litclaude-ai 0.4.0 → 0.4.4

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 0.4.4 - 2026-09-02 — inode-reuse hardening and Linux rotation safety
+
+- Bind regular-file reads and state transitions to ctime/birthtime-aware identities,
+  and quarantine/content-check destructive cleanup across owner locks, rule/session/team
+  state, skill-loop records, knowledge, observer, review, and scaffold paths. Add
+  deterministic inode-reuse regression coverage for the affected readers and cleanup.
+- Make directory pins Linux-safe: directory identity excludes mutable child-driven ctime
+  and retained descriptors are compared with final pathname samples. Quarantine short-lived
+  scaffold locks so a legitimate next owner can rotate in without being mistaken for residue.
+- Keep browser-drive teardown fail-closed around process-group reuse while accepting
+  already-gone or non-owned groups, and add regression coverage for concurrent observer
+  first-use writers and normal rotation. Regenerate canonical resource hashes for the
+  changed runtime assets so installer integrity checks cover the hardening.
+- During convergence, three Linux-only false-denial cases were captured and resolved:
+  directory ctime churn, process-group ID reuse, and lock rotation. Regular files pin
+  ctime/birthtime; directories do not, because child creation legitimately changes
+  directory ctime. This is a local release candidate only; no publish, tag, or push
+  was performed.
+
+## 0.4.3 - 2026-08-31 — packed-payload integrity and channel routing
+
+- Add packed-payload substance, cross-product parity, and referenced-path checks so
+  installed skills cannot silently lose the material they reference.
+- Route post-compact rule re-injection through the channel Claude Code actually reads,
+  so compacted sessions receive the intended rules again.
+- Refresh the canonical legal attribution metadata without changing the four upstream
+  attributions it records. This is a local release candidate only; no publish, tag, or
+  push was performed.
+
+## 0.4.2 - 2026-08-30 — coordinated major-update-v2 patch release
+
+- Require `lit-plan` to persist `plans/<slug>.md` with executable checkbox tasks
+  before a planning turn ends; approval gates execution after the plan exists.
+- Add the shared installer frame, `--yes` path, and explicit host-owned model
+  selection notice while preserving Claude's host routing authority.
+- Remove the retired handoff name from model-facing guidance and keep the
+  native handoff route available without a legacy user-skill path.
+- This is a local release candidate only; no publish, tag, or push was performed.
+
+## 0.4.1 - 2026-08-29 — approval-gated skill learning loop
+
+- Observe validated skill consultations, bounded user corrections, tool
+  iteration signals, and coverage gaps without persisting raw transcripts. A
+  detached Stop review may queue at most three schema-valid pending proposals;
+  it never applies them.
+- Add explicit list, apply, reject, rollback, and curator commands. Apply is the
+  only approval transition and may mutate only project
+  `.claude/skills/<name>/SKILL.md` packages marked
+  `litclaudeAgentGenerated: "true"`; bundled and unmarked user skills remain
+  protected.
+- Record exact before/after snapshots in the project-local decision ledger and
+  content-addressed blob store. Rollback uses ownership, identity, and byte
+  checks and fails closed on conflicts.
+- Add a deterministic SessionStart curator for projects that already have
+  skill-loop usage state. The default seven-day/two-hour schedule marks
+  eligible skills stale after 30 days and archives them after 90 days only
+  after backup; deletion, consolidation, and automatic apply remain disabled.
+- Pin the complete skill-loop runtime and observer resources in the canonical
+  manifest, keep local `.litclaude` state out of the package, and reject
+  unpinned bundled-skill payload additions.
+
 ## 0.4.0 - 2026-08-27 — output-channel enforcement
 
 - Add a standalone `#contract.output_channels` declaration to every shipped

package/README.md

@@ -1,4 +1,17 @@
-<p align="center"><img src="https://cdn.jsdelivr.net/npm/litclaude-ai@0.4.0/cover.png" width="100%" alt="LitClaude — Claude Code-native workflow package" /></p>
+<p align="center"><img src="https://cdn.jsdelivr.net/npm/litclaude-ai@0.4.4/cover.png" width="100%" alt="LitClaude — Claude Code-native workflow package" /></p>
+
+```text
+██╗     ██╗████████╗
+██║     ██║╚══██╔══╝
+██║     ██║   ██║   
+███████╗██║   ██║   
+╚══════╝╚═╝   ╚═╝   
+ ██████╗██╗      █████╗ ██╗   ██╗██████╗ ███████╗
+██╔════╝██║     ██╔══██╗██║   ██║██╔══██╗██╔════╝
+██║     ██║     ███████║██║   ██║██║  ██║█████╗  
+╚██████╗███████╗██╔══██║╚██████╔╝██████╔╝███████╗
+ ╚═════╝╚══════╝╚═╝  ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝
+```
 
 <h1 align="center">LitClaude</h1>
 <p align="center">
@@ -9,7 +22,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" alt="npm: litclaude-ai" />
-  <img src="https://img.shields.io/badge/version-0.4.0-2ea44f" alt="version 0.4.0" />
+  <img src="https://img.shields.io/badge/version-0.4.4-2ea44f" alt="version 0.4.4" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" alt="Claude Code plugin" />
   <img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license" />
 </p>
@@ -39,6 +52,35 @@ ordinary `claude` sessions.
 - Local MCP/LSP helpers, structured Wikify knowledge, and a managed HUD that
   can be safely removed with `uninstall`.
 
+**The workflow closes on evidence.** A plan remains open until each item has a binary check, and a slice closes only after its real Claude surface produces evidence and its temporary QA resources are gone. A passing test is necessary, but it is not the finish line.
+
+```mermaid
+flowchart TD
+    R["a request<br/>make it better"] --> DI["<b>deep-interview</b><br/>turn it into a decision-complete brief"]
+    DI --> P["<b>lit-plan</b><br/>objective · non-goals<br/>action / output / <b>binary verification</b>"]
+    P --> GATE{"user approves?"}
+    GATE -->|no| P
+    GATE -->|yes| SW["<b>start-work</b><br/>execute one slice"]
+
+    subgraph LOOP["each slice: RED to GREEN to SURFACE to CLEAN"]
+        SW --> RED["failing test first"]
+        RED --> GREEN["smallest change that passes"]
+        GREEN --> SURF["exercise the <b>real surface</b><br/>not just the test"]
+        SURF --> CLEAN["tear down · cleanup receipt"]
+    end
+
+    CLEAN --> EV{"evidence complete?"}
+    EV -->|"tests only"| SW
+    EV -->|"artifact + receipt"| RW["<b>review-work</b><br/>scope · evidence · payload<br/>security · real surface"]
+    RW -->|findings| SW
+    RW -->|clean| HO["<b>lit-handoff</b><br/>resumable packet"]
+
+    style GATE fill:#fff3cd,stroke:#856404
+    style EV fill:#fff3cd,stroke:#856404
+    style SURF fill:#d4edda,stroke:#155724
+    style RW fill:#d1ecf1,stroke:#0c5460
+```
+
 ## Install
 
 For the current published package:
@@ -50,13 +92,13 @@ npx --yes litclaude-ai@latest install
 For a reproducible install, pin the current package version:
 
 ```bash
-npm view litclaude-ai@0.4.0 version
+npm view litclaude-ai@0.4.4 version
 ```
 
-If that lookup returns `0.4.0`, the exact install is available:
+If that lookup returns `0.4.4`, the exact install is available:
 
 ```bash
-npx --yes litclaude-ai@0.4.0 install
+npx --yes litclaude-ai@0.4.4 install
 ```
 
 Otherwise, wait for explicit human publication before using that pin. Check the
@@ -78,6 +120,24 @@ npx --yes litclaude-ai@latest install --yolo
 `safe` adds no permission rules. `balanced` adds bounded read/search and routine
 Git, npm, and Node rules. `yolo` adds broader edit/write patterns. These modes
 write bounded entries under Claude's `permissions.allow` and `permissions.deny`.
+
+### Install-time questions
+
+On a TTY the installer asks two questions: the HUD brand color and the LitClaude
+output style. The output-style question offers `None / keep current`,
+ASD-STE100, and ELI5 (each in English and 한국어); a LitClaude style is written to
+Claude's global `outputStyle` only when you pick one, never over a value you set
+yourself, and `uninstall` removes it again only if it is still the LitClaude-written
+value. `LITCLAUDE_OUTPUT_STYLE` and `LITCLAUDE_HUD_ACCENT` answer the questions
+non-interactively, and `--yes` skips every question with today's shipped defaults:
+
+```bash
+npx --yes litclaude-ai@latest install --yes
+```
+
+The installer never asks for a model or reasoning effort: model selection is
+host-owned — Claude Code picks its own models — and the summary prints
+`Model selection: host-owned`.
 Existing settings are preserved; LitClaude tracks and removes only rules it
 inserted.
 
@@ -107,6 +167,30 @@ the hook; namespaced slash commands use Claude Code's native command surface and
 do not double-activate the hook. For an explicit skill invocation, use a route
 such as `/litclaude:lit-loop`.
 
+**Where Claude Code hands control to LitClaude.** Session and tool events feed the rules, routing, authority, and ledger surfaces; together they expose the package's 34 skills, 17 commands, and 11 agents without hiding the host boundary.
+
+```mermaid
+flowchart LR
+    subgraph CC["Claude Code"]
+        H1["SessionStart"]; H2["UserPromptSubmit"]; H3["PreToolUse"]
+        H4["PostToolUse"]; H5["Stop"]; H6["SubagentStart / SubagentStop"]; H7["SessionEnd"]
+    end
+    subgraph LC["LitClaude plugin"]
+        RULES["rules engine<br/>project rules into context"]
+        ROUTE["trigger routing<br/><code>lit</code> · <code>/litclaude:*</code>"]
+        AUTH["bounded authority<br/>pause on a new boundary"]
+        LEDGER[("durable ledger<br/><code>.litclaude/</code>")]
+    end
+    H1 --> RULES --> LEDGER
+    H2 --> ROUTE --> LEDGER
+    H3 --> AUTH
+    H4 --> LEDGER
+    H5 --> LEDGER
+    H6 --> LEDGER
+    H7 --> LEDGER
+    LC --> S["34 skills · 17 commands · 11 agents"]
+```
+
 ## Core routes
 
 | Type this | Purpose |
@@ -126,7 +210,49 @@ such as `/litclaude:lit-loop`.
 | `lit-scientific-visualization` | Prepare publication figures; also `/litclaude:lit-scientific-visualization` |
 | `litclaude wikify <capture/save/review/query/config>` | Manage reviewed local structured knowledge |
 | `browser-drive`, `$browser-drive` | Drive a real page only after a capability probe verifies an external driver; never substitute a fetch, use credentials, or install without approval |
-| `skill-observer`, `$skill-observer` | Record bounded skill proposals only; never edit a skill file, and every record stays `applied: false` |
+| `skill-observer`, `$skill-observer` | Review bounded learning signals and manage pending proposals; only an explicit foreground `apply <proposal-id>` may change an eligible agent-owned skill |
+
+## Skill learning loop
+
+LitClaude records bounded learning signals only after a validated `SKILL.md`
+consultation: user corrections, repeated tool iterations, and coverage gaps. A
+Stop review treats the bounded, secret-scrubbed transcript excerpt as inert data
+and may queue schema-valid proposals, but it never stores that excerpt or edits a
+skill. Automatic application is disabled (`autoApply: false`); a proposal remains
+`pending` until the user explicitly applies or rejects its exact id.
+
+Use `/litclaude:skill-observer list`, `apply <proposal-id>`, `reject
+<proposal-id>`, `rollback <ledger-id>`, `curator status`, or `curator run` from
+the project whose state you want to manage. Apply can write only an eligible
+project `.claude/skills/<name>/SKILL.md` carrying
+`metadata.litclaudeAgentGenerated: "true"`. Bundled skill ids, paths outside
+that root, and existing unmarked user skills are protected. Every mutation is
+recorded in `.litclaude/skill-ledger.jsonl` with content-addressed blobs under
+`.litclaude/skill-ledger-blobs/`; rollback verifies current bytes and restores
+the exact recorded snapshot or fails closed.
+
+The deterministic curator runs no more often than every seven days and only
+after two idle hours. By default it marks unused eligible skills stale after 30
+days and archives them after 90 days, taking a backup first. It never deletes or
+consolidates skills. SessionStart runs this maintenance only when project-local
+skill-loop usage state already exists; untouched projects receive no new
+`.litclaude` state.
+
+**Why a fresh install can still execute the skills.** A self-contained skill needs an explicit allowlist reason, while a skill that names a corpus must carry that corpus inside the packed tarball. These payload gates prevent a checkout-only reference from becoming a user's runtime failure.
+
+```mermaid
+flowchart LR
+    SK["a skill"] --> Q{"does it declare<br/>a capability?"}
+    Q -->|"self-contained<br/>procedure"| AL["explicit allowlist entry<br/>with a written reason"]
+    Q -->|"needs a corpus"| C["corpus must resolve<br/>inside the <b>packed payload</b>"]
+    AL --> G1
+    C --> G1["<b>payload-substance</b>"]
+    G1 --> G2["<b>cross-product parity</b><br/>one product cannot ship a stub<br/>where the family ships substance"]
+    G2 --> G3["<b>referenced-path resolution</b><br/>every path in a SKILL.md<br/>must exist in the tarball"]
+    G3 --> OK["installs and works<br/>on a machine that has<br/>nothing else"]
+    style C fill:#d4edda,stroke:#155724
+    style OK fill:#d4edda,stroke:#155724
+```
 
 `lit start work <plan>` is intentionally a `BLOCKED:` handoff. Use
 `/start-work` or `/litclaude:start-work` with the approved plan. `lit workflow`

package/README_ko-KR.md

@@ -1,4 +1,17 @@
-<p align="center"><img src="https://cdn.jsdelivr.net/npm/litclaude-ai@0.4.0/cover.png" width="100%" alt="LitClaude — Claude Code-native workflow package" /></p>
+<p align="center"><img src="https://cdn.jsdelivr.net/npm/litclaude-ai@0.4.4/cover.png" width="100%" alt="LitClaude — Claude Code-native workflow package" /></p>
+
+```text
+██╗     ██╗████████╗
+██║     ██║╚══██╔══╝
+██║     ██║   ██║   
+███████╗██║   ██║   
+╚══════╝╚═╝   ╚═╝   
+ ██████╗██╗      █████╗ ██╗   ██╗██████╗ ███████╗
+██╔════╝██║     ██╔══██╗██║   ██║██╔══██╗██╔════╝
+██║     ██║     ███████║██║   ██║██║  ██║█████╗  
+╚██████╗███████╗██╔══██║╚██████╔╝██████╔╝███████╗
+ ╚═════╝╚══════╝╚═╝  ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝
+```
 
 <h1 align="center">LitClaude</h1>
 <p align="center">
@@ -9,7 +22,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" alt="npm: litclaude-ai" />
-  <img src="https://img.shields.io/badge/version-0.4.0-2ea44f" alt="version 0.4.0" />
+  <img src="https://img.shields.io/badge/version-0.4.4-2ea44f" alt="version 0.4.4" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" alt="Claude Code plugin" />
   <img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license" />
 </p>
@@ -40,6 +53,35 @@ state route, compact status-line HUD를 제공합니다. 한 번 설치하면
 - local MCP/LSP helper, 구조화된 Wikify knowledge, 안전하게 제거할 수 있는
   managed HUD
 
+**이 workflow가 닫히는 조건을 한눈에 보세요.** 각 계획 항목에 binary check가 있어야 다음 단계로 갈 수 있고, 실제 Claude surface에서 evidence를 남기고 임시 QA resource까지 정리해야 하나의 slice가 끝납니다. Test가 통과했다는 사실만으로는 충분하지 않습니다.
+
+```mermaid
+flowchart TD
+    R["a request<br/>make it better"] --> DI["<b>deep-interview</b><br/>turn it into a decision-complete brief"]
+    DI --> P["<b>lit-plan</b><br/>objective · non-goals<br/>action / output / <b>binary verification</b>"]
+    P --> GATE{"user approves?"}
+    GATE -->|no| P
+    GATE -->|yes| SW["<b>start-work</b><br/>execute one slice"]
+
+    subgraph LOOP["each slice: RED to GREEN to SURFACE to CLEAN"]
+        SW --> RED["failing test first"]
+        RED --> GREEN["smallest change that passes"]
+        GREEN --> SURF["exercise the <b>real surface</b><br/>not just the test"]
+        SURF --> CLEAN["tear down · cleanup receipt"]
+    end
+
+    CLEAN --> EV{"evidence complete?"}
+    EV -->|"tests only"| SW
+    EV -->|"artifact + receipt"| RW["<b>review-work</b><br/>scope · evidence · payload<br/>security · real surface"]
+    RW -->|findings| SW
+    RW -->|clean| HO["<b>lit-handoff</b><br/>resumable packet"]
+
+    style GATE fill:#fff3cd,stroke:#856404
+    style EV fill:#fff3cd,stroke:#856404
+    style SURF fill:#d4edda,stroke:#155724
+    style RW fill:#d1ecf1,stroke:#0c5460
+```
+
 ## 설치
 
 현재 공개된 package를 설치합니다.
@@ -52,13 +94,13 @@ npx --yes litclaude-ai@latest install
 뒤 고정합니다.
 
 ```bash
-npm view litclaude-ai@0.4.0 version
+npm view litclaude-ai@0.4.4 version
 ```
 
-조회 결과가 `0.4.0`이면 exact install을 사용할 수 있습니다.
+조회 결과가 `0.4.4`이면 exact install을 사용할 수 있습니다.
 
 ```bash
-npx --yes litclaude-ai@0.4.0 install
+npx --yes litclaude-ai@0.4.4 install
 ```
 
 그렇지 않으면 명시적인 human publication을 기다립니다. Pin은 그 뒤에 사용합니다.
@@ -109,6 +151,30 @@ namespaced slash command는 Claude Code native command surface에서 처리되
 hook을 중복 활성화하지 않습니다. 명시적으로 skill을 실행하려면
 `/litclaude:lit-loop` 같은 route를 사용하세요.
 
+**Claude Code와 LitClaude가 만나는 지점입니다.** Session과 tool event는 rules, routing, authority, ledger surface로 들어가며, 그 결과 34개 skill·17개 command·11개 agent가 host 경계를 넘지 않고 연결됩니다.
+
+```mermaid
+flowchart LR
+    subgraph CC["Claude Code"]
+        H1["SessionStart"]; H2["UserPromptSubmit"]; H3["PreToolUse"]
+        H4["PostToolUse"]; H5["Stop"]; H6["SubagentStart / SubagentStop"]; H7["SessionEnd"]
+    end
+    subgraph LC["LitClaude plugin"]
+        RULES["rules engine<br/>project rules into context"]
+        ROUTE["trigger routing<br/><code>lit</code> · <code>/litclaude:*</code>"]
+        AUTH["bounded authority<br/>pause on a new boundary"]
+        LEDGER[("durable ledger<br/><code>.litclaude/</code>")]
+    end
+    H1 --> RULES --> LEDGER
+    H2 --> ROUTE --> LEDGER
+    H3 --> AUTH
+    H4 --> LEDGER
+    H5 --> LEDGER
+    H6 --> LEDGER
+    H7 --> LEDGER
+    LC --> S["34 skills · 17 commands · 11 agents"]
+```
+
 ## 주요 라우트
 
 | 입력 | 용도 |
@@ -128,7 +194,49 @@ hook을 중복 활성화하지 않습니다. 명시적으로 skill을 실행하
 | `lit-scientific-visualization` | 출판용 figure를 준비합니다. `/litclaude:lit-scientific-visualization`도 지원합니다. |
 | `litclaude wikify <capture/save/review/query/config>` | 검토 기반 local structured knowledge를 관리합니다. |
 | `browser-drive`, `$browser-drive` | 외부 driver capability probe가 확인된 뒤에만 실제 page를 조작합니다. fetch로 대체하지 않으며 credential 사용과 승인 없는 설치를 하지 않습니다. |
-| `skill-observer`, `$skill-observer` | 제한된 skill proposal만 기록합니다. skill file은 수정하지 않으며 모든 기록은 `applied: false`로 남습니다. |
+| `skill-observer`, `$skill-observer` | 제한된 learning signal을 검토하고 pending proposal을 관리합니다. 명시적인 foreground `apply <proposal-id>`만 eligible agent-owned skill을 변경할 수 있습니다. |
+
+## Skill learning loop
+
+LitClaude는 검증된 `SKILL.md` consultation 뒤에만 user correction, 반복된 tool
+iteration, coverage gap을 제한된 learning signal로 기록합니다. Stop review는
+secret을 제거한 bounded transcript excerpt를 inert data로 다루며 schema-valid
+proposal을 queue할 수 있지만, excerpt 자체를 저장하거나 skill을 수정하지
+않습니다. 자동 적용은 꺼져 있고(`autoApply: false`), 사용자가 정확한 id를
+명시해 apply 또는 reject하기 전까지 proposal은 `pending`입니다.
+
+관리할 state가 있는 project에서 `/litclaude:skill-observer list`, `apply
+<proposal-id>`, `reject <proposal-id>`, `rollback <ledger-id>`, `curator
+status`, `curator run`을 사용합니다. Apply는
+`metadata.litclaudeAgentGenerated: "true"`를 가진 eligible project
+`.claude/skills/<name>/SKILL.md`에만 쓸 수 있습니다. Bundled skill id, 이 root
+밖의 path, marker가 없는 기존 user skill은 보호됩니다. 모든 mutation은
+`.litclaude/skill-ledger.jsonl`에 기록되고 content-addressed blob은
+`.litclaude/skill-ledger-blobs/`에 저장됩니다. Rollback은 현재 byte를 검증한
+뒤 기록된 exact snapshot을 복원하며, 검증할 수 없으면 fail closed합니다.
+
+Deterministic curator는 7일보다 자주 실행되지 않고 2시간 idle 뒤에만
+실행됩니다. 기본값은 eligible skill을 30일 뒤 stale로 표시하고 90일 뒤 먼저
+backup한 다음 archive하는 것입니다. Skill을 delete하거나 consolidate하지
+않습니다. SessionStart maintenance는 project-local skill-loop usage state가 이미
+있을 때만 실행되므로 untouched project에 새 `.litclaude` state를 만들지
+않습니다.
+
+**아무것도 남아 있지 않은 machine에서도 skill이 작동하는 이유입니다.** Self-contained skill은 allowlist에 명시적인 근거가 있어야 하고, corpus를 참조하는 skill은 packed tarball 안에서 그 corpus를 찾아야 합니다. 이 payload gate가 checkout에만 남은 reference를 설치 후 장애로 만들지 않습니다.
+
+```mermaid
+flowchart LR
+    SK["a skill"] --> Q{"does it declare<br/>a capability?"}
+    Q -->|"self-contained<br/>procedure"| AL["explicit allowlist entry<br/>with a written reason"]
+    Q -->|"needs a corpus"| C["corpus must resolve<br/>inside the <b>packed payload</b>"]
+    AL --> G1
+    C --> G1["<b>payload-substance</b>"]
+    G1 --> G2["<b>cross-product parity</b><br/>one product cannot ship a stub<br/>where the family ships substance"]
+    G2 --> G3["<b>referenced-path resolution</b><br/>every path in a SKILL.md<br/>must exist in the tarball"]
+    G3 --> OK["installs and works<br/>on a machine that has<br/>nothing else"]
+    style C fill:#d4edda,stroke:#155724
+    style OK fill:#d4edda,stroke:#155724
+```
 
 `lit start work <plan>`은 의도적으로 `BLOCKED:` handoff를 반환합니다. 승인된
 plan과 함께 `/start-work` 또는 `/litclaude:start-work`를 사용하세요. `lit

package/RELEASE_CHECKLIST.md

@@ -1,6 +1,6 @@
 # LitClaude Release Checklist
 
-Status: `litclaude-ai@0.4.0` is the current release candidate — exact canonical
+Status: `litclaude-ai@0.4.4` is the current release candidate — exact canonical
 frontend corpus plus Claude-native `autoresearch`, `autoconference`, and `wikify`
 workflow-family integration. It byte-pins the frontend library, legal companions,
 family source closures, and adapters through independent commitments and package
@@ -45,16 +45,24 @@ side-effect-free, the launcher starts only a separate Claude Code
 print/background worker, and the release preserves the Korean polishing
 command, strict multi-agent review pipeline, fidelity guardrails, package
 hygiene checks, native route gates, and safe start-work handoff behavior.
-`package.json` is aligned to `0.4.0`,
-`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.4.0`, and the
-plugin-local MCP server reports `0.4.0`.
-
-This candidate adds machine-readable output-channel declarations across the
-shipped skill corpus and a `PostToolUse` hedge-feedback path that consumes those
-declarations after reader-facing writes. Two isolated A/B experiments found no
-measurable behavior change from the declaration prose alone; this release
-therefore treats the declaration as guard metadata, not as evidence that prose
-instructions by themselves make generated documents cleaner.
+`package.json` is aligned to `0.4.4`,
+`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.4.4`, and the
+plugin-local MCP server reports `0.4.4`.
+
+This candidate adds an approval-gated skill learning loop. Validated
+consultations, bounded corrections, iteration signals, and coverage gaps may
+produce pending proposals, but hooks and model reviews never apply them.
+Foreground apply is restricted to marked agent-owned project skills, with
+byte-exact ledger-backed rollback. The deterministic curator backs up and
+archives eligible skills on its bounded schedule, never deletes or consolidates,
+and runs at SessionStart only when project-local usage state already exists.
+Automatic apply remains disabled.
+
+The 0.4.0 release added machine-readable output-channel declarations across the
+shipped skill corpus and a `PostToolUse` hedge-feedback path. Two isolated A/B
+experiments found no measurable behavior change from declaration prose alone,
+so the declaration remains guard metadata rather than evidence that prose
+instructions by themselves improve generated documents.
 
 This release carries the v0.2.2 Dynamic workflow hardening surfaces:
 `/dynamic-workflow`, `workflow-check --json`, native `/goal` fallback guidance,
@@ -287,9 +295,9 @@ checkout and from an isolated install of the packed tarball:
 Before requesting publication approval, confirm these artifacts from the current
 checkout:
 
-- `package.json` version is `0.4.0`.
-- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.4.0`.
-- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.4.0`.
+- `package.json` version is `0.4.4`.
+- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.4.4`.
+- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.4.4`.
 - Prompt-hook tests cover bundled `SKILL.md` body injection for bare `hyperplan`, `litresearch`, `lit research`, `init-deep`, and explicit leading `$start-work`; diagnostic/copy mentions stay inert while leading natural-language `lit start work` stays BLOCKED.
 - `lit search` and `lit query` route to `/litclaude:litresearch` without activating on slash mentions, code spans, or non-lit prompts.
 - Litresearch web lanes require public API/feed preference, validator-first checks, route traces, prompt-injection quarantine, and honest auth/paywall/private-data stop reasons.