snipara-companion 3.7.1 → 3.7.3

package/CHANGELOG.md

@@ -4,6 +4,50 @@ Release notes for `snipara-companion`, newest first.
 
 ## Unreleased
 
+## New In 3.7.3
+
+- Restores source-bound Controller return projection for exact runtime context:
+  re-reads the bound context map, checks its hash and version, and reconstructs
+  the complete bridge identity. Verifies the Controller task context while
+  accepting Python's null representation of an omitted optional target attempt.
+  Regression qualification covers the corrected 3.7.2 candidate and the 3.7.3
+  release artifact; public round-trip tests assert the selected CLI version.
+
+## New In 3.7.2
+
+- Bundles the ESM-only runtime dependency graphs for the CommonJS Node 18
+  entry point, preserving the declared engine range. The public source mirror
+  carries the same build configuration.
+
+- Applies the canonical workflow version gate in the task facade before reading
+  or admitting a task. Unknown or missing versions refuse without creating a
+  partial task; existing workflow v1/v2 remain readable.
+
+- Documents exact local artifact installation, additive contract compatibility
+  and independently optional Companion/Orchestrator use. Public integration
+  suites can explicitly target an installed CLI and reject an invalid override
+  instead of silently testing the checkout build.
+
+- Adds a five-step local task facade and immutable local/GitHub intake, with no
+  required account, Orchestrator or implicit worker/network calls.
+- Exports exact task source bodies through the optional reviewed Controller
+  bridge while preserving legacy reference-only contracts and authority gates.
+
+- Adds local work-state checkpoints and revalidated resume briefs with decisions,
+  reasons, failed attempts, bound evidence, remaining checks and next actions.
+- Preserves initial dirty changes and detects HEAD, index, source and artifact
+  drift; keeps offline snapshots historical and Orchestrator optional.
+- Rejects unsafe context-pack paths, linked files and altered saved content before use.
+
+- Compiles numeric and explicit planner identities into one validated workflow graph,
+  retaining task-specific retrieval parameters and advisory operation metadata.
+- Loads required source chunks before starting context-bearing tasks, with bounded
+  context packs, per-attempt receipts, source identity checks and preparation deadlines.
+- Preserves context preparation through phase commands and restores verified local
+  snapshots when hosted session context is unavailable; snapshots do not imply freshness.
+- Rejects marked MCP error results and keeps task preparation failures separate from
+  executed attempts, task correctness and independent objective acceptance.
+
 ## New In 3.7.1
 
 - Preserves expected results and bounded source context in Controller task queries;

package/README.md

@@ -2,14 +2,24 @@
 
 [![npm version](https://img.shields.io/npm/v/snipara-companion.svg)](https://www.npmjs.com/package/snipara-companion)
 [![CI](https://github.com/Snipara/snipara-companion/actions/workflows/ci.yml/badge.svg)](https://github.com/Snipara/snipara-companion/actions/workflows/ci.yml)
-[![MIT License](https://img.shields.io/badge/license-MIT-yellow.svg)](./LICENSE)
+[![MIT License](https://img.shields.io/badge/license-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Node >=18](https://img.shields.io/badge/node-%3E%3D18-339933.svg)](./package.json)
 
 **Ask your repo what breaks if you touch this.**
 
 No global install. No account. Your code stays on your machine.
 
-`create-snipara` is the canonical activation engine. Use it first when a repo
+Start one local task with `snipara-companion task start "Goal" --accept "Criterion"
+--file src/service.ts`, then use `task work`, `task verify`, `task decide` and
+`task resume`. The [five-step journey](./docs/TASK_JOURNEY.md) reuses existing
+workflow artifacts. Companion and Orchestrator are optional and independent;
+this local path needs neither Hosted activation nor Orchestrator.
+
+For prepared package files and supported optional combinations, see
+[distribution and compatibility](./docs/DISTRIBUTION.md). Installed artifact
+verification is separate from publication and from a completed human pilot.
+
+`create-snipara` is the canonical Hosted activation engine. Use it when a repo
 needs Hosted MCP config, editor/client files, a First Work Brief, and
 review-only memory candidates. Use `snipara-companion` after that first
 activation for local continuity: source refresh, impact checks, workflow phase
@@ -203,6 +213,10 @@ impact, or handoff logic.
 
 #### Task-level execution
 
+Tasks can load their own cited source bodies before starting. See
+[task-local source context](docs/TASK_CONTEXT.md) for request fields, planner
+compatibility, bounded receipts, offline resume and evidence limits.
+
 Each managed phase now contains a normalized task contract. Existing
 phase-only plans are migrated in memory to one task per phase, so older
 `.snipara/workflow/current.json` files remain readable. A planner may add
@@ -675,6 +689,11 @@ snipara-companion workflow resume
 
 ## Command Reference
 
+Resume work with decisions, failed attempts, evidence and remaining checks using
+`workflow resume`. Use `workflow checkpoint` to bind the current state explicitly.
+This works independently of Orchestrator. See [work continuity](./docs/WORK_CONTINUITY.md)
+for drift states, offline behavior and evidence limits.
+
 The previous long README has moved to [docs/FULL_REFERENCE.md](./docs/FULL_REFERENCE.md).
 Start there for the full command list, hook setup, hosted MCP bridge commands,
 workflow modes, team-sync, local context packs, and release-oriented flows.