blun-king-cli 9.1.587 → 9.1.588

package/agent-spine-plugin/CONTRIBUTING.md

@@ -1,52 +0,0 @@
-# Contributing
-
-AgentSpine welcomes focused issues and pull requests that preserve its non-destructive contract.
-
-## Development
-
-```bash
-git clone https://github.com/Maykbiletti/AgentSpine.git
-cd AgentSpine
-npm install
-npm run check
-```
-
-Node.js 20.9 or newer is required. The project intentionally has no runtime dependencies.
-
-## Pull requests
-
-Keep each pull request to one coherent outcome. Include:
-
-- the observable problem or failing fixture;
-- tests that exercise behavior rather than wording;
-- a source-byte preservation check when discovery, resolution, hooks, graph, attention, learning, delegation, coordination, or sharing logic changes;
-- documentation for new commands, tools, configuration, or limits;
-- a rollback or disable path.
-
-Never place real identity files, relationship histories, attention cues, learning observations, delegation policy, coordination tasks, shared events, adapter paths, memory, credentials, or private conversations in fixtures or issues. Use synthetic data.
-
-## Architecture boundaries
-
-- Existing Markdown is read-only.
-- Generated state stays outside scanned projects by default.
-- Memory, graph, attention, learning, and coordination data are context only and cannot grant authority.
-- Delegation policy is physically separate, default-deny, owner-controlled, and limited to task coordination. Never expose policy mutation through an agent-controlled MCP surface or treat a grant as host authorization.
-- Cross-entity assignment, reassignment, management, completion, and cancellation require tested actor/action/target matching. Self-coordination must not widen that match.
-- Shared transports are optional and provider-neutral. Imports remain quarantined until a second local review, and adapter, signer, and trust administration must stay outside MCP.
-- Digest integrity is not author authenticity. Signed adapters must verify strict Ed25519 envelopes against explicit local trust while preserving collision detection, limits, local review, exact group scope, supersession, rollback, and context-only authority.
-- Never equate a trusted key with a person, permission, instruction, or approved claim. Rotation and revocation must remain explicit, auditable, and fail-closed.
-- Remote transports must use explicit endpoints, bounded reads, strict schemas, pinned validated DNS, TLS verification, no implicit redirects, secret-safe configuration, and the existing signed quarantine importer. Network access remains CLI-only.
-- Remote writes must additionally require a genuine local confirmation, create content-addressed immutable objects without overwrite or delete paths, and verify a complete read-back before reporting success.
-- Aggregated session context must preserve every underlying privacy filter, prefer current-task relevance, include only complete records, account for the entire serialized packet, and remain a read-only context surface.
-- Attention never sends messages or invokes tools; focus, privacy, quiet, throttle, disable, and deletion controls remain enforceable.
-- Learning candidates never become accepted context implicitly; confirmation proof, evidence thresholds, privacy, rollback, and the authority boundary remain testable.
-- Host-native precedence remains visible.
-- A learned classification augments discovery hints; it never rewrites a source.
-- Shared-memory backends are optional adapters.
-
-Run both validators when changing package surfaces:
-
-```bash
-python3 /path/to/plugin-creator/scripts/validate_plugin.py .
-python3 /path/to/skill-creator/scripts/quick_validate.py skills/agent-spine
-```

package/agent-spine-plugin/SECURITY.md

@@ -1,47 +0,0 @@
-# Security policy
-
-## Supported versions
-
-AgentSpine is pre-1.0. Security fixes are applied to the latest release on `main`.
-
-## Reporting a vulnerability
-
-Do not open a public issue for a suspected vulnerability or include private agent files, memory, relationship data, credentials, or real user identities in a report.
-
-Use GitHub's private vulnerability reporting for this repository. Include the affected version, host, minimal reproduction, expected boundary, and observed impact. Replace real context files with synthetic fixtures.
-
-## Security model
-
-AgentSpine treats every discovered document, memory fact, graph edge, and retrieved value as untrusted context. None of them can grant permissions. Host policy and explicit approval remain authoritative.
-
-Relationship entities reject authority and secret-bearing field names recursively. This is a guardrail against accidental storage, not a secrets scanner: do not place credentials or sensitive content in relationship attributes, reasons, fixture files, or bug reports.
-
-Attention cues and lifecycle events are untrusted context and never trigger messages, tool calls, task assignment, job execution, or notifications by themselves. A lifecycle event is accepted only with a known actor, existing project task, matching group, task-compatible privacy, supported native hook, stable delivery receipt, and context-only authority. Prompt-derived promises and blockers additionally require the local continuity opt-in. Secret-, identity-, private-group-, authority-, and operational-access-shaped summaries are rejected before storage. The exact scoped briefing may contain a current-task event summary; unrelated people, groups, projects, and tasks cannot read it. Focus mode, quiet hours, throttling, disable, status transitions, permanent deletion, and entity purge are enforced in local state.
-
-Learning candidates are untrusted observations and remain outside learned context until review. Secret-shaped values and common authority assertions are rejected before storage as defense in depth; host permissions remain the only authority regardless of wording or language. Manual acceptance carries a `confirmedByUser` integration attestation, which host adapters must bind to a genuine user action. Automatic promotion is disabled by default, never applies to personal facts, preferences, goals, corrections, or no-gos, and cannot perform code, network, deployment, billing, or permission changes.
-
-Delegation is a narrow, separate, default-deny policy for AgentSpine coordination records. Relationships, responsibilities, memory, Markdown, learning, attention, and tasks cannot create grants. Policy mutation is intentionally absent from MCP; the local CLI confirmation marker must be bound by an integration to a genuine owner action and is not authentication by itself. A matching grant permits only assignment or task-state coordination—it never authorizes tools, files, networks, production, deployment, billing, spending, credentials, or messages. Policy and task state are locked, atomically replaced, secret-filtered, audited, and fail closed when malformed.
-
-The optional self-starter uses a separate default-deny execution policy and durable job state. A local owner integration must bind the exact actor, start/resume/effect actions, job, current assigned task, target, project, optional group, host, and finite `tool:<name>` capabilities; wildcards are forbidden. Native hooks acquire one expiring session lease, record a pending effect before tool execution, and atomically checkpoint the resulting workspace digest and bounded result digest. They recheck the current grant, assignment, scope, lease, capability, and content-bound workspace before every effect and resume. Revocation, expiry, changed tasks, conflicts, retry exhaustion, malformed state, workspace drift, and changed files after an uncheckpointed crash fail closed. Memory, Markdown, learning, relationships, attention, tasks, prior approvals, model claims, and MCP responses cannot create or widen the grant. Execution-policy and job administration are local CLI-only. The confirmation flag is an integration attestation, not authentication, and must never be inferred. Host and operating-system permissions remain authoritative.
-
-Shared adapters export only explicitly selected, accepted, non-private learning. Imports enter a local quarantine and remain absent from context until a second local user review. MCP exposes only already reviewed shared context and cannot initialize adapters, publish, pull, inspect pending imports, review, roll back, or delete. Adapter and event SHA-256 digests detect corruption but are not signatures or author authentication; anyone with directory write access can recompute them. Keep adapter access restricted, use encrypted transport where needed, and treat every event as untrusted until local review. Shared memory never carries delegation policy, tasks, source files, evidence text, credentials, or host authority.
-
-Optional signed adapters wrap manifests and events in Ed25519 envelopes. Private keys remain under the installation state directory with owner-only mode where the platform exposes POSIX permissions; they never enter projects, adapters, MCP, hooks, logs, or command output. Public identities are trusted per receiving project through an explicit local CLI action. Pull verifies the manifest signer and every event signer before writing quarantine state, and the audit replays retained event signatures against the stored public identity. Unknown, revoked, swapped, malformed, or mismatched keys fail closed. A signature authenticates the holder of a configured key—it does not establish a real-world identity, approve the claim, grant delegation, or replace the receiving user's review. Key distribution, device security, encrypted transport, and real-world identity verification remain deployment responsibilities.
-
-The optional HTTPS snapshot transport accepts only an explicit TLS URL and signed immutable snapshots. Public mode rejects private, loopback, link-local, reserved, multicast, and documentation address ranges, validates every DNS answer, and pins the actual connection to a vetted address. Redirects, compression, embedded URL credentials, query strings, ambiguous directory URLs, non-JSON responses, oversized bodies, unsigned documents, and mixed or untrusted signers fail before local quarantine mutation. Private-network access requires explicit local confirmation. Optional bearer credentials come only from a named environment variable and are never returned, persisted, exposed through MCP, or added to hooks. HTTPS protects transit, not snapshot storage; server authorization, retention, logging, certificate operations, and endpoint availability remain deployment responsibilities.
-
-The immutable HTTPS object transport adds network writes only to the local CLI. Every publish requires explicit local owner confirmation, derives a content-addressed object URL, sends `If-None-Match: *`, accepts only create or precondition-failed outcomes, and performs a hardened signed read-back before reporting success. There is no overwrite, deletion, listing, mutable pointer, endpoint state, token state, MCP tool, or hook action. A service must enforce atomic create-only semantics and independently authenticate writers; the request digest header is not authorization. A `412` is considered idempotent only when read-back verifies the exact intended snapshot. Upload status, TLS, bearer authentication, digest equality, and signatures still create no rights or content approval.
-
-The optional mutable feed adds one deliberately constrained overwrite surface above immutable objects. Its entire bounded reference window is Ed25519-signed, updates require a strong previously observed ETag, and a `412` is exposed as a concurrency conflict. Receivers pin the feed ID, scope, adapter, signer identity, last sequence, entry digest, and snapshot digest in external local state while retaining prior receipts. Rollback, same-sequence equivocation, signer replacement, broken chains, and a window that no longer contains the locally observed tip fail closed before snapshot import. Corrupt receipt state is reported by the audit and never replaced automatically. Feed pulls still import only into quarantine. Feed state and remote authentication are context-only and cannot grant rights. Endpoint, token, publish, pull, and reset capabilities remain absent from MCP and hooks.
-
-The optional peer transport executes one owner-selected local program, which is a privileged operation independent of AgentSpine's content checks. Both serving and carrier execution require explicit local confirmation. AgentSpine passes a bounded executable/argument array directly with the shell disabled and a minimal environment that omits unrelated application secrets, bounds and discards stderr, enforces time and frame limits, and opens no listener. A fresh 256-bit challenge is bound by an Ed25519 response whose key must match the snapshot manifest and local trust. This prevents captured-response replay but does not sandbox a malicious chosen executable or carrier; operators must verify and constrain it using operating-system and SSH controls. Valid responses still enter quarantine, grant no rights, and require local content review. Peer controls remain absent from MCP and hooks.
-
-The optional local SQLite transport stores signed snapshots only in an owner-selected regular file outside the scanned project. Initialization and publication require explicit local confirmation; inspection and pull validate the exact schema, SQLite integrity result, immutable signed-manifest binding, all retained snapshots, the full revision hash chain, and its atomic head. Symbolic links, hard links, unexpected schema objects, malformed rows, oversized state, identity changes, tampering, and chain discontinuity fail closed. Extension loading is disabled, `trusted_schema` is off, and bound parameters carry values. File permissions, backups, encryption, copying, external rollback checkpoints, and filesystem availability remain operator responsibilities. A restored older but internally consistent database is not detectable without an external checkpoint. SQLite controls remain absent from MCP and hooks, imports still enter quarantine, and database state can never grant rights.
-
-Session briefing composes only existing privacy-filtered read models. It never reads pending learning or shared imports, delegation policy, assignment proof, credentials, adapter configuration, or signer material. Direct private context is explicit. Group context rejects private inclusion, requires an exact visible membership audience, excludes other groups, and emits source metadata without arbitrary Markdown content. The complete compact JSON output is byte-bounded and records are never truncated. Briefing reads do not consume attention cues or mutate any state. The resulting packet remains untrusted, context-only input to the host.
-
-Lifecycle hooks cover participating direct-write tools and common shell mutation forms. They also persist minimal heartbeat, promise, blocker, lease, and checkpoint state without storing transcripts, tool arguments, or tool output. For a leased self-starter session, all host tool events are resolved against the session automatically and must pass the exact capability check. Hooks remain defense in depth, not a shell parser, user authenticator, or operating-system sandbox. Encoded commands, custom tools outside the installed lifecycle, subprocesses, or programs outside the host can bypass them. Users should review plugin code, restrict tool access, protect credentials, use version control, and keep host approval controls enabled.
-
-The visible acceptance runner uses fictional identities and isolated temporary directories. Its SHA-256 receipts prove that bounded synthetic evidence passed a named gate; they are not signatures, user authentication, host trust, policy grants, or proof about a real deployment. The runner cannot approve executable components or create rights for an installed project. Fresh-install and upgrade tests use the same production hook adapter and require zero model-side MCP calls, exactly one MCP registration, exactly one hook set, source-hash preservation, and cleanup of staged state.
-
-Release workflows are tag-only and pin every external action to a full commit SHA. The build job can read repository content and mint short-lived OIDC attestations but cannot modify repository contents; the isolated publication job can write GitHub Release assets but cannot mint attestations. The local release gate rejects user-owned agent Markdown, generated AgentSpine state, tests, workflow internals, environment files, and key material from the npm tarball. GitHub attestations prove workflow provenance, not software correctness or authority. Consumers must still verify checksums, the repository identity, the expected tag, and the attestation.

package/agent-spine-plugin/docs/assignment-continuation.md

@@ -1,48 +0,0 @@
-# Assignment continuation and new-file preflight
-
-AgentSpine 0.72.3 distinguishes a host-explicit continuation from a new delivery.
-This is context-only bookkeeping, never authorization to write, use a tool or skip a test.
-
-## Host contract
-
-- A `UserPromptSubmit` without `assignment_id` / `assignmentId` starts a new assignment.
-- For a supplementary message belonging to the unfinished delivery, the host carries the exact active identifier returned by the preceding hook response. Both aliases, if supplied, must agree.
-- Host, session, project, entity, group and task must match, including absent fields. Goal, step, queue, attempt and plan digest must also match for a goal-bound delivery.
-- A continuation reads the current requirement under the assignment lock. It does not rotate the pointer, rewrite registrations, clear tests, close writes or create a replacement requirement.
-- A completed or consumed requirement cannot be continued. Starting another delivery still requires its own briefing, knowledge and premortem calls.
-- `PostCompact` and later tool hooks retain their existing behavior. Prompt text such as “continue” is never interpreted as a trusted assignment selector.
-
-The host must decide whether input is a new delivery or a supplement. Merely mentioning an identifier in chat or a skill is insufficient. Hosts that do not carry this structured field still create a new assignment on each prompt; this release does not claim they have native continuation support.
-
-Existing 0.72.2 records are not rewritten. Ordinary legacy assignment bindings remain readable. If an old goal assignment lacks the exact goal-binding metadata needed for explicit continuation, this selector cannot authorize that continuation; the existing goal lifecycle and its gates remain unchanged.
-
-## New files
-
-`delivery_knowledge_query` accepts a project-relative target that does not yet exist.
-It returns `state: "absent"`, `bytes: 0`, `sha256: null` and the nearest verified existing parent, rather than inventing a digest or creating the target. Each existing parent must be a regular directory, not a symlink, inside the canonical project boundary. Parents and absence are rechecked before returning.
-
-Existing regular files retain their byte count and SHA-256 snapshot. Symlinked targets or parents, path escapes, non-directory parents, permission errors and observed races fail the query and produce no successful knowledge receipt. Only `ENOENT` means absent. This is a point-in-time observation; native write authorization and subsequent verification still apply.
-
-## Reproducible evidence
-
-Run `node --test test/assignment-continuation.test.js test/assignment-continuation-boundaries.test.js test/delivery-target.test.js test/assignment-recovery.test.js`.
-
-The original 0.72.2 reader fails two positive assertions: a supplementary prompt changes the requirement despite an explicit assignment identifier; a new target fails its MCP query with `ENOENT`. The new reader keeps one obligation through multiple turns, a supplementary prompt after writing, compaction and a separate MCP process. The second assignment cannot close using the first write's test. In 0.72.4, the child artifact tests additionally clear inherited `NODE_TEST_CONTEXT` and require TAP evidence of an executed assertion. The original positive child exit alone could include a skipped recursive runner and was insufficient evidence that its assertion ran; see [the corrected evidence](structured-completion.md).
-
-Continuation adds no tree traversal. A nine-sample local comparison measured 6.91 ms median for fresh preparation and 2.42 ms for continuation before the final full regression; the test reports current measurements, not a universal latency promise. Crash recovery kills a process inside the state read and waits for the real 15-second lock lease; it never edits the lock timestamp or historical state to force recovery.
-
-CI run 143 exposed a Windows-only defect in the new fault-injection test: its literal forward-slash comparison did not match native paths, so the intended permission exception never occurred. The corrected probe uses native path joining and explicitly asserts both permission injection and parent replacement. No production protection or timeout was relaxed; the initial red CI is not counted as a successful validation.
-
-CI run 144 exposed a macOS cleanup race after an unsuccessful knowledge query. A deterministic MCP probe confirmed that an invalid target could produce its error response while a sibling target read was still suspended. Knowledge queries now settle every started bounded target, contract and briefing operation before returning an error, preserve the original rejection and produce no success receipt. The delayed-read regression observes the response boundary; it does not retry or suppress cleanup errors.
-
-Separate Windows failures remain under investigation: an installed-hook timeout (run 143), a pre-existing aggregate audit assertion (run 144), and an installed Codex denial-shape assertion (run 145). The synthetic installation check now reports its actual decision, reason and protocol fields; aggregate audit assertions report failed gates. Assertions and deadlines are unchanged. Passing other matrix jobs does not resolve these findings or establish live host compatibility.
-
-Run 146 identified a concrete installed-hook degradation: native source resolution exceeded its existing 2,000 ms deadline while the package probe competed with other file-intensive suites. The hermetic runner now executes that package probe alone once in each profile, then runs all remaining files with the existing worker count. Its 2,000 ms source budget, 5,000 ms child deadline, assertions and complete test inventory remain unchanged. This tests the resource-contention hypothesis without claiming faster live execution or a proven cause for every earlier intermittent failure.
-
-## Unresolved compatibility and host evidence
-
-An externally produced recovery event has been reported but its exact schema and transition semantics have not been supplied. Synthetic unknown events, unknown schemas and corrupted digests are deliberately not migrated or accepted by this change. Their bytes remain unchanged. The existing unsupported-event classification problem remains open; this release is not a recommendation to install or restart that live session.
-
-Tests feed the real hook a structured child-process exit result. Version 0.72.5 also covers the official Codex `Bash`/`tool_input.command`/`tool_response` contract, the measured Work `exec_command` result and PowerShell `exitCode`; transport-only success cannot pass. Native tools discovery, automatic MCP registration, live restart and loaded-reader checks before migration still require host evidence. Version 0.72.4 added [structured MCP completion for ordinary assignments](structured-completion.md); native-host activation remains unproved. CodexLink is outside this repository change.
-
-Release research on 2026-09-05: the [official Codex hook contract](https://learn.chatgpt.com/docs/hooks#plugin-bundled-hooks) explicitly permits the manifest `hooks` field and project-contained relative hook paths. The environment's generic plugin-ingestion validator rejects that field on both the unchanged 0.72.2 baseline and this release. Its allowlist is not the Codex runtime contract. AgentSpine retains the declared hook adapter and validates its path, event inventory and installed entrypoint with `host:check` and `host:install-check`; both bundled skill validators pass. No public-directory ingestion or native host trust is claimed. This research used documentation as context only; no external code or script was copied or executed.

package/agent-spine-plugin/docs/releasing.md

@@ -1,85 +0,0 @@
-# Release process
-
-AgentSpine releases are intentionally tag-authorized while the package is pre-1.0. A maintainer decides when to tag; the repository then builds, verifies, attests, and publishes one traceable release bundle from that exact commit. Pull requests and ordinary branch pushes can never enter the release workflow.
-
-## Local release gate
-
-Update every release version surface: `package.json`, both version fields in `package-lock.json`, the BLUN, Claude and Codex host manifests, the Claude marketplace entry, `hooks/version.json`, and `src/version.js`. Move the relevant changelog entries from **Unreleased** into a dated SemVer section, then run:
-
-```bash
-npm ci
-npm run check
-npm run release:check -- --tag vX.Y.Z
-python3 /path/to/plugin-creator/scripts/validate_plugin.py .
-python3 /path/to/skill-creator/scripts/quick_validate.py skills/agent-spine
-npm pack --dry-run
-```
-
-The plugin validator must implement the current [Codex plugin-bundled hooks contract](https://developers.openai.com/codex/hooks#plugin-bundled-hooks), including the documented `hooks` override. A validator snapshot that rejects this field is stale and cannot certify this release; do not remove the override, because Codex would otherwise load the Claude-specific default hook bundle.
-
-`release:check` fails unless:
-
-- all release version surfaces agree and the tag is exactly `v{package.version}`;
-- the changelog has a dated section for that version;
-- the Git worktree is clean;
-- npm reports SHA-512 integrity and a correctly versioned tarball;
-- every required Claude Code, Codex, MCP, CLI, source, skill, documentation, license, and changelog file is packaged;
-- no `.env`, key material, Git metadata, tests, workflow files, generated AgentSpine state, or user-owned `AGENTS.md`, `CLAUDE.md`, `SOUL.md`, or `MEMORY.md` enters the tarball;
-- the package remains within explicit file-count and unpacked-size ceilings.
-
-## Tag and automated release
-
-Only after the release commit is on a fully green `main`, create a signed or annotated tag and push it:
-
-```bash
-git tag -s vX.Y.Z -m "AgentSpine vX.Y.Z"
-git push origin vX.Y.Z
-```
-
-The tag workflow then:
-
-1. checks out the immutable tag with full history;
-2. proves the tagged commit is contained in `main`;
-3. installs only the lockfile dependency graph;
-4. repeats the complete test, audit, host, metadata, changelog, and package-boundary gates;
-5. creates the `.tgz`, a CycloneDX SBOM, and SHA-256 checksums;
-6. creates GitHub build-provenance and SBOM attestations through short-lived OIDC credentials;
-7. transfers the bundle through a named workflow artifact;
-8. gives only the final isolated job `contents: write` and creates the GitHub Release from the existing tag.
-
-Every external action is pinned to a full commit SHA. Dependabot watches those pins. The normal CI workflow has only `contents: read`; the build/attestation release job has `contents: read`, `id-token: write`, and `attestations: write`; only the asset-publication job has `contents: write`. No release job receives AgentSpine memory, signing keys, bearer values, npm tokens, or user source files.
-
-Protect the GitHub `release` environment with required reviewers if the repository plan supports it. Enable immutable releases and tag protection in repository settings where available. Workflow checks are defense in depth and do not replace repository rulesets.
-
-## Verify a downloaded release
-
-After downloading the tarball, SBOM, and `SHA256SUMS` from GitHub Releases:
-
-```bash
-sha256sum --check SHA256SUMS
-gh attestation verify agent-spine-X.Y.Z.tgz \
-  --repo Maykbiletti/AgentSpine
-```
-
-Inspect the package without installation:
-
-```bash
-npm pack --dry-run ./agent-spine-X.Y.Z.tgz
-```
-
-Then install the exact tarball in fresh Claude Code and Codex environments and repeat `agentspine doctor`, the MCP handshake, source scan, verification, and audit.
-
-## Optional npm publication
-
-The GitHub workflow deliberately does not publish to npm until ownership of the package name and the registry-side trust relationship are configured. When enabled, use npm Trusted Publishing bound to this repository, the exact release workflow filename, a GitHub-hosted runner, and a protected release environment. Keep OIDC provenance enabled and do not introduce a long-lived `NPM_TOKEN`.
-
-Authoritative references:
-
-- [GitHub artifact attestations](https://docs.github.com/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds)
-- [GitHub secure use reference](https://docs.github.com/actions/reference/security/secure-use)
-- [npm Trusted Publishing](https://docs.npmjs.com/trusted-publishers/)
-- [npm provenance statements](https://docs.npmjs.com/generating-provenance-statements/)
-
-## Rollback
-
-Never move, reuse, or delete an existing public version tag to hide a bad release. Publish a patch release that reverts the faulty behavior, retain the original checksums and attestations, and explain the affected versions. Uninstalling AgentSpine or deleting its external state must still leave every scanned project file untouched.

package/agent-spine-plugin/docs/structured-completion.md

@@ -1,67 +0,0 @@
-# Structured delivery completion
-
-Process assistance is advisory. Missing, consumed, late or unverified delivery
-receipts do not prevent authorized programming, analysis or ordinary replies.
-Do not reset evidence or repeat tests solely to dismiss a warning. The hook
-records mutation intent before allowing work and emits a bounded, deduplicated
-warning. An unverified Stop does not close a job or record successful learning.
-Access, protected-source, scope and effect-authorization checks remain enforced.
-`complete_delivery` still rejects invalid evidence; permitting a reply does not
-certify a successful delivery or grant publication authority.
-
-AgentSpine 0.72.4 adds `complete_delivery` for ordinary assignment-bound writing deliveries. Version 0.72.5 requires the actual test process result: structured exit code zero or the existing command-bound final marker. Transport success, a still-running process and prose output are not test evidence. An agent can store its three completed premortem checks through MCP and then give the user a normal summary. The operation does not execute a test, create host identity, authorize a write, consume the assignment or bypass Stop.
-
-## Call sequence
-
-1. Obtain the hook-issued assignment and requirement. Call `session_briefing`, `delivery_knowledge_query` and `record_delivery_premortem` before the first write.
-2. Make the changes through the host. Run a recognized test after the latest write. AgentSpine must have observed successful execution through the tool hook; a model-provided success flag is not evidence.
-3. Call `complete_delivery` with the exact root, requirement ID, complete binding, registered artifact digest, latest write digest and three checks. Use the returned identifiers, never identifiers copied from another delivery.
-4. Report the result normally. Stop independently rechecks observed tests, pending writes, scope, mandatory calls, closure integrity and the existing safety gates.
-
-The arguments have this shape; replace placeholders with actual bound values:
-
-```json
-{
-  "root": "/synthetic/project",
-  "requirementId": "<hook-issued requirement ID>",
-  "binding": {
-    "host": "codex",
-    "sessionId": "session:synthetic",
-    "projectId": "project:synthetic",
-    "assignmentId": "<hook-issued assignment ID>"
-  },
-  "artifactDigest": "<registered SHA-256>",
-  "lastWriteDigest": "<latest write SHA-256>",
-  "checks": [
-    { "category": "baseline-environment", "checkId": "<registered check ID>", "status": "PASS", "result": "Source comparison passed." },
-    { "category": "contract-tests", "checkId": "<registered check ID>", "status": "PASS", "result": "Observed artifact test passed." },
-    { "category": "delivery-path", "checkId": "<registered check ID>", "status": "PASS", "result": "Delivered tree matches the tested tree." }
-  ]
-}
-```
-
-Include established entity, group and task fields exactly. Results must be nonempty single-line text, at most 1,024 characters, without secret-shaped content. There must be one check per registered category. These descriptions are the agent's auditable account, not an independent measurement; the server separately requires observed successful post-write tests. Extra arguments such as `success` or a caller-supplied `testStateDigest` are rejected.
-
-## Preservation and concurrency
-
-The existing closure and event journal gain sealed `completionSource: "mcp"` and `testStateDigest` metadata capturing the observed verification state. Existing registrations, rejection receipts and previous-version records are not migrated or rewritten. Stop checks current evidence rather than trusting an old success forever.
-
-Identical retries return the stored closure. Changes to test evidence during the call cannot return successful completion. A later write invalidates the closure and requires fresh tests and its new write digest. A later failed or unverified test invalidates earlier successful verification. Changed check results conflict with an existing closure instead of overwriting history. Foreign bindings and consumed receipts cannot complete another assignment.
-
-The existing atomic replacement and owned lock protect storage. A regression terminates the real MCP process immediately before replacement, verifies unchanged state bytes, waits for the actual lock lease and retries through MCP. It never edits state or lock timestamps to recover.
-
-## Boundaries and measured evidence
-
-Goal- or queue-bound deliveries must use their existing checkpoint and outcome route. `complete_delivery` explicitly rejects them; goal protections are unchanged. The legacy five-line closure remains supported. Skill text does not register tools, and an isolated server test does not establish native Codex, Claude or Kimi compatibility.
-
-Run `node --test test/delivery-completion.test.js test/assignment-continuation.test.js test/delivery-verification.test.js test/mcp.test.js`.
-
-Before the MCP call, a normal Stop summary is allowed with unverified completion and an advisory. Afterwards the same summary can carry verified completion, including after a separate MCP process restart. Negative probes cover absent tests, later failed tests, new writes, foreign bindings, replay, malformed checks, secret-shaped values, concurrent calls and manipulated closure metadata: these never become valid evidence merely because the host can reply. Synthetic source bytes remain unchanged.
-
-Child tests clear inherited `NODE_TEST_CONTEXT` and require TAP evidence of one executed test and zero failures. An actual wrong artifact expectation must produce one failed test and exit 1. This corrects a 0.72.3 test-harness weakness: a recursive child test runner could skip its test while returning exit 0. Earlier positive exit status alone is not counted as proof that the artifact assertion ran.
-
-Version 0.72.5 exercises the official Codex `PostToolUse` fields (`Bash`, `tool_input.command`, `tool_response`), the measured Work `exec_command` result and PowerShell `exitCode`. This establishes the parser contract but not a live Otto restart or installed-reader migration. Native installation/update registration, loaded-reader compatibility, external recovery-event semantics and the live F79 task remain unverified. CodexLink and live session configuration are outside this change.
-
-CI 147's Windows aggregate audit failure was not reproduced by the diagnostic branch's ten passing matrix jobs. The assertion now reports failed gates without relaxing it or changing deadlines. Passing a later run does not establish that intermittent failure's cause.
-
-The first completion candidate exceeded the unchanged mandatory hook-context budget on long macOS and Windows paths. CI 150's diagnostic traced the apparent style rejection to that earlier preflight block. A synthetic 138-byte temporary-root probe reproduces the failure locally. Compact guidance retains every mandatory call, binding, check and legacy closure field, while the long-path Acceptance probe now passes without raising the injection limit or shortening user sources.

package/bin/abort-listener-policy.cjs

@@ -1,43 +0,0 @@
-'use strict';
-
-async function waitForAbortableCompletion(signal, work, onAbort) {
-  const listenerRegistered = !signal.aborted;
-  if (listenerRegistered) signal.addEventListener('abort', onAbort, { once: true });
-  else onAbort();
-  try {
-    return await work;
-  } finally {
-    if (listenerRegistered) signal.removeEventListener('abort', onAbort);
-  }
-}
-
-function createAbortOutcome(signal, outcome, isRelevant = () => true) {
-  let listener;
-  let listening = false;
-  const promise = new Promise((resolve) => {
-    if (signal === undefined) return;
-    const resolveIfRelevant = () => {
-      if (isRelevant()) resolve(outcome());
-    };
-    if (signal.aborted) {
-      resolveIfRelevant();
-      return;
-    }
-    listener = resolveIfRelevant;
-    listening = true;
-    signal.addEventListener('abort', listener, { once: true });
-  });
-  return {
-    promise,
-    cleanup() {
-      if (!listening) return;
-      listening = false;
-      signal.removeEventListener('abort', listener);
-    },
-  };
-}
-
-module.exports = {
-  createAbortOutcome,
-  waitForAbortableCompletion,
-};

package/bin/active-steer-priority-policy.cjs

@@ -1,24 +0,0 @@
-'use strict';
-
-const ACTIVE_STEER_INTERRUPT_CODE = 'BLUN_ACTIVE_STEER_INTERRUPT';
-const ACTIVE_STEER_PRIORITY_REMINDER = [
-  'A newer user steer is the highest-priority next action.',
-  'Act on it now with the available tools. Do not continue an idle prompt or ask for another task.',
-].join(' ');
-
-function createActiveSteerInterrupt() {
-  const error = new Error('Active model request superseded by a newer user steer');
-  error.code = ACTIVE_STEER_INTERRUPT_CODE;
-  return error;
-}
-
-function isActiveSteerInterrupt(error) {
-  return error?.code === ACTIVE_STEER_INTERRUPT_CODE;
-}
-
-module.exports = {
-  ACTIVE_STEER_INTERRUPT_CODE,
-  ACTIVE_STEER_PRIORITY_REMINDER,
-  createActiveSteerInterrupt,
-  isActiveSteerInterrupt,
-};