mempalace-code 1.10.3__tar.gz → 1.11.0__tar.gz

{mempalace_code-1.10.3 → mempalace_code-1.11.0}/.claude/skills/release/SKILL.md

@@ -111,12 +111,55 @@ unavailable and the user explicitly approves the fallback.
 
 ### Step 6: Verify Hosted Status
 
-Check all public surfaces separately:
+Run the release-status gate first. It checks every public publication surface
+and exits non-zero when any blocker remains:
 
 ```bash
+python scripts/release_status_gate.py --version X.Y.Z \
+  --repo rergards/mempalace-code \
+  --remote publish \
+  --branch main
+```
+
+The gate checks:
+1. publish remote git tag (`v X.Y.Z` on the `publish` remote)
+2. branch Tests workflow — most recent completed run on `main` must be green
+3. Publish to PyPI workflow — most recent completed run must be green
+4. GitHub Release metadata — non-draft, non-prerelease, `isLatest=true`
+5. PyPI JSON — `info.version == X.Y.Z` and both wheel and sdist present
+6. Install smoke — `pip install --no-cache-dir mempalace-code==X.Y.Z` in a disposable venv
+
+A release is **not shipped** when any blocker remains. Report the gate's
+`Remaining blockers` list verbatim in the release summary and do not use
+"shipped" or "latest" language until the gate exits 0.
+
+For machine-readable status (e.g. Autopilot gating):
+
+```bash
+python scripts/release_status_gate.py --version X.Y.Z --json
+```
+
+**Diagnostic-only mode** (skips install smoke; cannot be labeled fully shipped):
+
+```bash
+python scripts/release_status_gate.py --version X.Y.Z --skip-smoke
+```
+
+If the gate finds blockers, investigate the specific surface that failed.
+Manual fallback diagnostics for individual surfaces:
+
+```bash
+# Tag
+git ls-remote --tags publish "refs/tags/vX.Y.Z"
+
+# Workflows
 gh run list --repo rergards/mempalace-code --branch main --workflow Tests --limit 5
 gh run list --repo rergards/mempalace-code --workflow "Publish to PyPI" --limit 5
+
+# GitHub Release
 gh release view vX.Y.Z --repo rergards/mempalace-code
+
+# PyPI JSON
 python - <<'PY'
 import json, urllib.request
 version = "X.Y.Z"
@@ -126,10 +169,6 @@ assert data["info"]["version"] == version
 PY
 ```
 
-If the branch Tests run is red, the tag publish succeeded but the release is not
-clean. Fix and publish a follow-up patch before creating or advertising the
-GitHub Release as latest.
-
 If PyPI is visible but `gh release view` reports no release, create the GitHub
 Release only after hosted Tests are green:
 
@@ -151,11 +190,8 @@ tokens, hostnames, or incident-only details.
 Version: X.Y.Z
 Tag: vX.Y.Z
 Pushed to publish: [yes/no]
-Hosted Tests: [pass/fail/not-run]
-Publish to PyPI: [pass/fail/not-run]
-PyPI visible: [yes/no]
-GitHub Release: [created/existing/missing]
+Release status gate: [passed/failed]
 
 Remaining blockers:
-- [none or exact blocker]
+- [none or exact blocker from release_status_gate.py output]
 ```

{mempalace_code-1.10.3 → mempalace_code-1.11.0}/.claude/skills/verify/INSTRUCTIONS.md

@@ -49,6 +49,16 @@ Run in parallel:
 | Format | `ruff format --check mempalace_code/ tests/ scripts/` | 30s |
 | Tests | `python -m pytest tests/ -x -q -m "not needs_network"` | 120s |
 | Typecheck | `python -m pyright --pythonpath "$(python -c 'import sys; print(sys.executable)')"` | 120s |
+| Strict slice typecheck | `python -m pyright -p pyrightconfig.strict.json` | 60s |
+| Public safety | `python scripts/public_safety_scan.py --tracked --staged` | 30s |
+| Scorecard | `python scripts/quality_scorecard.py --check` | 30s |
+
+The scorecard check is stdlib-only (no install, no network) and validates the
+quality scorecard's shape, determinism, public-safety, and committed artifact
+freshness. The public-safety scan checks tracked and staged repository files for
+private local paths, secret-like tokens, and local-only raw artifacts. After a
+quality change lands, regenerate the committed artifacts with
+`python scripts/quality_scorecard.py --write` (see `docs/quality/README.md`).
 
 ### If storage changed — add these
 

{mempalace_code-1.10.3 → mempalace_code-1.11.0}/.github/workflows/ci.yml

@@ -59,8 +59,12 @@ jobs:
             pyproject.toml
             uv.lock
       - run: pip install ruff
-      - run: ruff check mempalace_code/ tests/
-      - run: ruff format --check mempalace_code/ tests/
+      - run: ruff check mempalace_code/ tests/ scripts/
+      - run: ruff format --check mempalace_code/ tests/ scripts/
+      - name: Public-safety scan (tracked + staged)
+        run: python scripts/public_safety_scan.py --tracked --staged
+      - name: Quality scorecard (shape + determinism + public-safety)
+        run: python scripts/quality_scorecard.py --check
 
   typecheck:
     runs-on: ubuntu-latest
@@ -76,6 +80,27 @@ jobs:
       - run: pip install -e ".[dev,chroma,spellcheck,treesitter]"
       - name: Pyright typecheck
         run: python -m pyright --pythonpath "$(python -c 'import sys; print(sys.executable)')"
+      - name: Pyright strict slice
+        run: python -m pyright -p pyrightconfig.strict.json
+
+  dependency-upgrade-gate:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'workflow_dispatch'
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: |
+            pyproject.toml
+            uv.lock
+      - name: Dependency upgrade gate
+        run: |
+          python scripts/dependency_upgrade_gate.py ci-check \
+            --base-ref "${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}"
 
   model-tests:
     runs-on: ubuntu-latest

mempalace_code-1.11.0/.github/workflows/dependency-audit.yml

@@ -0,0 +1,86 @@
+name: Dependency Audit
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"  # Weekly on Monday at 06:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  current-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: |
+            pyproject.toml
+            uv.lock
+
+      - name: Install audit dependencies
+        run: pip install pip-audit
+
+      - name: Run current dependency audit
+        id: audit
+        run: |
+          set +e
+          python scripts/dependency_upgrade_gate.py current-audit \
+            --out-dir dependency-audit-output
+          rc=$?
+          echo "audit_exit=$rc" >> "$GITHUB_OUTPUT"
+          exit $rc
+        continue-on-error: true
+
+      - name: Upload audit artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: dependency-audit-report
+          path: dependency-audit-output/
+          if-no-files-found: warn
+
+      - name: Create or update dependency-audit issue
+        if: steps.audit.outcome == 'failure'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          ISSUE_TITLE="[dependency-audit] current dependency audit findings"
+          ISSUE_BODY_FILE="dependency-audit-output/current-audit-issue-body.md"
+          ISSUE_LABEL="dependency-audit"
+
+          if [ ! -f "$ISSUE_BODY_FILE" ]; then
+            echo "No issue body file found; skipping issue creation." >&2
+            exit 0
+          fi
+
+          # Find existing open issue with the stable title
+          EXISTING=$(gh issue list \
+            --state open \
+            --search "\"$ISSUE_TITLE\" in:title" \
+            --json number \
+            --jq '.[0].number // empty' 2>/dev/null || true)
+
+          if [ -n "$EXISTING" ]; then
+            gh issue edit "$EXISTING" --body-file "$ISSUE_BODY_FILE"
+            echo "Updated existing issue #$EXISTING"
+          else
+            gh issue create \
+              --title "$ISSUE_TITLE" \
+              --body-file "$ISSUE_BODY_FILE" \
+              --label "$ISSUE_LABEL" 2>/dev/null || \
+            gh issue create \
+              --title "$ISSUE_TITLE" \
+              --body-file "$ISSUE_BODY_FILE"
+          fi
+
+      - name: Fail workflow on audit findings
+        if: steps.audit.outcome == 'failure'
+        run: |
+          echo "Dependency audit found actionable findings. See uploaded artifact and issue."
+          exit 1

{mempalace_code-1.10.3 → mempalace_code-1.11.0}/.gitignore

@@ -23,6 +23,7 @@ palace/
 .venv/
 venv/
 .env
+.verify-state
 
 # IDE
 .idea/

{mempalace_code-1.10.3 → mempalace_code-1.11.0}/CHANGELOG.md

@@ -2,7 +2,96 @@
 
 ## Unreleased
 
-No changes yet.
+## v1.11.0 — 2026-06-18
+
+Minor release for release-readiness gates, dependency audit automation, offline
+search guards, watcher reliability, and clearer CLI recovery guidance.
+
+### Added
+
+- Code-intelligence demo packet with deterministic public exhibits: generated fixture
+  project mined, searched, and read via real CLI with exact commands and normalized
+  output captured in `docs/demo/code-intelligence-packet.{md,json}`.
+- Generation script `scripts/gen_code_intelligence_packet.py` with `--check` mode
+  for drift detection and public-safety validation; wired into `/verify` and CI.
+- Comprehensive test suite for packet generation with coverage for output
+  normalization, known-answer retrieval assertions, and artifact cleanup.
+- Dependency upgrade/audit gate covering proposed dependency changes, current
+  resolver audit checks, CI integration, allowlist handling, and documentation.
+- Weekly scheduled dependency audit workflow for the current dependency graph.
+- Six-surface release publication status gate covering publish remote tags,
+  branch tests, PyPI publish workflow status, GitHub Release metadata, PyPI JSON,
+  and fresh install smoke.
+- Watcher startup readiness markers for `watch_and_mine` and `watch_all`, making
+  daemon initialization distinguishable from stale post-recovery log entries.
+
+### Changed
+
+- Human-facing CLI failures now prefer explicit `Next:` recovery guidance across
+  search, read, export, backup/restore, watch status, mine-all, compress, health,
+  cleanup, and model-fetch flows.
+- Pipe-sensitive commands keep machine-readable output clean: `read` failures and
+  `export --out -` diagnostics go to stderr, and generated backup/watch schedule
+  snippets remain on stdout while install hints go to stderr.
+- Legacy Claude Code hook prompts now give concise MCP save contracts instead of
+  broad "save everything" instructions, while Codex/Gemini docs point to MCP +
+  canonical usage rules.
+
+### Fixed
+
+- `watch_and_mine` and `watch_all` now refuse uninitialized roots before starting
+  macOS FSEvents observers, preventing runaway watcher churn on broad local roots.
+- Cached Hugging Face model fetch and search paths are guarded by subprocess-level
+  offline regressions that catch token warnings or metadata network calls.
+- `watch status` now reports the top-level launchd service state instead of
+  nested coalition state from `launchctl print`.
+- Release status gate no longer requests unsupported `gh release view --json
+  isLatest`; latest release is checked through `gh release list`.
+- Release install smoke subprocesses are bounded by a timeout so public-surface
+  diagnostics cannot hang indefinitely on resolver/network stalls.
+- Release gate token sanitization avoids self-matching scanner literals while
+  still redacting GitHub and PyPI token-shaped values from diagnostics.
+- `search --palace <missing>` now fails with a clear stderr diagnostic instead
+  of reporting an empty result set.
+
+### Removed
+
+- Ignored `.tasks/` and `docs/audits/` Autopilot artifacts are no longer tracked
+  in the public tree.
+
+## v1.10.4 — 2026-06-06
+
+Patch release for public quality/demo gates after v1.10.3.
+
+### Added
+
+- Deterministic public quality scorecard artifacts under `docs/quality/`, with
+  Markdown and JSON output generated by `scripts/quality_scorecard.py`.
+- Repo-wide public-safety scanner for tracked and staged files:
+  `python scripts/public_safety_scan.py --tracked --staged`.
+- Public-safe multi-agent workflow review protocol for future quality work.
+- Strict Pyright slice config for stable low-level modules, gated in CI and
+  `/verify`.
+- Detailed Autopilot demo backlog items for dependency audit CI, release status
+  checks, committed-tree public-safety scanning, scorecard metric expansion,
+  architecture guards, CLI/MCP contracts, docs drift guards, and workflow
+  effectiveness checks.
+
+### Changed
+
+- `/verify` and CI now run public-safety, scorecard freshness, and strict-slice
+  typecheck gates in addition to lint, format, tests, and basic Pyright.
+- Ruff global ignores were reduced from 33 to 3; older package/test debt remains
+  scoped to per-file ignores so new scripts inherit stricter rules.
+- Suppression scanning now uses Python tokenization so strings/docstrings that
+  mention `# type: ignore` do not count as live suppressions.
+- `scripts/quality_scorecard.py --check` now fails when committed scorecard
+  artifacts are stale.
+
+### Removed
+
+- `.verify-state` is no longer tracked and is ignored as a local-only verification
+  baseline.
 
 ## v1.10.3 — 2026-06-05
 

{mempalace_code-1.10.3 → mempalace_code-1.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mempalace-code
-Version: 1.10.3
+Version: 1.11.0
 Summary: Developer memory tool — mine codebases and conversations into a LanceDB-backed searchable palace. No API key required.
 Project-URL: Homepage, https://github.com/rergards/mempalace-code
 Project-URL: Repository, https://github.com/rergards/mempalace-code
@@ -335,6 +335,50 @@ launchctl unload ~/Library/LaunchAgents/com.mempalace.watch.plist   # stop until
 launchctl load   ~/Library/LaunchAgents/com.mempalace.watch.plist   # re-enable after freeing space
 ```
 
+**Diagnosing and stopping a crash-looping job:**
+
+If the daemon was pointed at an uninitialized directory it will crash-loop under `KeepAlive`. Confirm with:
+
+```bash
+mempalace-code watch ~/projects/ status   # shows state, runs count, and last exit code
+```
+
+Stop and optionally remove it:
+
+```bash
+# macOS 10.11+ preferred — unregisters the job immediately:
+launchctl bootout gui/$(id -u)/com.mempalace.watch
+
+# Older macOS / alternative:
+launchctl unload ~/Library/LaunchAgents/com.mempalace.watch.plist
+
+# Remove permanently (re-install after fixing the watch root):
+rm ~/Library/LaunchAgents/com.mempalace.watch.plist
+```
+
+**Daemon health check:**
+
+The daemon emits `WATCH_RUN` lines at each startup transition so the appended log at `/tmp/mempalace-watch.log` can be searched to confirm the latest startup reached the watch loop. Use this sequence to diagnose daemon state:
+
+```bash
+# 1. Process state — is the daemon running?
+launchctl print gui/$(id -u)/com.mempalace.watch
+# Or use the watch status shortcut:
+mempalace-code watch ~/projects/ status
+
+# 2. Palace storage health
+mempalace-code --palace ~/.mempalace/palace health
+
+# 3. Find the latest startup that reached watch-ready
+grep -a 'state=watch-ready' /tmp/mempalace-watch.log | tail -1
+# Example output: WATCH_RUN run_id=20260616T120102Z-p12345 state=watch-ready
+
+# 4. Filter that run's context (replace the run_id from step 3):
+grep -a 'run_id=20260616T120102Z-p12345' /tmp/mempalace-watch.log
+```
+
+A log file may contain `WATCH_RUN` lines from older runs that exited with disk-budget or backup failures. The `run_id` on the latest `state=watch-ready` line identifies the current healthy startup — lines from prior runs with different `run_id` values are stale and can be ignored. If no `watch-ready` line appears, check the most recent `run-started` line and the state that followed it (for example `state=pre-watch-backup-failed` or `state=initial-mine-skipped reason=disk-budget`).
+
 Configure the threshold via environment variable or `~/.mempalace/config.json`:
 
 ```bash
@@ -1002,7 +1046,7 @@ python -m pyright --pythonpath "$(python -c 'import sys; print(sys.executable)')
 Apache 2.0 — see [LICENSE](LICENSE) and [NOTICE](NOTICE).
 
 <!-- Link Definitions -->
-[version-shield]: https://img.shields.io/badge/version-1.10.2-4dc9f6?style=flat-square&labelColor=0a0e14
+[version-shield]: https://img.shields.io/badge/version-1.11.0-4dc9f6?style=flat-square&labelColor=0a0e14
 [release-link]: https://github.com/rergards/mempalace-code/releases
 [python-shield]: https://img.shields.io/badge/python-3.11+-7dd8f8?style=flat-square&labelColor=0a0e14&logo=python&logoColor=7dd8f8
 [python-link]: https://www.python.org/

{mempalace_code-1.10.3 → mempalace_code-1.11.0}/README.md

@@ -286,6 +286,50 @@ launchctl unload ~/Library/LaunchAgents/com.mempalace.watch.plist   # stop until
 launchctl load   ~/Library/LaunchAgents/com.mempalace.watch.plist   # re-enable after freeing space
 ```
 
+**Diagnosing and stopping a crash-looping job:**
+
+If the daemon was pointed at an uninitialized directory it will crash-loop under `KeepAlive`. Confirm with:
+
+```bash
+mempalace-code watch ~/projects/ status   # shows state, runs count, and last exit code
+```
+
+Stop and optionally remove it:
+
+```bash
+# macOS 10.11+ preferred — unregisters the job immediately:
+launchctl bootout gui/$(id -u)/com.mempalace.watch
+
+# Older macOS / alternative:
+launchctl unload ~/Library/LaunchAgents/com.mempalace.watch.plist
+
+# Remove permanently (re-install after fixing the watch root):
+rm ~/Library/LaunchAgents/com.mempalace.watch.plist
+```
+
+**Daemon health check:**
+
+The daemon emits `WATCH_RUN` lines at each startup transition so the appended log at `/tmp/mempalace-watch.log` can be searched to confirm the latest startup reached the watch loop. Use this sequence to diagnose daemon state:
+
+```bash
+# 1. Process state — is the daemon running?
+launchctl print gui/$(id -u)/com.mempalace.watch
+# Or use the watch status shortcut:
+mempalace-code watch ~/projects/ status
+
+# 2. Palace storage health
+mempalace-code --palace ~/.mempalace/palace health
+
+# 3. Find the latest startup that reached watch-ready
+grep -a 'state=watch-ready' /tmp/mempalace-watch.log | tail -1
+# Example output: WATCH_RUN run_id=20260616T120102Z-p12345 state=watch-ready
+
+# 4. Filter that run's context (replace the run_id from step 3):
+grep -a 'run_id=20260616T120102Z-p12345' /tmp/mempalace-watch.log
+```
+
+A log file may contain `WATCH_RUN` lines from older runs that exited with disk-budget or backup failures. The `run_id` on the latest `state=watch-ready` line identifies the current healthy startup — lines from prior runs with different `run_id` values are stale and can be ignored. If no `watch-ready` line appears, check the most recent `run-started` line and the state that followed it (for example `state=pre-watch-backup-failed` or `state=initial-mine-skipped reason=disk-budget`).
+
 Configure the threshold via environment variable or `~/.mempalace/config.json`:
 
 ```bash
@@ -953,7 +997,7 @@ python -m pyright --pythonpath "$(python -c 'import sys; print(sys.executable)')
 Apache 2.0 — see [LICENSE](LICENSE) and [NOTICE](NOTICE).
 
 <!-- Link Definitions -->
-[version-shield]: https://img.shields.io/badge/version-1.10.2-4dc9f6?style=flat-square&labelColor=0a0e14
+[version-shield]: https://img.shields.io/badge/version-1.11.0-4dc9f6?style=flat-square&labelColor=0a0e14
 [release-link]: https://github.com/rergards/mempalace-code/releases
 [python-shield]: https://img.shields.io/badge/python-3.11+-7dd8f8?style=flat-square&labelColor=0a0e14&logo=python&logoColor=7dd8f8
 [python-link]: https://www.python.org/

{mempalace_code-1.10.3 → mempalace_code-1.11.0}/docs/BACKLOG-archived.yaml

@@ -961,3 +961,68 @@ items:
       resolution: '2026-05-29: completed in pipeline run (commit=7588660, 9 files changed, 213 insertions(+), 1 deletion(-))'
       archived_date: "2026-05-29"
       done_summary: completed in pipeline run (commit=7588660, 9 files changed, 213 insertions(+), 1 deletion(-))
+    - key: AUTOPILOT-DEMO-QUALITY-SCORECARD
+      summary: Add a deterministic public quality scorecard that makes Autopilot cleanup progress visible across releases.
+      resolution: '2026-06-05: Deterministic public scorecard: scripts/quality_scorecard.py emits Markdown+JSON; --check gates shape/determinism/public-safety in CI lint job and /verify; baseline committed to docs/quality/; update workflow in docs/quality/README.md'
+      archived_date: "2026-06-11"
+      done_summary: 'Deterministic public scorecard: scripts/quality_scorecard.py emits Markdown+JSON; --check gates shape/determinism/public-safety in CI lint job and /verify; baseline committed to docs/quality/; update workflow in docs/quality/README.md'
+    - key: AUTOPILOT-DEMO-PUBLIC-SAFETY-GATE
+      summary: Add a repo-wide public-safety gate for tracked and staged files.
+      resolution: '2026-06-06: Added scripts/public_safety_scan.py --tracked --staged, CI and /verify wiring, focused tests, and removed tracked .verify-state while adding it to .gitignore.'
+      archived_date: "2026-06-11"
+      done_summary: Repo-wide public-safety scan now gates tracked/staged files and redacts matched content; .verify-state is local-only.
+    - key: AUTOPILOT-DEMO-RUFF-RATCHET
+      summary: Reduce transitional Ruff ignores in a measurable ratchet without broad style-only churn.
+      resolution: '2026-06-06: Reduced global Ruff ignores from 33 to 3 by keeping existing package/test debt scoped to per-file ignores and making new scripts inherit the stricter rule set.'
+      archived_date: "2026-06-11"
+      done_summary: 'Ruff global ignore ratchet: broad historical ignores are now scoped away from scripts; no new inline suppressions.'
+    - key: AUTOPILOT-DEMO-PYRIGHT-STRICT-SLICE
+      summary: Establish a strict Pyright slice for stable low-level modules and expand it gradually.
+      resolution: '2026-06-06: Added pyrightconfig.strict.json for version.py, mcp_tool_profiles.py, and disk_budget.py; annotated disk_budget.py enough to pass strict; wired strict slice into CI and /verify.'
+      archived_date: "2026-06-11"
+      done_summary: Initial strict Pyright slice gates three stable low-level modules in CI and /verify.
+    - key: AUTOPILOT-DEMO-WORKFLOW-REVIEW-PROTOCOL
+      summary: Document the public-safe adversarial Claude workflow protocol for repo quality work.
+      resolution: '2026-06-06: Added docs/quality/workflow-review-protocol.md and linked it from docs/quality/README.md.'
+      archived_date: "2026-06-11"
+      done_summary: Public-safe multi-agent workflow review protocol is documented for future quality improvements.
+    - key: AUTOPILOT-DEMO-CODE-INTELLIGENCE-GOLDEN-PACKET
+      summary: Generate a deterministic public-safe code-intelligence packet from real MemPalace CLI output and one minimal MCP stdio exhibit on a synthetic fixture project.
+      resolution: '2026-06-11: Deterministic code-intelligence demo packet implemented. scripts/gen_code_intelligence_packet.py builds fixture, mines, generates docs/demo/code-intelligence-packet.{md,json} with 1.5k lines of exhibits. Tests (464 lines) validate normalization, known-answer queries, check-mode drift, and cleanup. Wired into /verify and CI lint job. Quality scorecard updated.'
+      archived_date: "2026-06-11"
+      done_summary: Code-intelligence packet generation script and comprehensive demo artifacts with full test coverage; wired into /verify and CI.
+    - key: WATCH-MACOS-FSEVENTS-RUNAWAY-GUARD
+      summary: Prevent broken macOS watch jobs from monitoring broad uninitialized roots and driving sustained FSEvents or Spotlight churn.
+      resolution: '2026-06-11: completed in pipeline run (delivered: Add macOS watch runaway guard: root validation in render_watch_schedule, ThrottleInterval in launchd plist, on-save SKIP_DIRS event pruning with pre-start warning, crash-loop signal in watch status, and operator recovery docs in README, artifacts: mempalace_code/watcher.py, mempalace_code/cli_commands/watch.py, tests/test_watcher.py (+1), verified: VER-1, VER-2, VER-3 (+12), phase_commit=2c2716f, final_commit=10ff04f, 24 files changed, 1371 insertions(+), 16 deletions(-))'
+      archived_date: "2026-06-11"
+      done_summary: 'completed in pipeline run (delivered: Add macOS watch runaway guard: root validation in render_watch_schedule, ThrottleInterval in launchd plist, on-save SKIP_DIRS event pruning with pre-start warning, crash-loop signal in watch status, and operator recovery docs in README, artifacts: mempalace_code/watcher.py, mempalace_code/cli_commands/watch.py, tests/test_watcher.py (+1), verified: VER-1, VER-2, VER-3 (+12), phase_commit=2c2716f, final_commit=10ff04f, 24 files changed, 1371 insertions(+), 16 deletions(-))'
+    - key: STORE-HF-CACHED-SEARCH-SUBPROCESS-GUARD
+      summary: Add subprocess-level guard that cached model search/fetch never emits HuggingFace token warnings or performs network metadata calls after setup.
+      resolution: '2026-06-11: completed in pipeline run (delivered: Add subprocess-level offline guards in tests/test_offline.py: four non-network tests spawn real CLI subprocesses with fake sentence_transformers/huggingface_hub and a socket blocker via PYTHONPATH, proving cached fetch-model and search use only local_files_only model resolution and emit no HF token-warning output., artifacts: tests/test_offline.py, verified: VER-1, VER-2, VER-3 (+5))'
+      archived_date: "2026-06-11"
+      done_summary: 'completed in pipeline run (delivered: Add subprocess-level offline guards in tests/test_offline.py: four non-network tests spawn real CLI subprocesses with fake sentence_transformers/huggingface_hub and a socket blocker via PYTHONPATH, proving cached fetch-model and search use only local_files_only model resolution and emit no HF token-warning output., artifacts: tests/test_offline.py, verified: VER-1, VER-2, VER-3 (+5))'
+    - key: DEPENDENCY-SECURITY-UPGRADE-GATE
+      summary: Add a repeatable audited dependency-upgrade gate before raising package ceilings or refreshing the lock.
+      resolution: '2026-06-11: completed in pipeline run (delivered: Add dependency_upgrade_gate.py (audit/verify-report/ci-check), 17 focused tests, DEPENDENCY_UPGRADE_GATE.md documentation, CI gate step in Tests workflow with fetch-depth:0 and base-ref expressions, and regenerated quality scorecard., artifacts: scripts/dependency_upgrade_gate.py, tests/test_dependency_upgrade_gate.py, docs/DEPENDENCY_UPGRADE_GATE.md (+3), verified: VER-1, VER-2, VER-3 (+11), phase_commit=a6e7b12, final_commit=52035df, 23 files changed, 4452 insertions(+), 45 deletions(-))'
+      archived_date: "2026-06-11"
+      done_summary: 'completed in pipeline run (delivered: Add dependency_upgrade_gate.py (audit/verify-report/ci-check), 17 focused tests, DEPENDENCY_UPGRADE_GATE.md documentation, CI gate step in Tests workflow with fetch-depth:0 and base-ref expressions, and regenerated quality scorecard., artifacts: scripts/dependency_upgrade_gate.py, tests/test_dependency_upgrade_gate.py, docs/DEPENDENCY_UPGRADE_GATE.md (+3), verified: VER-1, VER-2, VER-3 (+11), phase_commit=a6e7b12, final_commit=52035df, 23 files changed, 4452 insertions(+), 45 deletions(-))'
+    - key: DEPENDENCY-SCHEDULED-AUDIT-CI
+      summary: Add a scheduled dependency audit workflow that checks current resolved packages without changing bounds.
+      resolution: '2026-06-11: completed in pipeline run (delivered: Add current-audit subcommand to dependency_upgrade_gate.py, weekly scheduled workflow, allowlist file, updated docs, and 8 focused acceptance tests., artifacts: scripts/dependency_upgrade_gate.py, tests/test_dependency_upgrade_gate.py, .github/workflows/dependency-audit.yml (+4), verified: VER-1, VER-2, VER-3 (+11), phase_commit=9f8e737, final_commit=5816c9b, 24 files changed, 3528 insertions(+), 6 deletions(-))'
+      archived_date: "2026-06-11"
+      done_summary: 'completed in pipeline run (delivered: Add current-audit subcommand to dependency_upgrade_gate.py, weekly scheduled workflow, allowlist file, updated docs, and 8 focused acceptance tests., artifacts: scripts/dependency_upgrade_gate.py, tests/test_dependency_upgrade_gate.py, .github/workflows/dependency-audit.yml (+4), verified: VER-1, VER-2, VER-3 (+11), phase_commit=9f8e737, final_commit=5816c9b, 24 files changed, 3528 insertions(+), 6 deletions(-))'
+    - key: RELEASE-PUBLICATION-STATUS-GATE
+      summary: Add a release-status verification gate that checks every public publication surface before calling a release shipped.
+      resolution: '2026-06-11: completed in pipeline run (delivered: Add scripts/release_status_gate.py (stdlib-only, 6-surface gate), 8 mocked tests covering AC-1 through AC-5, updated release skill (Step 6 now calls the gate), and regenerated quality scorecard., artifacts: scripts/release_status_gate.py, tests/test_release_status_gate.py, .claude/skills/release/SKILL.md (+2), verified: VER-1, VER-2, VER-3 (+9), phase_commit=404491c, final_commit=5b3231a, 23 files changed, 3567 insertions(+), 20 deletions(-))'
+      archived_date: "2026-06-11"
+      done_summary: 'completed in pipeline run (delivered: Add scripts/release_status_gate.py (stdlib-only, 6-surface gate), 8 mocked tests covering AC-1 through AC-5, updated release skill (Step 6 now calls the gate), and regenerated quality scorecard., artifacts: scripts/release_status_gate.py, tests/test_release_status_gate.py, .claude/skills/release/SKILL.md (+2), verified: VER-1, VER-2, VER-3 (+9), phase_commit=404491c, final_commit=5b3231a, 23 files changed, 3567 insertions(+), 20 deletions(-))'
+    - key: AUTOPILOT-DEMO-CODE-INTELLIGENCE-PACKET-ACCEPTANCE-FIX
+      summary: Close owner-acceptance blockers on the code-intelligence golden packet without broadening into new demo, docs-drift, or repo-wide public-safety work.
+      resolution: '2026-06-11: completed in pipeline run (delivered: Add owner-acceptance checklist to packet generator/artifacts, fix B905 zip strictness, encode scanner-flagged token literal, relocate audit evidence to public-safe path, replace fallback golden-packet plan with durable plan., artifacts: scripts/gen_code_intelligence_packet.py, tests/test_code_intelligence_packet.py, docs/demo/code-intelligence-packet.json (+6), verified: VER-1, VER-3, VER-4 (+12), phase_commit=680870f, final_commit=99bff31, 23 files changed, 1492 insertions(+), 84 deletions(-))'
+      archived_date: "2026-06-11"
+      done_summary: 'completed in pipeline run (delivered: Add owner-acceptance checklist to packet generator/artifacts, fix B905 zip strictness, encode scanner-flagged token literal, relocate audit evidence to public-safe path, replace fallback golden-packet plan with durable plan., artifacts: scripts/gen_code_intelligence_packet.py, tests/test_code_intelligence_packet.py, docs/demo/code-intelligence-packet.json (+6), verified: VER-1, VER-3, VER-4 (+12), phase_commit=680870f, final_commit=99bff31, 23 files changed, 1492 insertions(+), 84 deletions(-))'
+    - key: WATCH-RUN-READINESS-DIAGNOSTICS
+      summary: Make watch-daemon startup state easy to distinguish from stale appended log failures after disk-budget recovery.
+      resolution: '2026-06-16: completed in pipeline run (delivered: Add WATCH_RUN startup state markers to watch_and_mine/watch_all, update _optimize_once to return outcome, add TestWatchRunReadinessDiagnostics tests, and document health check workflow in README.md and docs/BACKUP_RESTORE.md, artifacts: mempalace_code/watcher.py, tests/test_watcher.py, README.md (+1), verified: VER-1, VER-2, VER-3 (+9), follow-ups: WATCH-ALL-BACKUP-FAIL-TEST, phase_commit=1b9b3e5, final_commit=936ae57, 8 files changed, 267 insertions(+), 15 deletions(-))'
+      archived_date: "2026-06-16"
+      done_summary: 'completed in pipeline run (delivered: Add WATCH_RUN startup state markers to watch_and_mine/watch_all, update _optimize_once to return outcome, add TestWatchRunReadinessDiagnostics tests, and document health check workflow in README.md and docs/BACKUP_RESTORE.md, artifacts: mempalace_code/watcher.py, tests/test_watcher.py, README.md (+1), verified: VER-1, VER-2, VER-3 (+9), follow-ups: WATCH-ALL-BACKUP-FAIL-TEST, phase_commit=1b9b3e5, final_commit=936ae57, 8 files changed, 267 insertions(+), 15 deletions(-))'