blun-king-cli 9.1.509 → 9.1.511

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 9.1.511 - 2026-08-31
+
+- Upgrades the managed core plugin from AgentSpine 0.8.0 to the cache-distinct 0.10.1 bundle with mandatory pre-answer receipts, Must-Remember, self-healing authenticated persona and relationship graph reconciliation, and a five-second local relationship deadline.
+- Race-safely verifies and identity-binds every active host instruction file without duplicating its already host-loaded text into the injected briefing; the real 15,519-byte user `CLAUDE.md` produced a 5,667-byte total injected context with no instruction content field.
+- Preserves the King-specific bounded Telegram-to-Mnemo recall rule, keeps all plugin state external to the package, and adds a package regression for compact BLUN delivery plus descriptor-only Codex delivery.
+
+## 9.1.510 - 2026-08-31
+
+- Adds `ReadBatch` for two to twelve independent known UTF-8 files or ranges in one concurrent tool call, reducing repeated model round trips over a large working context.
+- Reuses the exact `Read` path resolution, sensitive-file checks, permissions, UTF-8 validation, paging, and byte limits while preserving request order and reporting partial failures individually.
+- Keeps `ReadBatch` in the bounded core tool catalogue for main, coder, explore, and plan profiles, with focused concurrency, access, partial-failure, registration, and full-package regressions.
+
 ## 9.1.509 - 2026-08-30
 
 - Requires every authorized bot-to-bot Telegram work message to mention its intended King explicitly.

package/LIESMICH.txt

@@ -9,7 +9,18 @@ Installation
 ------------
 Die geprüfte Version exakt global installieren:
 
-  npm install -g blun-king-cli@9.1.509
+  npm install -g blun-king-cli@9.1.511
+
+AgentSpine 0.10.1
+-----------------
+Version 9.1.511 liefert AgentSpine 0.10.1 als neue inhaltsadressierte
+Pluginfassung. Der Preflight prueft weiterhin jede aktive Host-Anweisungsdatei
+race-sicher und bindet SHA-256 sowie Dateiidentitaet an den Zug, dupliziert den
+bereits vom Host geladenen Volltext aber nicht mehr in den Laufzeitkontext.
+Die reale 15.519-Byte-CLAUDE.md-Probe blieb dadurch bei 5.667 injizierten Byte.
+Der Stand enthaelt ausserdem den selbstheilenden Persona- und Beziehungsgraphen,
+die begrenzte Telegram-Mnemo-Abfrage und eine sichtbare Fuenf-Sekunden-Grenze
+fuer lokale Beziehungsabfragen.
 
 Start
 -----

package/README.md

@@ -9,9 +9,20 @@ Voraussetzung ist Node.js 24.15 oder neuer. Die geprüfte Version wird exakt
 installiert:
 
 ```powershell
-npm install -g blun-king-cli@9.1.509
+npm install -g blun-king-cli@9.1.511
 ```
 
+## AgentSpine 0.10.1
+
+Version 9.1.511 liefert AgentSpine 0.10.1 als neue inhaltsadressierte
+Pluginfassung. Der Preflight prueft weiterhin jede aktive Host-Anweisungsdatei
+race-sicher und bindet SHA-256 sowie Dateiidentitaet an den Zug, dupliziert den
+bereits vom Host geladenen Volltext aber nicht mehr in den Laufzeitkontext.
+Die reale 15.519-Byte-`CLAUDE.md`-Probe blieb dadurch bei 5.667 injizierten Byte.
+Der Stand enthaelt ausserdem den selbstheilenden Persona- und Beziehungsgraphen,
+die begrenzte Telegram-Mnemo-Abfrage und eine sichtbare Fuenf-Sekunden-Grenze
+fuer lokale Beziehungsabfragen.
+
 ## Reproduzierbares Staging und Packen
 
 Der Schritt baut nichts, installiert nichts und veröffentlicht nichts. Vorher müssen

package/agent-spine-plugin/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "agent-spine",
       "source": ".",
       "description": "Map existing rules, soul, and memory without rewriting source files.",
-      "version": "0.8.0",
+      "version": "0.10.1",
       "author": {
         "name": "Mayk Biletti"
       },

package/agent-spine-plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-spine",
-  "version": "0.8.0",
+  "version": "0.10.1",
   "description": "A non-destructive identity and memory spine for Claude Code agents.",
   "author": {
     "name": "Mayk Biletti",

package/agent-spine-plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-spine",
-  "version": "0.8.0",
+  "version": "0.10.1",
   "description": "A non-destructive identity and memory spine for Codex agents.",
   "author": {
     "name": "Mayk Biletti",
@@ -11,6 +11,7 @@
   "license": "Apache-2.0",
   "keywords": ["identity", "memory", "mcp", "agents"],
   "skills": "./skills/",
+  "hooks": "./hooks/codex.json",
   "mcpServers": {
     "agent-spine": {
       "command": "node",

package/agent-spine-plugin/CHANGELOG.md

@@ -4,19 +4,78 @@ All notable changes to AgentSpine will be documented here. The project follows [
 
 ## [Unreleased]
 
-### Added
-
-- BLUN King can now install AgentSpine as a native plugin with the same lifecycle hooks, MCP server, isolated app-home source resolution, and explicit plugin-install trust step as the existing Claude Code and Codex hosts
+## [0.10.1] - 2026-08-31
 
 ### Fixed
 
-- Routine BLUN hook results now render as one short human-readable status line instead of exposing compact internal JSON in the TUI, while actionable attention, self-starter, channel, and failure details remain available immediately
-- BLUN hooks now inject a compact runtime status instead of the complete session briefing on every prompt; detailed continuity remains available on demand while active attention, self-starter, and authenticated channel signals remain immediate
-- BLUN lifecycle hooks now index large real workspaces without absorbing embedded test profiles or failing at the smaller host-rule limit
-- Windows Node 24 state writes now treat transient lock access errors as contention across every lock-backed store, retry atomic replacements with a bounded backoff, and tolerate briefly retained handles during hermetic cleanup
+- Mandatory host-instruction files are still race-safely reread, hashed, identity-bound, and verified for each exact turn, but their already host-loaded bytes are no longer duplicated into the injected preflight briefing.
+- Large native `CLAUDE.md` and `AGENTS.md` hierarchies no longer fail merely because their instruction text exceeds the runtime context budget; only bounded descriptors enter the hook context.
+
+### Security
+
+- Unreadable, changed, replaced, symlinked, out-of-scope, individually oversized, or descriptor-overflowing mandatory instruction files continue to fail closed.
+
+## [0.10.0] - 2026-08-30
+
+### Added
+
+- Self-healing authenticated persona-to-graph reconciliation on every roster sync, including unchanged replays after partial graph failure
+- Automatic context-only group materialization for exact locally approved roster group IDs
+- Exact group-scoped team neighborhoods so a persona briefing can include current visible co-members without explicit pairwise edges
+- Separate roster-change and graph-repair diagnostics with deterministic counts for created groups, updated entities, and added or removed memberships
+
+### Changed
+
+- Active `person`, `agent`, and `bot` bindings now retain user-authored non-authority graph attributes while authenticated display name, status, source binding, privacy, and membership are reconciled
+- Package, lockfile, Claude Code, Codex, marketplace, BLUN and hook-bundle versions advance together to `0.10.0`
+
+### Fixed
+
+- An unchanged roster now repairs missing persona entities, groups, and membership edges instead of remaining permanently classified as a duplicate
+- Left and deactivated personas retain append-only identity history but no longer appear in current relationship neighborhoods
+- Missing roster groups no longer cause membership edges to be silently skipped
+- Relationship reads now fail visibly after a five-second local state deadline instead of waiting indefinitely
+
+### Security
+
+- Group peer expansion requires one exact group audience and filters inactive, private, and other-group entities before returning context
+- Conflicting non-group IDs and private groups fail visibly instead of weakening group-scope isolation
+- Persona, group, and relationship context remains incapable of granting rights, delegation, tools, execution, access, or policy changes
+
+## [0.9.0] - 2026-08-30
+
+### Added
+
+- Mandatory `agentspine.preflight/v2` before-answer receipts bound to the exact prompt, hook delivery, host, agent, user, tenant, profile, session, project, working directory, task, group, instruction identities, retrieval queries, and briefing
+- Provider-neutral `agentspine.retrieval-query/v1` and `agentspine.retrieval-result/v1` contracts with a bounded shell-free `mnemo-command/v1` reference adapter and environment-only credential names
+- Explicitly confirmed, scoped Must-Remember candidates with append-only activation, supersession, rollback, permanent local-user purge, checksums, retention, and reserved briefing priority
+- Local preflight policy, status, Must-Remember CLI and Doctor/Audit diagnostics; none of these administration surfaces are exposed through MCP
+- Claude Code `InstructionsLoaded` observability alongside the blocking `UserPromptSubmit` gate
+- BLUN King can now install AgentSpine as a native plugin with the same lifecycle hooks, MCP server, isolated app-home source resolution, and explicit plugin-install trust step as the existing Claude Code and Codex hosts
+
+### Changed
+
+- Prompt turns now carry a compact ordinary briefing plus a separately budgeted mandatory instruction and recall section, avoiding silent source truncation
+- Package, lockfile, Claude Code, Codex, marketplace, BLUN, hook-bundle, worker and preflight versions advance together to `0.9.0`
+
+### Fixed
+
+- Routine BLUN hook results now render as one short human-readable status line instead of exposing compact internal JSON in the TUI, while actionable attention, self-starter, channel, and failure details remain available immediately
+- BLUN hooks now inject a compact runtime status instead of the complete session briefing on every prompt; detailed continuity remains available on demand while active attention, self-starter, and authenticated channel signals remain immediate
+- BLUN lifecycle hooks now index large real workspaces without absorbing embedded test profiles or failing at the smaller host-rule limit
+- Windows Node 24 state writes now treat transient lock access errors as contention across every lock-backed store, retry atomic replacements with a bounded backoff, and tolerate briefly retained handles during hermetic cleanup
 - The gateway worker now canonicalizes its state directory before opening the native file watcher, avoiding the Windows libuv path assertion on differently cased or short paths
 - CI now identifies the failing check phase and annotates the exact hermetic test file or runner error, so public Windows failures can be diagnosed without access to private job logs
 
+### Security
+
+- Controlled preflight failures return the host's blocking decision and exit code 2 instead of the previous fail-open informational packet
+- Mandatory instructions are reopened without following symlinks, checked through one filehandle before and after reading, SHA-256 bound, fully injected, and rejected on replacement, deletion, scope escape, size overflow, stale identity or second receipt consumption
+- Required recall distinguishes a verified empty result from no invocation or failure; provider output is scope-bound, content-filtered and incapable of changing policy or authority
+- Receipts are short-lived, HMAC-authenticated in private external state, one-time consumable, and contain no prompt text, rule content, memory claims, credentials or transcripts
+- Receipt consumption revalidates the current instruction set, local policy revision, active critical-memory checksums and exact turn scope; aborted prepared turns are invalidated for safe retry while consumed deliveries remain replay-blocked
+- Claude-only `InstructionsLoaded` registration is physically separated from Codex's documented lifecycle event set
+
 ## [0.8.0] - 2026-08-29
 
 ### Added
@@ -266,7 +325,10 @@ All notable changes to AgentSpine will be documented here. The project follows [
 - Dual Claude Code and Codex plugin manifests
 - Cross-platform preservation, hook, graph, and MCP tests
 
-[Unreleased]: https://github.com/Maykbiletti/AgentSpine/compare/v0.8.0...HEAD
+[Unreleased]: https://github.com/Maykbiletti/AgentSpine/compare/v0.10.1...HEAD
+[0.10.1]: https://github.com/Maykbiletti/AgentSpine/compare/v0.10.0...v0.10.1
+[0.10.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.9.0...v0.10.0
+[0.9.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.6.0...v0.7.0
 [0.6.0]: https://github.com/Maykbiletti/AgentSpine/compare/v0.5.0...v0.6.0

package/agent-spine-plugin/README.md

@@ -91,7 +91,7 @@ claude --plugin-dir .
 ```
 
 Claude Code discovers the bundled skill, hooks, and MCP server. Review and trust executable components when the host asks.
-Version `0.8.0` explicitly registers `.mcp.json`, ships one native `hooks/hooks.json`, and invalidates Claude Code's earlier `0.7.0` plugin cache. The unreleased BLUN adapter adds `blun.plugin.json` with native MCP and lifecycle registrations. Fresh-install and upgrade checks prove package containment and entrypoint behavior; actual hook discovery and trust remain host-controlled and must be inspected in the live host. Claude project memory is `MEMORY.md`-indexed, lazy, race-safe, persistently cached outside the project, and independent of unrelated file count; the live path performs no memory-directory enumeration.
+Version `0.10.1` retains the `agentspine.preflight/v2` pre-answer contract, removes duplicate host-instruction injection, and includes self-healing authenticated persona-to-graph reconciliation. Exact roster groups are materialized as context-only entities, stale membership edges are repaired, inactive personas disappear from current relationship reads, and an exact group-scoped briefing includes visible team peers without exposing another group. Claude uses `hooks/hooks.json`; Codex selects `hooks/codex.json` so Claude-only events never enter Codex configuration. Fresh-install and upgrade checks prove package containment and entrypoint behavior; actual hook discovery and trust remain host-controlled and must be inspected in the live host. Claude project memory remains `MEMORY.md`-indexed, lazy, race-safe, persistently cached outside the project, and independent of unrelated file count. See [pre-answer recall gate](docs/preflight-recall.md) and [durable gateway worker](docs/gateway-runtime.md).
 
 Verify the installed registration from a checkout with:
 

package/agent-spine-plugin/blun.plugin.json

@@ -1,33 +1,33 @@
-{
-  "name": "agent-spine",
-  "version": "0.8.0",
-  "description": "A non-destructive identity and memory spine for BLUN King agents.",
-  "license": "Apache-2.0",
-  "author": {
-    "name": "Mayk Biletti"
-  },
-  "skills": "./skills/",
-  "mcpServers": {
-    "agent-spine": {
-      "transport": "stdio",
-      "command": "node",
-      "args": ["./src/mcp.js"]
-    }
-  },
-  "hooks": [
-    { "event": "SessionStart", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "UserPromptSubmit", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "PreToolUse", "matcher": "Edit|Write|apply_patch|Bash|exec_command", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "PostToolUse", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "PreCompact", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "PostCompact", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "Stop", "command": "node \"./src/hook.js\"", "timeout": 15 },
-    { "event": "SubagentStop", "command": "node \"./src/hook.js\"", "timeout": 15 }
-  ],
-  "interface": {
-    "displayName": "AgentSpine",
-    "shortDescription": "Identity, memory, attention, and resumable context without rewriting source files.",
-    "developerName": "Mayk Biletti",
-    "websiteURL": "https://github.com/Maykbiletti/AgentSpine"
-  }
-}
+{
+  "name": "agent-spine",
+  "version": "0.10.1",
+  "description": "A non-destructive identity and memory spine for BLUN King agents.",
+  "license": "Apache-2.0",
+  "author": {
+    "name": "Mayk Biletti"
+  },
+  "skills": "./skills/",
+  "mcpServers": {
+    "agent-spine": {
+      "transport": "stdio",
+      "command": "node",
+      "args": ["./src/mcp.js"]
+    }
+  },
+  "hooks": [
+    { "event": "SessionStart", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "UserPromptSubmit", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "PreToolUse", "matcher": "Edit|Write|apply_patch|Bash|exec_command", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "PostToolUse", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "PreCompact", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "PostCompact", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "Stop", "command": "node \"./src/hook.js\"", "timeout": 15 },
+    { "event": "SubagentStop", "command": "node \"./src/hook.js\"", "timeout": 15 }
+  ],
+  "interface": {
+    "displayName": "AgentSpine",
+    "shortDescription": "Identity, memory, attention, and resumable context without rewriting source files.",
+    "developerName": "Mayk Biletti",
+    "websiteURL": "https://github.com/Maykbiletti/AgentSpine"
+  }
+}

package/agent-spine-plugin/docs/acceptance.md

@@ -1,6 +1,6 @@
 # Visible cross-host acceptance
 
-AgentSpine `0.8.0` retains the visible, reproducible 14-gate acceptance scenario for the lifecycle adapter and adds staged installed-entrypoint source-root and indexed-memory scaling smoke tests. They execute the same bundled adapter used by Claude Code and Codex and never select an MCP tool, but they do not substitute for the hosts' own plugin discovery and hook-trust UI.
+AgentSpine `0.10.1` runs a visible, reproducible 15-gate acceptance scenario for the lifecycle adapter, including exact host-instruction identity verification without duplicate context injection, required provider recall and a fail-closed missing-provider probe. Staged installed-entrypoint source-root and indexed-memory scaling smoke tests execute the same bundled adapter used by Claude Code and Codex and never select an MCP tool, but they do not substitute for the hosts' own plugin discovery and hook-trust UI.
 
 ```bash
 agentspine acceptance
@@ -52,7 +52,7 @@ Every line includes a SHA-256 receipt derived from the acceptance schema, gate I
 
 ## Installation proof
 
-`npm run host:install-check` stages both a fresh installation and an upgrade from `0.7.0`. Each installed `0.8.0` bundle must contain exactly one MCP server, one hook set, and one worker entrypoint, then pass the complete visible acceptance run with `mcpCalls: 0`. It directly invokes the packaged hook entrypoint from an AgentSpine checkout and a foreign `cwd` with sources only in a custom Claude profile, and repeats the Codex-shaped event path with a custom home, two Git projects, a fallback name, and a nested override. Uninstall removes only staged plugin and generated state; all synthetic source hashes remain unchanged. A real Codex session must separately show the plugin source in `/hooks`, record trust for the current definition hash, and inject the briefing after a new session starts.
+`npm run host:install-check` stages both a fresh installation and an upgrade from `0.7.0`. Each installed `0.10.1` bundle must contain exactly one MCP server, one hook set, and one worker entrypoint, then pass the complete visible acceptance run with `mcpCalls: 0`. It directly invokes the packaged hook entrypoint from an AgentSpine checkout and a foreign `cwd` with sources only in a custom Claude profile, and repeats the Codex-shaped event path with a custom home, two Git projects, a fallback name, and a nested override. Uninstall removes only staged plugin and generated state; all synthetic source hashes remain unchanged. A real Codex session must separately show the plugin source in `/hooks`, record trust for the current definition hash, and inject the briefing after a new session starts.
 
 ## Deliberate trust boundaries
 

package/agent-spine-plugin/docs/gateway-runtime.md

@@ -31,7 +31,11 @@ Set `AGENTSPINE_PERSONA_ROSTER_FILE` or pass `--persona-roster` to the worker. T
 }
 ```
 
-Every tick synchronizes authenticated identities before any work is reconciled. New bindings append `join` events; renames retain the stable persona ID; omitted members in the same explicit roster scope become `left`; `"deactivated": true` records a distinct deactivation; reappearance appends `rejoin`. Names, Markdown, memory, and chat text cannot create identity or rights. Existing source files are never changed.
+Every tick synchronizes authenticated identities before any work is reconciled. New bindings append `join` events; renames retain the stable persona ID; omitted members in the same explicit roster scope become `left`; `"deactivated": true` records a distinct deactivation; reappearance appends `rejoin`. A binding may describe a `person`, `agent`, or `bot`; equal display names never merge identities. Names, Markdown, memory, and chat text cannot create identity or rights. Existing source files are never changed.
+
+Version `0.10.0` reconciles the authenticated roster into the relationship graph on every sync, including an otherwise unchanged replay. An exact `groupId` creates a missing group-scoped, context-only group entity; a conflicting non-group or private group fails visibly. Missing persona entities and membership edges are recreated, stale memberships are removed, and left or deactivated personas remain in append-only identity history but disappear from current relationship context. Reconciliation reports whether the roster changed separately from graph repair, so a previously partial installation can self-heal instead of remaining a permanent duplicate.
+
+When a hook supplies the same exact `groupId`, `relationship_context` and `session_briefing` include current visible co-members reached through authenticated `member-of` edges. They do not infer friendships, merge names, cross tenants, expose another group, or turn membership into delegation. A direct session without an exact group scope does not receive group-private peers. Relationship reads have a five-second local state deadline and return a clear error instead of waiting indefinitely on a stalled read.
 
 The same approved envelope may contain `nativeDiscovery` scopes. AgentSpine then checks only the officially documented direct agent-manifest directories: Claude Code `~/.claude/agents/` or `<project>/.claude/agents/`, and Codex `~/.codex/agents/` or `<project>/.codex/agents/`. `CLAUDE_CONFIG_DIR` and `CODEX_HOME` replace only their matching user scope. Each scope fixes issuer, tenant, profile, agent/bot kind, and optional group; those authenticated scope fields plus the exact source binding form the stable identity. The manifest contributes only its declared display name and an exact source descriptor; its instructions remain host-native context. Direct regular `.md` or `.toml` files are bounded to 128 entries and 256 KiB each; symlinks and files exchanged during a read fail closed. No other home or project directory is enumerated. See the official [Claude Code custom subagent locations](https://code.claude.com/docs/en/sub-agents) and [Codex custom agent locations](https://developers.openai.com/codex/agent-configuration/subagents).
 
@@ -58,6 +62,9 @@ A one-shot manual validation is available through:
 agentspine persona-sync /path/to/project \
   --roster /absolute/path/to/roster.json \
   --confirm-local-persona
+
+agentspine personas /path/to/project --json
+agentspine relationships group:engineering --group group:engineering --json
 ```
 
 ## Telegram and host runner

package/agent-spine-plugin/docs/host-integration.md

@@ -21,7 +21,7 @@ claude plugin install agent-spine@agent-spine
 
 Use `claude plugin validate .` in a checkout to validate the manifest and marketplace. Claude Code asks the user to approve executable plugin components according to its trust model.
 
-The Claude manifest explicitly references `./.mcp.json`. The hook bundle remains at Claude Code's native auto-discovery path `hooks/hooks.json`; it is deliberately not registered a second time through the manifest. Version `0.8.0` replaces the `0.7.0` plugin cache identity. The hook definition contains only portable documented hook fields; `hooks/version.json` carries the separately validated bundle release and lifecycle contract. The repository checks resolve installed-root variables, perform a real MCP `initialize` handshake, validate exactly one native hook command per event, and exercise staged clean install, previous-version cache rejection, upgrade, host-native source resolution, indexed and lazy Claude memory, automatic multilingual briefing, attention, exact job start, tool checkpoint, new-session resume, purge, and uninstall preservation:
+The Claude manifest explicitly references `./.mcp.json`. The hook bundle remains at Claude Code's native auto-discovery path `hooks/hooks.json`; it is deliberately not registered a second time through the manifest. Version `0.10.1` replaces the `0.10.0` plugin cache identity. The hook definition contains only portable documented hook fields; `hooks/version.json` carries the separately validated bundle release and preflight contract. The repository checks resolve installed-root variables, perform a real MCP `initialize` handshake, validate exactly one native hook command per event, and exercise staged clean install, previous-version cache rejection, upgrade, host-native source resolution, indexed and lazy Claude memory, automatic multilingual briefing, pre-answer recall, authenticated persona graph reconciliation, attention, exact job start, tool checkpoint, new-session resume, purge, and uninstall preservation:
 
 ```bash
 npm run host:check
@@ -43,44 +43,44 @@ claude mcp list
 
 Open `/mcp` in the new interactive session and approve or reconnect `agent-spine`. `Pending approval` means discovery succeeded but Claude Code still needs the user's trust decision. A missing entry after reinstall should be diagnosed from `claude plugin validate .`, `npm run host:check`, and Claude Code's plugin diagnostics; AgentSpine does not write to Claude's user configuration or silently approve itself.
 
-## Codex
+## Codex
 
 | Component | Path | Purpose |
 |---|---|---|
 | Manifest | `.codex-plugin/plugin.json` | Package identity plus explicit skill and MCP registration |
 | Skill | `skills/agent-spine/SKILL.md` | Context rules and preservation invariants |
 | MCP | Manifest `mcpServers` | Read-only source tools plus external overlay workflows |
-| Hooks | `hooks/hooks.json` | Auto-discovered lifecycle guardrails |
-
-Open `/plugins` in Codex CLI after configuring a marketplace that contains AgentSpine, then start a new session. Codex presents a startup review when a new or changed hook definition needs trust; there is no `/hooks` slash command. Codex records trust against the exact hook-definition hash, so an installed, updated, or previously untrusted bundle is skipped until that current definition is reviewed and trusted. This follows the official [Codex hooks trust and plugin discovery contract](https://developers.openai.com/codex/hooks).
-
-Codex discovers the hook at the standard `hooks/hooks.json` path. The file deliberately contains only the documented top-level `description` and `hooks` fields; earlier AgentSpine builds added private `version` and `contract` metadata there, which a strict Codex parser could reject before presenting a trust decision. Cache identity remains in `.codex-plugin/plugin.json`, while Codex records hook trust against the current definition hash. Codex sets `CLAUDE_PLUGIN_ROOT` for hook compatibility, so the same hook bundle can execute in both hosts. The MCP registration uses Codex's `PLUGIN_ROOT` expansion.
-
-Verify the live host in a newly started Codex CLI session:
-
-```text
-/plugins
-Trust all and continue
-```
-
-`npm run host:check` proves manifest shape, package containment, and a real MCP handshake. `npm run host:install-check` stages the installed bundle and executes its hook entrypoint with native event JSON. Neither command can manufacture Codex's user-controlled trust receipt; only the startup review in the actual host proves that final boundary.
-
-## BLUN King
-
-| Component | Path | Purpose |
-|---|---|---|
-| Manifest | `blun.plugin.json` | Native BLUN plugin identity plus skill, MCP, and lifecycle-hook registration |
-| Skill | `skills/agent-spine/SKILL.md` | Context rules and preservation invariants |
-| MCP | Manifest `mcpServers` | Read-only source tools plus external overlay workflows |
-| Hooks | Manifest `hooks` | Automatic briefing, attention, protected-source guard, and checkpoints |
-
-Install the local checkout from Fredrik's TUI:
-
-```text
-/plugins install C:\path\to\AgentSpine
-```
-
-BLUN asks the user to trust a third-party plugin before installation because its MCP server and hooks execute local code. Accept that visible install decision, then use `/reload` or `/new`; BLUN has no separate `/hooks` command. The BLUN adapter maps its isolated `BLUN_HOME` to AgentSpine's Codex-compatible `AGENTS.md` source hierarchy, so user state remains under the BLUN app home instead of leaking into `.codex` or a scanned project.
+| Hooks | `hooks/codex.json` | Manifest-selected lifecycle guardrails |
+
+Open `/plugins` in Codex CLI after configuring a marketplace that contains AgentSpine, then start a new session. Codex presents a startup review when a new or changed hook definition needs trust; there is no `/hooks` slash command. Codex records trust against the exact hook-definition hash, so an installed, updated, or previously untrusted bundle is skipped until that current definition is reviewed and trusted. This follows the official [Codex hooks trust and plugin discovery contract](https://developers.openai.com/codex/hooks).
+
+Codex loads `hooks/codex.json` through the explicit plugin-manifest entry. It contains only Codex-documented lifecycle events; Claude Code's additional `InstructionsLoaded` event remains confined to `hooks/hooks.json`. Both files deliberately contain only the documented top-level `description` and `hooks` fields. Cache identity remains in `.codex-plugin/plugin.json`, while Codex records hook trust against the current definition hash. The Codex hook and MCP registrations use the host-native `PLUGIN_ROOT` expansion.
+
+Verify the live host in a newly started Codex CLI session:
+
+```text
+/plugins
+Trust all and continue
+```
+
+`npm run host:check` proves manifest shape, package containment, and a real MCP handshake. `npm run host:install-check` stages the installed bundle and executes its hook entrypoint with native event JSON. Neither command can manufacture Codex's user-controlled trust receipt; only the startup review in the actual host proves that final boundary.
+
+## BLUN King
+
+| Component | Path | Purpose |
+|---|---|---|
+| Manifest | `blun.plugin.json` | Native BLUN plugin identity plus skill, MCP, and lifecycle-hook registration |
+| Skill | `skills/agent-spine/SKILL.md` | Context rules and preservation invariants |
+| MCP | Manifest `mcpServers` | Read-only source tools plus external overlay workflows |
+| Hooks | Manifest `hooks` | Automatic briefing, attention, protected-source guard, and checkpoints |
+
+Install the local checkout from Fredrik's TUI:
+
+```text
+/plugins install C:\path\to\AgentSpine
+```
+
+BLUN asks the user to trust a third-party plugin before installation because its MCP server and hooks execute local code. Accept that visible install decision, then use `/reload` or `/new`; BLUN has no separate `/hooks` command. The BLUN adapter maps its isolated `BLUN_HOME` to AgentSpine's Codex-compatible `AGENTS.md` source hierarchy, so user state remains under the BLUN app home instead of leaking into `.codex` or a scanned project.
 
 ## Direct MCP use
 
@@ -110,7 +110,7 @@ The audit exits non-zero when a required gate fails, making it suitable for inst
 
 Use `agentspine doctor --host claude|codex --cwd /active/project --json` or `agentspine source-status --host claude|codex --cwd /active/project --json` to see the checked scope counts and a concrete empty/fail-closed reason. The lifecycle adapter never substitutes the installation directory for the active host hierarchy. Details and official host references are in [host-native source roots](source-roots.md).
 
-The provider-neutral lifecycle adapter covers `SessionStart` (including resume and compact starts), `UserPromptSubmit`, `PreToolUse`, `PostToolUse`, `PreCompact`, `PostCompact`, `Stop`, and `SubagentStop`. Start, prompt, and compaction boundaries scan and inject the actual byte-budgeted `session_briefing`; no model-side MCP selection is required. Prompt submission can additionally capture minimal safe learning and direct promise/blocker signals after the separate local continuity opt-in. `PostToolUse` writes an idempotent task heartbeat; `Stop` and `SubagentStop` close that heartbeat without emitting repeated chat text.
+The provider-neutral lifecycle adapter covers `SessionStart` (including resume and compact starts), `UserPromptSubmit`, `PreToolUse`, `PostToolUse`, `PreCompact`, `PostCompact`, `Stop`, and `SubagentStop`. Claude Code additionally registers its documented `InstructionsLoaded` observability event; Codex does not. `UserPromptSubmit` is the blocking boundary. Before a prompt can proceed, `agentspine.preflight/v2` verifies the complete mandatory host-instruction hierarchy without reinjecting its bytes, loads confirmed Must-Remember entries and every locally required retrieval provider, then consumes one exact-turn receipt. Start and compaction boundaries retain the scoped `session_briefing`; no model-side MCP selection is required. Full behavior and the documented command-hook timeout limitation are in [pre-answer recall gate](preflight-recall.md).
 
 When an exact locally registered job is waiting, `SessionStart` acquires its lease and injects its real checkpoint automatically. Subsequent tool and stop hooks resolve that job from the native host session; the model does not need to repeat a job envelope. `PreToolUse` first retains the protected-source guard, then rechecks the current execution grant, assignment, scope, capability, lease, and workspace. `PostToolUse` checkpoints exactly one matching result. A new session resumes only after the same checks. Grant and job administration remain local CLI operations and are absent from MCP. No hook creates permissions.
 

package/agent-spine-plugin/docs/preflight-recall.md

@@ -0,0 +1,69 @@
+# Pre-answer recall gate
+
+AgentSpine 0.9 adds `agentspine.preflight/v2`, a provider-neutral pre-answer contract. On `UserPromptSubmit`, the lifecycle adapter resolves and race-safely rereads the active host instruction hierarchy, loads confirmed Must-Remember context, runs every locally required retrieval provider, creates a short-lived HMAC receipt bound to the exact turn, consumes it once, and only then injects the resulting context. The model does not call MCP for any part of this path.
+
+The receipt binds agent and optional persona, user, tenant, host, instruction host, profile, session, project, task, group, working-directory digest, hook delivery, prompt digest, every mandatory instruction file and file identity, the current local policy revision and profile digest, active Must-Remember checksums, provider query status, loaded item IDs and revisions, rejection count, briefing digest, creation time, and expiry. A different prompt, session, scope, working directory, source set, policy, critical-memory revision, hook delivery, or second consumption is rejected. Receipts contain no prompt text, source content, retrieval claims, credentials, or full transcripts.
+
+## Host instructions
+
+Claude Code uses its resolved user and project `CLAUDE.md` hierarchy. Codex uses the corresponding `AGENTS.override.md`/`AGENTS.md` hierarchy. A generic host must explicitly bind `instruction_host` to `claude` or `codex`; AgentSpine does not guess. The preflight race-safely rereads and hashes every active host instruction document, binds its exact file identity into the receipt, and emits only bounded `host-native` descriptors. It never duplicates the already host-loaded instruction bytes into hook context. An unreadable, replaced, deleted, oversized, out-of-scope, or symlinked mandatory file still blocks the turn.
+
+Claude Code's `InstructionsLoaded` lifecycle event is registered as an additional observability signal, while `UserPromptSubmit` remains the blocking and injection boundary. Codex uses its own manifest-selected hook set without that unsupported Claude-only event. The preflight does not rely on the model remembering to read a file or call a tool.
+
+## Required retrieval providers
+
+Retrieval policy is a separate local policy file outside every project. Configure it only through the local CLI:
+
+```bash
+agentspine preflight-policy ./dieter-preflight.json --confirm-local-policy
+agentspine preflight-status --json
+```
+
+The initial reference adapter is `mnemo-command/v1`: an absolute, regular executable receives one `agentspine.retrieval-query/v1` JSON object on stdin and must return one `agentspine.retrieval-result/v1` object on stdout. It may talk to a local or remote Mnemo deployment. Credentials are passed only through environment-variable names explicitly listed in local policy; values never enter repository files, state, context, receipts, logs, or MCP. Required providers must be fail-closed. A successful query with no matches produces status `empty`; a missing invocation, timeout, invalid scope, malformed response, or adapter failure blocks the turn.
+
+Example local policy profile:
+
+```json
+{
+  "id": "preflight-policy:dieter:claude",
+  "agentId": "agent:dieter",
+  "host": "claude",
+  "profileId": "profile:dieter",
+  "tenantId": "tenant:company",
+  "enabled": true,
+  "providers": [
+    {
+      "schema": "agentspine.retrieval-provider/v1",
+      "id": "mnemo:primary",
+      "adapter": "mnemo-command/v1",
+      "required": true,
+      "failClosed": true,
+      "timeoutMs": 5000,
+      "command": "/absolute/path/to/mnemo-adapter",
+      "args": [],
+      "credentialEnv": ["MNEMO_TOKEN"]
+    }
+  ]
+}
+```
+
+Policy, identity and authorization remain independent. Prompt, Markdown, memory, persona, team metadata and provider output cannot configure a provider, relax fail-closed behavior, grant a capability, or authorize an action.
+
+## Must-Remember
+
+Conversation wording such as “Merk dir das” may create only a pending candidate. Activation requires a separate explicit local user confirmation:
+
+```bash
+agentspine remember-propose --claim "Keine halbfertigen Commits veröffentlichen." --user person:papa --tenant tenant:company --project project:agent-spine
+agentspine remember-confirm remember-candidate:… --confirm-local-user
+```
+
+Confirmed entries are scoped, checksummed, append-only and versioned. A new version supersedes rather than overwrites; rollback is explicit. Permanent deletion requires `remember-purge … --confirm-local-purge`. Secret-shaped and authority-shaped claims are rejected. Must-Remember remains context-only.
+
+## Enforcement modes and host limits
+
+`preflight-status` and Doctor distinguish `instructions-only-no-required-provider`, `wrapper-hard-required`, the last provider result (`loaded`, verified `empty`, or failure), a consumed receipt, and a blocked turn with a privacy-safe failure code. Host inventory reports hook trust as unverified until the real host confirms it. The bundled command hook returns the documented blocking status and exit code 2 for controlled failures. Host trust remains a one-time user decision. A prepared turn that aborts before model injection is invalidated and may retry; a consumed delivery remains replay-blocked.
+
+Claude Code documents that a command hook killed by the host timeout is fail-open, even though an explicit exit code 2 blocks. Therefore an absolute guarantee against process termination requires the host or TUI to invoke the same preflight contract as a wrapper-hard gate immediately before its model API call. AgentSpine does not mislabel a merely installed command hook as proof against host-enforced timeout. A release is only live-proven after the target host shows fresh consumed receipts across consecutive turns, restart, and compaction.
+
+Host hierarchy and lifecycle behavior were checked on 2026-08-30 against the official [Claude Code hook reference](https://code.claude.com/docs/en/hooks) and [Codex AGENTS.md reference](https://developers.openai.com/codex/agent-configuration/agents-md).

package/agent-spine-plugin/docs/relationships.md

@@ -18,6 +18,8 @@ flowchart TB
 
 Entities have stable IDs, a kind, optional display name and aliases, attributes, provenance, confidence, and privacy. Relationships connect two known IDs with a typed relation. Name similarity never merges identities.
 
+Authenticated persona roster synchronization reconciles active `person`, `agent`, and `bot` identities into this graph. An exact roster `groupId` creates a missing group-scoped entity and an authenticated `member-of` edge. Replaying an unchanged roster repairs missing graph records without rewriting source Markdown or appending duplicate persona events.
+
 Supported privacy scopes are:
 
 | Scope | Default visibility |
@@ -59,9 +61,13 @@ agentspine relationships agent:builder --json
 
 The MCP tools expose additional attributes, aliases, source-document provenance, confidence, and explicit private reads.
 
+With an exact `groupId`, a relationship read returns the requested entity's direct visible edges plus current visible co-members of that group. This is a bounded team neighborhood, not an inferred friendship graph. Another group's members, inactive roster personas and private records remain excluded. Without an exact group audience, group-private peers are not returned.
+
 ## Limits
 
 - The graph is local user state and is not synchronized automatically.
+- Authenticated roster state is synchronized only when an owner-configured roster or native manifest scope is active; chat names never create entities.
+- Relationship reads stop with a visible error after a five-second local state deadline.
 - A 5 MiB graph ceiling stops unbounded growth instead of discarding history.
 - Attribute-key rejection cannot determine whether innocent-looking prose contains a secret.
 - Group-specific recipient policy and notification delivery are not implemented.

package/agent-spine-plugin/hooks/codex.json

@@ -0,0 +1,47 @@
+{
+  "description": "Resolves host-native user and project instructions before injecting scoped context, persisting attention and checkpoints, rechecking rights, and protecting sources.",
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear|compact",
+        "hooks": [{ "type": "command", "command": "node \"${PLUGIN_ROOT}/src/hook.js\"", "timeout": 15 }]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [{ "type": "command", "command": "node \"${PLUGIN_ROOT}/src/hook.js\"", "timeout": 15 }]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write|apply_patch|Bash",
+        "hooks": [{ "type": "command", "command": "node \"${PLUGIN_ROOT}/src/hook.js\"", "timeout": 15 }]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "hooks": [{ "type": "command", "command": "node \"${PLUGIN_ROOT}/src/hook.js\"", "timeout": 15 }]
+      }
+    ],
+    "PreCompact": [
+      {
+        "hooks": [{ "type": "command", "command": "node \"${PLUGIN_ROOT}/src/hook.js\"", "timeout": 15 }]
+      }
+    ],
+    "PostCompact": [
+      {
+        "hooks": [{ "type": "command", "command": "node \"${PLUGIN_ROOT}/src/hook.js\"", "timeout": 15 }]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [{ "type": "command", "command": "node \"${PLUGIN_ROOT}/src/hook.js\"", "timeout": 15 }]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [{ "type": "command", "command": "node \"${PLUGIN_ROOT}/src/hook.js\"", "timeout": 15 }]
+      }
+    ]
+  }
+}

package/agent-spine-plugin/hooks/hooks.json

@@ -24,6 +24,17 @@
         ]
       }
     ],
+    "InstructionsLoaded": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/src/hook.js\"",
+            "timeout": 15
+          }
+        ]
+      }
+    ],
     "PreToolUse": [
       {
         "matcher": "Edit|Write|apply_patch|Bash",

package/agent-spine-plugin/hooks/version.json

@@ -1,5 +1,5 @@
 {
   "schema": "agentspine.hook-bundle/v1",
-  "version": "0.8.0",
-  "contract": "agentspine.lifecycle/v1"
+  "version": "0.10.1",
+  "contract": "agentspine.preflight/v2"
 }