borgmcp 2.14.2 → 2.16.0

package/docs/EXTRACTION_PROVENANCE.md

@@ -22,7 +22,7 @@ The extraction copied the monorepo's `client/src/` production boundary and top-l
   recovery, `2.0.2`, `2.0.3`, `2.0.4`, `2.0.5`, and `2.0.6` successors were
   published and registry-verified. The immutable `2.0.7` workflow failed before
   package creation or npm publication. The `2.0.8`, `2.0.9`, `2.0.10`, `2.0.11`,
-  `2.1.0`, and `2.1.1` successors were published, and `2.2.0` was subsequently published, and `2.3.0` was subsequently published, and `2.4.0` was subsequently published, and `2.4.1` was subsequently published, and `2.5.0` was subsequently published, and `2.6.0` was subsequently published, and `2.6.1` was subsequently published, and `2.7.0` was subsequently published, and `2.7.1` was subsequently published, and `2.7.2` was subsequently published, and `2.7.3` was subsequently published, and `2.8.0` was subsequently published, and `2.9.0` was subsequently published, and `2.10.0` was subsequently published, and the immutable `2.10.1` release attempt failed before artifact creation or publication. The `2.10.2`, `2.11.0`, `2.12.1`, and `2.13.0` successors were published; the immutable `2.12.0` attempt failed before artifact creation or publication and was superseded by `2.12.1`. The current release identity is `2.14.2`. Extraction and
+  `2.1.0`, and `2.1.1` successors were published, and `2.2.0` was subsequently published, and `2.3.0` was subsequently published, and `2.4.0` was subsequently published, and `2.4.1` was subsequently published, and `2.5.0` was subsequently published, and `2.6.0` was subsequently published, and `2.6.1` was subsequently published, and `2.7.0` was subsequently published, and `2.7.1` was subsequently published, and `2.7.2` was subsequently published, and `2.7.3` was subsequently published, and `2.8.0` was subsequently published, and `2.9.0` was subsequently published, and `2.10.0` was subsequently published, and the immutable `2.10.1` release attempt failed before artifact creation or publication. The `2.10.2`, `2.11.0`, `2.12.1`, and `2.13.0` successors were published; the immutable `2.12.0` attempt failed before artifact creation or publication and was superseded by `2.12.1`. The current release identity is `2.16.0`. Extraction and
   versioning do not authorize publication.
 
 ## Review Holds
@@ -47,6 +47,6 @@ client `borgmcp@2.10.0` line. Its annotated tag object
 `sha512-lOxIPg3WcjSBte46iTM7SAFVN6Y0b2oizOKAJ9Q1EijBdOlmsh/cQlpUIaa8F2UJPaTDFsXy3M64gpGs6XgKzA==`
 in the `borgmcp-server-0.9.0-release` registry decision. That server and its
 client line pin historical `borgmcp-shared` version `0.8.1` and remain
-immutable. Client `borgmcp@2.14.1` is published. The immutable `v2.0.7`
-attempt failed before publication and remains preserved. The current release identity and publication gate remain governed by the reviewed `v2.14.2` source, a fresh annotated tag, and
+immutable. Client `borgmcp@2.15.0` is published. The immutable `v2.0.7`
+attempt failed before publication and remains preserved. The current release identity and publication gate remain governed by the reviewed `v2.16.0` source, a fresh annotated tag, and
 the exact-artifact and protected-publication gates.

package/docs/LOCAL_SERVER.md

@@ -65,6 +65,15 @@ the first owner record there, so bare `borg assimilate` can use it without an
 invitation prompt. Use `borg server invite` explicitly when another client or
 device needs a single-use invitation; its output is owned by the server.
 
+For an isolated verification or disposable local run, set `BORG_STATE_ROOT` to
+an absolute canonical directory path whose existing ancestors traverse no
+symlinks. On macOS, use the canonical `/private/tmp/...` spelling rather than
+the `/tmp/...` symlink. It replaces the effective home root for all
+Borg-owned state and agent configuration paths, including credentials, seats,
+worktrees, and hooks. Native agent registration commands also resolve their
+config roots under this directory. Harnesses that invoke a native agent should
+set `HOME` to the same directory so the agent itself uses the isolated config.
+
 Status reports only runtime evidence supplied by the server: running/stopped
 state, exact running artifact and immutable build identity when available,
 endpoint, process mode, and data-identity availability. If the running build
@@ -148,6 +157,20 @@ local opt-out for launch orientation messaging; setting it does not activate
 Borg tools or change server authorization. OpenCode has no launch-reminder
 surface.
 
+Each assimilated seat also receives a disposable scratch root at
+`~/.borg/scratch/<seat>/`. Borg pre-authorizes exactly the launched worktree and
+that seat's scratch root: Claude Code uses the worktree's
+`.claude/settings.local.json`, OpenCode uses the worktree's
+`.opencode/opencode.json`, and Codex receives native `--add-dir` flags at
+launch. Use the scratch root for detached review checkouts, clean-environment
+rigs, unpacked artifacts, and fake-home directories; nothing durable belongs
+there. For a rig, follow the named workspace, npm manifest-anchor, container
+label, listing, and teardown convention in
+[`docs/RELEASING.md`](RELEASING.md#clean-environment-rig-lifecycle) before
+delivering a verification result. Claude Code and Codex may also print a
+non-blocking reminder when a tool targets a path outside those two roots. The
+permission layer remains the enforcement mechanism.
+
 ## Updating Borg
 
 For an npm-global installation, use the whole-product command:

package/docs/RELEASING.md

@@ -4,220 +4,11 @@ The GitHub Actions workflow publishes one immutable, reviewed `borgmcp` version
 from a protected annotated tag. The protected publish job uses npm Trusted
 Publishing; no long-lived npm token is stored or exposed.
 
-## Immutable Release Evidence
-
-The existing lightweight `v2.0.0` tag points to
-`90a078264f4d61c0140ad0a30357a4df42c34ab0`. Immutable workflow run
-`29693915689` rejected it at annotated-tag verification and failed before package
-creation or npm publication; the publish job was skipped and
-`borgmcp@2.0.0` remains absent from npm. Never delete, move, replace, reuse, or
-rerun that tag or run.
-
-The annotated `v2.0.1` tag object
-`def12ee40af665fc6c3af4873a7d566b3f844fc1` peels to protected-main commit
-`b30fc54a4d73bda98db4630864cca796c8923dd9`. Workflow run `29748931957`
-successfully published that exact source as `borgmcp@2.0.1`; the registry records
-integrity
-`sha512-Ah8IY2izZ774gYLKthRL9lfrV+JBk2o9HSlrWUplyZgoGqwVjVboHNon0hWWF5i/fObiCGikFOMY6qZ+vaeyCw==`.
-Never move, replace, reuse, or rerun that tag or workflow. The next candidate
-must use a fresh unused identity and requires the complete release gate again.
-
-The annotated `v2.0.2` tag object
-`a1fc1f8f05c3f1b4d7ccbef86e244955642165b5` peels to protected-main commit
-`aced84956fdf41315904c8901e50a345f628152c`. Workflow run `29840120451`
-successfully published that exact source as `borgmcp@2.0.2`; the registry records
-integrity
-`sha512-w0O0t/2wzeJpXEqb4jQGuqZeavEkfFKdz6poRT8q1TxDKHTlOlwo3auctE+X1kWU2s5JkSDcUiUdQdyLwu84IA==`.
-Never move, replace, reuse, or rerun that tag or workflow. The next candidate
-must use a fresh unused identity and requires the complete release gate again.
-
-The annotated `v2.0.3` tag object
-`47701127cbdba6499595ef0529de264b00a61840` peels to protected-main commit
-`3e44e9c439c036850c6a9226d02876f4883501d9`. Workflow run `29851751102`
-successfully published that exact source as `borgmcp@2.0.3`; the registry records
-integrity
-`sha512-3Iy4BSB+yq8F75w/gWiEU7D+mKCYYa5mIsn/iC/byy5CK/QsAWg10KgsBI3GlDBZul1CD3Qq+zpmVeK2qpIE1A==`.
-Never move, replace, reuse, or rerun that tag or workflow. The next candidate
-must use a fresh unused identity and requires the complete release gate again.
-
-The annotated `v2.0.4` tag object
-`f86c5b81b77afa7ebd080b508831f1dc39c403e2` peels to protected-main commit
-`57a26139a11b47bc5f1d7234bc69e2a2a75954b3`. Workflow run `29925624599`, attempt 1,
-successfully published that exact source as `borgmcp@2.0.4`; the registry records integrity
-`sha512-xuGxMQ9FZTQN4KP/wGlJqI4LgxP2aKpeykbakjfXHPeUzmNHvkN0YtcenzlSvHsObnpQgMfsy7TNy+YrPkk65g==`.
-Never move, replace, reuse, or rerun that tag or workflow. The next candidate
-uses the unused `v2.0.5` identity from a fresh reviewed protected-main commit
-and requires the complete release gate again.
-
-The annotated `v2.0.5` tag object
-`242ed67fec00701f4eb332302e60dff84c0368f7` peels to protected-main commit
-`a18a169ec96c5e3194b3bd3edc9e84002c4bc7a3`. Workflow run `29955861508`, attempt 1,
-successfully published that exact source as `borgmcp@2.0.5`; the registry records integrity
-`sha512-pMqovKzUu0Mdru2YJULj3XkHSeiT/PuCAjwCQ2Sg/mmF299tZE80qvca6GCNCLjhYEWWIuXmssuxK7wePKqxdw==`.
-Never move, replace, reuse, or rerun that tag or workflow. The next candidate
-uses the unused `v2.0.6` identity from a fresh reviewed protected-main commit
-and requires the complete release gate again.
-
-The annotated `v2.0.6` tag object
-`b41d312efc9f8d1ed63021812d8165b00011e8d8` peels to protected-main commit
-`5fd9048e4c22e4478160e3a25654837b5a33d8bb`. Workflow run `29982288768`, attempt 1,
-successfully published that exact source as `borgmcp@2.0.6`; the registry records integrity
-`sha512-WDX4tmk46I6Tvb/Gz1XlD/9PbIgOe72rRDCjV+/lw6KnAxWW0S25LT1DgifotI9LQv7LLAok8WkjucDDTTQ+pw==`.
-Never move, replace, reuse, or rerun that tag or workflow.
-
-The annotated `v2.0.7` tag object
-`bf41d5a70d7df11930a3124feda72835ae903522` peels to protected-main commit
-`85f7c45cffdd449a6de4a52608453b6680492221`. Workflow run `30009042758`,
-attempt 1, received registry metadata HTTP 504 for
-`@esbuild/openbsd-arm64@0.28.1` and failed before package creation or npm
-publication. The publish and registry-verification jobs were skipped, and
-`borgmcp@2.0.7` remains absent from npm. Never delete, move, replace, reuse, or
-rerun that tag, version, or workflow. The next candidate uses the unused
-`v2.0.8` identity from a fresh reviewed protected-main commit and requires the
-complete release gate again.
-
-The annotated `v2.0.8` tag object
-`7b5a4929534abfa97a65e278df230adfdb842d8f` peels to protected-main commit
-`8bc796d8fc4e307dca593138fb080984662c7d62`. Workflow run `30012098601`, attempt 1,
-successfully published that exact source as `borgmcp@2.0.8`; the registry records integrity
-`sha512-az1IKG4VNwAF/8PKEVK88gdRoFFBqgtl6ObXX+CcJadavNqkwJ9UFeP8LOJ2js911mIiXEm8c4xDf6MnO0GOng==`.
-Never move, replace, reuse, or rerun that tag or workflow. Its successor used
-the fresh `v2.0.9` identity from a reviewed protected-main commit and passed the
-complete release gate.
-
-The annotated `v2.0.9` tag object
-`3a88bb4f46143789803a4e57f52b94d762f1ca9b` peels to protected-main commit
-`18084fc486a041f3438f584a97d218c01a5e0399`. Workflow run `30047299013`, attempt 1,
-successfully published that exact source as `borgmcp@2.0.9`; the registry records integrity
-`sha512-lf0TZ8ZcpHv/Nt3LkY/IGxkUFkg3weavF+rLv6xLImDDhLIaZly1y8jUdo3UuheQVhrLnLcxoz37Myr4mPx9lg==`.
-Never move, replace, reuse, or rerun that tag or workflow.
-
-The annotated `v2.0.10` tag object
-`31ae3c19ac4e04fac33269459a460d5316cce730` peels to protected-main commit
-`3f7003b65eadc74cd949857e831e1181a1aad2ff`. Workflow run `30063538271`, attempt 1,
-successfully published that exact source as `borgmcp@2.0.10`; the registry records integrity
-`sha512-BkFrq75mF7ih0/7Z7RsXsJYo43qNs4ng7tSnvcFCl3k6r+ex1FvTkah0+KQNinDSrv6a+HLWahUe8875so8zew==`.
-Never move, replace, reuse, or rerun that tag or workflow.
-
-The annotated `v2.0.11` tag object
-`fb95f4278137d1d7871d945c467eb33984abe1c4` peels to protected-main commit
-`0676d93d3e8a64ba583e95f164d122b39687b53a`. Workflow run `30073844074`, attempt 1,
-successfully published that exact source as `borgmcp@2.0.11`; the registry records integrity
-`sha512-429njJ7HVmWhpm8E71RoLzG57Qehy3RSxEzs6fQofVoOIiZXnK4QQDwbQe9MPfhKifbvVN5lGcDKtKAjuC76ww==`.
-Never move, replace, reuse, or rerun that tag or workflow.
-
-The annotated `v2.1.0` tag object
-`e0b189bb0dd1f1b12369ab81870113925e1afc41` peels to protected-main commit
-`10f18e4010c9c518c0ea2184d42ed5388642a53f`. Workflow run `30166498938`, attempt 1,
-successfully published that exact source as `borgmcp@2.1.0`; the same-run artifact report records integrity
-`sha512-Gm9n69y3C0feNDYRPEOnShLCscQJ/BoylcRMH+sDDQJmdcbjY8+U6dDTcFv3w+uH5P/IVwJydB8TGRHPXL0FQA==`.
-Never move, replace, reuse, or rerun that tag or workflow.
-
-The annotated `v2.1.1` tag object
-`aa8d772c4791b2da16d702d5d78e5b3c365796c4` peels to protected-main commit
-`db0a6a76744928e0067eb03b8a236076c56ae758`. Workflow run `30174878044`, attempt 1,
-successfully published that exact source as `borgmcp@2.1.1`; the same-run artifact report records integrity
-`sha512-nZJ3i6LBIj/4743mqVRJTUH3YGmC8HfC/NuQb7eOv+/K/dyBogDnwZ3opiZiZSe4LE5CXuG72Sip7cPRoCoZrA==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.2.0` tag object
-`edf12fcd4c56eb0ad59917269aaeee223b36bd53` peels to protected-main commit
-`db4f374e88c24dadee47d5400537890cad1e5f40`. Workflow run `30195666955`, attempt 1,
-successfully published that exact source as `borgmcp@2.2.0`; the same-run artifact report records integrity
-`sha512-Pi3rpQH6f+V67OPoRIwyKjOFrCJ5y/39knCayExBmnMC5Urb8m+m9UQVNV7cWMuhd3S3WMM6JOkgcIYOVhWnxg==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.3.0` tag object
-`24b1f8622a0a0b542dbac26c70662f5b499d3426` peels to protected-main commit
-`9e708b7233486abdcd7fbc893a2d5bc818241d87`. Workflow run `30218208664`, attempt 1,
-successfully published that exact source as `borgmcp@2.3.0`; the same-run artifact report records integrity
-`sha512-xyiyC/HXvWnSiii621WdA4qBKehmBzZSaLGN6PZvf82FQUqVONrRyhl1SmOLzPlPXX9boNKSA1EuaVJrtUv6zA==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.4.0` tag object
-`55458a1c38a670d3e15f8b19909afea195a146ce` peels to protected-main commit
-`3882c22d7e8eca34a2213a4e2e4b1bf10dce8fe3`. Workflow run `30246632666`, attempt 1,
-successfully published that exact source as `borgmcp@2.4.0`; the same-run artifact report records integrity
-`sha512-dQ4jXxmubhtXhIxObTegYYMrgPVk2mZXNHFfV4MRwRWKr1TpQ4xXdmp3Qb89vOOOORvZlux6GNNS5kjy3wDvZw==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.4.1` tag object
-`1e42aac25fc5368f16334a1eb48ffd0524a3fe7f` peels to protected-main commit
-`6b3b5d3c2c008888e55dd88485dafcb623ef9e17`. Workflow run `30282532108`, attempt 1,
-successfully published that exact source as `borgmcp@2.4.1`; the same-run artifact report records integrity
-`sha512-/tMVjZYqXQrZNPoZHjhpaS02e4Qju752sV+BLf9ML7yFmIf6DhzfItj9hDj/3+ORm6GK3aS4Fz4JmiWDxworZg==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.5.0` tag object
-`23132a4d71d42f59fd08bab66f0fe3da0114a15a` peels to protected-main commit
-`771dd6e78e26744180b2470374790d0e91aad7d7`. Workflow run `30349154152`, attempt 1,
-successfully published that exact source as `borgmcp@2.5.0`; the same-run artifact report records integrity
-`sha512-BQ5vxtmxqD9V+dmPuGQaog8Ip+K+hbnCxmjZt0zX2v354x7gUZtIt5zmP3HTNe4A5rmO9sp4qvv7XA4gcAGNrg==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.6.0` tag object
-`c8598e1a1852a3690f53f7089a8342b53e2191da` peels to protected-main commit
-`ef90006de0005e2fe2b35d36907a4656352e4abf`. Workflow run `30421261350`, attempt 1,
-successfully published that exact source as `borgmcp@2.6.0`; the same-run artifact report records integrity
-`sha512-KvJ5kuyMXH6Vd9tImV0zvXWhSj2Y68r09mAO3TqhsGAQM2XERcBPeEmrdp6VI1Z3KYMPjdg0bRvRW7CGonFl9w==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.6.1` tag object
-`e65b9d43c4a5a7c12a4fafc6e3f1024f6d99c023` peels to protected-main commit
-`902847186f5c4fc00f3610ee027e8f929b977670`. Workflow run `30427148267`, attempt 1,
-successfully published that exact source as `borgmcp@2.6.1`; the same-run artifact report records integrity
-`sha512-N0NIsD2D39d98vvjMkcFwMSn/UXHuHMdMTcuk3awfo6t5FHyd7BYhBsQXhpDuvdJK/02S8g0OdvfHUb827siYQ==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.7.0` tag object
-`a9a7f75114548b6c383168164f0f59bb05c02b85` peels to protected-main commit
-`a8d3c572dee3b90cf2a898768c45a1f46270fe11`. Workflow run `30440435955`, attempt 1,
-successfully published that exact source as `borgmcp@2.7.0`; the same-run artifact report records integrity
-`sha512-qn7ljuq/UwYzQJ5pWliLqD7Q5mlwk287ObOXbSV5FOcs+JdoXjFlb9NVC6bFoQzjHaWixCX600EAEtRZ0UeNPw==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.7.1` tag object
-`fc308b52393edf0ed8299490980207840a69c157` peels to protected-main commit
-`41091978bfe02831863de26e75fdf3bb48d4b038`. Workflow run `30463299198`, attempt 1,
-successfully published that exact source as `borgmcp@2.7.1`; the same-run artifact report records integrity
-`sha512-hgxKTCAocbTsBV/YHIegn/jlG9a9YwdbOHD3s5mL+CsN61/5m180rvGJ8+RlNRd5Sdk408phc+QW2Li46tmTMg==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.7.2` tag object
-`0b16c38da15090a49b285e687fae45381f0f6812` peels to protected-main commit
-`52b8a54565f548560dd674d689e0b841e2d8590d`. Workflow run `30491774435`, attempt 1,
-successfully published that exact source as `borgmcp@2.7.2`; the same-run artifact report records integrity
-`sha512-j/OKr5FzhnDbnLn4pNadbi6XQwR6hcmlfSQHuDsy696KYroL1UagIzelpLJXR+uR/T6FKbD2Zdphr/s81l1Rfw==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.7.3` tag object
-`b084eb3d2177fc93aa87ca58efde402542b90b8f` peels to protected-main commit
-`83fadd1b308f2b770ce0d8da6a3b61183ec94f8d`. Workflow run `30618377765`, attempt 1,
-successfully published that exact source as `borgmcp@2.7.3`; the same-run artifact report records integrity
-`sha512-Jb+Kg/+H3cPU34JX7eFV3gEO/PzdfJEruNU1mJwYlQZKG7TMfrLJzwghDzxmlMupHJHL3rzAVZ224wioM/pclg==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.8.0` tag object
-`576e2401a83537662ef0d5f7b0d03d6101b15c54` peels to protected-main commit
-`ad40e93ee9b1ff2801119c1c763ad526974ae2a6`. Workflow run `30639790368`, attempt 1,
-successfully published that exact source as `borgmcp@2.8.0`; the same-run artifact report records integrity
-`sha512-hKNyWwVg/8WJ/qcqaNjZVylMw2UzgFEhE7sAJmWy/BjNU4lEa6ox8N7SdbEt8hhKsySMxt+YTFbNFitRtf9u3g==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.9.0` tag object
-`26df119da33e914f857f820e68df6e887afed949` peels to protected-main commit
-`895f12065c09ec5c0a35f770f26ec89f36f2feaa`. Workflow run `30695501563`, attempt 1,
-successfully published that exact source as `borgmcp@2.9.0`; the same-run artifact report records integrity
-`sha512-e10KK//zAP6xRDtUjCrLqzVyeX5zd/39JD4LksBhNVL0ZIGthu5ZLahPMrcCjGl6lZQHNTCo8Tez5c1jmThgGQ==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.10.0` tag object
-`83bd13fe9943c980760db6ecdbcef0d8c413cee0` peels to protected-main commit
-`c5d3d2cbe85644d402dfd82ce108dceca3a913a1`. Workflow run `30764262636`, attempt 1,
-successfully published that exact source as `borgmcp@2.10.0`; the same-run artifact report records integrity
-`sha512-YUVxWevAToQYwu/MDV2r9TrKnaZxpYiEitmLtr7OekfyE0+XZnkyHmL1gSk04JAiYquzv6ZyTRDYMnjQzS5GxA==`.
-Never move, replace, reuse, or rerun that tag or workflow. FAILED-SUPERSEDED release record: The annotated `v2.10.1` tag object
-`afee30802629d0f838b2446efd2241ff01964af2` peels to protected-main commit
-`fcecd75211107994ccd0df0bf4093240f83de9b2`. Workflow run `30766475027`, attempt 1, concluded `failure`
-during verification before artifact creation or publication. Verify job `91545993819` records the release
-artifact build, verification, exercise, and upload steps as skipped; publish job `91546125556` was skipped.
-Registry verification found no published `borgmcp@2.10.1` package, so no published npm artifact or SRI
-exists for that version as of this check.
-Never delete, move, replace, reuse, or rerun that tag, version, or workflow. The annotated `v2.10.2` tag object
-`3655b212c12617aa08cf76747a3b65a73b78e5cc` peels to protected-main commit
-`bb8ff57162efdc777bb92f5e1f9d31aaf293d3c6`. Workflow run `30768860612`, attempt 1,
-successfully published that exact source as `borgmcp@2.10.2`; the same-run artifact report records integrity
-`sha512-uNeDidPLxZDe0E/RnQ35zaAMZwHcBbdpHrk+McQuV4lyBxoMSdf+MlBDHv7usijCtOBAUf+exlR/l4F9wVtvZg==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.13.0` tag object
-`67a2fd7bf76299dccc94a3260ddfd4b688eacaa1` peels to protected-main commit
-`fc5e4d9299210b70f979c7d39130a9c12ea265ea`. Workflow run `30894287863`, attempt 1,
-successfully published that exact source as `borgmcp@2.13.0`; the same-run artifact report records integrity
-`sha512-YuF3NwY5iBRVKhgdRiK+3GX+6O8O7S/V9g+XYN/1A0so9RLIYoQWpS91qJewqGQ59nyIARjRmk2wKhK8ODxU0Q==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.14.0` tag object
-`eb9d5cb14b08b1a2eb6d48b2492acbc6cecb7bef` peels to protected-main commit
-`4dd92bcbac26f460a4f137f766992e8f93843576`. Workflow run `30929322201`, attempt 1,
-successfully published that exact source as `borgmcp@2.14.0`; the same-run artifact report records integrity
-`sha512-haKgpQbcbaRya1XqYQaOy7yZiHMxeP8QO3fr7ahHaYDNYrDvlGmXNlW9VMtqnRJ9mtVDC5UTkeuQmCRJMzF/Tg==`.
-Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.14.1` tag object
-`c1c8b526dcc31259f6b821f0a6fdd0017a42435c` peels to protected-main commit
-`3de4cbf2e5adf6883334fe4e9b7aa1f43868daae`. Workflow run `30943397747`, attempt 1,
-successfully published that exact source as `borgmcp@2.14.1`; the same-run artifact report records integrity
-`sha512-VqkOp3jo/KnzgusCk98TFj/U8U7Q/gt8agvIbjiSWrV0lIHnsD+A+7w3C+GMQeyA08KXxRuZDF3No9sDomqMTQ==`.
-Never move, replace, reuse, or rerun that tag or workflow. The next candidate
-uses the unused `v2.14.2` identity from a fresh reviewed protected-main commit
-and requires the complete release gate again.
+## Release Integrity
+
+Release provenance is established by protected annotated tags, GitHub build
+provenance, and npm Trusted Publishing. Tags and publication workflows are
+immutable: never move, replace, reuse, or rerun them.
 
 ## Release Prerequisites
 
@@ -246,76 +37,11 @@ Before creating the release tag, independently verify all of these conditions:
 machine-checkable. A release tag created before they are resolved fails before
 dependency installation or publication.
 
-### Release identity preparation
-
-Prepare the next stable identity only from a clean protected-main checkout. The
-command requires evidence for the version being superseded because a workflow
-run and artifact integrity cannot be derived from the repository tree:
-
-```sh
-npm run release:prepare -- 2.3.0 \
-  --workflow-run-id 30195666955 \
-  --workflow-run-attempt 1 \
-  --artifact-integrity 'sha512-...'
-```
-
-The command independently verifies the annotated tag, its peeled commit, the
-exact successful tag-workflow attempt, and npm artifact integrity before writing
-anything. It then deterministically updates only the manifest version, the two
-root lockfile version fields, the extraction ledger, this document's immutable
-release record, and the release-lane current-version/evidence assertions.
-
-When the superseded tag's attempt failed before artifact creation or publication,
-prepare the fresh recovery identity with `--workflow-conclusion failure` and omit
-`--artifact-integrity` entirely. The preparer verifies the annotated tag and exact
-failed workflow attempt, writes a canonical failed-superseded record stating that
-the artifact build, verification, exercise, upload, and publish phases were all
-skipped, and separately re-verifies the last published release as the artifact
-provenance anchor. It also reads the authoritative registry version list before
-writing the time-bounded fact that no published npm artifact or SRI exists for
-the failed version. This recovery-time absence check is required before preparing
-the replacement identity; it is not the prohibited post-publication readback of
-the newly published release. A failed record carrying an SRI, a failed run whose
-artifact or publish phase ran, a failed version present in the registry, or a
-successful record without an SRI is invalid. Failed tags and workflow attempts
-stay immutable and must never be moved, reused, or rerun.
-
-```sh
-npm run release:prepare -- 2.10.2 \
-  --workflow-run-id 30766475027 \
-  --workflow-run-attempt 1 \
-  --workflow-conclusion failure
-```
+### Release branches
 
 Release branches use the `release/` prefix and enter protected `main` through a
-pull request. A direct push only updates the staging branch; it does
-not produce a release-identity verdict and grants no review skip, merge
-authority, or release authority.
-
-For a pull request from a same-repository `release/` branch, the dedicated
-release-identity workflow is loaded from the exact protected base commit. It
-checks out that base, fetches the exact candidate commit into the Git object
-database without checking it out, and invokes the base commit's verifier with
-explicit base and candidate SHAs. It does not install or execute candidate
-dependencies, package scripts, workflow code, actions, or verifier code. The
-candidate is treated only as Git tree and blob data.
-
-To reproduce the classification locally, resolve and pass exact commit SHAs:
-
-```sh
-base_sha=$(git rev-parse origin/main)
-candidate_sha=$(git rev-parse HEAD)
-npm run verify:release-identity -- --base "$base_sha" --candidate "$candidate_sha"
-```
-
-The verifier rechecks the recorded provenance against GitHub, npm, and Git. It
-reconstructs the expected tree in a temporary Git index and requires exact tree
-equality, exact changed paths, and exact per-file shapes. The release-identity
-allowlist must remain byte-identical. The generated no-cloud occurrence allowlist
-must also remain byte-identical; any source-line renumbering makes the commit a
-code change rather than a release-identity change. A commit the classifier
-rejects follows the full code review chain and must never be manually declared
-identity-only.
+pull request. Direct pushes only update staging branches; publication still
+requires the complete protected release gate.
 
 ## Repository Controls
 
@@ -340,6 +66,128 @@ Before preparing a candidate, independently verify:
 
 ## Release Workflow
 
+### Clean-environment rig lifecycle
+
+Every clean-environment verification rig has an explicit identity and an
+explicit end-of-life. Keep filesystem workspaces under the seat's disposable
+`~/.borg/scratch/<seat>/` root, and give each workspace a name beginning with
+`borg-rig-` followed by the seat, purpose, and a unique suffix. Before the
+first command that can create files, anchor the rig as its own npm project:
+
+```sh
+BORG_SEAT_LABEL="${BORG_SEAT_LABEL:?set the seat label}"
+BORG_SCRATCH_ROOT="${BORG_SCRATCH_ROOT:-$HOME/.borg/scratch/$BORG_SEAT_LABEL}"
+RIG_NONCE="${RIG_NONCE:-$(date +%Y%m%d%H%M%S)-$$}"
+RIG_ID="borg-rig-${BORG_SEAT_LABEL}-release-${RIG_NONCE}"
+RIG_ROOT="$BORG_SCRATCH_ROOT/$RIG_ID"
+mkdir -p "$RIG_ROOT"
+printf '%s\n' '{"private":true}' > "$RIG_ROOT/package.json"
+```
+
+The manifest anchor is required before any `npm install`, `npm update`, or
+other npm command. Without it, npm can walk up from an empty scratch directory
+and write the operator's `package.json` instead of creating project-local
+state. The committed `release:exercise` follows this rule for its temporary
+consumer; other QA scripts and manual rigs must do the same.
+
+The system temporary root is shared with the whole machine, so an unbounded
+listing there is not an inspectable cleanup check. Bound that leg by the
+invoking user and the run-window markers, which select directories whose
+timestamps fall within this run window without requiring a prefix inventory.
+New `mkdtemp` prefixes therefore require no documentation change. Keep both
+time predicates and the ownership predicate: removing the run-window bound
+turns a populated shared temp root back into an uninspectable listing.
+
+On a machine where several runs share one user account, this listing can
+include another run's live workspace. Removal is scoped to paths created by
+this run; anything else in the output is reported, not deleted. Unrelated
+same-user temporary directories created during the window can therefore
+appear in the result, so never remove a path merely because this listing found
+it.
+
+```sh
+TEMP_ROOT="${TMPDIR:-/tmp}"
+TEMP_OWNER="$(id -un)"
+TEMP_SCAN_START="$TEMP_ROOT/.${RIG_ID}-temp-scan-start"
+TEMP_SCAN_END="$TEMP_ROOT/.${RIG_ID}-temp-scan-end"
+
+list_recent_owned_temp_rigs() {
+  find "$TEMP_ROOT" -mindepth 1 -prune \
+    -type d \
+    -user "$TEMP_OWNER" \
+    -newer "$TEMP_SCAN_START" \
+    ! -newer "$TEMP_SCAN_END" \
+    -print
+}
+
+touch "$TEMP_SCAN_START"
+```
+
+Container-backed rigs use the same `RIG_ID` as the container name and carry
+both labels below. `--rm` is preferred; a runtime without automatic removal
+must remove the exact `RIG_ID` in its cleanup path and retain the labels for a
+bounded sweep:
+
+```sh
+RIG_IMAGE="${RIG_IMAGE:?set the rig image}"
+docker run --rm \
+  --name "$RIG_ID" \
+  --label borg-rig=1 \
+  --label "borg-rig-owner=$BORG_SEAT_LABEL" \
+  "$RIG_IMAGE"
+```
+
+Register the exact-target cleanup before launching the rig:
+
+```sh
+cleanup_done=0
+cleanup() {
+  [ "$cleanup_done" -eq 0 ] || return
+  cleanup_done=1
+  trap - EXIT HUP INT TERM
+  docker container rm --force "$RIG_ID" >/dev/null 2>&1 || true
+  rm -rf -- "$RIG_ROOT"
+  if [ -e "$TEMP_SCAN_START" ]; then
+    touch "$TEMP_SCAN_END"
+    list_recent_owned_temp_rigs
+  fi
+  rm -f -- "$TEMP_SCAN_START" "$TEMP_SCAN_END"
+}
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+```
+
+List before starting and after cleanup. The filters distinguish this seat's
+rigs from unrelated containers on a shared host:
+
+```sh
+docker container ls --all \
+  --filter label=borg-rig=1 \
+  --filter "label=borg-rig-owner=${BORG_SEAT_LABEL:?}" \
+  --format '{{.ID}}\t{{.Names}}\t{{.Status}}'
+find "$BORG_SCRATCH_ROOT" -mindepth 1 -print
+find "$BORG_SCRATCH_ROOT" -name 'borg-rig-*' -print
+```
+
+The unfiltered filesystem listings expose legacy names as well as conforming
+rigs. The bounded temporary-directory function covers tools that use `mkdtemp`
+instead of the seat scratch root. Run the container and scratch listings before
+launch and again from the cleanup path; the temporary-directory function runs
+after cleanup, between the start and end markers. Inspect its results and do
+not remove unrelated temporary files.
+
+Register cleanup before launching any process, run it on success and failure,
+and do not deliver a verdict until the container listing, both scratch listings,
+and the bounded temporary-directory listing show no rig owned by the seat from
+this run. For a non-`--rm` container runtime,
+remove only the named rig or the same owner label; never prune unrelated
+containers. A completed verification
+therefore implies zero running or stopped rig containers and no rig workspace
+created by this run left in either the seat scratch root or the system temporary
+directory.
+
 ### Pre-tag composed exercise
 
 Before creating a release tag, exercise the packed client against the selected

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "borgmcp",
-  "version": "2.14.2",
+  "version": "2.16.0",
   "description": "Coordinate AI coding agents in shared cubes. Works with Claude Code, Codex, and OpenCode.",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,27 +19,27 @@
     "borg-regen": "./dist/regen.js",
     "borg-clear-rewake": "./dist/clear-rewake.js",
     "borg-log-audit": "./dist/log-audit.js",
+    "borg-foreign-path-reminder": "./dist/foreign-path-reminder.js",
     "borg-inbox-monitor": "./dist/inbox-monitor.js"
   },
   "scripts": {
     "clean": "node scripts/clean.mjs",
-    "build": "npm run clean && tsc -p tsconfig.json && node scripts/set-bin-mode.mjs",
-    "check": "tsc -p tsconfig.json --noEmit",
-    "dev": "tsc -p tsconfig.json --watch",
+    "preflight:node": "node scripts/node-preflight.mjs",
+    "build": "npm run preflight:node && npm run clean && tsc -p tsconfig.json && node scripts/set-bin-mode.mjs",
+    "check": "npm run preflight:node && tsc -p tsconfig.json --noEmit",
+    "dev": "npm run preflight:node && tsc -p tsconfig.json --watch",
     "start": "node dist/index.js",
     "test": "npm run test:unit && npm run test:release",
-    "test:unit": "vitest run --config vitest.config.ts",
-    "test:release": "node --test test/release-lane.test.mjs test/release-identity.test.mjs",
+    "test:unit": "npm run preflight:node && vitest run --config vitest.config.ts",
+    "test:release": "npm run preflight:node && node --test test/release-lane.test.mjs",
     "onboarding:smoke": "node scripts/onboarding-smoke.mjs",
-    "release:prepare": "node scripts/release-identity.mjs prepare",
     "release:exercise": "npm run build && node scripts/release-exercise.mjs",
     "release:check": "npm run verify:public-source && npm run verify:release && npm run verify:lock && npm run check && npm test && npm run build && npm run onboarding:smoke && npm run verify:package",
     "verify:artifact": "node scripts/verify-packed-artifact.mjs",
     "verify:public-source": "node scripts/verify-public-source.mjs",
     "verify:package": "node scripts/verify-local-package.mjs",
     "verify:release": "node scripts/verify-release-readiness.mjs",
-    "verify:lock": "node scripts/verify-lock-registry.mjs",
-    "verify:release-identity": "node scripts/release-identity.mjs verify"
+    "verify:lock": "node scripts/verify-lock-registry.mjs"
   },
   "files": [
     "dist",

package/src/agent-runtime.ts

@@ -5,6 +5,8 @@
  * agent_kind without re-assimilating.
  */
 
+import { BORG_STATE_ROOT_ENV } from './private-root.js';
+
 export type AgentKind = 'claude' | 'codex' | 'opencode';
 
 /** Pinned into MCP-child environments by Borg launch paths. */
@@ -74,3 +76,18 @@ export function codexRemoteWakeConfigArgs(enabled: boolean = true): string[] {
     `mcp_servers.borg.env.${BORG_CODEX_REMOTE_WAKE_ENV}="${enabled ? '1' : '0'}"`,
   ];
 }
+
+/**
+ * Codex MCP children do not inherit the wrapper environment. Pin the explicit
+ * Borg state root into the per-launch child environment when one is active.
+ */
+export function codexStateRootConfigArgs(
+  env: NodeJS.ProcessEnv = process.env
+): string[] {
+  const stateRoot = env[BORG_STATE_ROOT_ENV];
+  if (stateRoot === undefined) return [];
+  return [
+    '-c',
+    `mcp_servers.borg.env.${BORG_STATE_ROOT_ENV}=${JSON.stringify(stateRoot)}`,
+  ];
+}