orionfold-relay 0.19.0 → 0.20.0

package/README.md

@@ -104,10 +104,13 @@ The governance is *in* the workflow, not bolted on. A blueprint is a fixed step
 ## Why it stays trustworthy
 
 - **Local-first** — SQLite database, no cloud dependency, `npx orionfold-relay` and go
+- **Never phones home** — no telemetry, no update checks, no license server; the complete outbound-network inventory is documented and code-linked in [docs/trust/data-flow.md](docs/trust/data-flow.md)
 - **Your rules, enforced** — tool permissions, inbox approvals, and audit trails for every agent action
 - **Your AI team** — 21 specialist profiles ready to deploy, each with instructions, tool policies, and runtime tuning
 - **Know what you spend** — usage metering, budgets, and per-provider/per-model spend visibility on governed runs
-- **Open source** — Apache-2.0, read the engine and run it yourself
+- **Open source & verifiable** — Apache-2.0, read the engine and run it yourself; every npm release ships with a provenance attestation and a CycloneDX SBOM ([docs/trust/supply-chain.md](docs/trust/supply-chain.md))
+
+Evaluating Relay for an enterprise? The full trust pack — [security packet](docs/trust/security-packet.md), [data-flow disclosure](docs/trust/data-flow.md), [supply-chain verification](docs/trust/supply-chain.md), [plain-language license terms](docs/trust/license-terms.md), and [continuity statement](docs/trust/continuity.md) — lives in [`docs/trust/`](docs/trust/). Vulnerability reports: [SECURITY.md](SECURITY.md).
 
 <img src="https://raw.githubusercontent.com/orionfold/relay/main/public/readme/inbox-list.png" alt="The governance command center: tool-permission approvals, agent questions, and a permission queue — nothing reaches a client without sign-off" width="1200" />
 
@@ -139,6 +142,9 @@ relay license remove <license-id>                            # forget a license
 - **What's free stays free.** Capabilities never move from the free engine into a paid
   pack. Paid packs are new content, not repossessed features.
 
+The full terms in plain language — seats, transfer, what expiry does and doesn't do —
+are in [docs/trust/license-terms.md](docs/trust/license-terms.md).
+
 ---
 
 ## Runtime bridge

package/dist/cli.js

@@ -1186,7 +1186,7 @@ var CURRENT_PLUGIN_API_VERSION, CAPABILITY_VALUES, ORIGIN_VALUES, PrimitivesBund
 var init_types = __esm({
   "src/lib/plugins/sdk/types.ts"() {
     "use strict";
-    CURRENT_PLUGIN_API_VERSION = "0.19";
+    CURRENT_PLUGIN_API_VERSION = "0.20";
     CAPABILITY_VALUES = ["fs", "net", "child_process", "env"];
     ORIGIN_VALUES = ["ainative-internal", "third-party"];
     PrimitivesBundleManifestSchema = z.object({
@@ -12891,7 +12891,7 @@ var init_registry6 = __esm({
     init_registry5();
     init_installer();
     init_schedule_spec();
-    SUPPORTED_API_VERSIONS = /* @__PURE__ */ new Set([CURRENT_PLUGIN_API_VERSION, "0.18"]);
+    SUPPORTED_API_VERSIONS = /* @__PURE__ */ new Set([CURRENT_PLUGIN_API_VERSION, "0.19"]);
     pluginCache = null;
     lastLoadedPluginIds = /* @__PURE__ */ new Set();
     PluginTableSchema = z16.object({
@@ -25623,8 +25623,8 @@ import { execFileSync as execFileSync3 } from "child_process";
 import yaml12 from "js-yaml";
 import semver from "semver";
 function relayCoreVersion() {
-  if (semver.valid("0.19.0")) {
-    return "0.19.0";
+  if (semver.valid("0.20.0")) {
+    return "0.20.0";
   }
   try {
     const root = getAppRoot(import.meta.dirname, 3);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orionfold-relay",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Orionfold Relay — a local-first, multi-agent orchestration runtime and builder scaffold for AI-native work.",
   "keywords": [
     "ai",

package/src/lib/plugins/examples/echo-server/plugin.yaml

@@ -1,6 +1,6 @@
 id: echo-server
 version: 0.1.0
-apiVersion: "0.19"
+apiVersion: "0.20"
 kind: chat-tools
 name: Echo Server
 description: |

package/src/lib/plugins/examples/finance-pack/plugin.yaml

@@ -1,6 +1,6 @@
 id: finance-pack
 version: 0.1.0
-apiVersion: "0.19"
+apiVersion: "0.20"
 kind: primitives-bundle
 name: Finance Pack
 description: |

package/src/lib/plugins/examples/reading-radar/plugin.yaml

@@ -1,6 +1,6 @@
 id: reading-radar
 version: 0.1.0
-apiVersion: "0.19"
+apiVersion: "0.20"
 kind: primitives-bundle
 name: Reading Radar
 description: |

package/src/lib/plugins/registry.ts

@@ -53,7 +53,7 @@ import type { ScheduleSpec } from "@/lib/validators/schedule-spec";
 // unfixed from 0.15.0 through 0.16.0 — treat the window test's failure as
 // a release blocker, not noise). The 0.13→0.14 three-MINOR bridge is over;
 // this is the standard 2-MINOR window now.
-const SUPPORTED_API_VERSIONS = new Set([CURRENT_PLUGIN_API_VERSION, "0.18"]);
+const SUPPORTED_API_VERSIONS = new Set([CURRENT_PLUGIN_API_VERSION, "0.19"]);
 
 /** Test-helper export so the window-enforcement test can read state. */
 export function isSupportedApiVersion(apiVersion: string): boolean {

package/src/lib/plugins/sdk/types.ts

@@ -6,7 +6,7 @@ import { z } from "zod";
 // (a hardcoded copy there once drifted to "0.14" — scaffolded plugins would
 // have been disabled on load the moment the window tightened). Bump on every
 // MINOR release; api-version-window.test.ts fails if this goes stale.
-export const CURRENT_PLUGIN_API_VERSION = "0.19";
+export const CURRENT_PLUGIN_API_VERSION = "0.20";
 
 // Shared capability tuple — single source of truth used by Zod schema and
 // capability-check.ts hash derivation. Exported so consumers don't need a