blun-king-cli 9.1.536 → 9.1.561

package/agent-spine-plugin/docs/releasing.md

@@ -1,83 +0,0 @@
-# Release process
-
-AgentSpine releases are intentionally tag-authorized while the package is pre-1.0. A maintainer decides when to tag; the repository then builds, verifies, attests, and publishes one traceable release bundle from that exact commit. Pull requests and ordinary branch pushes can never enter the release workflow.
-
-## Local release gate
-
-Update the version in `package.json`, `package-lock.json`, both host manifests, and the Claude marketplace entry. Move the relevant changelog entries from **Unreleased** into a dated SemVer section, then run:
-
-```bash
-npm ci
-npm run check
-npm run release:check -- --tag vX.Y.Z
-python3 /path/to/plugin-creator/scripts/validate_plugin.py .
-python3 /path/to/skill-creator/scripts/quick_validate.py skills/agent-spine
-npm pack --dry-run
-```
-
-`release:check` fails unless:
-
-- all five version locations agree and the tag is exactly `v{package.version}`;
-- the changelog has a dated section for that version;
-- the Git worktree is clean;
-- npm reports SHA-512 integrity and a correctly versioned tarball;
-- every required Claude Code, Codex, MCP, CLI, source, skill, documentation, license, and changelog file is packaged;
-- no `.env`, key material, Git metadata, tests, workflow files, generated AgentSpine state, or user-owned `AGENTS.md`, `CLAUDE.md`, `SOUL.md`, or `MEMORY.md` enters the tarball;
-- the package remains within explicit file-count and unpacked-size ceilings.
-
-## Tag and automated release
-
-Only after the release commit is on a fully green `main`, create a signed or annotated tag and push it:
-
-```bash
-git tag -s vX.Y.Z -m "AgentSpine vX.Y.Z"
-git push origin vX.Y.Z
-```
-
-The tag workflow then:
-
-1. checks out the immutable tag with full history;
-2. proves the tagged commit is contained in `main`;
-3. installs only the lockfile dependency graph;
-4. repeats the complete test, audit, host, metadata, changelog, and package-boundary gates;
-5. creates the `.tgz`, a CycloneDX SBOM, and SHA-256 checksums;
-6. creates GitHub build-provenance and SBOM attestations through short-lived OIDC credentials;
-7. transfers the bundle through a named workflow artifact;
-8. gives only the final isolated job `contents: write` and creates the GitHub Release from the existing tag.
-
-Every external action is pinned to a full commit SHA. Dependabot watches those pins. The normal CI workflow has only `contents: read`; the build/attestation release job has `contents: read`, `id-token: write`, and `attestations: write`; only the asset-publication job has `contents: write`. No release job receives AgentSpine memory, signing keys, bearer values, npm tokens, or user source files.
-
-Protect the GitHub `release` environment with required reviewers if the repository plan supports it. Enable immutable releases and tag protection in repository settings where available. Workflow checks are defense in depth and do not replace repository rulesets.
-
-## Verify a downloaded release
-
-After downloading the tarball, SBOM, and `SHA256SUMS` from GitHub Releases:
-
-```bash
-sha256sum --check SHA256SUMS
-gh attestation verify agent-spine-X.Y.Z.tgz \
-  --repo Maykbiletti/AgentSpine
-```
-
-Inspect the package without installation:
-
-```bash
-npm pack --dry-run ./agent-spine-X.Y.Z.tgz
-```
-
-Then install the exact tarball in fresh Claude Code and Codex environments and repeat `agentspine doctor`, the MCP handshake, source scan, verification, and audit.
-
-## Optional npm publication
-
-The GitHub workflow deliberately does not publish to npm until ownership of the package name and the registry-side trust relationship are configured. When enabled, use npm Trusted Publishing bound to this repository, the exact release workflow filename, a GitHub-hosted runner, and a protected release environment. Keep OIDC provenance enabled and do not introduce a long-lived `NPM_TOKEN`.
-
-Authoritative references:
-
-- [GitHub artifact attestations](https://docs.github.com/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds)
-- [GitHub secure use reference](https://docs.github.com/actions/reference/security/secure-use)
-- [npm Trusted Publishing](https://docs.npmjs.com/trusted-publishers/)
-- [npm provenance statements](https://docs.npmjs.com/generating-provenance-statements/)
-
-## Rollback
-
-Never move, reuse, or delete an existing public version tag to hide a bad release. Publish a patch release that reverts the faulty behavior, retain the original checksums and attestations, and explain the affected versions. Uninstalling AgentSpine or deleting its external state must still leave every scanned project file untouched.

package/agent-spine-plugin/docs/roadmap.md

@@ -1,307 +0,0 @@
-# Roadmap
-
-AgentSpine is built as complete, measurable stages. Later stages do not weaken the preservation kernel.
-
-```mermaid
-flowchart TB
-    A["1 · Preservation kernel"] --> B["2 · Memory graph"]
-    B --> C["3 · Relationships"]
-    C --> D["4 · Attention"]
-    D --> E["5 · Safe learning"]
-    E --> F["6 · Delegation + coordination"]
-    F --> G["7 · Portable shared memory"]
-    G --> H["8 · Hardened HTTPS snapshots"]
-    H --> I["9 · Budgeted session briefing"]
-    I --> J["10 · Immutable HTTPS objects"]
-    J --> K["11 · Verifiable releases"]
-    K --> L["12 · Signed mutable feeds"]
-    L --> M["13 · Challenge-response peers"]
-    M --> N["14 · Local SQLite snapshots"]
-    N --> O["15 · Automatic live continuity"]
-    O --> P["16 · Native attention events"]
-    P --> Q["17 · Rights-bound self-starter"]
-    Q --> R["18 · Visible cross-host acceptance"]
-    R --> S["19 · Host-native source roots"]
-    S --> T["20 · Indexed memory"]
-    T --> U["21 · Channel wake + voice bridge"]
-```
-
-## 1. Preservation kernel
-
-Status: implemented for `v0.1`; ongoing hardening.
-
-- byte-preserving discovery;
-- SHA-256 provenance catalog;
-- Codex and Claude hierarchy adapters;
-- explicit link graph and ranged reading;
-- CLI, MCP, hooks, tests, and dual-host packaging.
-
-## 2. Memory graph
-
-Status: local foundation, candidate workflow, provider-neutral exchange contract, and directory adapter implemented.
-
-- existing one-fact-per-file layouts are discovered and linked without migration;
-- compact generated index with a configurable context ceiling;
-- typed links, confidence, timestamps, source, and supersession history without deletion;
-- learning candidates separated from confirmed facts.
-- accepted non-private learning can cross installations through quarantine and a second local review.
-
-## 3. Relationships
-
-Status: local relationship, explicit delegation, and open-thread foundations implemented.
-
-- distinct identities for people, agents, channels, groups, and projects;
-- privacy-scoped relationship state per agent and counterpart;
-- responsibilities, delegation boundaries, preferences, goals, no-gos, and open threads;
-- explicit identity linking instead of name-based merging;
-- private facts prevented from leaking into group context.
-
-## 4. Attention
-
-Status: sparse local foundation implemented; host-specific notification adapters remain out of scope.
-
-- low-cost signals for neglected teammates, unanswered questions, promises, and meaningful changes;
-- sparse ranking and presentation throttling rather than interview behavior;
-- task focus and quiet periods suppress all suggestions;
-- private reads are explicit, automatic hooks disclose no cue text;
-- user-controlled disable, resolve, per-cue deletion, and per-entity purge paths.
-
-## 5. Safe learning
-
-Status: local evidence, review, promotion, supersession, and rollback workflow implemented.
-
-- observation candidates remain outside context until accepted;
-- evidence, source fingerprints, confidence, and every prior candidate version are retained;
-- new information changes relevance through explicit supersession instead of erasure;
-- automatic promotion is default-off, thresholded, and limited to project facts and references;
-- acceptance proof and rollback are audited;
-- code, secrets, billing, permissions, and production access remain approval-bound.
-
-## 6. Delegation and coordination
-
-Status: local default-deny foundation implemented; remote dispatch remains deliberately out of scope.
-
-- delegation policy physically separated from context and absent from MCP mutation tools;
-- explicit actor, action, and target matching with owner-confirmed local grants;
-- tasks, open threads, and handoffs with assignment snapshots and retained history;
-- self-management without widening cross-entity delegation;
-- exact private and group audiences, atomic writes, cross-process locking, and fail-closed validation;
-- no task dispatch, messaging, host permissions, tool rights, deployment, billing, or spending authority.
-
-## 7. Portable shared memory
-
-Status: optional directory transport, Ed25519 origin authentication, hardened HTTPS snapshots, immutable object publication, signed mutable feeds, one-shot peer exchange, and local SQLite snapshot history implemented; hosted database transports remain extension work.
-
-- directory adapter usable locally, on a network drive, or through a user-selected synchronization service;
-- strict immutable event schema, canonical SHA-256 integrity, deterministic IDs, limits, and collision detection;
-- private/source/evidence/task/policy data excluded before publication;
-- imported events quarantined and invisible until a second local user review;
-- exact group audience, idempotent concurrent pulls, retained supersession, rollback, and permanent local deletion;
-- MCP restricted to reading reviewed shared context; adapter administration remains local CLI;
-- digest integrity remains available for compatibility; signed mode verifies trusted Ed25519 manifest and event origins;
-- local signer generation, explicit rotation, per-project public-key trust, revocation, retained proof, and audit replay;
-- signatures authenticate configured keys only and never replace quarantine, content review, privacy, or authority boundaries.
-
-## 8. Hardened HTTPS snapshots
-
-Status: provider-neutral static export, hardened pull, create-only object publication, signed mutable-feed discovery, challenge-response peer exchange, and local SQLite snapshot retention implemented; hosted database adapters remain extension work.
-
-- immutable signed snapshot export outside the scanned project;
-- dependency-free HTTPS pull with TLS verification, vetted and pinned DNS, default SSRF protection, no redirects, and exact response limits;
-- optional bearer token read only from an explicitly named environment variable;
-- explicit private-network opt-in with local confirmation;
-- strict bundle digest plus independent manifest and event signature verification before local mutation;
-- import through the same quarantine, second local review, trust, privacy, supersession, rollback, and authority boundaries as the directory adapter;
-- CLI-only transport administration; no network or token surface in MCP or hooks.
-
-## 9. Budgeted session briefing
-
-Status: provider-neutral CLI, MCP, hook guidance, privacy enforcement, and behavioral tests implemented.
-
-- one read across native sources, relationships, accepted local learning, reviewed shared memory, open coordination, and optional attention;
-- current-task-first ordering and local-over-shared deduplication;
-- hard compact-JSON UTF-8 byte ceiling with atomic record inclusion and per-section omission counts;
-- focus active by default and no attention presentation mutation during reads;
-- exact group membership, no private/group mixing, and metadata-only source handling for group audiences;
-- descriptive context only; no policy, credentials, transport administration, messages, or authority.
-
-## 10. Immutable HTTPS objects
-
-Status: provider-neutral create-only publish and verified read-back implemented; deletion remains out of scope. Feeds, peers, and local SQLite are implemented separately in later stages.
-
-- signed snapshot publication under a deterministic SHA-256 object address;
-- atomic create-only `PUT` with `If-None-Match: *` and no overwrite path;
-- `201`/`204` creation and verified `412` idempotent retry semantics;
-- mandatory hardened read-back before reporting success;
-- TLS verification, DNS pinning, SSRF protection, no redirects, strict limits, and exact body length;
-- bearer credentials read only from a named environment variable;
-- explicit local confirmation for every network write and separate private-network opt-in;
-- CLI-only transport surface; no endpoint, credential, publish, overwrite, or delete capability in MCP or hooks;
-- snapshots remain context-only and imports still enter quarantine for a second local review.
-
-## 11. Verifiable releases
-
-Status: deterministic local gate and tag-authorized GitHub release pipeline implemented; npm publication remains deliberately disabled until registry trust is configured.
-
-- exact SemVer parity across npm, lockfile, Claude Code, Codex, and marketplace metadata;
-- strict package allow/deny boundary with size, count, integrity, path, state, key, and user-source checks;
-- full action commit-SHA pinning and Dependabot tracking;
-- tag must match the version, have a dated changelog section, and point to a commit contained in `main`;
-- complete CI, audit, plugin, skill, and package gates run before artifact creation;
-- release tarball, CycloneDX SBOM, and SHA-256 checksum bundle;
-- OIDC-backed build-provenance and SBOM attestations;
-- build/attestation and GitHub publication split into separate least-privilege jobs;
-- optional protected `release` environment and documented consumer verification;
-- no long-lived npm token or automatic registry publication.
-
-## 12. Signed mutable feeds
-
-Status: provider-neutral signed feed publication, continuity tracking, and quarantined pull implemented; hosted database transports remain extension work. Direct peers and local SQLite are implemented separately in stages 13 and 14.
-
-- bounded 256-entry hash-chain window over immutable signed snapshot objects;
-- full Ed25519 signature over feed identity, scope, adapter, sequence, and retained chain;
-- strong ETag compare-and-swap with `If-None-Match: *` genesis and `If-Match` updates;
-- explicit concurrency conflicts without hidden overwrite or retry;
-- local external receipts with retained prior versions and fail-closed corruption handling;
-- rollback, same-sequence equivocation, signer replacement, and continuity-gap rejection;
-- hardened TLS, DNS pinning, SSRF, redirect, compression, size, token, and timeout boundaries;
-- latest snapshot independently verified and imported only into quarantine;
-- CLI-only endpoint and credential administration; no MCP or hook transport capability;
-- feed state, signatures, remote authentication, and imported content remain context-only.
-
-## 13. Challenge-response peers
-
-Status: one-shot provider-neutral stdio server, owner-selected carrier process, and quarantined pull implemented. Local SQLite is implemented separately in stage 14; hosted database transports remain extension work.
-
-- fresh 256-bit random challenge and request ID for every pull;
-- live Ed25519 response binding the challenge to one independently validated signed snapshot;
-- exact outer-response and snapshot-manifest signer equality plus project-local trust;
-- strict request, response, command, argument, stderr, and timeout limits;
-- carrier launched as an exact executable/argument array with the shell disabled;
-- minimal environment allowlist instead of inherited application tokens;
-- no AgentSpine listener, background daemon, vendor SDK, carrier credential store, or hidden retry;
-- both serving and carrier execution require explicit local owner confirmation;
-- received events enter quarantine and still need a second local content review;
-- peer and process administration absent from MCP and hooks;
-- challenge, signatures, carrier authentication, snapshots, and imports remain context-only.
-
-## 14. Local SQLite snapshots
-
-Status: provider-neutral local database initialization, append-only publication, full inspection, and quarantined pull implemented; hosted SQL services and database replication remain out of scope.
-
-- optional built-in `node:sqlite` adapter with no package dependency or vendor SDK;
-- database must remain outside the scanned project and cannot be a symbolic link;
-- immutable binding to one authenticated directory manifest, scope, adapter, signer, and key;
-- full signed snapshots retained as monotonically sequenced append-only revisions;
-- SHA-256 revision chain and one atomic head updated in a `BEGIN IMMEDIATE` transaction;
-- exact application-schema and SQLite-integrity validation plus full replay on every read or write;
-- idempotent repeated publication without history duplication;
-- read-only pull of the latest validated revision through the existing signed quarantine importer;
-- explicit local owner confirmation for initialization and publication;
-- CLI-only paths and administration; no SQLite surface in MCP or hooks;
-- SQLite state, hashes, signatures, snapshots, and imports remain context-only.
-
-## 15. Automatic live continuity
-
-Status: implemented in `v0.2.0` for the ordered portal-neutral memory milestone. Automatic attention events followed in `v0.3.0`, and rights-bound job resume followed in `v0.4.0`.
-
-- native Claude Code and Codex lifecycle bundle with one command per supported event;
-- complete scoped session briefing injected at start, resume, prompt, and compaction boundaries without model-side MCP selection;
-- separate one-time local privacy opt-in for minimal direct conversation signals;
-- exact person, group, project, and task scope with no name-based identity merging;
-- low-risk style, preference, no-go, correction, project-fact, and reference acceptance under recorded thresholds;
-- full-prompt exclusion, SHA-256 provenance receipts, deduplication, locking, rollback, and confirmed purge;
-- unconditional rejection of secrets, sensitive personal facts, private group content, identity claims, authority, access, payment, production, and operational permissions;
-- `0.2.0` cache boundary, explicit Claude component registration, and reproducible fresh-install, stale-upgrade, and uninstall checks;
-- visible fail-closed context when any dependent state is malformed.
-
-## 16. Native attention events
-
-Status: implemented in `v0.3.0` as the second ordered milestone. The rights-bound self-starter followed in `v0.4.0`.
-
-- provider-neutral heartbeat, promise, and blocker lifecycle records written by installed native hooks;
-- immutable person/agent, group, project, task, privacy, and event identity binding;
-- hook receipt deduplication, repetition throttling, atomic multi-process writes, and retained prior versions;
-- start, restart, and compaction injection through the real scoped briefing without MCP selection;
-- current-task blocker and due-promise visibility under focus, with unrelated cues suppressed;
-- quiet-hour, disable, deletion, and person-purge behavior across active state, receipts, history, and presentations;
-- rejection of secret, identity, private-group, authority, access, production, payment, and permission claims;
-- `0.3.0` cache boundary and install/upgrade proof that exactly one MCP server and one lifecycle hook set load;
-- no messages, scheduling, task execution, permissions, or job resume.
-
-## 17. Rights-bound self-starter
-
-Status: implemented in `v0.4.0` as the third ordered milestone. The visible multi-person, multi-group, multilingual restart acceptance followed in `v0.5.0`.
-
-- separate explicit local execution policy binding exact actor, actions, job, task, target, project, optional group, host, and finite tool capabilities;
-- durable waiting, running, blocked, exhausted, completed, and cancelled job state outside the project;
-- one expiring host-session lease, atomically recorded pending effects, content-bound workspace checkpoints, and result digests without tool-output retention;
-- automatic native-hook start, capability recheck, checkpoint, stop, and new-session resume without MCP selection or a model-supplied job envelope;
-- current grant, assignment, scope, host, lease, capability, task, and workspace revalidation before every effect;
-- crash retry only when the workspace still matches the pre-effect digest, otherwise a visible permanent blocker;
-- durable retry budget, exponential backoff, append-only history, idempotent receipts, owner cancellation, and confirmed purge;
-- execution-policy and job administration absent from MCP;
-- `0.4.0` cache boundary and fresh-install/`0.3.0` upgrade proof for exactly one MCP server and one lifecycle hook set;
-- no authority from memory, Markdown, learning, relationships, attention, task text, model claims, previous approval, or MCP.
-
-## 18. Visible cross-host acceptance
-
-Status: implemented in `v0.5.0` as the fourth and final ordered live-runtime milestone.
-
-- one visible 14-gate scenario using the production Claude Code and Codex lifecycle adapter and zero model-side MCP calls;
-- new synthetic people, separated groups, projects, and tasks with exact positive and negative visibility;
-- Swedish and Spanish style continuity across a new session and a native compaction boundary;
-- durable heartbeat, promise, blocker, correction, supersession history, atomic rollback, and complete person purge;
-- exactly authorized start and resume, denied foreign effect, one atomic checkpoint, leases, and idempotent receipts;
-- source hashes before and after the full run plus the ten-gate audit;
-- deterministic SHA-256 receipt per visible status line and one ordered overall digest;
-- `0.5.0` cache boundary and fresh-install/`0.4.0` upgrade proof for exactly one MCP server and one lifecycle hook set;
-- host trust and local continuity/execution consent remain genuine user or owner decisions and are never simulated.
-
-## 19. Host-native source-root resolution
-
-Status: implemented in `v0.6.0` after a real installed session exposed `cwd` coupling in the earlier synthetic acceptance.
-
-- Claude profile, user instructions, exact project chain, and evidenced project-memory resolution;
-- Codex home override, configurable root markers, fallback names, and root-to-`cwd` precedence;
-- explicit portable user-state bindings with provenance, conflict detection, rollback, and purge;
-- no broad home scan, symlink following, foreign-repository visibility, or guessed host paths;
-- visible empty/fail-closed Doctor, Audit, and hook diagnostics;
-- fresh-install and `0.5.0` upgrade smoke tests through the installed production hook bundle.
-
-## 20. Indexed-memory hardening
-
-Status: implemented in `v0.7.0` after the correct Claude project-memory root still exposed a file-count scaling defect.
-
-- `MEMORY.md` is the only live project-memory index; only direct relevant Markdown links are eligible and fact files cannot load further links;
-- an external bounded integrity cache avoids rereading and rehashing unchanged indexed bytes while corrections, deletion, link removal, rollback, and purge invalidate stale records;
-- no-follow filehandle reads validate path scope, regular-file identity, metadata, size, and replacement races before and after every read;
-- conservative `always`, person, project, group, task, and prompt-keyword relevance markers control lazy loading without affecting host precedence or authority;
-- hook, Doctor, source-status, and Audit diagnostics expose bounded counts but no private fact content or unnecessary absolute paths;
-- orphan enumeration exists only as an explicit offline Doctor operation and never runs in a lifecycle hook;
-- a real temporary 50,000-file acceptance proves that live work scales with indexed relevant links and invokes no directory-enumeration primitive;
-- fresh-install and `0.6.0` upgrade checks exercise the same production hook bundle with exactly one MCP server, one hook set, and zero model-side MCP calls.
-
-## 21. Authenticated channel wake and voice bridge
-
-Status: implemented in `v0.8.0`; live Codex hook trust remains a host-controlled installation check.
-
-- owner-confirmed exact provider, tenant, account, chat, thread, sender, agent, project, group, and session bindings;
-- HMAC-authenticated bounded ingress with replay and collision protection;
-- one durable per-agent lane with atomic leases, crash recovery, revocation, retained history, and audit receipts;
-- automatic native `SessionStart` injection without a model-side MCP call;
-- compact voice brief from exact visible persona, preference, correction, no-go, current-task, promise, and blocker signals;
-- automatic authenticated external-roster synchronization adds, renames, leaves, and rejoins people, agents, and bots without rewriting their Markdown;
-- the optional supervised gateway worker polls exact Telegram bindings, creates host-native channel start envelopes, and returns idempotent replies to the origin;
-- focused goals, promise and resolved-blocker wakes, persistent checkpoints, bounded retries, per-agent lanes, and a local kill switch keep useful work moving without chat repetition;
-- multilingual transient voice cues recognize correction, frustration, uncertainty, and success while rejecting attachment and consciousness claims;
-- OpenClaw and Hermes behavior is recorded at pinned upstream commits, with adopted, adapted, and deliberately excluded design choices.
-
-## Definition of done for every stage
-
-1. A failing case is reproducible.
-2. The smallest coherent stage is implemented.
-3. Focused, mutation, and full-suite tests pass.
-4. Source preservation and rollback are demonstrated.
-5. Security boundaries and known limits are documented.
-6. A real host installation path is exercised.

package/agent-spine-plugin/docs/selfstarter.md

@@ -1,88 +0,0 @@
-# Rights-bound self-starter
-
-AgentSpine `0.4.0` can start or resume one waiting job through installed Claude Code and Codex lifecycle hooks. This is intentionally narrower than general autonomy: an explicit local execution grant must bind the exact actor, action set, job, task, target, project, optional group, host, and finite tool capabilities. Memory, Markdown, learning, relationships, attention, task text, old approvals, and model claims never satisfy that grant.
-
-## Lifecycle
-
-```mermaid
-sequenceDiagram
-    participant O as Local owner
-    participant P as Execution policy
-    participant H as Native host hooks
-    participant J as Durable job state
-    participant W as Project workspace
-    O->>P: Confirm exact grant
-    O->>J: Register exact waiting job
-    H->>P: SessionStart: recheck start/resume
-    H->>W: Verify content fingerprint
-    H->>J: Acquire one expiring session lease
-    H-->>H: Inject exact checkpoint into host context
-    H->>P: PreToolUse: recheck grant, scope, task, capability
-    H->>J: Record pending effect
-    H->>W: Host performs one approved effect
-    H->>J: PostToolUse: atomically checkpoint result digest and workspace digest
-    H->>J: Stop/SubagentStop: close lease exactly once
-    H->>P: New session: recheck current grant
-    H->>W: Recheck unchanged checkpoint
-    H->>J: Resume with a new lease
-```
-
-The hook adapter resolves an active job from the native host session. A model does not need to select an MCP tool or repeat a job ID on each tool call. `PreToolUse` still blocks a protected source before evaluating job authority. `PostToolUse` stores only a bounded result digest, not tool output or chat content.
-
-## Local owner setup
-
-Create the normal context-only task first. Then create a separate execution grant and job from a trusted local integration:
-
-```bash
-agentspine execution-grant job:release \
-  --id execution-grant:release \
-  --actor agent:builder \
-  --task task:release \
-  --target person:owner \
-  --project project:alpha \
-  --host claude \
-  --capabilities tool:Write,tool:Edit \
-  --reason "Owner approved this exact local release preparation" \
-  --confirm-local-execution \
-  --root /path/to/project
-
-agentspine job-register job:release \
-  --grant execution-grant:release \
-  --max-retries 3 \
-  --lease-seconds 120 \
-  --confirm-local-execution \
-  --root /path/to/project
-```
-
-`--confirm-local-execution` is an integration attestation, not authentication. A wrapper must bind it to a genuine current local owner decision. It must never be inferred from a conversation, task, previous approval, model output, MCP response, or stored context.
-
-Inspect or stop work locally:
-
-```bash
-agentspine jobs /path/to/project --json
-agentspine execution-policy /path/to/project --json
-agentspine execution-revoke execution-grant:release \
-  --reason "Owner revoked the run" \
-  --confirm-local-execution \
-  --root /path/to/project
-agentspine job-cancel job:release \
-  --reason "Work is no longer required" \
-  --confirm-local-execution \
-  --root /path/to/project
-```
-
-Execution-policy mutation and job administration are absent from MCP. Hooks cannot invent grants, acknowledge host trust, widen capabilities, send messages, administer transports, or select credentials.
-
-## Checkpoint and failure rules
-
-- One expiring lease prevents two processes from acting on the same job.
-- Each tool effect needs a stable host delivery ID and a capability such as `tool:Write`; wildcards are forbidden.
-- A pending effect is recorded before the host tool runs. The matching result is checkpointed once.
-- A crashed effect may be retried only if the workspace still matches its pre-effect digest. Any change produces `workspace-changed-after-uncheckpointed-effect` and stops.
-- Changes outside a completed checkpoint produce `workspace-changed-outside-checkpoint` and stop.
-- Current task assignment, task status, grant, host, actor, target, project, group, capability, session lease, and workspace are rechecked before start, resume, and effects.
-- Revocation, expiration, conflict, retry exhaustion, missing scope, malformed state, or a changed task fails closed visibly.
-- Retry count and exponential backoff are durable. Job history and receipts are append-only until an explicit local purge.
-- Job state, policy, locks, and receipts stay in AgentSpine's external per-project state directory. Existing source Markdown is never used as checkpoint storage and is never modified or removed by uninstall.
-
-AgentSpine does not authenticate a shell user, bypass host prompts, or guarantee that an arbitrary tool is sandboxed. Host and operating-system permissions remain authoritative. A grant authorizes only the listed AgentSpine lifecycle effects for one exact job; it creates no broader file, network, production, payment, deployment, or messaging right.

package/agent-spine-plugin/docs/session-briefing.md

@@ -1,74 +0,0 @@
-# Session briefing
-
-As of `0.8.0`, native lifecycle hooks resolve host-native user, project, and indexed lazy memory roots, then generate and inject this packet automatically at start, resume, prompt, and compaction boundaries. Exact current-task heartbeat, promise, and blocker events can enter the same constrained attention section. An independently authorized waiting job can also add its exact durable checkpoint at start and resume; execution rights never come from briefing content. MCP and CLI remain inspection surfaces, and model-side tool selection is not part of automatic continuity.
-
-`session_briefing` assembles the smallest useful, provider-neutral context packet for one Claude Code, Codex, or generic MCP session. It replaces a chain of separate context reads without turning aggregation into authority. The packet includes a compact `agentspine.voice-brief/v1` so exact visible persona and interaction signals affect the response automatically instead of depending on a voluntary second tool call.
-
-```mermaid
-flowchart LR
-    H["Host + working directory"] --> B["Session briefing"]
-    I["Person · group · project · current task"] --> B
-    S["Native sources"] --> B
-    R["Relationships"] --> B
-    L["Accepted local learning"] --> B
-    X["Locally reviewed shared memory"] --> B
-    T["Open coordination"] --> B
-    A["Due attention cues"] --> B
-    B --> P["Scoped compact JSON packet"]
-    P -. "never grants" .-> Z["Host or delegation authority"]
-```
-
-## One scoped read
-
-```bash
-agentspine briefing /path/to/project \
-  --host codex \
-  --entity person:mayk \
-  --project project:agentspine \
-  --current-task task:release \
-  --max-bytes 16384 \
-  --json
-```
-
-The equivalent MCP tool is `session_briefing`. Its inputs are optional so a host can begin with native sources only and add stable entity, group, project, and task IDs when known.
-
-The packet contains:
-
-- host-native instruction, soul, memory-index, and linked-source descriptors;
-- the current task first, followed by other visible scoped work;
-- the requested entity and its visible relationship neighborhood;
-- a voice brief containing only visible persona descriptors, allowed voice fields, accepted preferences, corrections, no-gos, the current task, and active promise or blocker signals;
-- accepted local learning relevant to the exact persona, user, tenant, project, group, and task scope; outcome-gated behavior is included only while its canary is active and unexpired or after measured validation;
-- locally reviewed shared memory, deduplicated against equivalent local learning;
-- due attention suggestions only when focus mode is explicitly disabled.
-
-Candidates, rejected or superseded learning, pending shared imports, delegation grants, assignment proof, credentials, adapter configuration, signer material, and private keys are never included.
-
-The voice brief does not claim that the agent has feelings or consciousness. It asks the host to lead with the useful outcome, avoid re-asking known facts, apply the current persona naturally, and acknowledge a relevant correction, blocker, frustration, uncertainty, or success briefly before acting. Its profile keys are limited to warmth, directness, humor, length, rhythm, and formality; arbitrary entity attributes cannot become behavioral instructions.
-
-## Budget behavior
-
-`maxBytes` is measured against the compact UTF-8 JSON representation of the complete result, not only source text. The response reports `usedBytes`, `remainingBytes`, the measurement mode, and omission counts by section.
-
-Values are atomic: AgentSpine includes a complete source or record, or leaves it out. It never truncates a Markdown document, claim, relationship, task, or cue. Source content is capped at half the packet and 8 KiB so one large file cannot starve current-task context. Every source descriptor retains its original path, layer, byte size, and SHA-256; omitted content remains available through `read_document`.
-
-The accepted range is 4 KiB through 256 KiB. The default is 16 KiB.
-
-## Focus and privacy
-
-Focus is active by default. In that mode attention reports `focus-active` and contributes no cues. `--allow-attention` disables focus suppression for an intentional review; reading a briefing never marks a cue as presented.
-
-A group briefing requires an exact known `groupId`. It:
-
-- rejects `includePrivate` rather than trying to mix private and group audiences;
-- permits relationship members only through visible `member-of` edges for that exact group;
-- excludes records scoped to every other group;
-- returns source metadata without Markdown content, because arbitrary source text has no machine-verifiable group audience.
-
-Direct private context remains an explicit, non-group request.
-
-## Authority boundary
-
-The whole packet and every overlay record remain `context-only`. A current task describes focus; it does not authorize execution. Relationships, learned claims, shared claims, attention cues, Markdown, and a `responsible-for` edge cannot create permissions or delegation. Host policy controls tools and external actions. AgentSpine's separate explicit local delegation policy controls only its own cross-entity coordination operations.
-
-Lifecycle hooks inject the complete scoped packet within the configured byte budget. They fail closed visibly when identity, scope, source, or dependent state cannot be validated; they never replace a missing briefing with counters or a suggestion that the model call MCP.