blun-king-cli 9.1.597 → 9.1.600

package/standard-skills/translate-native/SKILL.md

@@ -15,7 +15,7 @@ The MCP server injects this policy in its initialization response and exposes a
 
 Version 6.2 and later production hosts should use the isolated guard service and verify-before-send adapters. The service—not the agent or delivery process—owns the signing key. Candidate streaming must be buffered until the complete two-field envelope is verified, and a service outage must block without local-key fallback. Content-free audit records may contain hashes and finding codes, but never source text, target text, release tokens, service tokens, or model reasoning.
 
-For Claude Code, use the Version 6.3 authenticated loopback Streamable HTTP MCP together with the Version 6.64.0 `translate-native` plugin. The service survives client disconnects; the plugin injects mandatory session policy at `SessionStart` and repeats the exact release workflow for every child at `SubagentStart`. Require `Stop` and `SubagentStop` to consume a fresh service-signed one-time delivery grant bound to the canonical source and target hashes, exact language, task purpose, content policy, delivery channel, Claude session, service-authoritative current session-start epoch, agent identity, guard version, and current service boot. Accept Claude's documented `session_id` and optional `agent_id` only as non-empty, NUL-free strings; never coerce malformed hook identities into a grant namespace. Route `SubagentStop` through its dedicated hook mode, require its explicit `agent_id`, forbid `agent_id` on the main-thread `Stop` route, and reject a route/event mismatch before reading protected state so neither boundary can address the other's grant namespace. After an isolated-service restart, recover a missing session epoch only while authorizing a freshly verified release receipt; never recover during grant consumption or replace a different current epoch. Rotate the owner-only random epoch on every startup, resume, clear, compaction, fork, or `StopFailure` event; register its hash with the isolated service before writing the local marker, reject reused, missing, or unsafe epochs, and never allow a copied local grant record plus its old marker to authorize output. On `StopFailure`, remove the old local marker first, emit no error or candidate, keep other sessions isolated, and remain fail-closed until `SessionStart` if service registration or local replacement fails. On `SessionEnd`, remove the exact session's local epoch and grants first, then compare-and-swap only its still-current service epoch to an undisclosed tombstone within the cleanup budget; emit nothing, preserve parallel sessions, reject delayed retirement after a newer start, and require a fresh `SessionStart` before delivery can resume. Never let a subagent rely on the parent's grant or treat startup context as enforcement; the service-backed stop boundary remains authoritative. Persist only the source hash in hook state, never the complete translation source. Invalidate every unconsumed grant for the current session at `UserPromptSubmit`, before the new turn is processed, and again when `StopFailure` reports that the turn ended on an API error; never let a grant survive an interruption or failed turn into a later attempt, never emit the error or candidate from this cleanup, and never invalidate another labeled concurrent session. When `release_response` or `release_translation` fails at transport level, use `PostToolUseFailure` to invalidate the earlier grant for that exact session and agent before requesting a reconnect and fresh release. When the tool returns without a usable receipt, the isolated verifier rejects it, authorization becomes unavailable, or protected state cannot be replaced, invalidate the exact record both before the attempt and again on rejection so concurrent hooks cannot leave stale authority behind. Preserve unrelated agents and sessions, and block if protected state cannot be cleared. Discard structurally valid grant records created before Version 6.18 when they lack the session epoch required for safe resume isolation. Classify readable Morse runs of at least three separated valid letter codes using both dots and dashes, plus the exact bounded compact SOS prosign, as natural language; accept literal, HTML-encoded, standard typographic, punctuation-wrapped, and emoji-adjacent forms while retaining short decorative and incomplete-signal compatibility. Classify contiguous multi-symbol Unicode Roman numeral runs as natural language only when compatibility normalization cannot parse them as a non-increasing additive/subtractive Roman number; retain genuine numeric and isolated-symbol compatibility. Require Anthropic's documented `stop_hook_active` field to be an exact boolean on both `Stop` and `SubagentStop`; terminate malformed values with `continue: false` before reading or consuming any protected grant state. Give Claude one protected correction attempt after an invalid stop; if `stop_hook_active` is already true and the corrected answer is still unverified, terminate processing with `continue: false` instead of entering the client's finite block loop. A newly released exact answer may still pass during that correction attempt. Apply the same rule to `SubagentStop`. Keep the operating-system health monitor enabled so it proves an audit-free release/signature/tamper round trip, executes a real Swedish Unicode MCP tool call, checks the enrolled Claude plugin cache every minute, repairs one ordered dependency pass, applies persistent exponential backoff after repeated repair failures, and remains fail-closed during recovery. Never steal the shared maintenance lock from a live owner solely because it exceeds the stale-age threshold; bind new locks to the operating-system process-start identity so a reused numeric PID cannot preserve a crashed owner, recover only a confirmed dead, mismatched-generation, or untrusted old owner, preserve ambiguous and legacy live owners, and compare the exact file identity again before removing or releasing a lock. Never auto-install a missing plugin; enroll only an observed installation. Before executing candidate code, require the active repository to have a valid completely clean `HEAD`, including untracked paths; recheck the identical clean revision before fetch and again after fetch immediately before fast-forward, then require the exact tested revision and a clean checkout immediately after cutover and after post-update tests before any runtime activation. Never stash or delete local work; use only `reset --keep` to undo a cutover or post-test race with uncommitted concurrent changes, and never reset or automatically execute an independently advanced `HEAD`. Strictly validate the clean tested candidate before changing the active repository or either persistent runtime, refresh only the trusted marketplace, and require its publicly advertised version to equal the candidate version. Permit the cutover only after that preflight succeeds without changing the installed plugin cache; then apply the official user-scope plugin update and verify enabled state, load errors, and the exact installed version through Claude's public CLI. Remain degraded on every mismatch or process loss, preserve the active runtime when preflight fails, and require `/reload-plugins` or a new session before treating downloaded hooks as loaded. When signed-commit policy is enabled in the caller, active updater policy, or rollback-paused policy, combine those requirements monotonically and verify the exact update or rollback commit before test discovery or any other repository-owned code executes. Reject symbolic links, special files, oversized input, malformed JSON, and invalid stored updater field types fail-closed on every public updater path; write policy JSON only through unpredictable owner-only atomic temporary files. When enabling automatic updates again, preserve any active or rollback-paused signature requirement; lower it only through an explicit disable followed by a new enable. For emergency recovery, use only the installer's tested `rollback` command: it accepts the updater-recorded ancestor, requires the same completely clean exact `HEAD` after preflight and the clean exact target after cutover, after post-rollback tests, and again after runtime and Claude-cache probes before pausing updates, preserves uncommitted race-time bytes with `reset --keep`, never resets an independent commit, preserves signature policy, requires an already matching Claude cache, probes restarted runtimes, and pauses automatic updates after success. Portable receipt verification must only read an existing owner-only key; it must never create, replace, or repair signing state. An advertised tool list, heartbeat, successful tool call, or locally forged hook record alone is insufficient. Do not edit the text after release, reuse a prior grant, relabel a grant across source, locale, purpose, content policy, or session epoch, or fall back to an unguarded response when the HTTP MCP or isolated guard is unavailable.
+For Claude Code, use the Version 6.3 authenticated loopback Streamable HTTP MCP together with the Version 6.155.0 `translate-native` plugin. The service survives client disconnects; the plugin injects mandatory session policy at `SessionStart` and repeats the exact release workflow for every child at `SubagentStart`. Require `Stop` and `SubagentStop` to consume a fresh service-signed one-time delivery grant bound to the canonical source and target hashes, exact language, task purpose, content policy, delivery channel, Claude session, service-authoritative current session-start epoch, agent identity, guard version, and current service boot. Accept Claude's documented `session_id` and optional `agent_id` only as non-empty, NUL-free strings; never coerce malformed hook identities into a grant namespace. Route `SubagentStop` through its dedicated hook mode, require its explicit `agent_id`, forbid `agent_id` on the main-thread `Stop` route, and reject a route/event mismatch before reading protected state so neither boundary can address the other's grant namespace. After an isolated-service restart, recover a missing session epoch only while authorizing a freshly verified release receipt; never recover during grant consumption or replace a different current epoch. Rotate the owner-only random epoch on every startup, resume, clear, compaction, fork, or `StopFailure` event; register its hash with the isolated service before writing the local marker, reject reused, missing, or unsafe epochs, and never allow a copied local grant record plus its old marker to authorize output. On `StopFailure`, remove the old local marker first, emit no error or candidate, keep other sessions isolated, and remain fail-closed until `SessionStart` if service registration or local replacement fails. On `SessionEnd`, remove the exact session's local epoch and grants first, then compare-and-swap only its still-current service epoch to an undisclosed tombstone within the cleanup budget; emit nothing, preserve parallel sessions, reject delayed retirement after a newer start, and require a fresh `SessionStart` before delivery can resume. Never let a subagent rely on the parent's grant or treat startup context as enforcement; the service-backed stop boundary remains authoritative. Persist only the source hash in hook state, never the complete translation source. Invalidate every unconsumed grant for the current session at `UserPromptSubmit`, before the new turn is processed, and again when `StopFailure` reports that the turn ended on an API error; never let a grant survive an interruption or failed turn into a later attempt, never emit the error or candidate from this cleanup, and never invalidate another labeled concurrent session. When `release_response` or `release_translation` fails at transport level, use `PostToolUseFailure` to invalidate the earlier grant for that exact session and agent before requesting a reconnect and fresh release. When the tool returns without a usable receipt, the isolated verifier rejects it, authorization becomes unavailable, or protected state cannot be replaced, invalidate the exact record both before the attempt and again on rejection so concurrent hooks cannot leave stale authority behind. Preserve unrelated agents and sessions, and block if protected state cannot be cleared. Discard structurally valid grant records created before Version 6.18 when they lack the session epoch required for safe resume isolation. Classify readable Morse runs of at least three separated valid letter codes using both dots and dashes, plus the exact bounded compact SOS prosign, as natural language; accept literal, HTML-encoded, standard typographic, punctuation-wrapped, and emoji-adjacent forms while retaining short decorative and incomplete-signal compatibility. Classify contiguous multi-symbol Unicode Roman numeral runs as natural language only when compatibility normalization cannot parse them as a non-increasing additive/subtractive Roman number; retain genuine numeric and isolated-symbol compatibility. Require Anthropic's documented `stop_hook_active` field to be an exact boolean on both `Stop` and `SubagentStop`; terminate malformed values with `continue: false` before reading or consuming any protected grant state. Give Claude one protected correction attempt after an invalid stop; if `stop_hook_active` is already true and the corrected answer is still unverified, terminate processing with `continue: false` instead of entering the client's finite block loop. A newly released exact answer may still pass during that correction attempt. Apply the same rule to `SubagentStop`. Keep the operating-system health monitor enabled so it proves an audit-free release/signature/tamper round trip, executes a real Swedish Unicode MCP tool call, checks the enrolled Claude plugin cache every minute, repairs one ordered dependency pass, applies persistent exponential backoff after repeated repair failures, and remains fail-closed during recovery. Never steal the shared maintenance lock from a live owner solely because it exceeds the stale-age threshold; bind new locks to the operating-system process-start identity so a reused numeric PID cannot preserve a crashed owner, recover only a confirmed dead, mismatched-generation, or untrusted old owner, preserve ambiguous and legacy live owners, and compare the exact file identity again before removing or releasing a lock. Never auto-install a missing plugin; enroll only an observed installation. Before executing candidate code, require the active repository to have a valid completely clean `HEAD`, including untracked paths; recheck the identical clean revision before fetch and again after fetch immediately before fast-forward, then require the exact tested revision and a clean checkout immediately after cutover and after post-update tests before any runtime activation. Never stash or delete local work; use only `reset --keep` to undo a cutover or post-test race with uncommitted concurrent changes, and never reset or automatically execute an independently advanced `HEAD`. Strictly validate the clean tested candidate before changing the active repository or either persistent runtime, refresh only the trusted marketplace, and require its publicly advertised version to equal the candidate version. Permit the cutover only after that preflight succeeds without changing the installed plugin cache; then apply the official user-scope plugin update and verify enabled state, load errors, and the exact installed version through Claude's public CLI. Remain degraded on every mismatch or process loss, preserve the active runtime when preflight fails, and require `/reload-plugins` or a new session before treating downloaded hooks as loaded. When signed-commit policy is enabled in the caller, active updater policy, or rollback-paused policy, combine those requirements monotonically and verify the exact update or rollback commit before test discovery or any other repository-owned code executes. Reject symbolic links, special files, oversized input, malformed JSON, and invalid stored updater field types fail-closed on every public updater path; write policy JSON only through unpredictable owner-only atomic temporary files. When enabling automatic updates again, preserve any active or rollback-paused signature requirement; lower it only through an explicit disable followed by a new enable. For emergency recovery, use only the installer's tested `rollback` command: it accepts the updater-recorded ancestor, requires the same completely clean exact `HEAD` after preflight and the clean exact target after cutover, after post-rollback tests, and again after runtime and Claude-cache probes before pausing updates, preserves uncommitted race-time bytes with `reset --keep`, never resets an independent commit, preserves signature policy, requires an already matching Claude cache, probes restarted runtimes, and pauses automatic updates after success. Portable receipt verification must only read an existing owner-only key; it must never create, replace, or repair signing state. An advertised tool list, heartbeat, successful tool call, or locally forged hook record alone is insufficient. Do not edit the text after release, reuse a prior grant, relabel a grant across source, locale, purpose, content policy, or session epoch, or fall back to an unguarded response when the HTTP MCP or isolated guard is unavailable.
 
 For titles, meta descriptions, and UI strings, pass the exact `content_type`. A short result with insufficient deterministic evidence returns `REVIEW_REQUIRED`, not `PASS`. `short_text_reviewed` is compatibility metadata, not proof: the caller must never use it to override a finding, and the guard does not allow it to suppress measurable ASCII-folding pressure. Genuine independence requires a host-controlled gateway or reviewer outside the releasing agent's authority. The receipt binds the review flag and content type. Transport-only BOM and CRLF/LF differences are canonicalized; mojibake and character changes are never canonicalized away.
 

package/standard-skills/translate-native/VERSION

@@ -1 +1 @@
-6.64.0
+6.155.0