blun-king-cli 9.1.486 → 9.1.488

package/LIESMICH.txt

@@ -1,5 +1,5 @@
-BLUN King für macOS und Windows
-===============================
+BLUN King für macOS, Linux und Windows
+======================================
 
 Voraussetzung
 -------------
@@ -9,7 +9,7 @@ Installation
 ------------
 Die geprüfte Version exakt global installieren:
 
-  npm install -g blun-king-cli@9.1.108
+  npm install -g blun-king-cli@9.1.488
 
 Start
 -----
@@ -44,13 +44,32 @@ abweichende MCP-Befehle bleiben unverändert.
 /mcp zeigt den Betriebszustand ohne internen Konfigurationspfad. In der
 Detailansicht bleibt der Pfad für die Fehlersuche verfügbar.
 
+Ab BLUN King 9.1.487 gehört AgentSpine fest zum ausgelieferten Paket. Beim
+normalen Start wird die geprüfte Pluginfassung in einem inhaltsadressierten
+Verzeichnis installiert, aktiviert und mit ihrem MCP-Server verbunden. Eine
+vorhandene GitHub- oder lokale AgentSpine-Installation wird auf die gebündelte
+Fassung umgeschaltet, ohne andere Plugins oder deren Einstellungen zu löschen.
+Unveränderte Inhalte werden wiederverwendet; ein beschädigter Digest-Pfad
+stoppt die Aktualisierung, bevor die Plugin-Registry geändert wird. Dieser
+Lieferweg gilt unter macOS, Linux und Windows.
+
 Telegram-Nachrichten werden in Eingangsreihenfolge verarbeitet. Im Leerlauf
-startet die Warteschlange selbstständig; während eines Werkzeuglaufs erfolgt
-die Zustellung am nächsten geschützten Übergabepunkt. Strg+C und Esc brechen
-einen aktiven Zug ab, ohne den geschriebenen Entwurf zu löschen. Das gilt auch
-bei Autovervollständigung, Geistervorschlägen, Bash-Eingabe und einer offenen
+startet die Warteschlange selbstständig. Während eines aktiven Laufs gibt
+Strg+S alle zu diesem Zeitpunkt wartenden Konsolen- und Chatnachrichten genau
+einmal frei. Jeder Druck auf Esc gibt genau eine weitere wartende Nachricht
+frei; erst bei leerer Warteschlange bricht Esc den aktuellen Lauf ab. Die
+Warteschlange wird dabei nicht gelöscht. Strg+C bricht den aktiven Zug direkt
+ab, ohne den geschriebenen Entwurf zu löschen. Das gilt auch bei
+Autovervollständigung, Geistervorschlägen, Bash-Eingabe und einer offenen
 Mehrzeileneingabe.
 
+Version 9.1.488 stellt außerdem die interne Todo-Liste wieder her. Deutsche
+Aufgabenlisten-Befehle wählen wieder TodoList statt der getrennten TaskList für
+Hintergrundprozesse. Lesen, Ersetzen, Aktualisieren und Leeren funktionieren in
+derselben Sitzung; eine vollständig erledigte Liste wird aus der Anzeige
+entfernt. Adressierte Telegram-Nachrichten erscheinen nicht mehr gleichzeitig
+im Fokusbereich und in der Warteschlange.
+
 Telegram-Nachrichten, die bei bereits aktivem Kernzug eintreffen, werden ohne
 konkurrierenden Start zurückgewiesen und bleiben an der Spitze der
 FIFO-Warteschlange. Für diesen normalen Wartestatus erscheint kein

package/README.md

@@ -9,7 +9,7 @@ Voraussetzung ist Node.js 24.15 oder neuer. Die geprüfte Version wird exakt
 installiert:
 
 ```powershell
-npm install -g blun-king-cli@9.1.106
+npm install -g blun-king-cli@9.1.488
 ```
 
 ## Reproduzierbares Staging und Packen
@@ -68,13 +68,24 @@ blun tools enable context7
 ```
 
 Telegram-Nachrichten werden in Eingangsreihenfolge verarbeitet. Trifft eine
-Nachricht im Leerlauf ein, startet die Warteschlange selbstständig; während
-eines Werkzeuglaufs wird sie am nächsten geschützten Übergabepunkt eingefügt.
+Nachricht im Leerlauf ein, startet die Warteschlange selbstständig. Während
+eines aktiven Laufs gibt Strg+S alle zu diesem Zeitpunkt wartenden Konsolen-
+und Chatnachrichten genau einmal frei. Jeder Druck auf Esc gibt genau eine
+weitere wartende Nachricht frei; erst bei leerer Warteschlange bricht Esc den
+aktuellen Lauf ab. Die Warteschlange wird dabei nicht gelöscht. Strg+C bricht
+den aktiven Zug direkt ab, ohne den geschriebenen Entwurf zu löschen.
 Telegram-Nachrichten, die bei bereits aktivem Kernzug eintreffen, werden ohne
 konkurrierenden Start zurückgewiesen und bleiben an der Spitze der
 FIFO-Warteschlange. Für diesen normalen Wartestatus erscheint kein
 `turn.agent_busy`-Fehler.
 
+Version 9.1.488 stellt außerdem die interne Todo-Liste wieder her. Deutsche
+Aufgabenlisten-Befehle wählen wieder TodoList statt der getrennten TaskList für
+Hintergrundprozesse. Lesen, Ersetzen, Aktualisieren und Leeren funktionieren in
+derselben Sitzung; eine vollständig erledigte Liste wird aus der Anzeige
+entfernt. Adressierte Telegram-Nachrichten erscheinen nicht mehr gleichzeitig
+im Fokusbereich und in der Warteschlange.
+
 Ab BLUN King 9.1.416 bleiben alle Ergebnisse des jüngsten Werkzeugaufrufs bis
 zur nächsten Assistentenantwort vollständig im Modellkontext. Das gilt auch für
 große parallele Read-, Grep- und Bash-Aufrufe sowie für nachträglich

package/agent-spine-plugin/.claude-plugin/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "agent-spine",
+  "description": "Non-destructive identity and memory infrastructure for AI agents.",
+  "owner": {
+    "name": "Mayk Biletti"
+  },
+  "plugins": [
+    {
+      "name": "agent-spine",
+      "source": ".",
+      "description": "Map existing rules, soul, and memory without rewriting source files.",
+      "version": "0.8.0",
+      "author": {
+        "name": "Mayk Biletti"
+      },
+      "category": "development",
+      "tags": ["agents", "identity", "memory", "mcp"]
+    }
+  ]
+}

package/agent-spine-plugin/.claude-plugin/plugin.json

@@ -0,0 +1,14 @@
+{
+  "name": "agent-spine",
+  "version": "0.8.0",
+  "description": "A non-destructive identity and memory spine for Claude Code agents.",
+  "author": {
+    "name": "Mayk Biletti",
+    "url": "https://github.com/Maykbiletti"
+  },
+  "homepage": "https://github.com/Maykbiletti/AgentSpine",
+  "repository": "https://github.com/Maykbiletti/AgentSpine",
+  "license": "Apache-2.0",
+  "keywords": ["identity", "memory", "mcp", "agents"],
+  "mcpServers": "./.mcp.json"
+}

package/agent-spine-plugin/.codex-plugin/plugin.json

@@ -0,0 +1,34 @@
+{
+  "name": "agent-spine",
+  "version": "0.8.0",
+  "description": "A non-destructive identity and memory spine for Codex agents.",
+  "author": {
+    "name": "Mayk Biletti",
+    "url": "https://github.com/Maykbiletti"
+  },
+  "homepage": "https://github.com/Maykbiletti/AgentSpine",
+  "repository": "https://github.com/Maykbiletti/AgentSpine",
+  "license": "Apache-2.0",
+  "keywords": ["identity", "memory", "mcp", "agents"],
+  "skills": "./skills/",
+  "mcpServers": {
+    "agent-spine": {
+      "command": "node",
+      "args": ["${PLUGIN_ROOT}/src/mcp.js"]
+    }
+  },
+  "interface": {
+    "displayName": "AgentSpine",
+    "shortDescription": "Identity and memory without rewriting your files.",
+    "longDescription": "Maps existing rules, soul, memory, and linked Markdown into a verifiable context spine while preserving every source byte.",
+    "developerName": "Mayk Biletti",
+    "category": "Developer Tools",
+    "capabilities": ["Read", "MCP", "Hooks", "Worker"],
+    "websiteURL": "https://github.com/Maykbiletti/AgentSpine",
+    "defaultPrompt": [
+      "Map this project's existing agent identity.",
+      "Show the active rules, soul, and memory layers.",
+      "Verify that protected sources are unchanged."
+    ]
+  }
+}

package/agent-spine-plugin/.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "agent-spine": {
+      "command": "node",
+      "args": ["${CLAUDE_PLUGIN_ROOT}/src/mcp.js"]
+    }
+  }
+}

package/agent-spine-plugin/CHANGELOG.md

@@ -0,0 +1,277 @@
+# Changelog
+
+All notable changes to AgentSpine will be documented here. The project follows [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+### Added
+
+- BLUN King can now install AgentSpine as a native plugin with the same lifecycle hooks, MCP server, isolated app-home source resolution, and explicit plugin-install trust step as the existing Claude Code and Codex hosts
+
+### Fixed
+
+- Routine BLUN hook results now render as one short human-readable status line instead of exposing compact internal JSON in the TUI, while actionable attention, self-starter, channel, and failure details remain available immediately
+- BLUN hooks now inject a compact runtime status instead of the complete session briefing on every prompt; detailed continuity remains available on demand while active attention, self-starter, and authenticated channel signals remain immediate
+- BLUN lifecycle hooks now index large real workspaces without absorbing embedded test profiles or failing at the smaller host-rule limit
+- Windows Node 24 state writes now treat transient lock access errors as contention across every lock-backed store, retry atomic replacements with a bounded backoff, and tolerate briefly retained handles during hermetic cleanup
+- The gateway worker now canonicalizes its state directory before opening the native file watcher, avoiding the Windows libuv path assertion on differently cased or short paths
+- CI now identifies the failing check phase and annotates the exact hermetic test file or runner error, so public Windows failures can be diagnosed without access to private job logs
+
+## [0.8.0] - 2026-08-29
+
+### Added
+
+- Provider-neutral authenticated channel ingress with exact provider, tenant, account, chat, thread, sender, agent, project, group, and session bindings
+- Durable per-agent event lanes with replay protection, atomic leases, expired-lease recovery, revocation cancellation, retained history, and integrity receipts
+- Automatic `agentspine.voice-brief/v1` projection from exact visible persona, preference, correction, no-go, current-task, promise, and blocker context
+- Installed-bundle proof that both Claude Code and Codex receive one exact authenticated channel event and voice profile with zero model-side MCP calls
+- Pinned OpenClaw and Hermes harness reference study documenting adopted, adapted, and deliberately excluded behavior
+- Authenticated external persona-roster synchronization with stable identities and append-only join, rename, leave, group-change, and rejoin events
+- Bounded native Claude Code and Codex agent-manifest discovery under one approved roster scope, including distinct deactivation, exact profile/tenant identity, rename stability, and immediate membership removal
+- Optional `agentspine-worker` with Telegram polling and delivery, one absolute shell-free host runner, per-agent lanes, focused goals, checkpoints, retries, health state, and a local kill switch
+- Event-driven desired-state wake, deadline reconciliation, restartable prepared outbox delivery, bounded host-failure retry, independent stale-heartbeat audit, and explicit dead-letter versus delivery-unknown terminal states
+- Transient German, English, Swedish, and Spanish response cues plus an advisory voice guard against fabricated attachment, emotion, or consciousness claims
+- Empty- and populated-profile hermetic test execution so real user state cannot change test expectations
+
+### Changed
+
+- The shared hook document now uses only the documented `description` and `hooks` top-level fields; version/cache identity stays in the host manifests
+- Host checks no longer report live Codex hook trust as proven merely because the shared hook entrypoint can execute directly
+- Native Codex hook input is recognized from its Codex-specific `model` field or plugin environment even when no synthetic `host` field and no explicit `CODEX_HOME` override exist
+- Session briefings reserve a bounded voice section and report voice omissions in the same compact-JSON budget
+- Channel policy and runtime inspection are available through local CLI commands while every channel administration and execution operation remains absent from MCP
+- A configured roster file is reread before every worker reconciliation, so authenticated team additions and removals become visible without a new chat prompt
+- Promise and resolved-blocker lifecycle events now enter the same durable wake queue as direct messages and owner-assigned goals
+
+### Security
+
+- Channel policy changes require explicit local owner confirmation; wildcard routes and senders, unknown agents/projects/groups, and invalid group membership fail closed
+- HMAC secrets remain environment-only, signatures are never stored, secret-bearing messages are rejected, and event ID collisions cannot overwrite earlier payloads
+- Current and retained events, policy history, payload digests, route bindings, receipt digests, and authority markers are replayed by the ten-gate audit
+- Channel state and voice context cannot grant host, tool, file, network, send, delegation, production, or execution rights
+- Persona events, roster receipts, gateway history, queue and delivery IDs, lanes, checkpoints, and receipts fail closed under structural or digest manipulation
+- Persona activity and exact group membership plus revoked reply grants are rechecked at claim, run completion, and immediately before network effect; known no-effect exhaustion cannot enter a supervisor restart loop
+- Provider and ingress credentials remain environment-only and are removed from the environment passed to the host runner
+
+## [0.7.0] - 2026-08-29
+
+### Added
+
+- External, integrity-checked indexed-memory metadata/content cache with atomic multi-process updates, immediate link-removal pruning, and cache purge on source-binding rollback or purge
+- Explicit relevance markers for `always`, person, project, group, task, and prompt-keyword scopes; unproven fact files remain unopened and omitted
+- Privacy-bounded indexed-memory diagnostics for indexed, relevant, loaded, cache-hit, cache-miss, missing, scope, path, symlink, size, and race outcomes
+- Explicit `doctor --offline-memory-orphans` enumeration that reports counts only and remains outside every live lifecycle path
+- Real temporary 50,000-file acceptance with deterministic open-count instrumentation and a source-level ban on directory enumeration in the live indexed-memory module
+
+### Changed
+
+- Claude project-memory resolution now treats `MEMORY.md` as the explicit index and opens only directly linked, relevant Markdown facts instead of walking the complete memory tree
+- Package, lockfile, Claude Code, Codex, marketplace, and hook-bundle versions advance together to `0.7.0`; upgrade acceptance rejects the cached `0.6.0` bundle
+
+### Security
+
+- Indexed memory targets are opened with no-follow semantics and validated through one filehandle before and after reading; file replacement races retry and then reject visibly
+- Missing targets, path escapes, symlinked paths, non-regular files, oversized sources, transitive links, stale cache records, and corrupt cache state cannot enter the briefing
+- Cache and relevance remain context-only and cannot create identity, rights, delegation, trust, capabilities, network access, or self-starter policy
+
+## [0.6.0] - 2026-08-28
+
+### Added
+
+- Provider-neutral host-native source-root registry with bounded Claude profile, project-chain, project-memory, Codex home, root-marker, fallback-name, and nested-override resolution
+- Explicit portable user-state binding with provenance, conflict detection, rollback, purge, and low-risk learning-only projection across repositories and hosts
+- Installed production-hook RED/GREEN reproduction of the real zero-source failure from an AgentSpine checkout and foreign working directory
+- `source-status`, `source-bind`, `source-rollback`, and `source-purge` CLI workflows plus host-aware Doctor and Audit diagnostics
+
+### Changed
+
+- Package, lockfile, Claude Code, Codex, marketplace, and hook-bundle versions advance together to `0.6.0`
+- The lifecycle bundle declares `agentspine.source-roots/v1`; upgrade tests reject the cached `0.5.0` bundle
+- Automatic briefing uses separate user, project, and project-memory bindings instead of treating the launch directory as one recursive source root
+
+### Security
+
+- Home-wide scans, foreign-repository discovery, symlink following, guessed Claude memory paths, blind root-hash state copying, and project-state flattening are prohibited and tested
+- Empty or damaged source resolution is visible and never reported as loaded personal continuity
+- Source and migration bindings remain context-only and cannot create identities, roles, delegation, host trust, execution grants, capabilities, or self-starter rights
+
+## [0.5.0] - 2026-08-28
+
+### Added
+
+- Visible 14-gate cross-host acceptance using new synthetic people, separated groups, Swedish and Spanish prompts, real lifecycle restart and compaction boundaries, and zero model-side MCP calls
+- Deterministic SHA-256 receipts for identity, multilingual continuity, attention, isolation, correction, rollback, purge, authorized resume, denied foreign effects, durable checkpoints, source preservation, and the final audit
+- Installed-bundle acceptance for both fresh installation and upgrade from `0.4.0`
+
+### Changed
+
+- Package, lockfile, Claude Code, Codex, marketplace, and hook-bundle versions advance together to `0.5.0`
+- The lifecycle bundle declares `agentspine.acceptance/v1`
+- Safe direct style, correction, no-go, project-fact, promise, and blocker recognition covers the Swedish and Spanish acceptance paths
+
+### Security
+
+- Person and exact-group negative visibility, a denied foreign lease effect, complete person purge, and byte-for-byte source preservation are visible acceptance gates
+- Acceptance state is synthetic, external, temporary, and transcript-free; its receipts create no identity, trust, approval, or authority
+- Fresh-install and upgrade proofs require exactly one MCP server, exactly one hook set, and complete automatic behavior with `mcpCalls: 0`
+
+## [0.4.0] - 2026-08-28
+
+### Added
+
+- Rights-bound self-starter for one exact waiting job with durable checkpoints, expiring leases, retry budget, backoff, crash recovery, audit receipts, cancellation, and purge
+- Native Claude Code and Codex lifecycle path from `SessionStart` through `PreToolUse`, `PostToolUse`, `Stop`, and a new-session resume without a model-side MCP call or repeated job envelope
+- Separate local execution policy binding actor, action set, job, task, target, project, optional group, host, and finite tool capabilities
+- Fresh-install and `0.3.0` upgrade proof for exactly one MCP server, one hook set, an authorized effect, a durable checkpoint, and automatic resume
+
+### Changed
+
+- Package, lockfile, Claude Code, Codex, marketplace, and hook-bundle versions advance together to `0.4.0`
+- The lifecycle bundle declares `agentspine.selfstarter/v1` and resolves active jobs from the native host session
+- Ten-gate audit includes external execution-policy and job-state integrity without reading either as context authority
+
+### Security
+
+- Every start, resume, and effect rechecks the current exact grant, task assignment, scope, host session, capability, lease, and content-bound workspace fingerprint
+- Memory, Markdown, learning, relationships, attention, tasks, prior approvals, model claims, and MCP responses cannot create or widen execution rights
+- Unknown effects, concurrent leases, revocation, expiry, workspace drift, uncheckpointed crash changes, retry exhaustion, malformed state, and protected-source writes fail closed
+- MCP exposes no execution-policy grant, revoke, job registration, cancellation, or checkpoint administration
+
+## [0.3.0] - 2026-08-28
+
+### Added
+
+- Provider-neutral heartbeat, promise, and blocker lifecycle events written by installed Claude Code and Codex hooks without a model-side MCP call
+- Exact actor, group, project, and task binding with stable event identity, minimal SHA-256 provenance, idempotent receipts, occurrence counts, and retained prior versions
+- Automatic current-task event injection at start, restart, prompt, and compaction boundaries, including stale-heartbeat, open-promise, and open-blocker handling
+- CLI inspection and permanent event deletion plus entity purge across events, receipts, history, and presentation throttles
+- Fresh-install and previous-version upgrade test that proves one MCP server, one hook set, automatic event capture, restart injection, and source-preserving uninstall
+
+### Changed
+
+- Package, lockfile, Claude Code, Codex, marketplace, and hook-bundle versions advance together to `0.3.0`
+- Focus mode suppresses unrelated cues while permitting an active blocker, due promise, or stale heartbeat for the exact current task
+- Parallel catalog replacement uses collision-free atomic temporary paths across concurrent lifecycle hooks
+
+### Security
+
+- Automatic prompt events require the local continuity opt-in and reject group conversation content, secrets, identity claims, rights, roles, delegation, access, production, payment, and approval claims
+- Corrupt attention lifecycle state and unknown task scope fail closed; events remain context-only and can neither send messages nor create authority
+
+## [0.2.0] - 2026-08-28
+
+### Added
+
+- Native Claude Code and Codex lifecycle integration that automatically injects the actual scoped, byte-budgeted session briefing at start, resume, prompt, and compaction boundaries without a model-side MCP call
+- Separate local opt-in for minimal high-confidence style, preference, no-go, correction, project-fact, and reference learning with digest provenance, deduplication, rollback, purge, and no transcript retention
+- Complete hook inventory for prompt, tool, compaction, stop, and subagent-stop boundaries plus reproducible fresh-install, stale-cache upgrade, and uninstall preservation checks
+
+### Changed
+
+- Claude Code explicitly registers the MCP file and loads exactly one hook bundle from its native `hooks/hooks.json` discovery path
+- Package, lockfile, Claude Code, Codex, and marketplace cache versions advance together to `0.2.0`
+- Session hooks now inject usable accepted context instead of counts and a suggestion to call `session_briefing`
+
+### Security
+
+- Automatic learning rejects secrets, sensitive personal facts, identity merging, private group content, rights, roles, delegation, approvals, tool or file access, network or database access, production, payments, and policy claims
+- Hook JSON input is bounded, state remains external and atomically locked, malformed state is visible and fail-closed, and source Markdown remains byte-for-byte unchanged
+
+### Added
+
+- Executable Claude Code and Codex host-registration check with a real MCP `initialize` handshake
+- Optional local SQLite snapshot transport with immutable signed-adapter binding, append-only hash-linked revisions, atomic head advancement, full integrity replay, quarantined pull, CLI integration, and no MCP database authority
+- One-shot challenge-response peer transport over an owner-selected stdin/stdout carrier, with a fresh nonce, live Ed25519 proof, shell-free process execution, environment minimization, quarantine import, CLI integration, and no MCP process authority
+- Provider-neutral signed HTTPS feed with strong ETag compare-and-swap publication, bounded hash-chain continuity, external rollback receipts, quarantined pull, CLI integration, audit coverage, and no MCP transport authority
+- Ten-gate `agentspine audit` command and MCP tool
+- Privacy-scoped entities and relationships for people, agents, groups, channels, and projects
+- Append-only history for superseded document annotations, document links, entities, and relationships
+- Broken-link and competing-candidate findings in every catalog
+- Large-tree, manifest-consistency, CLI-MCP, privacy, authority, and shell-guard tests
+- Local sparse-attention state for unanswered questions, promises, check-ins, and meaningful changes
+- Relationship-silence cues based on minimal interaction timestamps rather than conversation capture
+- Attention CLI and MCP surfaces with quiet hours, focus suppression, throttling, disable, resolve, and permanent deletion controls
+- Exact group-audience binding for group-scoped cues and activity timestamps
+- Cross-process locking for concurrent local attention updates
+- Evidence-backed learning candidates kept separate from accepted context
+- Explicit review, low-risk opt-in promotion, supersession, rollback, and permanent learning deletion
+- SHA-256 provenance capture for document evidence and serialized concurrent evidence appends
+- Safe-learning CLI, MCP tools, hook metadata, audit checks, and full lifecycle tests
+- Separate default-deny delegation policy with explicit actor, action, target, provenance, revision, and revocation history
+- Context-only tasks, open threads, and handoffs with assignment snapshots and retained prior versions
+- Coordination CLI, read/check MCP surfaces, privacy-filtered hook metadata, audit integration, and concurrency tests
+- Provider-neutral shared-event contract and optional directory adapter with immutable event files
+- Quarantined, idempotent shared-memory import with a second local review before context
+- Shared supersession, rollback, exact group filtering, CLI administration, read-only MCP context, hooks, and audit coverage
+- Optional Ed25519 manifest and event envelopes with strict public identities and retained verification proof
+- Installation-local signer generation and rotation plus project-local trust, revocation, and audit replay
+- Immutable signed HTTPS snapshot export and dependency-free provider-neutral pull transport
+- DNS pinning, default SSRF blocking, redirect and compression rejection, bounded responses, optional environment-only bearer authentication, and explicit private-network opt-in
+- Provider-neutral `session_briefing` across native sources, relationships, accepted learning, reviewed shared memory, coordination, and attention
+- Current-task priority, local/shared deduplication, exact compact-JSON byte accounting, atomic omission, and group-safe metadata-only source handling
+- Provider-neutral content-addressed HTTPS object publication with create-only preconditions
+- Mandatory signed read-back verification and safe idempotent retry handling for immutable remote objects
+- Tag-authorized GitHub release pipeline with CycloneDX SBOM, SHA-256 checksums, build provenance, and SBOM attestations
+- Deterministic release metadata and package-boundary validator covering both host manifests and forbidden state/source material
+- Pinned-action policy, release-sensitive CODEOWNERS, and isolated least-privilege publication jobs
+
+### Changed
+
+- Claude Code now receives an explicit manifest reference to the bundled `.mcp.json`, preventing the MCP server from disappearing in installations that do not apply implicit component discovery
+- `agentspine mcp` now starts the stdio server instead of returning immediately
+- Discovery fingerprints files with bounded parallel reads
+- Context resolution reuses catalogs and only follows confident overlay links
+- Protected-source hooks recognize common mutating shell commands and refresh after tool writes
+- Agent annotations cannot promote arbitrary Markdown into a constitution layer
+- CI runs the repository's own ten-gate audit and uses the current maintained GitHub action majors
+- Syntax checks and protected-path comparisons are portable across Linux, macOS, and Windows
+- External-state auditing handles Windows project and state directories on different drives
+- Session hooks expose only due attention counts and kinds; cue text remains behind an explicit privacy-filtered read
+- The ten-gate audit now validates attention authority, privacy, configuration, and external-state placement
+- Accepted learning must carry auditable manual-confirmation proof or an evidence-threshold policy snapshot
+- Cross-entity coordination now requires a matching explicit local policy grant; relationship responsibility remains descriptive only
+- Session hooks expose only counts and kinds of locally reviewed shared memory; pending claims remain hidden
+- Session hooks point to one explicit scoped briefing without automatically injecting its content
+
+### Security
+
+- Relationship attributes recursively reject permissions, rights, authorization, credentials, secrets, tokens, and API keys
+- Every relationship and history record is explicitly context-only
+- Every attention cue and activity is context-only; corrupt attention policy fails closed
+- Secret-shaped observations and authority assertions are rejected before learning storage
+- Delegation policy mutation is excluded from MCP, and malformed policy or coordination state fails closed without overwrite
+- Task coordination grants no host, tool, file, network, deployment, production, billing, or spending authority
+- Private learning, source content, evidence text, tasks, policy, and credentials are excluded from shared events
+- Adapter administration is excluded from MCP; malformed, oversized, symlinked, collided, or tampered exchange state fails closed
+- Private signing keys remain outside projects and agent surfaces; unknown, revoked, swapped, or mismatched signers fail closed
+- HTTPS snapshot transport validates TLS endpoints, every DNS answer, bundle integrity, strict schema, and all nested signatures before quarantine mutation
+- Group briefings reject private reads, foreign membership, and unscoped source content; briefing output remains context-only and read-only
+- HTTPS publishing is CLI-only, owner-confirmed, DNS-pinned, SSRF-restricted, overwrite-free, size-bounded, and credential-safe
+- Release workflows accept tags only, verify containment in `main`, use short-lived OIDC for attestations, and expose no npm or AgentSpine secrets
+
+### Planned
+
+- Optional hosted database transports implementing the signed-envelope and shared-event contracts
+
+## [0.1.0] - 2026-08-27
+
+### Added
+
+- Non-destructive Markdown discovery and SHA-256 provenance catalog
+- Native Codex and Claude Code context resolution
+- Exact ranged reads for sources outside the context budget
+- Agent-authored overlay annotations and document graph links
+- CLI, stdio MCP server, and lifecycle hooks
+- Protected-source write guard for participating host tools
+- Dual Claude Code and Codex plugin manifests
+- Cross-platform preservation, hook, graph, and MCP tests
+
+[Unreleased]: https://github.com/Maykbiletti/AgentSpine/compare/v0.8.0...HEAD
+[0.8.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.7.0...v0.8.0
+[0.7.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.6.0...v0.7.0
+[0.6.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.5.0...v0.6.0
+[0.5.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.2.0...v0.3.0
+[0.2.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.1.0...v0.2.0
+[0.1.0]: https://github.com/Maykbiletti/AgentSpine/releases/tag/v0.1.0

package/agent-spine-plugin/LICENSE

@@ -0,0 +1,186 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the
+copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other
+entities that control, are controlled by, or are under common control with
+that entity. For the purposes of this definition, "control" means (i) the
+power, direct or indirect, to cause the direction or management of such
+entity, whether by contract or otherwise, or (ii) ownership of fifty percent
+(50%) or more of the outstanding shares, or (iii) beneficial ownership of
+such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation source, and
+configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation
+or translation of a Source form, including but not limited to compiled object
+code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that is
+included in or attached to the work (an example is provided in the Appendix
+below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form,
+that is based on (or derived from) the Work and for which the editorial
+revisions, annotations, elaborations, or other modifications represent, as a
+whole, an original work of authorship. For the purposes of this License,
+Derivative Works shall not include works that remain separable from, or merely
+link (or bind by name) to the interfaces of, the Work and Derivative Works
+thereof.
+
+"Contribution" shall mean any work of authorship, including the original
+version of the Work and any modifications or additions to that Work or
+Derivative Works thereof, that is intentionally submitted to Licensor for
+inclusion in the Work by the copyright owner or by an individual or Legal
+Entity authorized to submit on behalf of the copyright owner. For the purposes
+of this definition, "submitted" means any form of electronic, verbal, or
+written communication sent to the Licensor or its representatives, including
+but not limited to communication on electronic mailing lists, source code
+control systems, and issue tracking systems that are managed by, or on behalf
+of, the Licensor for the purpose of discussing and improving the Work, but
+excluding communication that is conspicuously marked or otherwise designated
+in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on
+behalf of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this
+section) patent license to make, have made, use, offer to sell, sell, import,
+and otherwise transfer the Work, where such license applies only to those
+patent claims licensable by such Contributor that are necessarily infringed by
+their Contribution(s) alone or by combination of their Contribution(s) with
+the Work to which such Contribution(s) was submitted. If You institute patent
+litigation against any entity (including a cross-claim or counterclaim in a
+lawsuit) alleging that the Work or a Contribution incorporated within the Work
+constitutes direct or contributory patent infringement, then any patent
+licenses granted to You under this License for that Work shall terminate as of
+the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and in
+Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy
+of this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that
+You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from the
+Source form of the Work, excluding those notices that do not pertain to any
+part of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution,
+then any Derivative Works that You distribute must include a readable copy of
+the attribution notices contained within such NOTICE file, excluding those
+notices that do not pertain to any part of the Derivative Works, in at least
+one of the following places: within a NOTICE text file distributed as part of
+the Derivative Works; within the Source form or documentation, if provided
+along with the Derivative Works; or, within a display generated by the
+Derivative Works, if and wherever such third-party notices normally appear.
+The contents of the NOTICE file are for informational purposes only and do not
+modify the License. You may add Your own attribution notices within Derivative
+Works that You distribute, alongside or as an addendum to the NOTICE text from
+the Work, provided that such additional attribution notices cannot be
+construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide
+additional or different license terms and conditions for use, reproduction,
+or distribution of Your modifications, or for any such Derivative Works as a
+whole, provided Your use, reproduction, and distribution of the Work otherwise
+complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any
+Contribution intentionally submitted for inclusion in the Work by You to the
+Licensor shall be under the terms and conditions of this License, without any
+additional terms or conditions. Notwithstanding the above, nothing herein
+shall supersede or modify the terms of any separate license agreement you may
+have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as required
+for reasonable and customary use in describing the origin of the Work and
+reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work (and each Contributor provides its
+Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied, including, without limitation, any warranties
+or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any risks
+associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in
+tort (including negligence), contract, or otherwise, unless required by
+applicable law (such as deliberate and grossly negligent acts) or agreed to in
+writing, shall any Contributor be liable to You for damages, including any
+direct, indirect, special, incidental, or consequential damages of any
+character arising as a result of this License or out of the use or inability to
+use the Work (including but not limited to damages for loss of goodwill, work
+stoppage, computer failure or malfunction, or any and all other commercial
+damages or losses), even if such Contributor has been advised of the
+possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work
+or Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations
+and/or rights consistent with this License. However, in accepting such
+obligations, You may act only on Your own behalf and on Your sole
+responsibility, not on behalf of any other Contributor, and only if You agree
+to indemnify, defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason of your
+accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate
+notice, with the fields enclosed by brackets "[]" replaced with your own
+identifying information. (Don't include the brackets!) The text should be
+enclosed in the appropriate comment syntax for the file format. We also
+recommend that a file or class name and description of purpose be included on
+the same "printed page" as the copyright notice for easier identification
+within third-party archives.
+
+Copyright 2026 Mayk Biletti
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.