myte 0.0.45 → 0.0.46

package/README.md

@@ -35,8 +35,6 @@ The CLI searches for `.env` in the current folder and then up parent directories
 
 ## Common Commands
 
-Live mutation commands require `--confirm-write --approval-artifact <path>` after the local artifact has been shown to and approved by the user.
-
 - `npx myte config --json`
 - `npx myte bootstrap`
 - `npx myte sync-qaqc`
@@ -72,10 +70,9 @@ Live mutation commands require `--confirm-write --approval-artifact <path>` afte
 - `npx mytecody update --dry-run`
 - `npx mytecody update`
 
-## Behavior
-
-- `bootstrap`, `sync-qaqc`, `feedback-sync`, and `suggestions sync` write project-scoped local context under `MyteCommandCenter` in the current workspace unless `--output-dir` is provided.
-- Live project-key mutations require explicit user approval before the CLI sends them. Create a local approval artifact, show it to the user, then rerun with `--confirm-write --approval-artifact <path>`.
+## Behavior
+
+- `bootstrap`, `sync-qaqc`, `feedback-sync`, and `suggestions sync` write project-scoped local context under `MyteCommandCenter` in the current workspace unless `--output-dir` is provided.
 - `bootstrap` writes mission cards and mission suggestion thread state together; agents should run it before looking for mission or suggestion ids.
 - `mission status` is active-state only (`todo`, `in_progress`, `done`). Use `mission archive` for project-key lifecycle archival; restore archived missions from the web archived-board view.
 - `mission status` and `mission archive` refresh local bootstrap + mission-ops state by default after a successful mutation. Use `--no-sync` only when you intentionally want to skip the local refresh.
@@ -86,12 +83,22 @@ Live mutation commands require `--confirm-write --approval-artifact <path>` afte
 - `feedback-sync` excludes archived Feedback from normal `MyteCommandCenter` state. Project-key API/CLI can archive authorized Feedback, but Feedback unarchive/restore is web UI only.
 - `feedback validate|apply` remains available for validation and owner-direct apply paths.
 - `query --with-diff` is stricter than the snapshot commands. It requires project repositories to be configured by the project owner or builder, and it requires at least one matching local project repo to be resolved for diff collection.
-- If diff-scoped repo configuration is missing or no local project repo can be resolved, `query --with-diff` exits with an error instead of silently dropping diff context.
-- Most markdown files are excluded from diff context by default so code and runtime configuration changes dominate the payload. Key instruction files such as `README.md` and `AGENTS.md` remain eligible.
-
-## Agent Usage Contract
-
-Codex, Claude, and other coding agents should use one project-scoped key per workspace:
+- If diff-scoped repo configuration is missing or no local project repo can be resolved, `query --with-diff` exits with an error instead of silently dropping diff context.
+- Most markdown files are excluded from diff context by default so code and runtime configuration changes dominate the payload. Key instruction files such as `README.md` and `AGENTS.md` remain eligible.
+
+## Live Write Approval
+
+All live project-key writes must be approved by the user before the CLI sends them to Myte.
+
+- First create a local `.md`, `.yml`, `.yaml`, or `.json` approval artifact that lists the command, every target id, and the proposed change.
+- Show the artifact path and full content or concise complete summary to the user.
+- After explicit approval, rerun the write with `--confirm-write --approval-artifact <path>`.
+- Batch writes must enumerate every feedback id, mission id, suggestion id, request id, or PRD item in the artifact. QAQC batches are capped by the API at 10 mission ids.
+- The API also validates the approval envelope, payload hash, targets, and true batch count, so direct HTTP calls with only the API key are rejected.
+
+## Agent Usage Contract
+
+Codex, Claude, and other coding agents should use one project-scoped key per workspace:
 
 ```bash
 MYTE_API_KEY=<project_api_key>
@@ -104,16 +111,12 @@ Recommended agent flow:
 1. Run `myte config --json` to confirm the project, API base, configured repos, and local workspace detection.
 2. Run `myte bootstrap --json`, `myte feedback-sync --json`, or `myte sync-qaqc --json` to hydrate local context under `MyteCommandCenter`. Use `myte suggestions sync --json` only for narrow mission-review refreshes after bootstrap.
 3. Use `myte query "<goal/evidence/ask>" --with-diff` when local code changes matter.
-4. Before any live write, create a local approval artifact, show it to the user, and get explicit approval. Use `.md` for comments, human updates, and PRD markdown; use `.yml`/`.yaml` or `.json` for structured mission/feedback decisions and batch writes.
-5. After approval, rerun the mutation with `--confirm-write --approval-artifact <path>`. Batch artifacts must enumerate every feedback id, mission id, suggestion id, request id, or PRD item.
-6. Direct HTTP calls with `MYTE_API_KEY` cannot bypass this gate on live project-content mutations. The API returns `428` with agent instructions when approval metadata is missing or mismatched.
-7. Read/sync/query/validate commands, `--print-context`, and `--dry-run` do not require write approval.
-8. Use `myte create-prd <file.md>` only after the PRD markdown has been reviewed by a human. The file body is the PRD document; `--description` is only the short board/card summary.
-9. Use `myte feedback status|edit|assign|archive` to create reviewable local artifacts, then `feedback submit` and `feedback review` for the owner-review membrane.
-10. Use `myte feedback move` only for direct board movement that is intentionally audited, with a clear `--reason`; use `--feedback-ids` for batch moves or batch archive.
-11. Use `myte suggestions create|revise|review` for mission review threads. Valid create `change_type` values are exactly `update` and `create`; revisions keep the existing thread type and must not include `change_type`.
-12. Use `myte mission archive` for project-key mission lifecycle archival. Archive requires Project Owner or elevated delegate capability; restore is web-only from the archived missions board.
-13. Use `myte update-team "<content>"` for project/team comments through `/api/project-assistant/project-comment`, and `myte feedback comment --feedback-id <id> --body-file ./comment.md` for feedback-specific implementation notes.
+4. Use `myte create-prd <file.md>` only after the PRD markdown has been reviewed by a human, then send it with `--confirm-write --approval-artifact <path>`. The file body is the PRD document; `--description` is only the short board/card summary.
+5. Use `myte feedback status|edit|assign|archive` to create reviewable local artifacts, then `feedback submit` and `feedback review` for the owner-review membrane.
+6. Use `myte feedback move` only for direct board movement that is intentionally audited, with a clear `--reason`; use `--feedback-ids` for batch moves or batch archive.
+7. Use `myte suggestions create|revise|review` for mission review threads. Valid create `change_type` values are exactly `update` and `create`; revisions keep the existing thread type and must not include `change_type`.
+8. Use `myte mission archive` for project-key mission lifecycle archival. Archive requires Project Owner or elevated delegate capability; restore is web-only from the archived missions board.
+9. Use `myte update-team "<content>"` for project/team comments through `/api/project-assistant/project-comment`, and `myte feedback comment --feedback-id <id> --body-file ./comment.md` for feedback-specific implementation notes.
 
 PRD document contract:
 
@@ -248,7 +251,7 @@ The harness creates five disposable `TEST` feedback items from markdown, verifie
 
 ## Direct Project API Surface
 
-All routes use `Authorization: Bearer <MYTE_API_KEY>`. The CLI adds idempotency and client-session headers on mutation routes. Live project-content mutation routes also require write-approval headers; the official CLI supplies them from `--confirm-write --approval-artifact <path>`.
+All routes use `Authorization: Bearer <MYTE_API_KEY>`. The CLI adds idempotency and client-session headers on mutation routes.
 
 Read/sync routes:
 
@@ -265,11 +268,10 @@ Read/sync routes:
 - `GET /api/project-assistant/feedback/<feedback_id>/prd/versions/<version_id>/diff`
 - `GET /api/project-assistant/suggestions`
 - `GET /api/project-assistant/run-qaqc/<batch_id>`
-- `POST /api/project-assistant/query`
-- `POST /api/project-assistant/feedback/<feedback_id>/refinement/validate`
 
-Live project-content mutation routes:
+Mutation routes:
 
+- `POST /api/project-assistant/query`
 - `POST /api/project-assistant/run-qaqc`
 - `POST /api/project-assistant/mission-status-update`
 - `POST /api/project-assistant/mission-archive`
@@ -278,6 +280,7 @@ Live project-content mutation routes:
 - `POST /api/project-assistant/client-update-drafts`
 - `POST /api/project-assistant/create-prd`
 - `POST /api/project-assistant/create-prds`
+- `POST /api/project-assistant/feedback/<feedback_id>/refinement/validate`
 - `POST /api/project-assistant/feedback/<feedback_id>/refinement/requests`
 - `POST /api/project-assistant/feedback-review-requests/<request_id>/revise`
 - `POST /api/project-assistant/feedback/<feedback_id>/refinement/apply`

package/THIRD_PARTY_NOTICES.md

@@ -1,11 +1,11 @@
-# Third-Party Notices
-
-The `myte` package exposes the `mytecody` command. The command installs and
-launches a branded MyteCody engine and signed client assets from a Myte release
-manifest.
-
-The branded MyteCody engine is derived from the OpenAI Codex open-source
-project, version baseline `0.139.0`, licensed under Apache-2.0.
-
-Myte names, marks, logos, terminal branding, and product design are separate
-Myte-owned brand assets.
+# Third-Party Notices
+
+The `myte` package exposes the `mytecody` command. The command installs and
+launches a branded MyteCody engine and signed client assets from a Myte release
+manifest.
+
+The branded MyteCody engine is derived from the OpenAI Codex open-source
+project, version baseline `0.139.0`, licensed under Apache-2.0.
+
+Myte names, marks, logos, terminal branding, and product design are separate
+Myte-owned brand assets.

package/TRADEMARKS.md

@@ -1,10 +1,10 @@
-# Trademarks
-
-Myte, Myte AI, MyteCody, "MYTE CODY - Your Tech Your Way", logo assets, terminal
-animation assets, and related product branding are Myte-owned marks and brand
-assets.
-
-OpenAI and Codex are trademarks or project names of their respective owners.
-MyteCody uses a Codex-derived open-source engine under the applicable open
-source license, but MyteCody is a Myte product surface and is not presented as
-an official OpenAI product.
+# Trademarks
+
+Myte, Myte AI, MyteCody, "MYTE CODY - Your Tech Your Way", logo assets, terminal
+animation assets, and related product branding are Myte-owned marks and brand
+assets.
+
+OpenAI and Codex are trademarks or project names of their respective owners.
+MyteCody uses a Codex-derived open-source engine under the applicable open
+source license, but MyteCody is a Myte product surface and is not presented as
+an official OpenAI product.

package/bin/mytecody.js

@@ -1,19 +1,19 @@
-#!/usr/bin/env node
-"use strict";
-
-const cody = require("@mytegroupinc/myte-core/mytecody-cli");
-
-if (!cody || typeof cody.run !== "function") {
-  console.error("mytecody core entrypoint is unavailable.");
-  process.exit(1);
-}
-
-Promise.resolve(cody.run(process.argv.slice(2))).then(
-  (code) => {
-    process.exitCode = Number.isInteger(code) ? code : 0;
-  },
-  (err) => {
-    console.error("Unexpected error:", err?.message || err);
-    process.exitCode = 1;
-  },
-);
+#!/usr/bin/env node
+"use strict";
+
+const cody = require("@mytegroupinc/myte-core/mytecody-cli");
+
+if (!cody || typeof cody.run !== "function") {
+  console.error("mytecody core entrypoint is unavailable.");
+  process.exit(1);
+}
+
+Promise.resolve(cody.run(process.argv.slice(2))).then(
+  (code) => {
+    process.exitCode = Number.isInteger(code) ? code : 0;
+  },
+  (err) => {
+    console.error("Unexpected error:", err?.message || err);
+    process.exitCode = 1;
+  },
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "myte",
-  "version": "0.0.45",
+  "version": "0.0.46",
   "description": "Myte developer CLI.",
   "type": "commonjs",
   "license": "MIT",
@@ -19,6 +19,6 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@mytegroupinc/myte-core": "0.0.45"
-  }
-}
+    "@mytegroupinc/myte-core": "0.0.46"
+  }
+}