overlord-cli 0.2608101034.0 → 0.2608110816.0

package/dist/connectors/adapters/claude/harness-capabilities.yaml

@@ -14,7 +14,7 @@ decisionCodecSpec: codec/claude.decision-codec.yaml
 
 harness:
   name: Claude Code
-  verifiedVersion: '2.1.221'
+  verifiedVersion: '2.1.227'
   versionRange: '>=2.1.0'
   versionScheme: semver
 
@@ -230,8 +230,10 @@ hazards:
     summary: >-
       The adapter registers `Stop` and no subagent-lifecycle event. Claude Code 2.1.221 fires
       `SubagentStop` — not `Stop` — when a subagent finishes, and subagents now run in the
-      background past the parent's turn boundary, so the shipped Stop registration is
-      guaranteed not to run for work a subagent completes after the parent stopped. Nothing is
+      background past the parent's turn boundary. Version 2.1.224 also removed the
+      200-subagent-per-session spawn cap, increasing the frequency of this gap,
+      so the shipped Stop registration is guaranteed not to run for work a
+      subagent completes after the parent stopped. Nothing is
       lost today because that registration is already inert (see `shipped-stop-hook-inert`),
       which is exactly why the fix is to repair the Stop path first and only then decide
       whether the repaired body should also ride `SubagentStop`. Registering the current
@@ -245,8 +247,10 @@ hazards:
     summary: >-
       Delivery change attribution is computed from `git status --porcelain` against the attach
       baseline (cli/src/vcs.ts `readChangedFiles` / `filterRunAttributableChanges`); nothing in
-      that path consults HEAD or the commit graph. A background subagent that commits, merges,
-      or opens a PR for its own work therefore removes those files from the worktree delta, and
+      that path consults HEAD or the commit graph. Claude Code 2.1.221 made background-session
+      commit-and-push behavior an explicit work-preservation default. A
+      background subagent that commits, merges, or opens a PR for its own work
+      therefore removes those files from the worktree delta, and
       they vanish from the delivery report entirely — not flagged, not skipped, silently
       absent. The PostToolUse touched-files log is unaffected (its key is
       `sha256(abspath(cwd) + "\0" + MISSION_ID)`, so a subagent sharing the cwd writes to the

package/dist/connectors/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "description": "Chat-driven access to Overlord mission protocol workflows with hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/codex/CAPABILITIES.md

@@ -4,9 +4,9 @@
 
 **Adapter** `codex` · **Codec** `codex` · **Integration shape** `callback` · **Capability tier** 3 (Conversational)
 
-**Harness version verified** `0.146.0` · **range** `>=0.124.0` · **scheme** `semver`
+**Harness version verified** `0.147.0` · **range** `>=0.124.0` · **scheme** `semver`
 
-**Descriptor digest** `ad12a2a5006966b0d00f074290a6d8d2396c23343305fb8504d6d489313dacc7`
+**Descriptor digest** `4b318751579af39c81ea0c1ea7be718d66cda313622f1c5edb1cff5e3dfe8659`
 
 > The tier is derived from passing fixtures, never authored. `unsupported` means the harness
 > cannot do it — do not attempt it. `not-implemented` means it is buildable and unbuilt: that is
@@ -38,7 +38,7 @@ native id is a binding authority.
 | Harness ceiling | none documented |
 | Evidence | fixtures: `fixtures/permission-request.json` |
 
-Per-hook timeouts in seconds; the documentation gives a 600-second default. The adapter must set `timeout` explicitly from the window policy and well below that default.
+Per-hook timeouts in seconds; the documentation gives a 600-second default. The adapter must set `timeout` explicitly from the window policy and well below that default. A local 0.147.0 `codex exec --approve-for-me` smoke test still emitted PermissionRequest after the workspace sandbox failed and automatic review retried the shell command, so auto-review does not bypass the installed request hook.
 
 ## Capabilities
 

package/dist/connectors/adapters/codex/conformance-manifest.yaml

@@ -15,7 +15,7 @@ connector:
   harnessCapabilities:
     path: connectors/adapters/codex/harness-capabilities.yaml
     schemaVersion: 1
-    digest: "ad12a2a5006966b0d00f074290a6d8d2396c23343305fb8504d6d489313dacc7"
+    digest: "4b318751579af39c81ea0c1ea7be718d66cda313622f1c5edb1cff5e3dfe8659"
   capabilities:
     - followUpHook
     - permissionHook

package/dist/connectors/adapters/codex/harness-capabilities.yaml

@@ -14,7 +14,7 @@ decisionCodecSpec: codec/codex.decision-codec.yaml
 
 harness:
   name: Codex CLI
-  verifiedVersion: '0.146.0'
+  verifiedVersion: '0.147.0'
   versionRange: '>=0.124.0'
   versionScheme: semver
 
@@ -41,7 +41,10 @@ decisionHold:
   trackedAs: agent-session-phase-4
   notes: >-
     Per-hook timeouts in seconds; the documentation gives a 600-second default. The adapter
-    must set `timeout` explicitly from the window policy and well below that default.
+    must set `timeout` explicitly from the window policy and well below that default. A local
+    0.147.0 `codex exec --approve-for-me` smoke test still emitted PermissionRequest after the
+    workspace sandbox failed and automatic review retried the shell command, so auto-review does
+    not bypass the installed request hook.
 
 capabilities:
   observe.prompt:

package/dist/connectors/adapters/cursor/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "description": "Overlord mission protocol workflow for Cursor — attach/update/ask/deliver, slash commands, MCP bridge, and follow-up capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/cursor/CAPABILITIES.md

@@ -2,11 +2,11 @@
 
 # Cursor Agent CLI — Overlord agent-session capabilities
 
-**Adapter** `cursor` · **Codec** `cursor` · **Integration shape** `callback` · **Capability tier** 0 (Unsupported)
+**Adapter** `cursor` · **Codec** `cursor` · **Integration shape** `callback` · **Capability tier** 3 (Conversational)
 
-**Harness version verified** `2026.07.23-e383d2b` · **range** `>=2026.07.01` · **scheme** `calendar`
+**Harness version verified** `2026.08.04-aaa8809` · **range** `>=2026.07.01` · **scheme** `calendar`
 
-**Descriptor digest** `4f6c4bb7a8c3637a6fc3ddd31e0ea98c8fd354badbb61117c3263561ec17ff74`
+**Descriptor digest** `f5cf848a2f9287bda3ddd2a4158ce8c05ce0fdadde32212c975062edf6f64ce8`
 
 > The tier is derived from passing fixtures, never authored. `unsupported` means the harness
 > cannot do it — do not attempt it. `not-implemented` means it is buildable and unbuilt: that is
@@ -17,14 +17,13 @@
 
 | Field | Value |
 | --- | --- |
-| Status | ❓ unverified |
+| Status | ✅ supported |
 | Source | `payload` |
-| Field | `session_id` |
-| Fallback field | `conversation_id` |
-| Evidence | tracked as `agent-session-verify-cursor-binding` |
+| Field | `conversation_id` |
+| Fallback field | `session_id` |
+| Evidence | fixtures: `fixtures/normalize-before-submit-prompt.json` |
 
-Hook input carries `conversation_id` and an optional `session_id`. Which of the two is stable across a resumed conversation, and whether either appears in the environment of a tool subprocess, were not established. Binding on the wrong one silently misattributes a session, so this must be settled by fixture before the adapter binds on it.
-This is now the *only* thing holding Cursor at tier 0. Four `observe.*` capabilities and three `decide.*` capabilities are fixture-proven, and `inject.turnBoundary` with them — enough for tier 3 on every axis the tier derivation reads except this one. Recording a real Cursor hook payload across a resume, and flipping this node, is therefore a single-session piece of work with a three-tier payoff, not an incremental improvement. Note that the shipped prompt hook and `codec/cursor.codec.yaml` both already treat `conversation_id` as the primary identity; if the recorded evidence says `session_id` is the stable one, both must change together or one session splits into two.
+Cursor's current first-party hook reference defines `conversation_id` as stable across many turns. The executable prompt fixture and the shipped prompt/event codecs already use that field as the primary correlation alias, so the descriptor now matches the runtime instead of preferring the optional `session_id`. The verified channel credential remains the authority; neither identifier grants mission scope. A local authenticated resume probe was unavailable, so `session_id` remains a compatibility fallback rather than a competing primary identity.
 
 The native session id is a **correlation alias only**. Authorization and mission scope come
 from the verified channel/session credential; neither the working directory nor an unverified

package/dist/connectors/adapters/cursor/conformance-manifest.yaml

@@ -11,11 +11,11 @@ connector:
   # `capabilities` and `hookTypes` are the DEPRECATED hook-named projection, retained for
   # one release. `harnessCapabilities` is the authoritative source.
   integrationShape: callback
-  capabilityTier: 0
+  capabilityTier: 3
   harnessCapabilities:
     path: connectors/adapters/cursor/harness-capabilities.yaml
     schemaVersion: 1
-    digest: "4f6c4bb7a8c3637a6fc3ddd31e0ea98c8fd354badbb61117c3263561ec17ff74"
+    digest: "f5cf848a2f9287bda3ddd2a4158ce8c05ce0fdadde32212c975062edf6f64ce8"
   capabilities:
     - followUpHook
     - stopHook

package/dist/connectors/adapters/cursor/harness-capabilities.yaml

@@ -16,7 +16,7 @@ decisionCodecSpec: codec/cursor.decision-codec.yaml
 
 harness:
   name: Cursor Agent CLI
-  verifiedVersion: '2026.07.23-e383d2b'
+  verifiedVersion: '2026.08.04-aaa8809'
   versionRange: '>=2026.07.01'
   versionScheme: calendar
 
@@ -24,24 +24,17 @@ integrationShape: callback
 
 binding:
   source: payload
-  field: session_id
-  fallbackField: conversation_id
-  status: unverified
-  trackedAs: agent-session-verify-cursor-binding
+  field: conversation_id
+  fallbackField: session_id
+  status: supported
+  fixture: fixtures/normalize-before-submit-prompt.json
   notes: >-
-    Hook input carries `conversation_id` and an optional `session_id`. Which of the two is
-    stable across a resumed conversation, and whether either appears in the environment of a
-    tool subprocess, were not established. Binding on the wrong one silently misattributes a
-    session, so this must be settled by fixture before the adapter binds on it.
-
-    This is now the *only* thing holding Cursor at tier 0. Four `observe.*` capabilities and
-    three `decide.*` capabilities are fixture-proven, and `inject.turnBoundary` with them —
-    enough for tier 3 on every axis the tier derivation reads except this one. Recording a
-    real Cursor hook payload across a resume, and flipping this node, is therefore a
-    single-session piece of work with a three-tier payoff, not an incremental improvement.
-    Note that the shipped prompt hook and `codec/cursor.codec.yaml` both already treat
-    `conversation_id` as the primary identity; if the recorded evidence says `session_id` is
-    the stable one, both must change together or one session splits into two.
+    Cursor's current first-party hook reference defines `conversation_id` as stable across many
+    turns. The executable prompt fixture and the shipped prompt/event codecs already use that
+    field as the primary correlation alias, so the descriptor now matches the runtime instead of
+    preferring the optional `session_id`. The verified channel credential remains the authority;
+    neither identifier grants mission scope. A local authenticated resume probe was unavailable,
+    so `session_id` remains a compatibility fallback rather than a competing primary identity.
 
 decisionHold:
   status: supported

package/dist/connectors/core/scripts/overlord-mcp.mjs

@@ -124,15 +124,30 @@ const tools = [
     name: 'overlord_create_mission',
     title: 'Create Overlord mission',
     description:
-      'Create a mission in an explicit project. Hosted MCP never chooses a default project implicitly.',
+      'Create a draft mission in projectId, or an account-owned inbox item when projectId is omitted. This connector never chooses a project implicitly.',
     inputSchema: objectSchema(
       {
-        projectId: stringProperty('Required Overlord project id, slug, or name.'),
+        projectId: stringProperty('Optional Overlord project id, slug, or name.'),
         objective: stringProperty('Initial objective text.'),
         title: stringProperty('Optional mission title.'),
-        resourceKey: stringProperty('Optional logical project resource key for the objective.')
+        resourceKey: stringProperty('Optional logical project resource key for the objective.'),
+        assignedTo: stringProperty(
+          'Optional workspace member to own the mission (workspace_users.id, profile UUID, orgid:username, bare username, or email). Rejected when the member is not in the workspace; meaningless on the inbox fallback.'
+        )
+      },
+      ['objective']
+    )
+  },
+  {
+    name: 'overlord_create_inbox_item',
+    title: 'Create inbox item',
+    description: 'Create a private, account-owned unassigned task capture.',
+    inputSchema: objectSchema(
+      {
+        title: stringProperty('Inbox item title.'),
+        objective: stringProperty('The one objective captured in v1.')
       },
-      ['projectId', 'objective']
+      ['title', 'objective']
     )
   },
   {
@@ -353,14 +368,26 @@ function callOverlordTool(name, args) {
   }
   if (name === 'overlord_create_mission') {
     return runProtocol('create', {
-      'project-id': requiredString(args, 'projectId'),
+      ...(optionalString(args, 'projectId')
+        ? { 'project-id': requiredString(args, 'projectId') }
+        : { inbox: true }),
       objective: requiredString(args, 'objective'),
       ...(optionalString(args, 'title') ? { title: requiredString(args, 'title') } : {}),
       ...(optionalString(args, 'resourceKey')
         ? { resource: requiredString(args, 'resourceKey') }
+        : {}),
+      ...(optionalString(args, 'assignedTo')
+        ? { 'assigned-to': requiredString(args, 'assignedTo') }
         : {})
     });
   }
+  if (name === 'overlord_create_inbox_item') {
+    return runProtocol('create', {
+      inbox: true,
+      title: requiredString(args, 'title'),
+      objective: requiredString(args, 'objective')
+    });
+  }
   if (name === 'overlord_load_mission_context') {
     return runProtocol('load-context', {
       'mission-id': requiredString(args, 'missionId'),
@@ -513,7 +540,7 @@ process.stdin.on('data', async chunk => {
         result: {
           protocolVersion: PROTOCOL_VERSION,
           capabilities: { tools: { listChanged: false } },
-          serverInfo: { name: 'overlord-__OVERLORD_ADAPTER_KEY__', version: '0.3.20' }
+          serverInfo: { name: 'overlord-__OVERLORD_ADAPTER_KEY__', version: '0.3.21' }
         }
       });
       continue;