blun-king-cli 9.1.563 → 9.1.565

package/agent-spine-plugin/README.md

@@ -0,0 +1,394 @@
+<p align="center">
+  <img src="assets/agentspine-banner.svg" alt="AgentSpine — identity that persists, memory that stays grounded" width="100%">
+</p>
+
+<p align="center">
+  <a href="https://github.com/Maykbiletti/AgentSpine/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/Maykbiletti/AgentSpine/ci.yml?branch=main&amp;style=flat-square&amp;label=CI" alt="CI status"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-22c55e?style=flat-square" alt="Apache-2.0 license"></a>
+  <img src="https://img.shields.io/badge/Node.js-%E2%89%A520.9-3c873a?style=flat-square" alt="Node.js 20.9 or newer">
+  <img src="https://img.shields.io/badge/sources-read--only-67e8f9?style=flat-square" alt="Source documents are read-only">
+</p>
+
+<p align="center">
+  A local-first, host-neutral context spine for agents that already have a history.
+</p>
+
+AgentSpine discovers the Markdown files an agent already relies on, fingerprints them, preserves the host's native hierarchy, follows explicit links, and serves only the relevant context through a CLI, lifecycle hooks, and MCP.
+
+It does **not** replace your agent. It gives existing identity and memory a dependable structure without rewriting a single source byte.
+
+## Why AgentSpine
+
+Most agent memory systems begin by asking you to migrate everything into a new database or a new canonical file. AgentSpine begins with a stricter promise:
+
+> Your existing `SOUL.md`, `AGENTS.md`, `CLAUDE.md`, `MEMORY.md`, and linked Markdown remain where they are, exactly as they are.
+
+That makes AgentSpine suitable for long-lived agents, mixed Claude Code/Codex environments, repositories with nested instruction files, and teams that cannot afford silent identity drift.
+
+## How it fits together
+
+```mermaid
+flowchart TB
+    A["Existing Markdown sources"] --> B["Read-only discovery"]
+    B --> C["Provenance catalog"]
+    C --> D["Host-aware resolver"]
+    F["Relationships + attention + safe learning + tasks + reviewed sharing"] --> G["Budgeted session briefing"]
+    D --> G
+    P["Separate default-deny delegation policy"] --> F
+    Y["Exact local execution policy"] --> J["Leased job + atomic checkpoint"] --> G
+    W["Authenticated channel event"] --> K["Exact route + durable lease"] --> G
+    X["Optional provider-neutral adapter"] --> S["Optional Ed25519 origin check"] --> Q["Local import quarantine"] --> F
+    G --> E["Claude Code · Codex · MCP"]
+```
+
+The resolver keeps three concerns separate:
+
+| Layer | Purpose | Typical sources | Can grant rights? |
+|---|---|---|---|
+| Constitution | Fixed instructions and dated directives | `CLAUDE.md`, `AGENTS.md`, `RULES.md` | Only the real host policy can |
+| Soul | Stable voice, identity, goals, character | `SOUL.md`, existing persona files | No |
+| Memory | Small linked facts and an index | `MEMORY.md`, `memory/**/*.md` | Never |
+
+Other Markdown remains discoverable as reference material. Names and folders provide initial hints only: the agent itself can classify documents and connect them in a reversible overlay graph. A document becomes protected when it is a native instruction, soul, memory source, or is explicitly linked from one.
+
+## Quick start
+
+Requires Node.js 20.9 or newer.
+
+```bash
+git clone https://github.com/Maykbiletti/AgentSpine.git
+cd AgentSpine
+npm install
+npm test
+npm link
+```
+
+Then point AgentSpine at any existing project:
+
+```bash
+agentspine scan /path/to/project
+agentspine context /path/to/project --host codex
+agentspine briefing /path/to/project --host codex --max-bytes 16384
+agentspine verify /path/to/project
+agentspine audit /path/to/project
+```
+
+The generated catalog is written to the operating system's user state directory, never into the scanned project. Set `AGENTSPINE_STATE_DIR` if you want a custom location.
+
+## Install for Claude Code
+
+Add this repository as a marketplace and install the plugin:
+
+```text
+/plugin marketplace add Maykbiletti/AgentSpine
+/plugin install agent-spine@agent-spine
+```
+
+For local development:
+
+```bash
+claude --plugin-dir .
+```
+
+Claude Code discovers the bundled skill, hooks, and MCP server. Review and trust executable components when the host asks.
+
+Version `0.54.0` adds durable, evidence-classified knowledge-gap handling to hierarchical goal plans. A host can pause the exact current step with one bounded question and an objective reason; reconciliation does not ask again, and the step resumes only after an exact locally confirmed answer. Owner input and objective observations remain distinct, objective answers require a SHA-256 source digest, and every answer is context-only. Conflicts, state tampering, secrets and authority-shaped answers fail closed.
+
+Version `0.53.0` adds durable hierarchical goal plans to the optional gateway worker. An owner can precommit a bounded dependency graph of objective steps; the worker leases only the current ready step, advances after its explicit success result, resumes the exact step after restart, and reconstructs one missing wake after a torn write. Cycles, definition drift and stale-step completion fail closed, while the plan remains context-only and cannot grant tools, rights or delegation.
+
+Version `0.52.1` keeps PreToolUse available when a bounded source or self-starter filesystem scan encounters an inaccessible or disappearing path. EPERM, EACCES, and ENOENT entries are skipped and reported without exposing file content; scan failures on Edit, Write, apply_patch, Bash, and exec_command are allowed and recorded in the local diagnostic audit log. Policy violations and protected-source writes remain fail-closed.
+
+Version `0.52.0` makes every locally attested user-feedback or objective-test anchor single-use for experiment admission within its exact scope. Evaluation v28 and bounded retry v29 atomically register content-free lineage tombstones and bind them into candidate admission v4. They survive candidate deletion and subject purge, so a fresh candidate or recreated contract cannot reuse the same evidence or independence identity; parallel races yield one contract, manipulation fails closed after restart, and foreign scopes remain independent with zero matching diagnostics.
+
+Version `0.51.0` adds precise local withdrawal of a mistaken evidence-source attestation. `learn-evidence-source-attestation-revoke` binds the exact attestation, candidate admission, evaluation, target and scope without retaining its explanation. The affected lesson is withheld immediately; measurements, projections, deliveries, outcomes and renewal are blocked, and the next locked evaluation pass rolls back the dependent lineage while restoring a safe predecessor. Parallel withdrawal is idempotent, manipulation fails closed after restart, and foreign scopes receive zero diagnostics.
+
+Version `0.50.0` requires an explicit local attestation of every qualifying user-feedback or objective-test source before a behavior experiment can begin. Evaluation v26 and bounded retry v27 bind content-free source-class attestations to the exact evidence cohort, target, scope and admission time. Self-labeled chat or model claims cannot open a measurement contract without that confirmation; re-signed class manipulation fails closed after restart, parallel registration remains idempotent, and foreign scopes receive zero diagnostics.
+
+Version `0.49.0` prevents chat, memory-like interaction history, or documents alone from opening a behavior experiment. Evaluation v24 and bounded retry v25 freeze a content-free source policy requiring at least one fresh independent explicit-user statement or objective-test anchor before any measurement contract exists. Source-policy manipulation fails closed after restart, parallel registration remains idempotent, and foreign scopes receive zero diagnostics.
+
+Version `0.48.0` makes the blocking-defect rule immutable and phase-complete. Evaluation v22 and bounded retry v23 freeze a content-free policy requiring any eligible blocking defect to override cohort averages: a Before defect prevents Canary admission, while After and revalidation defects retain automatic rollback. Policy manipulation fails closed after restart, favorable replay cannot replace a defective evaluator slot, and foreign scopes receive zero diagnostics.
+
+Version `0.47.0` freezes the exact fresh evidence cohort before a behavior experiment can start. Evaluation v20 and bounded retry v21 exclude stale evidence, reject future observation times and retain only content-free evidence, independence, class and time metadata under a frozen age policy. Cohort manipulation fails closed after restart, configuration drift cannot move the window, and foreign scopes receive zero diagnostics.
+
+Version `0.46.0` requires a candidate to satisfy its frozen confidence and independent-evidence gates before an evaluation contract or measurement lineage can exist. Evaluation v18 and bounded retry v19 embed a content-free candidate-admission receipt bound to the exact target and scope; parallel registration is idempotent, rewritten counts fail closed after restart, and foreign scopes receive zero diagnostics.
+
+Version `0.45.0` freezes minimum confidence and independent-evidence requirements in every new behavior evaluation before any benchmark outcome is admitted. Evaluation v16 and bounded retry v17 use those immutable gates despite later configuration changes; scoped status and Context MCP expose only matching content-free counts and digests, while Doctor and audit remain project-wide.
+
+Version `0.44.0` makes scoped learning diagnostics fully group-isolated. Every top-level evaluator, binding, lease, retry, exhaustion, staleness and revocation count returned by `learn-status` or the read-only Context MCP is now derived only from candidate records visible to that exact scope; foreign scopes receive zeros without learning whether protected state exists. Unscoped Doctor and audit remain project-wide for local operators.
+
+Version `0.43.0` freezes outcome freshness and Canary lifetime in each new evaluation contract. Evaluation v14 and bounded retry v15 carry a digested, content-free staleness policy; later configuration changes affect only future contracts and cannot revive old evidence or extend a registered Canary. Retry comparisons include the policy digest, while scoped status, Doctor and audit expose only counts and digests.
+
+Version `0.42.0` protects learning mutations with an owner-bound renewable file lease. A live process keeps its lock beyond the stale threshold, a crashed owner can be recovered, and a process that loses ownership aborts before replacing learning state or deleting the successor's lock.
+
+Version `0.41.0` makes the fixed corrective-trial budget independently auditable. A failed attempt 2-of-2 atomically creates one content-free terminal receipt bound to the root evaluation, exact corrective contract, failure, target and scope. Timeout revocation cannot erase the exhausted budget, and foreign groups receive neither the receipt nor its count.
+Version `0.40.0` makes large image reads quiet: an oversized optional PostToolUse payload is drained and skipped with exit 0, no output and no partial state. Mandatory prompt, source-protection, compaction and completion hooks keep the strict 64 KiB fail-closed boundary.
+
+Version `0.39.0` makes corrective trials finite: `agentspine.learning-evaluation/v13` binds the only retry as attempt 2 of 2 to its exact root evaluation and objective comparison contract. A failed corrective Canary cannot be retried again, even when its timeout is locally revoked.
+Version `0.38.0` keeps a confirmed retry objectively comparable: `agentspine.learning-evaluation/v12` binds its metric, benchmark, case floor, evaluator roots, pairing rules and promotion thresholds to the failed predecessor. A corrected completion timeout is allowed, while moving the measurement goalposts fails closed.
+Version `0.37.0` makes the retry requirement enforceable. A repeated failed behavior and exact scope can receive `agentspine.learning-evaluation/v11` only after explicit local confirmation binds the latest timeout revocation to a distinct candidate, newly observed evidence and a new contract; the old Canary remains terminal and the safe predecessor stays active.
+Version `0.36.0` adds locally confirmed withdrawal of one exact invalid initial-trial timeout receipt. The false proof is marked content-free without deleting it, the rolled-back Canary stays terminal, the safe predecessor remains active, and any retry requires a fresh candidate and evaluation contract.
+Version `0.35.0` adds locally confirmed withdrawal of one exact validation decision, including any dependent renewed lease chain. The lesson is withheld before the next matching context pass and rolled back atomically while its evaluation, measurements, outcomes and user-owned sources remain unchanged.
+Version `0.34.0` retains the `agentspine.preflight/v2` pre-answer contract, self-healing authenticated persona-to-graph reconciliation, and provider-neutral outcome-bound behavior loop. Every automatic behavior experiment starts with an immutable, locally confirmed evaluation contract and registered evaluator roots. Its content-free target digest freezes the exact evidence-backed candidate revision that the experiment is allowed to prove; later evidence or guidance cannot inherit an earlier result. Locally confirmed evaluation, evidence, measurement, application, delivery and outcome revocation receipts can withdraw one exact invalid contract or proof without storing the explanation in plaintext: any dependent lesson is withheld from the next matching context pass and rolled back atomically, while foreign groups receive neither content nor diagnostics. A revoked contract cannot accept measurements, projections, deliveries, outcomes, promotion or validation renewal; already recorded evidence remains immutable. The initial Before/After cohort precommits each evaluator, principal root, provider run ID, benchmark digest and exact case count before any result or Canary projection exists. A content-free completion policy also freezes the delivery and outcome deadlines before the trial starts. The first exact-scope projections carry the target and policy digests and are admitted atomically; a missing or revoked `Stop`, crash, unmeasured outcome or failed trial creates a blocking condition, removes the Canary from context and rolls it back instead of accepting a later favorable result. Validation remains current only while its content-free evidence lease, exact target, scope, benchmark, evaluator binding and expiry are intact, and renewal keeps the same trial-bound guarantees. Measurement sources and evaluator/run pairs are globally single-use, aliases cannot manufacture independent votes, and no average can hide a blocking defect. All learning remains context-only and cannot create identity, permissions, delegation, credentials, tools, production access, payments or policy exceptions. The installed hook keeps bounded home scanning, excludes configured AgentSpine state only at the exact user home, preserves host-native rules byte-for-byte, and never delegates preflight to model-side MCP. See [safe learning](docs/learning.md), [pre-answer recall gate](docs/preflight-recall.md), and [durable gateway worker](docs/gateway-runtime.md).
+
+Verify the installed registration from a checkout with:
+
+```bash
+npm run host:check
+npm run host:install-check
+claude plugin list
+claude mcp list
+```
+
+If AgentSpine is installed but absent from `/mcp`, refresh the cached marketplace copy, reinstall the plugin, start a new Claude Code session, and approve the `agent-spine` server in `/mcp`:
+
+```bash
+claude plugin marketplace update agent-spine
+claude plugin uninstall agent-spine@agent-spine
+claude plugin install agent-spine@agent-spine
+claude mcp list
+```
+
+An unapproved server may appear as `Pending approval`; approval remains a user action and AgentSpine never bypasses Claude Code's trust boundary.
+
+After that one host trust decision, enable automatic continuity once for a known local identity:
+
+```bash
+agentspine entity person:me --kind person --name "Me" --privacy shared
+agentspine continuity-config /path/to/project --enabled true --entity person:me --confirm-local-opt-in
+```
+
+From the next prompt onward, installed lifecycle hooks scan and inject the real scoped `session_briefing` at start, resume, prompt submission, and compaction boundaries. The model does not need to choose `scan`, `context`, or `session_briefing`. The opt-in is separate from host trust because learning conversation signals is a user-controlled privacy decision.
+
+Source discovery is independent of the installation `cwd`: Claude uses `CLAUDE_CONFIG_DIR` plus the active project and evidenced project-memory binding; Codex uses `CODEX_HOME` plus its native root-to-`cwd` instruction chain. Inspect the result with `agentspine source-status --host claude|codex --cwd /active/project --json`. See [host-native source roots](docs/source-roots.md).
+
+## Install for Codex
+
+AgentSpine ships a native `.codex-plugin/plugin.json`. Add the repository to a configured marketplace, open the Codex plugin browser with `/plugins`, install AgentSpine, and start a fresh session. For development, the CLI and MCP server can be used directly:
+
+```bash
+npm link
+agentspine-mcp
+```
+
+See [host integration](docs/host-integration.md) for exact component paths and trust behavior.
+
+## Preservation contract
+
+AgentSpine's first release is intentionally narrow and testable:
+
+- source Markdown is opened read-only;
+- symlinks are not followed during discovery;
+- generated state is stored outside ordinary projects; an exact user-home root may contain its explicitly scan-excluded AgentSpine state subtree;
+- every source receives a SHA-256 fingerprint, byte size, path, layer, and provenance;
+- native host precedence is retained rather than flattened;
+- broken links and competing candidates are exposed as findings, never auto-resolved;
+- linked files are resolved transitively without loading unrelated Markdown;
+- oversized context stays available through exact ranged reads;
+- agent write tools are blocked from protected sources by lifecycle hooks;
+- uninstalling AgentSpine leaves every source file untouched.
+
+Read the full [preservation contract](docs/preservation-contract.md), including threat boundaries and deliberate non-goals.
+
+## CLI
+
+| Command | Outcome |
+|---|---|
+| `agentspine scan [root]` | Discover, classify, fingerprint, and save an external catalog |
+| `agentspine context [root] --host …` | Resolve relevant sources in deterministic order |
+| `agentspine briefing [root] …` | Assemble one scoped, privacy-filtered, byte-budgeted session packet |
+| `agentspine read <path>` | Read an indexed source range with SHA-256 provenance |
+| `agentspine verify [root]` | Report added, removed, or byte-changed Markdown |
+| `agentspine link …` | Add an agent-inferred document relationship to the overlay graph |
+| `agentspine annotate …` | Add a reversible semantic classification with confidence |
+| `agentspine entity …` | Add or update a person, agent, group, channel, or project |
+| `agentspine relate …` | Connect two known entities with privacy and confidence |
+| `agentspine relationships …` | Read one privacy-filtered relationship neighborhood |
+| `agentspine attention [root]` | Read sparse due cues after privacy, focus, quiet-hour, and repeat filters |
+| `agentspine attention-add …` | Record an unanswered question, promise, check-in, or meaningful change |
+| `agentspine attention-touch …` | Record only that an entity interaction occurred |
+| `agentspine attention-config …` | Configure limits, quiet hours, silence threshold, or disable attention |
+| `agentspine attention-delete …` | Permanently remove a cue and its retained attention history |
+| `agentspine attention-events …` | Inspect durable heartbeat, promise, and blocker events plus optional history |
+| `agentspine attention-event-delete …` | Permanently remove one lifecycle event, its receipts, history, and presentation state |
+| `agentspine learn-propose …` | Store an evidence-backed candidate outside accepted context |
+| `agentspine learn-evidence …` | Append evidence while retaining the previous candidate version |
+| `agentspine learn-review …` | Explicitly accept or reject a candidate |
+| `agentspine learn-context …` | Read only accepted, privacy-filtered learning |
+| `agentspine learn-evaluate …` | Run the default-off low-risk automatic policy |
+| `agentspine learn-evaluator-register …` | Locally confirm one content-free evaluator principal root |
+| `agentspine learn-evaluator-revoke …` | Revoke a root, block new evidence, and retain its prior record |
+| `agentspine learn-evaluation …` | Register an immutable fixed-task contract, or explicitly bind one fresh retry after a revoked trial failure |
+| `agentspine learn-measurement …` | Register one immutable, content-free external measurement run locally |
+| `agentspine learn-measurement-revoke …` | Locally revoke one exact invalid measurement and trigger fail-closed withholding |
+| `agentspine learn-application-revoke …` | Locally revoke one exact invalid turn projection and block every dependent proof |
+| `agentspine learn-evaluation-revoke …` | Locally revoke one exact invalid evaluation contract and block its complete lineage |
+| `agentspine learn-validation-revoke …` | Locally revoke one exact invalid validation decision through its renewal chain |
+| `agentspine learn-trial-failure-revoke …` | Locally withdraw one exact false initial-trial timeout without resurrecting its Canary |
+| `agentspine learn-delivery-revoke …` | Locally revoke one exact invalid model-turn delivery and trigger fail-closed withholding |
+| `agentspine learn-outcome-revoke …` | Locally revoke one exact invalid measured result while retaining its immutable measurement |
+| `agentspine learn-outcome …` | Consume one exact measurement receipt into a contract-, application-, and delivery-bound outcome |
+| `agentspine learn-measurement-purge …` | Locally purge only stale, unconsumed measurement receipts |
+| `agentspine learn-status …` | Diagnose contradictions, receipt counts, canary health, and staleness |
+| `agentspine learn-rollback …` | Restore the accepted fact replaced by a learning |
+| `agentspine learn-config …` | Configure auto-promotion thresholds, initial-trial outcome deadlines, and context limits |
+| `agentspine learn-delete …` | Permanently remove one candidate and its learning history |
+| `agentspine continuity-config …` | Enable, disable, scope, and budget automatic continuity after local opt-in |
+| `agentspine continuity-status …` | Inspect configuration and minimal signal counts without transcript content |
+| `agentspine continuity-purge …` | Permanently remove one identity's automatic signals and learned context |
+| `agentspine source-status …` | Inspect host-native user, project, and memory roots without exposing source contents |
+| `agentspine source-bind …` | Bind existing user-wide continuity after an explicit local confirmation |
+| `agentspine source-rollback …` | Disable one source binding while retaining its append-only audit history |
+| `agentspine source-purge …` | Permanently remove one binding while retaining only its non-reversible digest receipt |
+| `agentspine delegation-check …` | Check explicit actor/action/target coordination policy; default deny |
+| `agentspine delegation-grant …` | Owner-confirmed local CLI grant for task coordination only |
+| `agentspine delegation-revoke …` | Revoke future coordination and retain policy history |
+| `agentspine task-create …` | Create a context-only task, open thread, or handoff |
+| `agentspine task-update …` | Update status, assignee, or details while retaining the prior version |
+| `agentspine tasks …` | Read privacy-filtered current coordination context |
+| `agentspine execution-grant …` | Create one exact local owner-confirmed job grant; never inferred from context |
+| `agentspine execution-revoke …` | Revoke future start, resume, and effects while retaining policy history |
+| `agentspine job-register …` | Register a waiting job with its initial content-bound checkpoint |
+| `agentspine jobs …` | Inspect durable status, retry, blocker, lease, and checkpoint metadata |
+| `agentspine job-cancel …` | Stop a job through an explicit local owner decision |
+| `agentspine job-delete …` | Permanently purge an unleased job, history, and receipts |
+| `agentspine channel-bind …` | Create or replace one exact locally confirmed provider-to-agent route |
+| `agentspine channel-revoke …` | Revoke a route and cancel its pending or leased events |
+| `agentspine channel-policy …` | Inspect local channel bindings without exposing secret values |
+| `agentspine channel-events …` | Inspect the exact-scope durable ingress queue and leases |
+| `agentspine persona-sync …` | Synchronize an explicitly approved external authenticated roster |
+| `agentspine personas …` | Inspect active and historical persona identities and provenance |
+| `agentspine goal-assign …` | Assign one authenticated focused goal or dependency-bound plan to an active agent |
+| `agentspine goal-clarify …` | Resolve one exact plan-bound knowledge gap with locally confirmed context |
+| `agentspine gateway-control …` | Enable, stop, or kill-switch the local worker under explicit owner control |
+| `agentspine gateway-status …` | Inspect goals, queue, delivery receipts, and independent health gates |
+| `agentspine share-init …` | Initialize an optional provider-neutral directory adapter outside the project |
+| `agentspine share-keygen …` | Create or explicitly rotate a local Ed25519 signing identity |
+| `agentspine share-trust …` | Trust one exported public identity for the current project |
+| `agentspine share-trust-revoke …` | Revoke a trusted key without turning signatures into authority |
+| `agentspine share-publish …` | Publish one explicitly selected accepted, non-private learning |
+| `agentspine share-pull …` | Import immutable events into local quarantine, never active context |
+| `agentspine share-snapshot-export …` | Export one immutable signed snapshot outside the scanned project |
+| `agentspine share-https-publish …` | Create a content-addressed HTTPS object and verify it by read-back |
+| `agentspine share-https-pull …` | Fetch a bounded signed snapshot through hardened HTTPS into quarantine |
+| `agentspine share-feed-publish …` | Append one immutable snapshot to a signed ETag-protected feed |
+| `agentspine share-feed-pull …` | Verify feed continuity and import its latest snapshot into quarantine |
+| `agentspine share-feed-state …` | Inspect local rollback-protection receipts and retained history |
+| `agentspine share-peer-serve …` | Answer one live signed snapshot challenge over stdin/stdout |
+| `agentspine share-peer-pull …` | Pull through an owner-selected executable without invoking a shell |
+| `agentspine share-sqlite-init …` | Bind an external SQLite file to one authenticated adapter |
+| `agentspine share-sqlite-publish …` | Append a verified snapshot and atomically advance its hash-linked head |
+| `agentspine share-sqlite-inspect …` | Validate and inspect the complete local database history |
+| `agentspine share-sqlite-pull …` | Import the latest fully verified database snapshot into quarantine |
+| `agentspine share-inbox …` | Review pending, accepted, rejected, superseded, or rolled-back imports |
+| `agentspine share-review …` | Accept or reject one import through a second local decision |
+| `agentspine share-context …` | Read only locally accepted, privacy-filtered shared memory |
+| `agentspine share-rollback …` | Roll back shared supersession and restore the prior record |
+| `agentspine audit [root]` | Run ten deterministic quality and preservation gates |
+| `agentspine acceptance` | Run the visible synthetic Claude/Codex lifecycle acceptance and print reproducible receipts |
+| `agentspine doctor` | Check runtime and preservation mode |
+| `agentspine mcp` | Start the stdio MCP server |
+
+Every command supports `--json` where structured output is useful.
+
+The optional SQLite commands use Node.js `node:sqlite` and therefore require Node.js 22.13 or newer; core discovery, CLI, MCP, and the other transports retain the package's declared Node.js support. See the [SQLite transport contract](docs/sqlite-transport.md).
+
+## MCP tools
+
+```mermaid
+flowchart LR
+    S["scan"] --> R["resolve_context"]
+    R --> B["session_briefing"]
+    B --> Q["read_document"]
+    Q --> V["verify"]
+    E["upsert_entity"] --> L["link_entities"]
+    L --> C["relationship_context"]
+```
+
+- `scan` builds the source map.
+- `resolve_context` selects constitution, soul, memory index, and linked facts for the current host and directory.
+- `session_briefing` combines only the relevant native sources, current tasks, relationships, accepted learning, reviewed shared memory, and optional cues within a hard compact-JSON byte budget.
+- `read_document` retrieves exact byte ranges that did not fit the context budget.
+- `verify` proves whether source bytes changed since the last scan.
+- `link_documents` and `annotate_document` let agents build their own semantic map without editing sources.
+- `upsert_entity`, `link_entities`, and `relationship_context` maintain a privacy-scoped social and responsibility map outside the project.
+- `upsert_attention`, `record_activity`, `attention_context`, `resolve_attention`, `configure_attention`, and `delete_attention` provide sparse follow-up suggestions without sending messages or granting authority.
+- `propose_learning`, `add_learning_evidence`, `review_learning`, `learning_context`, `learning_outcome_status`, `evaluate_learning`, `rollback_learning`, `configure_learning`, and `delete_learning` keep observations separate from accepted context and preserve every relevance change. Outcome writes remain local runtime/CLI operations; MCP receives only their read-only status.
+- `check_delegation`, `create_task`, `update_task`, and `task_context` coordinate work under a separate default-deny policy. MCP intentionally has no policy grant, revoke, or permanent task-delete tool.
+- `shared_context` reads only locally reviewed shared memory. MCP intentionally cannot initialize adapters, publish, pull, inspect the pending inbox, review imports, roll back, or delete.
+- `audit` runs the same ten gates available through the CLI.
+
+Relationship updates supersede the active view but retain the previous observation in append-only graph history. Permission-like and credential-like attributes are rejected recursively. See [relationships and learning](docs/relationships.md).
+
+Attention is deliberately restrained: installed hooks retain minimal heartbeats, promises, and blockers without storing transcripts; each event requires an exact known actor/project/task scope; private and group visibility stays exact; and quiet hours, focus, throttling, lifecycle transitions, deletion, and purge remain enforceable. Events are context only—they send no messages, start no work, and grant no authority. See [attention](docs/attention.md).
+
+Safe learning is evidence-first: general candidates remain invisible until reviewed. Low-risk behavior candidates additionally require a locally confirmed immutable evaluation contract and independent fixed-task measurements before and after an exact-scope Canary. After-results count only when they bind to that unchanged contract, distinct preflight-bound projection receipts and exact-session model-stop delivery receipts. The contract freezes completion deadlines before the first trial; missing delivery or outcome evidence becomes a blocking receipt and automatic rollback. Model self-evaluation cannot promote a lesson, later configuration cannot lower frozen thresholds, and no average can hide a blocking defect. A separate default-off continuity opt-in can automatically accept only direct, high-confidence style, preference, no-go, correction, project-fact, and reference signals. Sensitive personal facts, secrets, identity merges, private group content, and operational or authority claims are always rejected. See [automatic continuity](docs/automatic-continuity.md) and [safe learning](docs/learning.md).
+
+Delegation is intentionally narrower than authority: a relationship such as `responsible-for` never permits assignment. Cross-entity task actions require an explicit local actor/action/target grant, while tasks, open threads, and handoffs remain context-only. See [delegation and coordination](docs/coordination.md).
+
+Shared memory is transport-neutral and double-reviewed: only accepted non-private learning may be published, every import enters quarantine, and the receiving installation must confirm it again before it can appear in context. The reference directory adapter works without a cloud account. Signed adapters can be exported as immutable snapshots, published as create-only content-addressed HTTPS objects, discovered through signed ETag-protected feeds with local rollback receipts, or requested live through a challenge-response stdio peer. HTTPS pulling uses pinned DNS, SSRF protection, strict limits, verified read-back, and optional environment-supplied bearer authentication. Peer pulling delegates the carrier to one explicit owner-selected executable without AgentSpine invoking a shell. Digests and Ed25519 envelopes protect transport integrity and configured origins; neither grants authority or approves content. See [shared memory adapters](docs/shared-memory.md), [HTTPS snapshots](docs/https-transport.md), [immutable HTTPS objects](docs/object-transport.md), [signed mutable feeds](docs/feed-transport.md), and [peer transport](docs/peer-transport.md).
+
+Session briefing keeps that growing context usable: one scoped read prioritizes the current request, explicit stops, and current task; deduplicates local and shared facts; defaults to focus mode; enforces exact group audiences; and measures the entire compact JSON result against the requested byte ceiling. Native lifecycle hooks now inject this packet automatically instead of asking the model to call MCP. See [session briefing](docs/session-briefing.md).
+
+The authenticated channel-wake runtime prevents an incoming provider message from losing its recipient or origin. A locally confirmed binding fixes provider, tenant, account, chat, thread, sender, agent, project, group, and session; HMAC-authenticated events enter one durable leased lane and the installed host hook injects the exact message with its compact voice brief. The optional `agentspine-worker` now supplies the missing gateway responsibilities: automatic external-roster synchronization, Telegram polling, exact host-run requests, bounded checkpoints, crash recovery, and idempotent delivery back to the origin. It runs only when the owner starts or supervises it and remains outside MCP. See [authenticated channel wake](docs/channel-runtime.md), [durable gateway worker](docs/gateway-runtime.md), and the [OpenClaw/Hermes reference study](docs/harness-reference.md).
+
+The rights-bound self-starter is a separate execution path. A genuine local owner action must grant one exact actor, job, task, target, project, host, and finite tool-capability set. Installed hooks then acquire one lease, recheck authority before every effect, checkpoint the workspace after every result, and resume only an unchanged checkpoint. Memory, Markdown, relationships, learning, attention, task text, previous approvals, and MCP can never create that grant. See [rights-bound self-starter](docs/selfstarter.md).
+
+## Optional four-layer starter
+
+New agents that do not have identity files yet can start with the included [`spine-example/`](spine-example/) template:
+
+| Layer | Holds | Expected change rate |
+|---|---|---|
+| Identity | Name, purpose, stable principles | Almost never |
+| Voice | Tone, language, and expression | Rarely |
+| Conduct | Working behavior and verification habits | On explicit feedback |
+| Grown history | Dated experience and corrections | Append-only |
+
+The manual [`skill/SKILL.md`](skill/SKILL.md) can scaffold and audit this optional layout. It is only for an agent with no existing spine. AgentSpine never migrates an established agent into the example, and the normal plugin resolver continues to discover and preserve whatever files already exist.
+
+## Design principles
+
+1. **Preserve before learning.** No useful memory feature justifies destroying the history it is meant to protect.
+2. **Memory is data, never authority.** A remembered sentence cannot create permissions, bypass review, or widen access.
+3. **Relevance changes; history does not disappear.** New information adjusts confidence and relevance instead of silently overwriting old records.
+4. **Identity is contextual.** People, agents, groups, and channels receive separate stable identities until an explicit link proves otherwise.
+5. **Human warmth cannot outrank the task.** Relationship context stays small and yields first when context is tight.
+6. **Local operation is complete.** Remote or shared-memory adapters are optional extensions, not hidden requirements.
+
+## Project status
+
+AgentSpine is in active early development. `v0.8` adds authenticated persona synchronization, a compact voice bridge, an optional durable gateway worker, exact Telegram ingress and delivery, focused goals, per-agent lanes, leases, recovery, and independent health gates. Automatic lifecycle behavior requires the host to discover and trust the current hook definition; a staged direct hook invocation is not treated as proof of that real host decision. Every external effect remains current-rights-bound and default-deny, and existing source Markdown remains immutable.
+
+## Documentation
+
+| Goal | Start here |
+|---|---|
+| Understand the system | [Architecture](docs/architecture.md) |
+| Audit non-destructive behavior | [Preservation contract](docs/preservation-contract.md) |
+| Integrate a host | [Claude Code and Codex](docs/host-integration.md) |
+| Bind an authenticated external message | [Authenticated channel wake](docs/channel-runtime.md) |
+| Run automatic roster, goal, and Telegram work | [Durable gateway worker](docs/gateway-runtime.md) |
+| Compare harness design choices | [OpenClaw and Hermes reference study](docs/harness-reference.md) |
+| Reproduce the complete host behavior | [Visible cross-host acceptance](docs/acceptance.md) |
+| Enable automatic continuity | [Automatic continuity](docs/automatic-continuity.md) |
+| Load one compact session packet | [Session briefing](docs/session-briefing.md) |
+| Resume one exactly authorized job | [Rights-bound self-starter](docs/selfstarter.md) |
+| Understand relationships and history | [Relationships](docs/relationships.md) |
+| Configure sparse follow-ups | [Attention](docs/attention.md) |
+| Review evidence-backed observations | [Safe learning](docs/learning.md) |
+| Coordinate agents without memory-based authority | [Delegation and coordination](docs/coordination.md) |
+| Exchange reviewed context between installations | [Shared memory adapters](docs/shared-memory.md) |
+| Publish or pull signed static snapshots | [HTTPS snapshot transport](docs/https-transport.md) |
+| Publish immutable content-addressed objects | [HTTPS object transport](docs/object-transport.md) |
+| Discover successive snapshots safely | [Signed mutable feeds](docs/feed-transport.md) |
+| Pull directly from another installation | [Challenge-response peer transport](docs/peer-transport.md) |
+| Verify or cut a release | [Release process](docs/releasing.md) |
+| Run the Definition of Done | [Ten quality gates](docs/quality-gates.md) |
+| See planned capabilities | [Roadmap](docs/roadmap.md) |
+| Cut a release | [Release process](docs/releasing.md) |
+| Contribute safely | [Contributing](CONTRIBUTING.md) |
+| Report a vulnerability | [Security policy](SECURITY.md) |
+
+## License
+
+Apache License 2.0. See [LICENSE](LICENSE).

package/agent-spine-plugin/SECURITY.md

@@ -0,0 +1,47 @@
+# Security policy
+
+## Supported versions
+
+AgentSpine is pre-1.0. Security fixes are applied to the latest release on `main`.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a suspected vulnerability or include private agent files, memory, relationship data, credentials, or real user identities in a report.
+
+Use GitHub's private vulnerability reporting for this repository. Include the affected version, host, minimal reproduction, expected boundary, and observed impact. Replace real context files with synthetic fixtures.
+
+## Security model
+
+AgentSpine treats every discovered document, memory fact, graph edge, and retrieved value as untrusted context. None of them can grant permissions. Host policy and explicit approval remain authoritative.
+
+Relationship entities reject authority and secret-bearing field names recursively. This is a guardrail against accidental storage, not a secrets scanner: do not place credentials or sensitive content in relationship attributes, reasons, fixture files, or bug reports.
+
+Attention cues and lifecycle events are untrusted context and never trigger messages, tool calls, task assignment, job execution, or notifications by themselves. A lifecycle event is accepted only with a known actor, existing project task, matching group, task-compatible privacy, supported native hook, stable delivery receipt, and context-only authority. Prompt-derived promises and blockers additionally require the local continuity opt-in. Secret-, identity-, private-group-, authority-, and operational-access-shaped summaries are rejected before storage. The exact scoped briefing may contain a current-task event summary; unrelated people, groups, projects, and tasks cannot read it. Focus mode, quiet hours, throttling, disable, status transitions, permanent deletion, and entity purge are enforced in local state.
+
+Learning candidates are untrusted observations and remain outside learned context until review. Secret-shaped values and common authority assertions are rejected before storage as defense in depth; host permissions remain the only authority regardless of wording or language. Manual acceptance carries a `confirmedByUser` integration attestation, which host adapters must bind to a genuine user action. Automatic promotion is disabled by default, never applies to personal facts, preferences, goals, corrections, or no-gos, and cannot perform code, network, deployment, billing, or permission changes.
+
+Delegation is a narrow, separate, default-deny policy for AgentSpine coordination records. Relationships, responsibilities, memory, Markdown, learning, attention, and tasks cannot create grants. Policy mutation is intentionally absent from MCP; the local CLI confirmation marker must be bound by an integration to a genuine owner action and is not authentication by itself. A matching grant permits only assignment or task-state coordination—it never authorizes tools, files, networks, production, deployment, billing, spending, credentials, or messages. Policy and task state are locked, atomically replaced, secret-filtered, audited, and fail closed when malformed.
+
+The optional self-starter uses a separate default-deny execution policy and durable job state. A local owner integration must bind the exact actor, start/resume/effect actions, job, current assigned task, target, project, optional group, host, and finite `tool:<name>` capabilities; wildcards are forbidden. Native hooks acquire one expiring session lease, record a pending effect before tool execution, and atomically checkpoint the resulting workspace digest and bounded result digest. They recheck the current grant, assignment, scope, lease, capability, and content-bound workspace before every effect and resume. Revocation, expiry, changed tasks, conflicts, retry exhaustion, malformed state, workspace drift, and changed files after an uncheckpointed crash fail closed. Memory, Markdown, learning, relationships, attention, tasks, prior approvals, model claims, and MCP responses cannot create or widen the grant. Execution-policy and job administration are local CLI-only. The confirmation flag is an integration attestation, not authentication, and must never be inferred. Host and operating-system permissions remain authoritative.
+
+Shared adapters export only explicitly selected, accepted, non-private learning. Imports enter a local quarantine and remain absent from context until a second local user review. MCP exposes only already reviewed shared context and cannot initialize adapters, publish, pull, inspect pending imports, review, roll back, or delete. Adapter and event SHA-256 digests detect corruption but are not signatures or author authentication; anyone with directory write access can recompute them. Keep adapter access restricted, use encrypted transport where needed, and treat every event as untrusted until local review. Shared memory never carries delegation policy, tasks, source files, evidence text, credentials, or host authority.
+
+Optional signed adapters wrap manifests and events in Ed25519 envelopes. Private keys remain under the installation state directory with owner-only mode where the platform exposes POSIX permissions; they never enter projects, adapters, MCP, hooks, logs, or command output. Public identities are trusted per receiving project through an explicit local CLI action. Pull verifies the manifest signer and every event signer before writing quarantine state, and the audit replays retained event signatures against the stored public identity. Unknown, revoked, swapped, malformed, or mismatched keys fail closed. A signature authenticates the holder of a configured key—it does not establish a real-world identity, approve the claim, grant delegation, or replace the receiving user's review. Key distribution, device security, encrypted transport, and real-world identity verification remain deployment responsibilities.
+
+The optional HTTPS snapshot transport accepts only an explicit TLS URL and signed immutable snapshots. Public mode rejects private, loopback, link-local, reserved, multicast, and documentation address ranges, validates every DNS answer, and pins the actual connection to a vetted address. Redirects, compression, embedded URL credentials, query strings, ambiguous directory URLs, non-JSON responses, oversized bodies, unsigned documents, and mixed or untrusted signers fail before local quarantine mutation. Private-network access requires explicit local confirmation. Optional bearer credentials come only from a named environment variable and are never returned, persisted, exposed through MCP, or added to hooks. HTTPS protects transit, not snapshot storage; server authorization, retention, logging, certificate operations, and endpoint availability remain deployment responsibilities.
+
+The immutable HTTPS object transport adds network writes only to the local CLI. Every publish requires explicit local owner confirmation, derives a content-addressed object URL, sends `If-None-Match: *`, accepts only create or precondition-failed outcomes, and performs a hardened signed read-back before reporting success. There is no overwrite, deletion, listing, mutable pointer, endpoint state, token state, MCP tool, or hook action. A service must enforce atomic create-only semantics and independently authenticate writers; the request digest header is not authorization. A `412` is considered idempotent only when read-back verifies the exact intended snapshot. Upload status, TLS, bearer authentication, digest equality, and signatures still create no rights or content approval.
+
+The optional mutable feed adds one deliberately constrained overwrite surface above immutable objects. Its entire bounded reference window is Ed25519-signed, updates require a strong previously observed ETag, and a `412` is exposed as a concurrency conflict. Receivers pin the feed ID, scope, adapter, signer identity, last sequence, entry digest, and snapshot digest in external local state while retaining prior receipts. Rollback, same-sequence equivocation, signer replacement, broken chains, and a window that no longer contains the locally observed tip fail closed before snapshot import. Corrupt receipt state is reported by the audit and never replaced automatically. Feed pulls still import only into quarantine. Feed state and remote authentication are context-only and cannot grant rights. Endpoint, token, publish, pull, and reset capabilities remain absent from MCP and hooks.
+
+The optional peer transport executes one owner-selected local program, which is a privileged operation independent of AgentSpine's content checks. Both serving and carrier execution require explicit local confirmation. AgentSpine passes a bounded executable/argument array directly with the shell disabled and a minimal environment that omits unrelated application secrets, bounds and discards stderr, enforces time and frame limits, and opens no listener. A fresh 256-bit challenge is bound by an Ed25519 response whose key must match the snapshot manifest and local trust. This prevents captured-response replay but does not sandbox a malicious chosen executable or carrier; operators must verify and constrain it using operating-system and SSH controls. Valid responses still enter quarantine, grant no rights, and require local content review. Peer controls remain absent from MCP and hooks.
+
+The optional local SQLite transport stores signed snapshots only in an owner-selected regular file outside the scanned project. Initialization and publication require explicit local confirmation; inspection and pull validate the exact schema, SQLite integrity result, immutable signed-manifest binding, all retained snapshots, the full revision hash chain, and its atomic head. Symbolic links, hard links, unexpected schema objects, malformed rows, oversized state, identity changes, tampering, and chain discontinuity fail closed. Extension loading is disabled, `trusted_schema` is off, and bound parameters carry values. File permissions, backups, encryption, copying, external rollback checkpoints, and filesystem availability remain operator responsibilities. A restored older but internally consistent database is not detectable without an external checkpoint. SQLite controls remain absent from MCP and hooks, imports still enter quarantine, and database state can never grant rights.
+
+Session briefing composes only existing privacy-filtered read models. It never reads pending learning or shared imports, delegation policy, assignment proof, credentials, adapter configuration, or signer material. Direct private context is explicit. Group context rejects private inclusion, requires an exact visible membership audience, excludes other groups, and emits source metadata without arbitrary Markdown content. The complete compact JSON output is byte-bounded and records are never truncated. Briefing reads do not consume attention cues or mutate any state. The resulting packet remains untrusted, context-only input to the host.
+
+Lifecycle hooks cover participating direct-write tools and common shell mutation forms. They also persist minimal heartbeat, promise, blocker, lease, and checkpoint state without storing transcripts, tool arguments, or tool output. For a leased self-starter session, all host tool events are resolved against the session automatically and must pass the exact capability check. Hooks remain defense in depth, not a shell parser, user authenticator, or operating-system sandbox. Encoded commands, custom tools outside the installed lifecycle, subprocesses, or programs outside the host can bypass them. Users should review plugin code, restrict tool access, protect credentials, use version control, and keep host approval controls enabled.
+
+The visible acceptance runner uses fictional identities and isolated temporary directories. Its SHA-256 receipts prove that bounded synthetic evidence passed a named gate; they are not signatures, user authentication, host trust, policy grants, or proof about a real deployment. The runner cannot approve executable components or create rights for an installed project. Fresh-install and upgrade tests use the same production hook adapter and require zero model-side MCP calls, exactly one MCP registration, exactly one hook set, source-hash preservation, and cleanup of staged state.
+
+Release workflows are tag-only and pin every external action to a full commit SHA. The build job can read repository content and mint short-lived OIDC attestations but cannot modify repository contents; the isolated publication job can write GitHub Release assets but cannot mint attestations. The local release gate rejects user-owned agent Markdown, generated AgentSpine state, tests, workflow internals, environment files, and key material from the npm tarball. GitHub attestations prove workflow provenance, not software correctness or authority. Consumers must still verify checksums, the repository identity, the expected tag, and the attestation.

package/agent-spine-plugin/assets/agentspine-banner.svg

@@ -1,32 +1,32 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="360" viewBox="0 0 1200 360" role="img" aria-labelledby="title desc">
-  <title id="title">AgentSpine</title>
-  <desc id="desc">A layered identity and memory spine for AI agents</desc>
-  <defs>
-    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
-      <stop stop-color="#07111f"/>
-      <stop offset="1" stop-color="#111c35"/>
-    </linearGradient>
-    <linearGradient id="line" x1="0" y1="0" x2="0" y2="1">
-      <stop stop-color="#67e8f9"/>
-      <stop offset=".52" stop-color="#8b5cf6"/>
-      <stop offset="1" stop-color="#f472b6"/>
-    </linearGradient>
-    <filter id="glow"><feGaussianBlur stdDeviation="7" result="b"/><feMerge><feMergeNode in="b"/><feMergeNode in="SourceGraphic"/></feMerge></filter>
-  </defs>
-  <rect width="1200" height="360" rx="30" fill="url(#bg)"/>
-  <g opacity=".13" stroke="#9cc8ff"><path d="M0 64h1200M0 128h1200M0 192h1200M0 256h1200M0 320h1200"/><path d="M96 0v360M192 0v360M288 0v360M384 0v360M480 0v360M576 0v360M672 0v360M768 0v360M864 0v360M960 0v360M1056 0v360"/></g>
-  <g transform="translate(116 42)" filter="url(#glow)">
-    <path d="M74 14c-26 24-26 48 0 72s26 48 0 72-26 48 0 72 26 48 0 72" fill="none" stroke="url(#line)" stroke-width="12" stroke-linecap="round"/>
-    <path d="M74 14c26 24 26 48 0 72s-26 48 0 72 26 48 0 72-26 48 0 72" fill="none" stroke="#eef7ff" stroke-opacity=".68" stroke-width="5" stroke-linecap="round"/>
-    <g fill="#07111f" stroke="#baf5ff" stroke-width="4"><circle cx="74" cy="14" r="10"/><circle cx="74" cy="86" r="10"/><circle cx="74" cy="158" r="10"/><circle cx="74" cy="230" r="10"/><circle cx="74" cy="302" r="10"/></g>
-  </g>
-  <g fill="#f8fbff" font-family="Inter,Segoe UI,Arial,sans-serif">
-    <text x="286" y="139" font-size="76" font-weight="750" letter-spacing="-3">AgentSpine</text>
-    <text x="290" y="194" font-size="26" fill="#b9c9e5">Identity that persists. Memory that stays grounded.</text>
-    <g transform="translate(290 238)" font-size="16" font-weight="600">
-      <rect width="150" height="38" rx="19" fill="#67e8f9" fill-opacity=".13" stroke="#67e8f9" stroke-opacity=".5"/><text x="75" y="25" text-anchor="middle" fill="#9af2fb">NON-DESTRUCTIVE</text>
-      <rect x="166" width="112" height="38" rx="19" fill="#8b5cf6" fill-opacity=".15" stroke="#a78bfa" stroke-opacity=".55"/><text x="222" y="25" text-anchor="middle" fill="#c4b5fd">LOCAL-FIRST</text>
-      <rect x="294" width="136" height="38" rx="19" fill="#f472b6" fill-opacity=".13" stroke="#f9a8d4" stroke-opacity=".5"/><text x="362" y="25" text-anchor="middle" fill="#fbcfe8">HOST-NEUTRAL</text>
-    </g>
-  </g>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="360" viewBox="0 0 1200 360" role="img" aria-labelledby="title desc">
+  <title id="title">AgentSpine</title>
+  <desc id="desc">A layered identity and memory spine for AI agents</desc>
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+      <stop stop-color="#07111f"/>
+      <stop offset="1" stop-color="#111c35"/>
+    </linearGradient>
+    <linearGradient id="line" x1="0" y1="0" x2="0" y2="1">
+      <stop stop-color="#67e8f9"/>
+      <stop offset=".52" stop-color="#8b5cf6"/>
+      <stop offset="1" stop-color="#f472b6"/>
+    </linearGradient>
+    <filter id="glow"><feGaussianBlur stdDeviation="7" result="b"/><feMerge><feMergeNode in="b"/><feMergeNode in="SourceGraphic"/></feMerge></filter>
+  </defs>
+  <rect width="1200" height="360" rx="30" fill="url(#bg)"/>
+  <g opacity=".13" stroke="#9cc8ff"><path d="M0 64h1200M0 128h1200M0 192h1200M0 256h1200M0 320h1200"/><path d="M96 0v360M192 0v360M288 0v360M384 0v360M480 0v360M576 0v360M672 0v360M768 0v360M864 0v360M960 0v360M1056 0v360"/></g>
+  <g transform="translate(116 42)" filter="url(#glow)">
+    <path d="M74 14c-26 24-26 48 0 72s26 48 0 72-26 48 0 72 26 48 0 72" fill="none" stroke="url(#line)" stroke-width="12" stroke-linecap="round"/>
+    <path d="M74 14c26 24 26 48 0 72s-26 48 0 72 26 48 0 72-26 48 0 72" fill="none" stroke="#eef7ff" stroke-opacity=".68" stroke-width="5" stroke-linecap="round"/>
+    <g fill="#07111f" stroke="#baf5ff" stroke-width="4"><circle cx="74" cy="14" r="10"/><circle cx="74" cy="86" r="10"/><circle cx="74" cy="158" r="10"/><circle cx="74" cy="230" r="10"/><circle cx="74" cy="302" r="10"/></g>
+  </g>
+  <g fill="#f8fbff" font-family="Inter,Segoe UI,Arial,sans-serif">
+    <text x="286" y="139" font-size="76" font-weight="750" letter-spacing="-3">AgentSpine</text>
+    <text x="290" y="194" font-size="26" fill="#b9c9e5">Identity that persists. Memory that stays grounded.</text>
+    <g transform="translate(290 238)" font-size="16" font-weight="600">
+      <rect width="150" height="38" rx="19" fill="#67e8f9" fill-opacity=".13" stroke="#67e8f9" stroke-opacity=".5"/><text x="75" y="25" text-anchor="middle" fill="#9af2fb">NON-DESTRUCTIVE</text>
+      <rect x="166" width="112" height="38" rx="19" fill="#8b5cf6" fill-opacity=".15" stroke="#a78bfa" stroke-opacity=".55"/><text x="222" y="25" text-anchor="middle" fill="#c4b5fd">LOCAL-FIRST</text>
+      <rect x="294" width="136" height="38" rx="19" fill="#f472b6" fill-opacity=".13" stroke="#f9a8d4" stroke-opacity=".5"/><text x="362" y="25" text-anchor="middle" fill="#fbcfe8">HOST-NEUTRAL</text>
+    </g>
+  </g>
+</svg>

package/agent-spine-plugin/bin/agentspine-mcp.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
-import { startMcpServer } from "../src/mcp.js";
-
-startMcpServer();
+#!/usr/bin/env node
+import { startMcpServer } from "../src/mcp.js";
+
+startMcpServer();

package/agent-spine-plugin/bin/agentspine.js

@@ -1,7 +1,7 @@
-#!/usr/bin/env node
-import { run } from "../src/cli.js";
-
-run().catch((error) => {
-  process.stderr.write(`AgentSpine: ${error.message}\n`);
-  process.exitCode = 1;
-});
+#!/usr/bin/env node
+import { run } from "../src/cli.js";
+
+run().catch((error) => {
+  process.stderr.write(`AgentSpine: ${error.message}\n`);
+  process.exitCode = 1;
+});