reads only locally reviewed shared memory. MCP intentionally cannot initialize adapters, publish, pull, inspect the pending inbox, review imports, roll back, or delete.
+- `audit` runs the same ten gates available through the CLI.
+
+Relationship updates supersede the active view but retain the previous observation in append-only graph history. Permission-like and credential-like attributes are rejected recursively. See [relationships and learning](docs/relationships.md).
+
+Attention is deliberately restrained: installed hooks retain minimal heartbeats, promises, and blockers without storing transcripts; each event requires an exact known actor/project/task scope; private and group visibility stays exact; and quiet hours, focus, throttling, lifecycle transitions, deletion, and purge remain enforceable. Events are context only—they send no messages, start no work, and grant no authority. See [attention](docs/attention.md).
+
+Safe learning is evidence-first: general candidates remain invisible until reviewed. A separate default-off continuity opt-in can automatically accept only direct, high-confidence style, preference, no-go, correction, project-fact, and reference signals. Sensitive personal facts, secrets, identity merges, private group content, and operational or authority claims are always rejected. See [automatic continuity](docs/automatic-continuity.md) and [safe learning](docs/learning.md).
+
+Delegation is intentionally narrower than authority: a relationship such as `responsible-for` never permits assignment. Cross-entity task actions require an explicit local actor/action/target grant, while tasks, open threads, and handoffs remain context-only. See [delegation and coordination](docs/coordination.md).
+
+Shared memory is transport-neutral and double-reviewed: only accepted non-private learning may be published, every import enters quarantine, and the receiving installation must confirm it again before it can appear in context. The reference directory adapter works without a cloud account. Signed adapters can be exported as immutable snapshots, published as create-only content-addressed HTTPS objects, discovered through signed ETag-protected feeds with local rollback receipts, or requested live through a challenge-response stdio peer. HTTPS pulling uses pinned DNS, SSRF protection, strict limits, verified read-back, and optional environment-supplied bearer authentication. Peer pulling delegates the carrier to one explicit owner-selected executable without AgentSpine invoking a shell. Digests and Ed25519 envelopes protect transport integrity and configured origins; neither grants authority or approves content. See [shared memory adapters](docs/shared-memory.md), [HTTPS snapshots](docs/https-transport.md), [immutable HTTPS objects](docs/object-transport.md), [signed mutable feeds](docs/feed-transport.md), and [peer transport](docs/peer-transport.md).
+
+Session briefing keeps that growing context usable: one scoped read prioritizes the current request, explicit stops, and current task; deduplicates local and shared facts; defaults to focus mode; enforces exact group audiences; and measures the entire compact JSON result against the requested byte ceiling. Native lifecycle hooks now inject this packet automatically instead of asking the model to call MCP. See [session briefing](docs/session-briefing.md).
+
+The authenticated channel-wake runtime prevents an incoming provider message from losing its recipient or origin. A locally confirmed binding fixes provider, tenant, account, chat, thread, sender, agent, project, group, and session; HMAC-authenticated events enter one durable leased lane and the installed host hook injects the exact message with its compact voice brief. The optional `agentspine-worker` now supplies the missing gateway responsibilities: automatic external-roster synchronization, Telegram polling, exact host-run requests, bounded checkpoints, crash recovery, and idempotent delivery back to the origin. It runs only when the owner starts or supervises it and remains outside MCP. See [authenticated channel wake](docs/channel-runtime.md), [durable gateway worker](docs/gateway-runtime.md), and the [OpenClaw/Hermes reference study](docs/harness-reference.md).
+
+The rights-bound self-starter is a separate execution path. A genuine local owner action must grant one exact actor, job, task, target, project, host, and finite tool-capability set. Installed hooks then acquire one lease, recheck authority before every effect, checkpoint the workspace after every result, and resume only an unchanged checkpoint. Memory, Markdown, relationships, learning, attention, task text, previous approvals, and MCP can never create that grant. See [rights-bound self-starter](docs/selfstarter.md).
+
+## Optional four-layer starter
+
+New agents that do not have identity files yet can start with the included [`spine-example/`](spine-example/) template:
+
+| Layer | Holds | Expected change rate |
+|---|---|---|
+| Identity | Name, purpose, stable principles | Almost never |
+| Voice | Tone, language, and expression | Rarely |
+| Conduct | Working behavior and verification habits | On explicit feedback |
+| Grown history | Dated experience and corrections | Append-only |
+
+The manual [`skill/SKILL.md`](skill/SKILL.md) can scaffold and audit this optional layout. It is only for an agent with no existing spine. AgentSpine never migrates an established agent into the example, and the normal plugin resolver continues to discover and preserve whatever files already exist.
+
+## Design principles
+
+1. **Preserve before learning.** No useful memory feature justifies destroying the history it is meant to protect.
+2. **Memory is data, never authority.** A remembered sentence cannot create permissions, bypass review, or widen access.
+3. **Relevance changes; history does not disappear.** New information adjusts confidence and relevance instead of silently overwriting old records.
+4. **Identity is contextual.** People, agents, groups, and channels receive separate stable identities until an explicit link proves otherwise.
+5. **Human warmth cannot outrank the task.** Relationship context stays small and yields first when context is tight.
+6. **Local operation is complete.** Remote or shared-memory adapters are optional extensions, not hidden requirements.
+
+## Project status
+
+AgentSpine is in active early development. `v0.8` adds authenticated persona synchronization, a compact voice bridge, an optional durable gateway worker, exact Telegram ingress and delivery, focused goals, per-agent lanes, leases, recovery, and independent health gates. Automatic lifecycle behavior requires the host to discover and trust the current hook definition; a staged direct hook invocation is not treated as proof of that real host decision. Every external effect remains current-rights-bound and default-deny, and existing source Markdown remains immutable.
+
+## Documentation
+
+| Goal | Start here |
+|---|---|
+| Understand the system | [Architecture](docs/architecture.md) |
+| Audit non-destructive behavior | [Preservation contract](docs/preservation-contract.md) |
+| Integrate a host | [Claude Code and Codex](docs/host-integration.md) |
+| Bind an authenticated external message | [Authenticated channel wake](docs/channel-runtime.md) |
+| Run automatic roster, goal, and Telegram work | [Durable gateway worker](docs/gateway-runtime.md) |
+| Compare harness design choices | [OpenClaw and Hermes reference study](docs/harness-reference.md) |
+| Reproduce the complete host behavior | [Visible cross-host acceptance](docs/acceptance.md) |
+| Enable automatic continuity | [Automatic continuity](docs/automatic-continuity.md) |
+| Load one compact session packet | [Session briefing](docs/session-briefing.md) |
+| Resume one exactly authorized job | [Rights-bound self-starter](docs/selfstarter.md) |
+| Understand relationships and history | [Relationships](docs/relationships.md) |
+| Configure sparse follow-ups | [Attention](docs/attention.md) |
+| Review evidence-backed observations | [Safe learning](docs/learning.md) |
+| Coordinate agents without memory-based authority | [Delegation and coordination](docs/coordination.md) |
+| Exchange reviewed context between installations | [Shared memory adapters](docs/shared-memory.md) |
+| Publish or pull signed static snapshots | [HTTPS snapshot transport](docs/https-transport.md) |
+| Publish immutable content-addressed objects | [HTTPS object transport](docs/object-transport.md) |
+| Discover successive snapshots safely | [Signed mutable feeds](docs/feed-transport.md) |
+| Pull directly from another installation | [Challenge-response peer transport](docs/peer-transport.md) |
+| Verify or cut a release | [Release process](docs/releasing.md) |
+| Run the Definition of Done | [Ten quality gates](docs/quality-gates.md) |
+| See planned capabilities | [Roadmap](docs/roadmap.md) |
+| Cut a release | [Release process](docs/releasing.md) |
+| Contribute safely | [Contributing](CONTRIBUTING.md) |
+| Report a vulnerability | [Security policy](SECURITY.md) |
+
+## License
+
+Apache License 2.0. See [LICENSE](LICENSE).

package/agent-spine-plugin/assets/agentspine-banner.svg

@@ -0,0 +1,32 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="360" viewBox="0 0 1200 360" role="img" aria-labelledby="title desc">
+  <title id="title">AgentSpine</title>
+  <desc id="desc">A layered identity and memory spine for AI agents</desc>
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+      <stop stop-color="#07111f"/>
+      <stop offset="1" stop-color="#111c35"/>
+    </linearGradient>
+    <linearGradient id="line" x1="0" y1="0" x2="0" y2="1">
+      <stop stop-color="#67e8f9"/>
+      <stop offset=".52" stop-color="#8b5cf6"/>
+      <stop offset="1" stop-color="#f472b6"/>
+    </linearGradient>
+    <filter id="glow"><feGaussianBlur stdDeviation="7" result="b"/><feMerge><feMergeNode in="b"/><feMergeNode in="SourceGraphic"/></feMerge></filter>
+  </defs>
+  <rect width="1200" height="360" rx="30" fill="url(#bg)"/>
+  <g opacity=".13" stroke="#9cc8ff"><path d="M0 64h1200M0 128h1200M0 192h1200M0 256h1200M0 320h1200"/><path d="M96 0v360M192 0v360M288 0v360M384 0v360M480 0v360M576 0v360M672 0v360M768 0v360M864 0v360M960 0v360M1056 0v360"/></g>
+  <g transform="translate(116 42)" filter="url(#glow)">
+    <path d="M74 14c-26 24-26 48 0 72s26 48 0 72-26 48 0 72 26 48 0 72" fill="none" stroke="url(#line)" stroke-width="12" stroke-linecap="round"/>
+    <path d="M74 14c26 24 26 48 0 72s-26 48 0 72 26 48 0 72-26 48 0 72" fill="none" stroke="#eef7ff" stroke-opacity=".68" stroke-width="5" stroke-linecap="round"/>
+    <g fill="#07111f" stroke="#baf5ff" stroke-width="4"><circle cx="74" cy="14" r="10"/><circle cx="74" cy="86" r="10"/><circle cx="74" cy="158" r="10"/><circle cx="74" cy="230" r="10"/><circle cx="74" cy="302" r="10"/></g>
+  </g>
+  <g fill="#f8fbff" font-family="Inter,Segoe UI,Arial,sans-serif">
+    <text x="286" y="139" font-size="76" font-weight="750" letter-spacing="-3">AgentSpine</text>
+    <text x="290" y="194" font-size="26" fill="#b9c9e5">Identity that persists. Memory that stays grounded.</text>
+    <g transform="translate(290 238)" font-size="16" font-weight="600">
+      <rect width="150" height="38" rx="19" fill="#67e8f9" fill-opacity=".13" stroke="#67e8f9" stroke-opacity=".5"/><text x="75" y="25" text-anchor="middle" fill="#9af2fb">NON-DESTRUCTIVE</text>
+      <rect x="166" width="112" height="38" rx="19" fill="#8b5cf6" fill-opacity=".15" stroke="#a78bfa" stroke-opacity=".55"/><text x="222" y="25" text-anchor="middle" fill="#c4b5fd">LOCAL-FIRST</text>
+      <rect x="294" width="136" height="38" rx="19" fill="#f472b6" fill-opacity=".13" stroke="#f9a8d4" stroke-opacity=".5"/><text x="362" y="25" text-anchor="middle" fill="#fbcfe8">HOST-NEUTRAL</text>
+    </g>
+  </g>
+</svg>

package/agent-spine-plugin/bin/agentspine-mcp.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { startMcpServer } from "../src/mcp.js";
+
+startMcpServer();

package/agent-spine-plugin/bin/agentspine.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { run } from "../src/cli.js";
+
+run().catch((error) => {
+  process.stderr.write(`AgentSpine: ${error.message}\n`);
+  process.exitCode = 1;
+});

package/agent-spine-plugin/blun.plugin.json

@@ -0,0 +1,33 @@
+{
+  "name": "agent-spine",
+  "version": "0.8.0",
+  "description": "A non-destructive identity and memory spine for BLUN King agents.",
+  "license": "Apache-2.0",
+  "author": {
+    "name": "Mayk Biletti"
+  },
+  "skills": "./skills/",
+  "mcpServers": {
+    "agent-spine": {
+      "transport": "stdio",
+      "command": "node",
+      "args": ["./src/mcp.js"]
+    }
+  },
+  "hooks": [
+    { "event": "SessionStart", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "UserPromptSubmit", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "PreToolUse", "matcher": "Edit|Write|apply_patch|Bash|exec_command", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "PostToolUse", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "PreCompact", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "PostCompact", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "Stop", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "SubagentStop", "command": "node \"./src/hook.js\"", "timeout": 15 }
+  ],
+  "interface": {
+    "displayName": "AgentSpine",
+    "shortDescription": "Identity, memory, attention, and resumable context without rewriting source files.",
+    "developerName": "Mayk Biletti",
+    "websiteURL": "https://github.com/Maykbiletti/AgentSpine"
+  }
+}