chainlesschain 0.163.5 → 0.163.7

package/src/commands/session-observability.js

@@ -0,0 +1,305 @@
+import fs from "node:fs";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { TextDecoder } from "node:util";
+import { numericOption } from "../lib/cli-numeric.js";
+import { loadConfig } from "../lib/config-manager.js";
+import { mergePricing } from "../lib/llm-pricing.js";
+import {
+  buildCausalObservabilityReport,
+  causalSessionIds,
+  createCausalObservabilityLimitTracker,
+  createVerifiedSessionObservabilityProjection,
+  normalizeCausalRequest,
+  projectVerifiedDelivery,
+  selectCausalDeliveries,
+} from "../lib/causal-observability.js";
+import { restoreDeliveryFlow } from "../lib/delivery-coordinator.js";
+import { readVerifiedProjection } from "../harness/jsonl-session-store.js";
+import { ensurePrivateFile } from "../lib/secure-fs.js";
+import {
+  sameFileStatIdentity,
+  samePathHandleFileIdentity,
+  withTrustedFileParentSync,
+} from "../lib/secure-file-identity.js";
+
+const MAX_INPUT_BYTES = 16 * 1024 * 1024;
+
+function readTrustedJson(filePath, deps = {}) {
+  const runtimeFs = deps.fs || fs;
+  const trustedParent =
+    deps.withTrustedFileParentSync || withTrustedFileParentSync;
+  return trustedParent(
+    runtimeFs,
+    filePath,
+    ({ canonicalPath, parentDevice }) => {
+      const before = runtimeFs.lstatSync(canonicalPath, { bigint: true });
+      if (
+        before.isSymbolicLink() ||
+        !before.isFile() ||
+        Number(before.nlink) !== 1
+      ) {
+        throw new Error(
+          `input must be a regular, single-link file: ${filePath}`,
+        );
+      }
+      const size = Number(before.size);
+      if (size <= 0 || size > MAX_INPUT_BYTES) {
+        throw new Error(
+          `input exceeds the safe ${MAX_INPUT_BYTES}-byte limit: ${filePath}`,
+        );
+      }
+      let descriptor = null;
+      try {
+        descriptor = runtimeFs.openSync(
+          canonicalPath,
+          runtimeFs.constants.O_RDONLY |
+            Number(runtimeFs.constants.O_NOFOLLOW || 0),
+        );
+        const opened = runtimeFs.fstatSync(descriptor, { bigint: true });
+        if (
+          !opened.isFile() ||
+          Number(opened.nlink) !== 1 ||
+          !samePathHandleFileIdentity(before, opened, parentDevice)
+        ) {
+          throw new Error(`input identity changed while opening: ${filePath}`);
+        }
+        const bounded = Buffer.allocUnsafe(MAX_INPUT_BYTES + 1);
+        let bytesRead = 0;
+        while (bytesRead < bounded.length) {
+          const count = runtimeFs.readSync(
+            descriptor,
+            bounded,
+            bytesRead,
+            bounded.length - bytesRead,
+            null,
+          );
+          if (count === 0) break;
+          bytesRead += count;
+        }
+        if (bytesRead > MAX_INPUT_BYTES) {
+          throw new Error(
+            `input exceeds the safe ${MAX_INPUT_BYTES}-byte limit: ${filePath}`,
+          );
+        }
+        const body = bounded.subarray(0, bytesRead);
+        const after = runtimeFs.fstatSync(descriptor, { bigint: true });
+        if (
+          Number(after.size) !== body.length ||
+          !sameFileStatIdentity(opened, after)
+        ) {
+          throw new Error(`input changed while being read: ${filePath}`);
+        }
+        return Object.freeze({
+          canonicalPath,
+          value: JSON.parse(
+            new TextDecoder("utf-8", { fatal: true }).decode(body),
+          ),
+        });
+      } finally {
+        if (descriptor !== null) runtimeFs.closeSync(descriptor);
+      }
+    },
+  );
+}
+
+function atomicWritePrivate(outputPath, contents, deps = {}) {
+  const runtimeFs = deps.fs || fs;
+  const absolute = path.resolve(outputPath);
+  const trustedParent =
+    deps.withTrustedFileParentSync || withTrustedFileParentSync;
+  return trustedParent(runtimeFs, absolute, ({ canonicalPath, parentPath }) => {
+    if (runtimeFs.existsSync(canonicalPath)) {
+      throw new Error(
+        `output already exists; refusing to overwrite: ${absolute}`,
+      );
+    }
+    const temporary = path.join(
+      parentPath,
+      `.${path.basename(canonicalPath)}.${randomUUID()}.tmp`,
+    );
+    let published = false;
+    try {
+      runtimeFs.writeFileSync(temporary, contents, {
+        encoding: "utf8",
+        mode: 0o600,
+        flag: "wx",
+      });
+      (deps.ensurePrivateFile || ensurePrivateFile)(temporary, {
+        applyWindowsAcl: true,
+        failIfUnavailable: true,
+      });
+      // Publishing a fully-written hard link is atomic and, unlike rename,
+      // fails closed if another writer created the requested output first.
+      runtimeFs.linkSync(temporary, canonicalPath);
+      published = true;
+      runtimeFs.rmSync(temporary);
+      (deps.ensurePrivateFile || ensurePrivateFile)(canonicalPath, {
+        applyWindowsAcl: true,
+        failIfUnavailable: true,
+      });
+      return canonicalPath;
+    } catch (error) {
+      try {
+        runtimeFs.rmSync(temporary, { force: true });
+        if (published) runtimeFs.rmSync(canonicalPath, { force: true });
+      } catch {
+        // Preserve the authoritative write error.
+      }
+      throw error;
+    }
+  });
+}
+
+function budgetOverrides(options) {
+  const parse = (value, name, extra = {}) =>
+    value == null
+      ? undefined
+      : numericOption(value, { name, min: 0, ...extra });
+  return {
+    maxTokens: parse(options.maxTokens, "--max-tokens", { integer: true }),
+    maxUsd: parse(options.maxUsd, "--max-usd"),
+    maxRetries: parse(options.maxRetries, "--max-retries", { integer: true }),
+    maxRetryRatio: parse(options.maxRetryRatio, "--max-retry-ratio", {
+      max: 1,
+    }),
+    maxToolP95Ms: parse(options.maxToolP95Ms, "--max-tool-p95-ms"),
+  };
+}
+
+function nonEmptyFilterOption(value, name) {
+  if (value == null) return undefined;
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(`${name} must be a non-empty string`);
+  }
+  return value;
+}
+
+function optionFilter(options) {
+  return {
+    workspaceId: nonEmptyFilterOption(options.workspace, "--workspace"),
+    teamId: nonEmptyFilterOption(options.team, "--team"),
+    policyId: nonEmptyFilterOption(options.policy, "--policy"),
+  };
+}
+
+function mergeDefined(base, overrides) {
+  const definedOverrides = Object.fromEntries(
+    Object.entries(overrides).filter(([, value]) => value !== undefined),
+  );
+  return Object.fromEntries(
+    Object.entries({ ...base, ...definedOverrides }).filter(
+      ([, value]) => value !== undefined,
+    ),
+  );
+}
+
+export function runSessionObservability(requestPath, options = {}, deps = {}) {
+  try {
+    const trustedRequest = readTrustedJson(requestPath, deps);
+    const request = normalizeCausalRequest(trustedRequest.value);
+    const requestDir = path.dirname(trustedRequest.canonicalPath);
+    const deliveries = request.deliveryStates.map((statePath) => {
+      const resolved = path.resolve(requestDir, statePath);
+      const state = (deps.restoreDeliveryFlow || restoreDeliveryFlow)(
+        readTrustedJson(resolved, deps).value,
+      );
+      return projectVerifiedDelivery(state);
+    });
+    const filter = mergeDefined(request.filter, optionFilter(options));
+    const selectedDeliveries = (
+      deps.selectCausalDeliveries || selectCausalDeliveries
+    )(deliveries, filter);
+    const selectedSessionIds = (deps.causalSessionIds || causalSessionIds)(
+      selectedDeliveries,
+    );
+    const limitTracker = (
+      deps.createCausalObservabilityLimitTracker ||
+      createCausalObservabilityLimitTracker
+    )();
+    for (const delivery of selectedDeliveries) {
+      limitTracker.acceptDelivery(delivery);
+    }
+    const sessionsById = new Map();
+    const pricingTable = (deps.mergePricing || mergePricing)(
+      (deps.loadConfig || loadConfig)().llm?.pricing,
+    );
+    for (const sessionId of selectedSessionIds) {
+      const session = (deps.readVerifiedProjection || readVerifiedProjection)(
+        sessionId,
+        () =>
+          (
+            deps.createVerifiedSessionObservabilityProjection ||
+            createVerifiedSessionObservabilityProjection
+          )(sessionId, { pricingTable }),
+      );
+      limitTracker.acceptSession(session);
+      sessionsById.set(sessionId, session);
+    }
+    const budgets = mergeDefined(request.budgets, budgetOverrides(options));
+    const report = (
+      deps.buildCausalObservabilityReport || buildCausalObservabilityReport
+    )({
+      deliveries: selectedDeliveries,
+      sessionsById,
+      filter,
+      budgets,
+      pricingTable,
+      generatedAt: deps.now ? deps.now() : new Date().toISOString(),
+    });
+    const output = `${JSON.stringify(report, null, 2)}\n`;
+    if (options.output) {
+      const written = atomicWritePrivate(options.output, output, deps);
+      if (!options.json) process.stdout.write(`${written}\n`);
+    } else {
+      process.stdout.write(output);
+    }
+    if (
+      options.strictBudget === true &&
+      ["exceeded", "unknown"].includes(report.budget.status)
+    ) {
+      return 2;
+    }
+    return 0;
+  } catch (error) {
+    process.stderr.write(`Causal observability failed: ${error.message}\n`);
+    return 1;
+  }
+}
+
+export function registerSessionObservabilitySubcommand(session) {
+  session
+    .command("observability <request>")
+    .description(
+      "Export verified token/USD, retry, tool latency, diff, gate, artifact and PR causality",
+    )
+    .option("--workspace <id>", "Only delivery authority for this workspace")
+    .option("--team <id>", "Only delivery authority for this team")
+    .option("--policy <id>", "Only delivery authority for this policy")
+    .option("--max-tokens <n>", "Alert when aggregate tokens exceed n")
+    .option(
+      "--max-usd <amount>",
+      "Alert when estimated priced USD exceeds amount",
+    )
+    .option("--max-retries <n>", "Alert when automatic LLM retries exceed n")
+    .option(
+      "--max-retry-ratio <ratio>",
+      "Alert when approximate retry/call ratio exceeds 0..1",
+    )
+    .option(
+      "--max-tool-p95-ms <ms>",
+      "Alert when fully observed tool P95 exceeds ms",
+    )
+    .option(
+      "--strict-budget",
+      "Exit 2 when a budget is exceeded or cannot be evaluated",
+    )
+    .option(
+      "--output <path>",
+      "Atomically write owner-only JSON instead of stdout",
+    )
+    .option("--json", "Machine-readable output (default when stdout is used)")
+    .action((requestPath, options) => {
+      process.exitCode = runSessionObservability(requestPath, options);
+    });
+}

package/src/commands/session.js

@@ -65,6 +65,7 @@ import {
 import { executionBroker } from "../lib/process-execution-broker/index.js";
 import { registerSessionMcpRecoveryCommands } from "./session-mcp-recovery.js";
 import { registerSessionShowSubcommand } from "./session-show.js";
+import { registerSessionObservabilitySubcommand } from "./session-observability.js";
 
 export const _deps = {
   execFileSync: (...args) => executionBroker.execFileSync(...args),
@@ -1839,6 +1840,43 @@ export function registerSessionCommand(program) {
       }
     });
 
+  registerSessionObservabilitySubcommand(session);
+
+  session
+    .command("observability-authority <id>")
+    .description(
+      "Print the verified headHash/eventCount/scope binding for a delivery flow",
+    )
+    .option("--json", "Machine-readable JSON output")
+    .action(async (id) => {
+      try {
+        const { getVerifiedSessionObservabilityAuthority } =
+          await import("../harness/jsonl-session-store.js");
+        const authority = getVerifiedSessionObservabilityAuthority(id);
+        console.log(
+          JSON.stringify(
+            {
+              causality: {
+                scope: authority.observabilityScope,
+                sessions: [
+                  {
+                    sessionId: authority.sessionId,
+                    headHash: authority.headHash,
+                    eventCount: authority.eventCount,
+                  },
+                ],
+              },
+            },
+            null,
+            2,
+          ),
+        );
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exitCode = 1;
+      }
+    });
+
   // session workflow — inspect canonical coding workflow state
   // Reads .chainlesschain/sessions/<id>/{intent.md,plan.md,progress.log,mode.json}
   // written by the 4 workflow skills ($deep-interview/$ralplan/$ralph/$team).

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.163.7",
+      "cliVersions": ["0.163.6", "0.163.7"],
+      "date": "2026-08-14",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.163.7: governed scheduler migration and causal observability",
+          "body": "> `chainlesschain` **0.163.6 → 0.163.7** (candidate; not yet published,\n> 2026-08-14).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Five-domain migration journal**: Agenda, Cowork Cron, Routine, Automation,\n  and Loop migrations use the scheduler store schema-v5 journal with\n  domain-typed source locators, immutable source/target digest bindings,\n  idempotent recovery, and fail-closed rejection of conflicting or ambiguous\n  legacy entries.\n- **Governed rollback controls**: the new scheduler migration `list`, `show`,\n  and `rollback` commands expose redacted migration status and blockers.\n  Rollback requires the latest evidence digest, an interactive TTY, and the\n  exact typed challenge before reopening any legacy source.\n- **Target-first recovery and CAS fencing**: rollback stops or restores the\n  scheduler target before restoring the legacy source, validates target\n  revision, definition and execution evidence, and makes terminal source\n  restoration retry-safe across process crashes. This is not a claim of one\n  atomic transaction across independent stores or filesystems.\n- **Fail-closed source identity**: Windows drive and UNC paths are canonicalized\n  while relative, incomplete and device-namespace paths are rejected.\n  Automation migration requires an existing native SQLite database and refuses\n  the non-durable sql.js fallback; Loop restoration remains bound to its durable\n  retirement fence, marker and original source digest.\n- **Windows persistence hardening**: team adjudication atomic replacement\n  retries only transient Windows `EACCES`, `EBUSY`, and `EPERM` sharing\n  failures with bounded backoff and authority-path revalidation. Exhausted,\n  non-transient, and non-Windows replacement failures continue to fail closed.\n- **Cross-platform CI hardening**: migration fixtures verify retirement fences\n  and canonical source identities consistently across operating systems, while\n  distributed-queue and authority test workers use bounded lifetimes and attach\n  result observers before short-lived children can exit. Terminal Skill\n  authority fixtures now use an explicit parent acknowledgement before clean\n  exit, removing Windows IPC exit-before-message ordering ambiguity without\n  weakening concurrent revocation assertions.\n- **Verified causal delivery reports**: scoped sessions can be bound by exact\n  transcript head and event count to digest-protected delivery states. The new\n  session observability commands export a redacted session-to-delivery graph\n  spanning diffs, gates, artifacts, pull requests, and merges, with exact\n  workspace, team, and policy filters.\n- **Fail-closed call-ledger budgets**: `call-ledger@1` brackets model, retry,\n  compaction, subagent, isolated-skill, and tool calls with known or unknown\n  settlements. Strict budget mode rejects exceeded and unevaluable results\n  instead of treating missing token, cost, retry, or tool-latency evidence as\n  zero.\n- **Background recovery authority hardening**: verified transcript CAS,\n  delegated recovery leases, IPC sender/nonce binding, bootstrap guards, exact\n  process-group termination checks, and terminal cleanup prevent uncertain or\n  still-live descendants from authorizing recovery or worktree deletion.\n- **Causal evidence boundary**: report bindings prove exact verified revisions,\n  not that a model call semantically caused a source hunk. Scope labels are not\n  identity or membership proofs, digests are not signatures, anti-rollback is\n  machine-local, and incomplete or legacy ledgers remain partial or unknown.\n- **Known residuals**: scheduler ENOSPC/partial-write/fsync/rename/SQLite fault\n  closure and the Linux, Windows, and macOS long-soak matrix remain open.\n  Signed native distribution and representative alias-removal telemetry also\n  remain outside this candidate.\n- **Release status**: final tag, source SHA, workflow run IDs, package digest,\n  provenance, and registry readback are intentionally omitted until the exact\n  `0.163.7` release merge commit passes both required workflow matrices on\n  Linux, Windows, and macOS, followed by the dedicated npm release and\n  independent public readback workflows."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.163.6",
+      "cliVersions": ["0.163.5", "0.163.6"],
+      "date": "2026-08-12",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.163.6: unified scheduler authority and automation control",
+          "body": "> `chainlesschain` **0.163.5 → 0.163.6** (published from exact SHA\n> `85c3577c887003fea98d0a159603cd359506f09b`, 2026-08-12).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Complete scheduler adapter migration**: Agenda monitors, Loop iterations,\n  Automation cron flows, Routine GitHub polling, channel automation events,\n  and the standalone daemon now execute through the shared scheduler service\n  with durable claims, definition snapshots, recovery fences, and bounded\n  retry/dead-letter behavior.\n- **Timezone and missed-run consistency**: Agenda and Cowork cron definitions\n  persist canonical IANA timezones, handle DST gaps and repeated civil times,\n  and collapse downtime to one latest due occurrence without replay storms.\n- **Shared scheduler permission and budget authority**: Agenda, Routine,\n  Cowork, Automation, and Loop bind exact capability policies to durable\n  revisions and use one transactional reservation/settlement path. Missing,\n  stale, disabled, exhausted, or inconsistent policy state fails closed;\n  retries reuse the original reservation instead of charging twice.\n- **Layered Automation enforcement**: the shared scheduler authority composes\n  with Automation's creator identity, connector permissions, live revocation,\n  and per-flow run/action budgets. Domain evidence and the scheduler policy\n  revision remain independently validated.\n- **Governed management surfaces**: scheduler policy inspection/update commands\n  require exact capabilities and revision CAS, while the Automation Center\n  exposes governed flow and Routine controls without bypassing backend\n  permission or budget checks.\n- **Known residuals**: durable outcome-unknown adjudication, complete mixed-\n  version migration/rollback, scheduler disk-fault closure, and the three-OS\n  long-soak matrix remain open. Signed native distribution and representative\n  alias-removal telemetry also remain outside this release.\n- **Published release evidence**: immutable tag `v-npm-0-163-6` resolves to\n  exact source commit `85c3577c887003fea98d0a159603cd359506f09b`. Its Linux,\n  Windows, and macOS `CLI CI` (`31595865423`) and `CLI Strict Sandbox`\n  (`31595865206`) matrices passed; the dedicated npm release (`31595865181`)\n  completed its exact-SHA gate, immutable package, Trusted Publishing, and\n  signed provenance, and the independent public readback (`31597577056`)\n  succeeded. npm reports `latest=0.163.6`; the public tarball SHA-1 is\n  `18bb9d807a4a35a36cf9049dcc15f67eb47bbfa6`."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.163.5",
@@ -10,7 +36,7 @@
       "sections": [
         {
           "heading": "Added — cc CLI 0.163.5: durable scheduler runtime and recovery",
-          "body": "> `chainlesschain` **0.163.4 → 0.163.5** (candidate; not yet published,\n> 2026-08-11).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Unified scheduler runtime**: the versioned scheduler store now has a shared\n  runtime with adapter registration, snapshot-bound authorization, durable\n  owner/fence claims, lease renewal, bounded retry, dead-letter settlement,\n  history, and adapter-kind isolation.\n- **Routine scheduling migration**: manual triggers and `routine run` cron/once\n  executions use canonical logical occurrences, revision-CAS job snapshots,\n  deterministic run evidence, dual-driver fencing, and crash recovery that\n  settles terminal evidence without replaying the agent.\n- **Agenda wakeup/cron migration**: production Agenda wakeup and cron entries\n  preserve their full permission/worktree/turn/token/cost/time run policy while\n  executing through the shared kernel. New and legacy drivers coordinate with\n  durable leases; known failures retry, while start-only outcomes fail closed.\n- **Cowork Cron migration**: production `cowork cron run` uses definition-only\n  snapshots, workspace-scoped recovery claims, cross-version JSONL delivery\n  fences, terminal-evidence recovery, and automatic one-second polling for\n  six-field cron expressions.\n- **Durable compaction recovery**: micro-compaction strips transient runtime\n  markers before persistence, records checkpoint state durably, restores it in\n  REPL/agent flows, and preserves trace propagation across Process Broker\n  execution boundaries.\n- **Honest execution boundary**: durable terminal evidence prevents duplicate\n  automatic replay after a scheduler process crash. Start-only evidence or a\n  post-side-effect persistence failure remains outcome-unknown and requires\n  explicit handling; this release does not claim global exactly-once behavior.\n- **Known residuals**: Agenda monitor, Automation, Loop, Routine GitHub,\n  standalone scheduler daemon/liveness, shared permission/budget resolution,\n  IANA timezone/DST/missed-run semantics, migration/rollback, disk-fault and\n  long-soak closure remain outside this release. Signed native distribution and\n  representative alias-removal telemetry also remain open.\n- **Release status**: final tag, source SHA, workflow run IDs, package digest,\n  provenance, and registry readback are intentionally omitted until the exact\n  `0.163.5` merge commit passes Linux, Windows, and macOS `CLI CI` and `CLI\n  Strict Sandbox`, followed by the dedicated npm release and independent public\n  readback workflows."
+          "body": "> `chainlesschain` **0.163.4 → 0.163.5** (published from exact SHA\n> `095087c1e859a8451ce01ed58c59af3fede756fd`, 2026-08-11).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Unified scheduler runtime**: the versioned scheduler store now has a shared\n  runtime with adapter registration, snapshot-bound authorization, durable\n  owner/fence claims, lease renewal, bounded retry, dead-letter settlement,\n  history, and adapter-kind isolation.\n- **Routine scheduling migration**: manual triggers and `routine run` cron/once\n  executions use canonical logical occurrences, revision-CAS job snapshots,\n  deterministic run evidence, dual-driver fencing, and crash recovery that\n  settles terminal evidence without replaying the agent.\n- **Agenda wakeup/cron migration**: production Agenda wakeup and cron entries\n  preserve their full permission/worktree/turn/token/cost/time run policy while\n  executing through the shared kernel. New and legacy drivers coordinate with\n  durable leases; known failures retry, while start-only outcomes fail closed.\n- **Cowork Cron migration**: production `cowork cron run` uses definition-only\n  snapshots, workspace-scoped recovery claims, cross-version JSONL delivery\n  fences, terminal-evidence recovery, and automatic one-second polling for\n  six-field cron expressions.\n- **Durable compaction recovery**: micro-compaction strips transient runtime\n  markers before persistence, records checkpoint state durably, restores it in\n  REPL/agent flows, and preserves trace propagation across Process Broker\n  execution boundaries.\n- **Honest execution boundary**: durable terminal evidence prevents duplicate\n  automatic replay after a scheduler process crash. Start-only evidence or a\n  post-side-effect persistence failure remains outcome-unknown and requires\n  explicit handling; this release does not claim global exactly-once behavior.\n- **Known residuals**: Agenda monitor, Automation, Loop, Routine GitHub,\n  standalone scheduler daemon/liveness, shared permission/budget resolution,\n  IANA timezone/DST/missed-run semantics, migration/rollback, disk-fault and\n  long-soak closure remain outside this release. Signed native distribution and\n  representative alias-removal telemetry also remain open.\n- **Published release evidence**: immutable tag `v-npm-0-163-5` resolves to\n  exact source commit `095087c1e859a8451ce01ed58c59af3fede756fd`. Its Linux,\n  Windows, and macOS `CLI CI` (`31509337185`) and `CLI Strict Sandbox`\n  (`31509336854`) matrices passed; the dedicated npm release (`31509336832`)\n  completed its exact-SHA gate, immutable package, Trusted Publishing and\n  signed provenance, and the independent public readback (`31514940240`)\n  succeeded. npm reports `latest=0.163.5`; the public tarball SHA-1 is\n  `5dc6677dee6d1d73b708e6a50e3808007a314894`."
         }
       ]
     },
@@ -23,7 +49,7 @@
       "sections": [
         {
           "heading": "Added — cc CLI 0.163.4: immutable MCP capsules and durable scheduler storage",
-          "body": "> `chainlesschain` **0.163.3 → 0.163.4** (candidate; not yet published,\n> 2026-08-11).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Immutable MCP capsule build inputs**: the capsule builder now executes in a\n  bounded worker against an in-memory WASM virtual filesystem populated from\n  verified bytes. Package sources and native builder assets are canonicalized,\n  identity-bound, and no longer reopened from mutable host paths during the\n  build.\n- **Platform-bound live capsule evidence**: materialized stdio MCP capsules are\n  exercised through the production Process Broker and child contract on Linux,\n  Windows, and macOS. Framed reports, exact asset identity, deferred host-path\n  resolution, and shared CJS/ESM trace context prevent warning or path-alias\n  drift from weakening the evidence chain.\n- **Bounded failure behavior**: worker memory, output, timeout, and cleanup are\n  bounded; partial or malformed child evidence, post-verification replacement,\n  unapproved effects, and unsupported strict boundaries fail closed.\n- **Command lifecycle evidence and alias decision**: report v2 binds exact\n  coverage, approval, scope, and repository evidence and summarizes command\n  telemetry without silently accepting zero-data input. All 25 deprecated\n  aliases remain retained until representative opt-in telemetry exists and the\n  documented `0.164.0` removal floor is reached.\n- **Scheduler kernel storage foundation**: a versioned SQLite store adds strict\n  schema verification, expected-revision CAS, logical-occurrence deduplication,\n  durable claims, and two-handle race coverage. This is the first P2-4 storage\n  milestone, not completion of the scheduling kernel or orchestration runtime.\n- **Delivery and recovery hardening**: production delivery adapters, durable\n  provider-backed compaction, MCP recovery admission, session ownership fences,\n  and exact Windows write checks close additional internal consistency gaps.\n- **Native release readback hardening**: release evidence now verifies public\n  bytes, checksums, manifests, signatures, and provenance contracts more\n  strictly. Signed native distribution is still blocked until real signed\n  artifacts and public package-manager readback are available.\n- **Known residuals**: full P2-4 scheduling orchestration, signed native\n  distribution, representative alias telemetry, and the remaining documented\n  long-soak/host-boundary follow-ups are not claimed by this release.\n- **Release status**: final tag, exact source SHA, workflow run IDs, package\n  digest, provenance, and public registry readback are intentionally omitted\n  until the exact `0.163.4` release commit passes the Linux, Windows, and macOS\n  `CLI CI` and `CLI Strict Sandbox` gates and the npm release/readback workflows\n  complete successfully."
+          "body": "> `chainlesschain` **0.163.3 → 0.163.4** (published from exact SHA\n> `27ed0ac2005e16ce5ddff53990e85b1d13ea0b1d`, 2026-08-11).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Immutable MCP capsule build inputs**: the capsule builder now executes in a\n  bounded worker against an in-memory WASM virtual filesystem populated from\n  verified bytes. Package sources and native builder assets are canonicalized,\n  identity-bound, and no longer reopened from mutable host paths during the\n  build.\n- **Platform-bound live capsule evidence**: materialized stdio MCP capsules are\n  exercised through the production Process Broker and child contract on Linux,\n  Windows, and macOS. Framed reports, exact asset identity, deferred host-path\n  resolution, and shared CJS/ESM trace context prevent warning or path-alias\n  drift from weakening the evidence chain.\n- **Bounded failure behavior**: worker memory, output, timeout, and cleanup are\n  bounded; partial or malformed child evidence, post-verification replacement,\n  unapproved effects, and unsupported strict boundaries fail closed.\n- **Command lifecycle evidence and alias decision**: report v2 binds exact\n  coverage, approval, scope, and repository evidence and summarizes command\n  telemetry without silently accepting zero-data input. All 25 deprecated\n  aliases remain retained until representative opt-in telemetry exists and the\n  documented `0.164.0` removal floor is reached.\n- **Scheduler kernel storage foundation**: a versioned SQLite store adds strict\n  schema verification, expected-revision CAS, logical-occurrence deduplication,\n  durable claims, and two-handle race coverage. This is the first P2-4 storage\n  milestone, not completion of the scheduling kernel or orchestration runtime.\n- **Delivery and recovery hardening**: production delivery adapters, durable\n  provider-backed compaction, MCP recovery admission, session ownership fences,\n  and exact Windows write checks close additional internal consistency gaps.\n- **Native release readback hardening**: release evidence now verifies public\n  bytes, checksums, manifests, signatures, and provenance contracts more\n  strictly. Signed native distribution is still blocked until real signed\n  artifacts and public package-manager readback are available.\n- **Known residuals**: full P2-4 scheduling orchestration, signed native\n  distribution, representative alias telemetry, and the remaining documented\n  long-soak/host-boundary follow-ups are not claimed by this release.\n- **Published release evidence**: immutable tag `v-npm-0-163-4` resolves to\n  exact source commit `27ed0ac2005e16ce5ddff53990e85b1d13ea0b1d`. `CLI CI`\n  (`31421782916`), `CLI Strict Sandbox` (`31421782072`), the npm release\n  (`31424056034`), and independent public readback (`31425519966`) succeeded."
         }
       ]
     },