memhouse 0.18.10 → 0.18.12

package/AGENTS.md

@@ -3,18 +3,18 @@
 Conventions for any coding agent in this repository — Claude Code, Codex, Gemini CLI,
 OpenCode, whatever comes next. `CLAUDE.md` points here; this file is the canonical copy.
 
-Constellation-wide rules (worktrees, branch naming, never pushing to `ramazanpolat/*`)
-live in [`~/agent-realm/CLAUDE.md`](../CLAUDE.md) and are not repeated here.
+Constellation-wide rules (worktrees, branch naming, which remotes are frozen) live in the
+parent directory's [`CLAUDE.md`](../CLAUDE.md) and are not repeated here.
 
 
 ## Release lines — read before tagging, publishing, or merging a release
 
-memhouse shipped two lines while zeo ran the pre-0.18 layout. Since its conversion there
-is one line; the rules below are kept because a second line can happen again.
+memhouse shipped two lines while the first production house ran the pre-0.18 layout. Since
+its conversion there is one line; the rules below are kept because a second line can happen again.
 
 | line | git branch | npm dist-tag | versions | who installs it |
 |---|---|---|---|---|
-| the one line | `main` (default) | `latest`, and `team` as an alias | 0.18.x | everyone — `npm install -g memhouse` (zeo was converted to the one layout with `memhouse convert`; `release/0.17` is retired) |
+| the 0.18 line | `release/0.18` (cut at v0.18.11; `main` stays the default branch) | `latest`, and `team` as an alias | 0.18.x | everyone — `npm install -g memhouse` (the production house was converted to the one layout with `memhouse convert`; `release/0.17` is retired) |
 
 Rules, each learned once:
 
@@ -28,18 +28,17 @@ Rules, each learned once:
   its own CHANGELOG entry, never assumed. The one-layout (0.18) renamed every room to
   `<member>_*`; anything touching room names ports with care (`house/HOUSE.md`).
 - **`memhouse update` follows the channel a machine was installed from** (`MEMHOUSE_CHANNEL`),
-  so a zeo machine never receives a team build by accident, and vice versa.
+  so a machine on the old line never receives a team build by accident, and vice versa.
 - **`master` is retired.** It was the pre-0.18 default; `main` is the default now. Do not
   branch from it, tag on it, or push to it.
 - **A publish is live when `npm view` says so.** `npm publish` prints `+ memhouse@x.y.z`;
   confirm with `npm view memhouse dist-tags --prefer-online`. A version that seems missing
   right after a publish is registry lag or a stale local npm cache (`npm cache verify`),
   not a "staged" publish. That misdiagnosis cost three releases.
-- **Which token.** The pilot's publish token lives in the macOS keychain as `npmjs-token`
-  (`~/.pilot-profile/online/npm.md` has the temp-userconfig recipe). Lend it to the one
-  command; never print it.
-- **One owner per line at a time.** Before releasing, check `ListAgents`/herdr for another
-  session on the same repo and agree who cuts it; the release record lives in `CHANGELOG.md`
+- **Which token.** The publish token is a secret reference, resolved at the moment of use
+  and lent to the one `npm publish` (a temporary userconfig); never print it.
+- **One owner per line at a time.** Before releasing, check for another
+  session working on the same repo and agree who cuts it; the release record lives in `CHANGELOG.md`
   on the line's branch and in `drills/`.
 
 ## What memhouse is

package/CHANGELOG.md

@@ -4,6 +4,146 @@ Versions before 0.8.0 were beta-only. Beta installs of 0.7.x and earlier should
 uninstall and reinstall — the 0.8.0 layout is new, and an in-place `update` +
 migration path is planned work, not a promise the old versions can cash.
 
+## 0.18.12 — 2026-10-29
+
+Release notes: [`docs/releases/v0.18.12.md`](docs/releases/v0.18.12.md).
+
+- **Skills:** each `/mem` skill's `allowed-tools` is restricted to the read-only memhouse
+  commands it teaches, instead of `Bash` as a whole. Any other command goes through the
+  normal permission prompt. `memhouse update` refreshes installed skills; then
+  `/reload-plugins`.
+- `misc/skill-allowlist-test.js` and `misc/env-guard-test.js` join `npm test`. Test tooling
+  reads its deploy targets from an untracked `deploy/targets.env`, and fixtures use stand-ins.
+- The 0.18 line is cut from `release/0.18`.
+- No drill was run for this patch release.
+
+## 0.18.11 — 2026-10-10
+
+Release notes: [`docs/releases/v0.18.11.md`](docs/releases/v0.18.11.md). Read its upgrade
+section first: the first pass after the upgrade re-sends every stored session with
+subagents once.
+
+- Sessions with subagents ship only their new rows.
+- **Security:** `invite` no longer sends a stored credential to `--url` (G4).
+- The 0.18.10 pre-tag list is finished, and the gentar kit is v0.9.3.
+- The dashboard ships the license notices of every package it bundles (`public/THIRD_PARTY_NOTICES.txt`).
+- **No drill was run for this release; waived (2026-10-08) under the maintainer's 0.18.10 ruling. The drill runs before 0.19.0.**
+
+- **The dashboard now ships the license notices of what it bundles.** The built dashboard
+  (`public/`) includes React, chart.js, lucide-react (ISC), react-markdown, the remark and
+  micromark family, tailwindcss and others: every bundled package. Their licenses require the
+  notice to travel with every copy, and Vite's minifier strips the license comments, so
+  every published package so far carried those copies without one.
+  - `ui/third-party-notices.js`, a Vite plugin with no dependencies of its own, now writes
+    `public/THIRD_PARTY_NOTICES.txt` at build time from the bundle's module graph. It
+    lists each package with its version, declared license, and the license text it ships.
+  - A bundled package with no license text fails the build. The only exception is an
+    explicit, reasoned list of packages that truly ship none; it is empty today. Each
+    `name@version` is listed once, so a second bundled version keeps its own text.
+  - CI's tarball audit also fails if the file is missing or does not list the main
+    packages.
+- **A session with subagents ships only its new rows, like any other.** 0.18.8's tail-only
+  shipping did not reach the sessions that grow the most: folded subagent rows were numbered
+  by position after the parent's turns, so one new parent turn moved every one of them, the
+  session forked to a new epoch and re-sent itself whole on every pass. Measured on a real
+  house: 1.07 M message rows written in 24 h against 10.2 M in total, most of them full
+  copies of five sessions, one 6,120-line session stored 60 times in a day. A subagent's
+  rows now sit in a block of their own — `seq = 1,000,000,000 + slot × 100,000 + turn`,
+  `tool_calls.idx` the same — where `slot` is the subagent's rank by start time, so neither
+  the parent growing, a running subagent growing, nor a new subagent appearing moves an
+  existing row. The session's own turns keep `0, 1, 2, …`, so a session without subagents
+  is numbered exactly as before. Readers that `ORDER BY seq` see the parent first, then each
+  subagent contiguous, in the order they started (they were in agent-id order, which is
+  random). `seq` is sparse now: count with `count()`, never `max(seq) + 1`.
+  **Upgrade cost, once:** every stored session with subagents forks exactly one time, the
+  first time it is re-shipped after the upgrade (it grows, or `ship --full`), and is
+  tail-only from then on. The superseded epoch is kept, as every epoch is. Sessions without
+  subagents are not affected. Two things widen that first pass:
+  - A session whose subagent files are newer than the house's record of it is read again on
+    the first pass even if it did not grow. `lastUpdatedAt` now counts subagent writes; see
+    the next entry. So the first pass after the upgrade forks and re-sends every such
+    session whole, once.
+  - Two installs that ship the SAME session files (two instances on one machine, or a
+    synced directory) must be upgraded together. A 0.18.10 and a 0.18.11 number the same
+    session differently, and each would fork it back on every pass.
+
+  **The first pass is a one-time bulk write into the house.** Schedule it, and do not
+  run it on a house whose storage is degraded. A parse that does not fit the blocks (a parent past 1e9
+  turns, a subagent past 100,000, more than 32,949 subagents) falls back to positional
+  numbering, which is correct and merely re-ships whole.
+- **A subagent that runs on after its parent goes quiet is shipped on the next pass.** The
+  incremental skip compared only the parent file's mtime (or the index's `modified`), and a
+  subagent writes only its own file, so a background agent's turns waited for the parent's
+  next write, or were never shipped. A session's `lastUpdatedAt` is now the newest mtime of
+  the parent and every subagent transcript, Workflow-run agents included — stat calls only,
+  and only for sessions that have a subagent directory. After upgrading, a session whose
+  subagents are newer than its parent is re-read once on the first pass, and ships the turns
+  it was missing.
+- **`memhouse update --no-install` restarts a tarball or nightly install.** It is the command
+  every nightly prints for itself, and on exactly those builds it stopped at "no automatic
+  update for this install" (a tarball is on no registry tag), exited 1, and left the old
+  shipper running the old code in memory. `--no-install` no longer needs a channel: the
+  files are already in place, and the restart, migrations and schema check run. Found while
+  upgrading testbed from 0.18.9 to a nightly of this release.
+
+- **A subagent caught before its first line is written holds its session for one pass.**
+  A subagent with no timestamped line ranked last. When its first line then landed with an
+  earlier time than a sibling's, it moved ahead of it, renumbered every sibling after it,
+  and the session forked and re-shipped whole. Now the shipper waits a pass (`held for one
+  pass` in the log) and ranks it by its real start time. A file that never gets a
+  timestamped line stops holding the session after 10 minutes. (SUB-1)
+- **An option that takes no value no longer swallows the next word.**
+  - `memhouse update --no-install yes` set no-install to "yes", and ran the npm install it
+    was told to skip.
+  - `memhouse share --revoke bob` revoked nobody.
+  - Switches are now true when present, and the next word stays a positional.
+  (A6, review G34)
+- **`update --channel <name>` pins only a channel the registry has.** It compared the flag
+  with itself and never wrote the pin at all. A name that is not a tag is now refused, and
+  nothing is pinned. When the registry does not answer, the channel is not pinned. (A5)
+- **`update --no-install` no longer prints "files updated"** for files it did not touch.
+  It also now runs on a project-dependency install too; it installs nothing, so where the
+  files came from does not matter. (A6)
+- **The epoch log line counts rows, not the highest seq.** On a session with subagents it
+  read "1000000123 messages stored". (A4)
+- **Docs: the host id is derived from the machine's own id, not random,** since 0.18.6.
+  The guides, `HOUSE.md`, `host.js` and `uninstall --full-removal` said a reinstall mints a
+  new identity. It derives the same one again. (A8)
+- **`invite` never sends a credential this install keeps to `--url` (G4, security).** `--url`
+  is the invitee's address, typed on a command line. A typo, a tunnel or somebody else's
+  server got the member's own credential (the reachability probe and the grants read), or
+  a kept admin's (provisioning). `resolveConfig()` lets the flag outrank the env file, so
+  the "configured" URL the code used WAS `--url`.
+  - A stored credential now goes only to the house it was saved for: the member's, a
+    `--keep-admin` admin's, or a password resolved from the env file.
+  - `--url` gets an unauthenticated `/ping` to confirm the invitee can reach it.
+  - An admin given for this command (`--admin-user` or an exported
+    `MEMHOUSE_ADMIN_USER`, with its password from a file, stdin, the environment or a
+    prompt) still provisions at `--url`.
+  - `misc/invite-matrix.sh` points `--url` at a spy server and asserts it receives
+    nothing but a ping.
+- **The dashboard no longer goes empty on a quiet house (G11).** The stats tables carry a
+  one-day TTL and were refreshed only by a pass that shipped something. So a house whose
+  machines went quiet for a day lost every generation, and the dashboard, which had chosen
+  its tables once per process, kept reading the emptied one.
+  - The shipper now also refreshes when the newest generation is over an hour old.
+  - The dashboard re-resolves its rooms every five minutes, so it falls back to the inline
+    rollup when a stats table is empty.
+- **The skills find their reference again (G26).** All five said
+  `Read ../reference/HOUSE.md`, a path that does not exist in the installed plugin; the
+  file is at `../../reference/HOUSE.md`. A unit test now resolves every skill's reference
+  path from its own directory.
+- **`/mem:recall` queries that run (A2).**
+  - "Recent sessions" ordered by `started_at`, which the room does not have; it now uses
+    `created_at` / `last_updated_at`, read `FINAL`.
+  - The search now returns `hit_seq`, which the transcript read needs.
+  - The read takes its window by position (three turns before, twelve after) instead of
+    by `seq` arithmetic, which a subagent's block numbering defeats.
+- **`HOUSE.md`'s subagent queries keep to the current parse (A3).** They had no epoch
+  filter, so a re-parsed session doubled each subagent's turns.
+- `misc/skill-recipe.sh` now runs these queries verbatim, extracted from the docs, against
+  fixture rows with a superseded parse and a subagent block.
+
 ## 0.18.10 — 2026-10-08
 
 Release notes: [`docs/releases/v0.18.10.md`](docs/releases/v0.18.10.md), covering what
@@ -11,7 +151,7 @@ changed, the upgrade steps, and the status of the 0.18.10 pre-tag list.
 
 - **A security release; everyone on 0.18.x should upgrade.** It covers G23 (#20), the admin
   password off argv (#14) and the scoped share boundary (#13).
-- **No drill was run for this release; waived by the pilot (2026-10-08). The drill runs before 0.19.0.**
+- **No drill was run for this release; waived by the maintainer (2026-10-08). The drill runs before 0.19.0.**
 - **Moved to 0.18.11:** the subagent re-ship fix and the gentar kit v0.9.3 bump.
 - **Docs:** the repository now meets the documentation standard (#17): a short README,
   `docs/` tutorials and guides, `examples/`, and the `AGENTS.md` install section.
@@ -38,7 +178,7 @@ changed, the upgrade steps, and the status of the 0.18.10 pre-tag list.
   stdin), from `MEMHOUSE_ADMIN_PASSWORD` (so `with-secret` lends it to one command), from a
   credential this install already keeps for the same admin, or from a prompt. Before, giving
   `--admin-user` as a flag switched every other source off, so the only scriptable admin
-  path put the password on argv, where `ps` and shell history keep it. Found by O's sandbox
+  path put the password on argv, where `ps` and shell history keep it. Found in a sandbox
   rehearsal. **Deprecation:** `--admin-password <value>` still works in this release, with a
   warning, and is **removed in 0.19.0**, the next minor release after this one (deprecated
   2026-10-08). Move scripts to `MEMHOUSE_ADMIN_PASSWORD` or `--admin-password-file`.
@@ -138,14 +278,14 @@ The upgrade path itself, and a machine that stays the same machine.
 
 ## 0.18.5 — 2026-09-18
 
-The first release on **one line**: published to `latest` and `team` alike. zeo was converted to the one layout the same evening with `memhouse convert` (six members, every row count identical before and after, shares carried).
+The first release on **one line**: published to `latest` and `team` alike. The first production house was converted to the one layout the same evening with `memhouse convert` (six members, every row count identical before and after, shares carried).
 
-- **One release line.** With zeo converted to the one layout there is no 0.17 line to keep:
+- **One release line.** With the production house converted to the one layout there is no 0.17 line to keep:
   `latest` now points at the same 0.18.x build as `team` (kept as an alias), the publish
   guard and `AGENTS.md` say so, and `release/0.17` is retired.
 
 - **`memhouse convert` — an operator moves a pre-one-layout house to the one layout.**
-  Before 0.18 each member owned a database (`polat.messages`, `ALL ON polat.*`). `convert`
+  Before 0.18 each member owned a database (`sam.messages`, `ALL ON sam.*`). `convert`
   finds every such member, renames their five rooms into `mem.<name>_*` in one atomic
   statement (nothing copied), swaps the database-wide grant for the one wildcard, carries
   whole-house shares and row policies to the new names, drops the 0.17.1 refreshable
@@ -164,7 +304,7 @@ On the `team` channel. Found by the operator's own second machine on its first `
 
 - **`memhouse update` never crosses release lines on its own.** An unpinned 0.18.2 whose
   `team` tag had moved to 0.18.3 matched no tag, and the picker fell back to `latest` —
-  zeo's 0.17.1, a different house layout. A real member was downgraded on her first update.
+  the 0.17 line's 0.17.1, a different house layout. A real member was downgraded on her first update.
   The picker now follows the tag on the install's own major.minor line, and when no tag is
   on that line, or the registry does not answer, it stops and says so; `--channel` is the
   only way across.
@@ -295,7 +435,7 @@ possible.
   every adapter is watching and the variable that changes it. A name or directory that
   does not exist is refused against that adapter, never shipped from the default instead.
 
-- **One layout.** Every member's rooms are named for them — `mem.polat_messages`,
+- **One layout.** Every member's rooms are named for them — `mem.sam_messages`,
   `mem.alice_messages` — and one grant covers them: `GRANT … ON mem.<name>_* TO <name>
   WITH GRANT OPTION`. A wildcard on the member's own name, verified on 25.11 and 26.7: it
   lets the member create and rebuild their own rooms and share them, and reaches nothing
@@ -331,7 +471,7 @@ possible.
   (25.11, the default local tag).
 
 - **Bringing a housemate into a house you already own now works, and moves nothing.** A
-  member alone in their own database holds `ALL ON polat.*`. That grant is **dynamic** —
+  member alone in their own database holds `ALL ON sam.*`. That grant is **dynamic** —
   it covers rooms created later — so a housemate's rooms would be readable *and
   droppable* by the owner the moment they existed (both measured). `invite` used to
   refuse and point at a migration command that did not exist.
@@ -447,7 +587,7 @@ possible.
   fourteen places, which names nothing in a house holding `alice_messages`. Rather than
   teach fourteen query sites about prefixes, the `q()` helper in `reference/HOUSE.md` —
   the single connection every skill routes through — now rewrites room names after
-  `FROM`/`JOIN`. A needle like `LIKE '%messages%'` is untouched, and `FROM yigit_messages`
+  `FROM`/`JOIN`. A needle like `LIKE '%messages%'` is untouched, and `FROM bob_messages`
   is left alone so a shared room still reads.
 
   Written with `[[:space:]]` classes, not `\b`: **BSD `sed` does not support `\b`**, and
@@ -696,7 +836,7 @@ possible.
 
 - **The skills no longer fall back to a hardcoded `mem` house.** A house is a database
   named for its owner — `resolveConfig` defaults `MEMHOUSE_DB` to the connection's
-  username (`polat` ships into `polat.messages`), and `memhouse invite` mints a per-user
+  username (`sam` ships into `sam.messages`), and `memhouse invite` mints a per-user
   database. But the plugin skills hardcoded `${MEMHOUSE_DB:-mem}` in their connection
   recipes, so a config missing `MEMHOUSE_DB` would silently query a `mem` house that the
   user-named convention had moved on from. All eight skills now fall back to
@@ -731,10 +871,10 @@ possible.
 - **Read a friend's shared memory by naming their house.** A share is a read-only GRANT on
   a whole house (a ClickHouse database), and the rooms resolve by the connection's
   database — so `/mem:ask`, `/mem:search` and `/mem:sql` now recognize a house named in the
-  question ("how did yigit fix X", "search … in yigit", "query yigit's house"), resolve it
+  question ("how did bob fix X", "search … in bob", "query bob's house"), resolve it
   against `SHOW DATABASES`, and point the connection at that house with your own
   credentials, read-only. A name that matches a readable house wins over the `in <project>`
-  qualifier — otherwise "in yigit" silently filtered your own project column and returned
+  qualifier — otherwise "in bob" silently filtered your own project column and returned
   nothing. `/mem:hello` now names the phrase, and `/mem:users` still lists the houses shared
   with you.
 
@@ -915,7 +1055,7 @@ now the whole install.
   stamp cannot be skipped) and `host` (a random fingerprint minted once per install).
 - **Joining any ClickHouse is two statements**: `CREATE USER` + `GRANT ALL ON <house>.*`.
   The member's own shipper creates and evolves the rooms.
-- The house name defaults to the username (`polat` ships to `polat.messages`) and is
+- The house name defaults to the username (`sam` ships to `sam.messages`) and is
   freely decoupled (`--db`); `system` and `information_schema` are refused everywhere —
   previously `--db system` granted a member everything on the server's own database.
 - Removed: per-member suffixed rooms, Merge rooms, the narrowed grant set,

package/README.md

@@ -14,8 +14,8 @@ can search every past session, see what it cost, and reopen the one that solved
 before.
 
 Every row says where it came from, in a way no client can fake. `user_id` is stamped by
-the server (`MATERIALIZED currentUser()`), and `host` is a fingerprint minted once per
-install. A team pointed at one house gets a shared memory with real attribution.
+the server (`MATERIALIZED currentUser()`), and `host` is a fingerprint derived from
+the machine's own id. A team pointed at one house gets a shared memory with real attribution.
 
 ## Install
 

package/SECURITY.md

@@ -64,5 +64,7 @@ makes the security model short, and worth stating without varnish.
 
 ## Reporting
 
-The repository is private during beta. Report security issues to the maintainer
-directly (ramazanpolat@gmail.com) rather than in a public channel.
+The repository is private during beta. Report a security issue privately, never in a
+public issue or channel: once the repository is public, through GitHub's private
+vulnerability reporting (the **Security** tab, **Report a vulnerability**); until then,
+to the maintainer through the channel that gave you access.