coding-os 0.3.16__tar.gz → 0.3.18__tar.gz

{coding_os-0.3.16 → coding_os-0.3.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-os
-Version: 0.3.16
+Version: 0.3.18
 Summary: The cognitive operating system that gives AI agents memory, structure, and discipline
 Author-email: Kourosh Ebrahimzadeh <info@coding-os.dev>
 License-Expression: Apache-2.0

{coding_os-0.3.16 → coding_os-0.3.18}/coding_os.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-os
-Version: 0.3.16
+Version: 0.3.18
 Summary: The cognitive operating system that gives AI agents memory, structure, and discipline
 Author-email: Kourosh Ebrahimzadeh <info@coding-os.dev>
 License-Expression: Apache-2.0

{coding_os-0.3.16 → coding_os-0.3.18}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "coding-os"
-version = "0.3.16"
+version = "0.3.18"
 description = "The cognitive operating system that gives AI agents memory, structure, and discipline"
 readme = "README.md"
 requires-python = ">=3.10"

{coding_os-0.3.16 → coding_os-0.3.18}/src/core/rules/git-workflow.md

@@ -18,6 +18,20 @@
 - **Self-review before each commit, never self-approve:** re-read the diff + run the Verification-Matrix command for what changed *before* committing; authoritative review is a separate pass (`reviewer` role, `/code-review`, CI).
 - Every commit obeys the Commit Message Contract below.
 
+### The three tiers — reversibility decides who may act
+
+| Tier | Examples | Who decides |
+|---|---|---|
+| **Commit** — local, undone by `git restore` | any self-verified logical unit | agent, unprompted |
+| **Push / merge** — public but revertable | push to `main`, merging a green dependency PR | agent at task close or on ask; `git revert` is the undo |
+| **Publish** — irreversible, leaves the repo | package-registry upload, GitHub Release, deploy, anything mailed or posted outward | **human only** — ask every time |
+
+A published version cannot be replaced: PyPI, npm and crates.io all refuse re-upload of a yanked version, so a bad publish is permanent in a way no git operation is. Approval to publish **one** version is not approval for the next; re-ask.
+
+A machine gate can enforce the bottom row where the platform offers one — on GitHub a [deployment environment](https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments) with `required_reviewers` on the publishing job (leave `prevent_self_review` off for a solo maintainer, or the only approver is locked out; a `wait_timer` is the softer variant that ships automatically but leaves a cancel window).
+
+**coding-os itself runs with that gate off, deliberately.** It was added and removed the same day: a one-maintainer release train pays the approval cost on *every* version, while the failure it prevents — shipping a version you did not mean to — has not happened, and CI already gates the merge that produces the tag. Automation an operator has to babysit gets routed around, which ends worse than not having it. So the tier above is a **rule the agent follows**, not a wall the platform enforces: ask before publishing, every time. A project with more than one maintainer, or where a bad publish is expensive, should turn the environment gate on — the tier does not change, only who enforces it.
+
 ## Concurrent sessions
 
 **Safe:** parallel sessions on `main` — commits, pushes, and test runs all serialize-and-retry; an abandoned session's committed work is already on `main`. **⚠️ Care:** two sessions editing the same file (last write wins — dirty-tree notice at SessionStart), and mid-editing a `block-*` safety hook (next section).

{coding_os-0.3.16 → coding_os-0.3.18}/src/templates/spring-boot/scaffold/src/backend/pom.xml

@@ -23,6 +23,11 @@
          @JsonView/case-insensitive deserialization bypasses. Drop this
          override once spring-boot-starter-parent manages >= 2.21.5. -->
     <jackson-bom.version>2.21.5</jackson-bom.version>
+    <!-- Ahead of the parent's managed 2.24.3, which is inside the range of
+         CVE-2026-49844 (GHSA-qv9r-c865-cp47): MapMessage JSON serialization
+         emits non-finite floats unencoded, producing invalid JSON downstream.
+         Drop this override once the parent manages >= 2.25.5. -->
+    <log4j2.version>2.25.5</log4j2.version>
   </properties>
 
   <dependencies>