oacp-cli 0.5.2__tar.gz → 0.5.4__tar.gz

{oacp_cli-0.5.2 → oacp_cli-0.5.4}/.gitattributes

@@ -9,3 +9,6 @@ tests/conformance/signing/messages/** -text
 tests/conformance/signing/messages/tamper_crlf_trailer.yaml whitespace=-trailing-space
 tests/conformance/signing/messages/tamper_trailing_space.yaml whitespace=-trailing-space
 tests/conformance/signing/messages/tamper_trailing_blank_line.yaml whitespace=-blank-at-eof
+
+# Not part of source exports; the sdist excludes it in pyproject.toml.
+tests/dev_only export-ignore

{oacp_cli-0.5.2 → oacp_cli-0.5.4}/CHANGELOG.md

@@ -7,6 +7,82 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.4] - 2026-10-27
+
+Scripts run under an envelope by sha256 pin only, and the Claude envelope hook judges more shell shapes instead of asking on them or passing them unjudged.
+
+### Added
+
+- Receiver config `envelope.trusted_scripts` pins the scripts the envelope hook may run ([config](docs/protocol/autonomy.md#receiver-config)).
+- `oacp trust pin-script` records a script's pin and re-signs the receiver config ([signing](docs/protocol/message_signing.md#policy-file-signing)).
+- `oacp doctor --project <name>` reports malformed, missing and stale script pins ([config](docs/protocol/autonomy.md#receiver-config)).
+- The envelope hook logs asks and denies to `envelope_decisions.jsonl` ([adapter](docs/protocol/autonomy.md#delivery-static-shim-dynamic-envelope)).
+
+### Changed
+
+- The envelope hook runs a pinned script and asks on an unpinned one ([adapter](docs/protocol/autonomy.md#delivery-static-shim-dynamic-envelope)).
+- The envelope hook judges an App-token `gh` chain by its final command ([adapter](docs/protocol/autonomy.md#delivery-static-shim-dynamic-envelope)).
+- The envelope hook passes more read-only shell forms as reads ([adapter](docs/protocol/autonomy.md#delivery-static-shim-dynamic-envelope)).
+- The envelope hook stops denying a destructive word in a search pattern ([adapter](docs/protocol/autonomy.md#delivery-static-shim-dynamic-envelope)).
+- The envelope hook allows `--attach-audit` stamps on the task's record ([adapter](docs/protocol/autonomy.md#delivery-static-shim-dynamic-envelope)).
+- `oacp verify --attach-audit` refuses another message's record ([spec](docs/protocol/message_signing.md#receiver-audit-stamping---attach-audit)).
+- The finalizer refuses an uncovered `--realized` grant-only effect ([contract](docs/protocol/autonomy.md#terminal-finalization-and-audit-integrity)).
+- Audit sweeps report the legacy work-clock advisory as one line ([validation](docs/protocol/autonomy.md#terminal-finalization-and-audit-integrity)).
+
+### Fixed
+
+- `oacp trust sign-policy` locks the policy and keeps it whole when a run fails ([signing](docs/protocol/message_signing.md#policy-file-signing)).
+- The envelope hook judges commands nested in shell compound commands ([adapter](docs/protocol/autonomy.md#delivery-static-shim-dynamic-envelope)).
+- The envelope hook asks on a program name built by shell expansion ([adapter](docs/protocol/autonomy.md#delivery-static-shim-dynamic-envelope)).
+- The envelope hook judges `/usr/bin/env gh …` like `env gh …` ([adapter](docs/protocol/autonomy.md#delivery-static-shim-dynamic-envelope)).
+
+## [0.5.3] - 2026-10-20
+
+Kernel commands regroup under `agent`, `trust`, and `autonomy`, and the retired memory, packet, and findings surfaces leave the kernel.
+
+### Added
+
+- Custom audit directories outside the expected layout draw a warning ([guide](docs/guides/command-migration.md#audit-directory-diagnostics)).
+- Message verification streams verdicts for paths supplied on standard input ([guide](docs/guides/batch-verification.md)).
+- Admission and finalization stamp the serving model and effort ([contract](docs/protocol/autonomy.md#terminal-finalization-and-audit-integrity)).
+- Task profiles may declare `sends_oacp_reply` for the completion reply ([contract](docs/protocol/autonomy.md#message-fields)).
+
+### Changed
+
+- **Breaking:** Agent, key, and audit-writer commands move under `agent`, `trust`, and `autonomy` ([migration](docs/guides/command-migration.md)).
+- **Breaking:** Workspace initialization refuses existing roots and offers a write-free plan ([migration](docs/guides/workspace-initialization.md)).
+- Protocol contract stamp `spec_version` moves to `0.5.3` ([contract version](docs/protocol/autonomy.md#contract-version)).
+- Review verdicts name the head they bind to in `validated_head` ([spec](docs/protocol/review_loop.md#message-schemas)).
+- Review rounds add `max_rounds`, `withheld_side_effects`, `human_direction`, supersession ([spec](docs/protocol/review_loop.md#message-schemas)).
+- A review round that expects a GitHub action must declare `side_effects` ([spec](docs/protocol/review_loop.md#message-schemas)).
+- `SECURITY.md` names the same-user forgery limit of message signing ([policy](SECURITY.md#local-forgery-the-same-user-threat-model)).
+
+### Removed
+
+- Packet initialization and the packet and handoff templates ([migration](docs/guides/command-migration.md#packet-and-handoff-templates)).
+- The findings evaluator and quality gate; workflows own their validators ([migration](docs/guides/command-migration.md#workflow-validators)).
+- Handoff body-schema checks and advisories from message validation and admission ([boundary](docs/protocol/inbox_outbox.md#validation-boundary)).
+- The `oacp memory` and `oacp org-memory` shims; call the memory tool directly ([migration](docs/guides/memory-cli-migration.md)).
+- The `oacp write-event` shim and bundled event writer; use `agent-memory event write` ([migration](docs/guides/memory-cli-migration.md)).
+- The `oacp retention` advisory command ([migration](docs/guides/memory-cli-migration.md#retention)).
+
+### Fixed
+
+- Never-admitted reviews close on replacement evidence ([contract](docs/protocol/autonomy.md#closing-a-sender-superseded-never-admitted-review)).
+- Workspace updates preserve the existing agent roster ([layout](scripts/_oacp_constants.py)).
+- Inbox and watch text output keeps untrusted values on a bounded, terminal-safe line ([renderers](scripts/oacp_inbox.py)).
+- A scoped re-authorization decided before its pause clears it at the pause stamp ([contract](docs/protocol/autonomy.md#consumption)).
+- A stored clear stamped before its pause reads as unanswered ([contract](docs/protocol/autonomy.md#threshold-exceeded-checkpoint)).
+- `sends_oacp_reply_only: true` covers its own reply without a checkpoint pause ([contract](docs/protocol/autonomy.md#threshold-exceeded-checkpoint)).
+- A breaching `--replace` on a closed record fails closed ([contract](docs/protocol/autonomy.md#terminal-finalization-and-audit-integrity)).
+- The envelope hook treats `gh search` as a read ([adapter](docs/protocol/autonomy.md#delivery-static-shim-dynamic-envelope)).
+- The envelope hook exempts single-pipeline sandboxed `$TMPDIR` writes ([adapter](docs/protocol/autonomy.md#delivery-static-shim-dynamic-envelope)).
+- The envelope hook no longer counts quoted redirect characters as file writes ([classifier](scripts/claude_envelope_hook.py)).
+- The envelope hook asks for review on unsupported quoting, shell comments, and ambiguous heredocs ([classifier](scripts/claude_envelope_hook.py)).
+- The envelope hook classifies mutations after command-substitution environment assignments ([classifier](scripts/claude_envelope_hook.py)).
+- The envelope hook permits read-only message verification while retaining review for write modes ([classifier](scripts/claude_envelope_hook.py)).
+- `oacp setup claude` writes an agent file Claude Code loads, named after the project ([template](templates/claude/agents/role_agent.template.md)).
+
 ## [0.5.2] - 2026-09-15
 
 ### Added
@@ -912,6 +988,8 @@ The central debrief store is the headline change: every agent's full end-of-sess
 - Checkout step in github-release workflow job (#19)
 - Pre-release audit fixes: SHA-pinned actions, dangling doc refs (#15, #16)
 
+[0.5.4]: https://github.com/kiloloop/oacp/compare/v0.5.3...v0.5.4
+[0.5.3]: https://github.com/kiloloop/oacp/compare/v0.5.2...v0.5.3
 [0.5.2]: https://github.com/kiloloop/oacp/compare/v0.5.1...v0.5.2
 [0.5.1]: https://github.com/kiloloop/oacp/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/kiloloop/oacp/compare/v0.4.6...v0.5.0

{oacp_cli-0.5.2 → oacp_cli-0.5.4}/Makefile

@@ -16,7 +16,7 @@ endif
 
 # ── Targets ──────────────────────────────────────────────────────────────
 
-.PHONY: help update test docs validate validate-msg validate-card send quality packet preflight doctor
+.PHONY: help update test docs validate validate-msg validate-card send preflight doctor
 
 help: ## Show available targets (default)
 	@echo "OACP — task runner"
@@ -32,8 +32,9 @@ update: _require-project ## Sync existing workspace with latest structure
 test: ## Run all tests
 	python3 -m pytest $(SCRIPTS_DIR)/../tests -v $(ARGS)
 
-docs: ## Regenerate the README command table from oacp --help
+docs: ## Regenerate the README command table and autonomy audit example
 	python3 $(SCRIPTS_DIR)/gen_readme_commands.py --write
+	python3 $(SCRIPTS_DIR)/../tools/generate_audit_example.py --write
 
 validate-msg: ## Validate inbox messages
 	python3 $(SCRIPTS_DIR)/validate_message.py $(ARGS)
@@ -51,9 +52,3 @@ doctor: ## Check environment and workspace health
 
 send: _require-project ## Send an inbox message
 	python3 $(SCRIPTS_DIR)/send_inbox_message.py $(PROJECT) $(ARGS)
-
-quality: ## Run quality gate check
-	python3 $(SCRIPTS_DIR)/check_quality_gate.py $(ARGS)
-
-packet: _require-project ## Create a review/findings/merge packet
-	bash $(SCRIPTS_DIR)/init_packet.sh $(PROJECT) $(ARGS)

{oacp_cli-0.5.2 → oacp_cli-0.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: oacp-cli
-Version: 0.5.2
+Version: 0.5.4
 Summary: Open Agent Coordination Protocol CLI for file-based multi-agent workflows
 Project-URL: Homepage, https://github.com/kiloloop/oacp
 Project-URL: Repository, https://github.com/kiloloop/oacp
@@ -33,7 +33,6 @@ Description-Content-Type: text/markdown
 [![Claude Code](https://img.shields.io/badge/Runtime-Claude_Code-6B4FBB.svg)](https://claude.ai/code)
 [![Codex](https://img.shields.io/badge/Runtime-Codex-74AA9C.svg)](https://openai.com/index/codex/)
 [![Cursor](https://img.shields.io/badge/Runtime-Cursor-222222.svg)](https://cursor.com/)
-[![PRs Welcome](https://img.shields.io/badge/PRs-Welcome-brightgreen)](https://github.com/kiloloop/oacp/pulls)
 
 > Coordinate agents *without* the chaos.
 
@@ -56,7 +55,7 @@ The CLI ships structured tasks between agents and lets you watch the conversatio
 ## Live agent fleet
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/kiloloop/oacp/main/docs/img/oacp-fleet-thread.png" alt="claude / codex / gemini fleet with PR #42 review thread" width="650" />
+  <img src="https://raw.githubusercontent.com/kiloloop/oacp/main/docs/img/oacp-fleet-thread.png" alt="claude / codex fleet with PR #42 review thread" width="650" />
 </p>
 
 Every multi-agent thread is a sequence of typed messages — `review_request`, `review_feedback`, `review_addressed`, `review_lgtm` — with explicit quality gates.
@@ -69,7 +68,6 @@ PROJECT · my-app                                   ● live
 
   C  claude   code           drafting PR #42
   X  codex    cli            reviewing
-  G  gemini   api            idle
 
   claude  →  review_request    "auth refactor"      [codex]
   codex   →  review_feedback   2 minor, 0 blocking  [claude]
@@ -134,7 +132,7 @@ oacp send my-project --from alice --to bob --type task_request \
 ```
 
 By default, `oacp init my-project` creates `claude`, `codex`, and `cursor`
-agents. Pass `--agents` to include Gemini or custom agent names.
+agents. Pass `--agents` to choose your own agent names.
 
 When running inside a configured agent runtime, `--from` can be omitted — OACP infers the sender from `OACP_AGENT`, `AGENT_NAME`, or the agent card. See [QUICKSTART.md](QUICKSTART.md) for a full walkthrough. Or try the [5-minute quickstart →](examples/quickstart/) to send your first message to a real AI agent.
 
@@ -256,29 +254,28 @@ uv tool install .
 <!-- BEGIN GENERATED: oacp commands — do not edit by hand; run `make docs` -->
 | Command | Description |
 |---------|-------------|
-| `oacp init` | Create a project workspace under $OACP_HOME/projects/ |
-| `oacp add-agent` | Add an agent to an existing project workspace |
-| `oacp agent` | Manage global agent profiles (init, sync, show, list) |
+| `oacp init` | Create a new project workspace; preview with --dry-run |
+| `oacp agent` | Add project agents and manage global profiles |
 | `oacp inbox` | List pending inbox messages |
 | `oacp watch` | Emit inbox delta events for Monitor-friendly polling |
-| `oacp retention` | Parked: engine archived outside the kernel; advisory shim until 0.5.3 |
-| `oacp memory` | Run agent-memory (sync, archive, restore); shim until 0.5.3 |
 | `oacp session-init` | Verify Codex startup inputs and emit SessionStart context |
 | `oacp setup` | Generate runtime-specific config files in a repo |
 | `oacp send` | Send a protocol-compliant inbox message |
-| `oacp key` | Generate and inspect message-signing keys |
-| `oacp trust` | Import, inspect, and revoke trust-root entries (catalog + pins) |
-| `oacp org-memory` | Run agent-memory org (init); shim until 0.5.3 |
-| `oacp write-event` | Write an event to org-memory/events/ |
-| `oacp autonomy-outcome` | Record a human approval/decline in an autonomy audit |
-| `oacp autonomy-finalize` | Record checkpoints and terminal states in an autonomy audit |
+| `oacp trust` | Manage local keys and project trust (catalog + pins) |
+| `oacp autonomy` | Record human outcomes, checkpoints, and terminal audit states |
 | `oacp envelope` | Compile, show, or clear the runtime envelope for a task |
 | `oacp doctor` | Check environment and workspace health |
 | `oacp validate` | Validate an inbox/outbox YAML message |
 | `oacp verify` | Verify a message's auth trailer against receiver-local pins |
 <!-- END GENERATED: oacp commands -->
 
-`oacp --version` prints the installed version.
+`oacp --version` prints the installed version. Related operations now use
+`agent add`, `trust keygen|keys`, and `autonomy outcome|finalize`; see the
+[command migration guide](docs/guides/command-migration.md).
+
+Memory operations use [agent-memory](https://github.com/kiloloop/agent-memory)
+directly. The `memory`, `org-memory`, `write-event`, and `retention` commands
+were removed in 0.5.3; see the [migration guide](docs/guides/memory-cli-migration.md).
 
 <details>
 <summary>Key flags</summary>
@@ -289,8 +286,6 @@ uv tool install .
 
 **`oacp doctor`**: `--fix` (auto-fix safe issues), `--json`, `-o/--output`
 
-**`oacp memory`** / **`oacp org-memory`**: exec shims for [agent-memory](https://github.com/kiloloop/agent-memory) (`pip install agent-memory-cli`): argv passes through, `--oacp-dir` becomes `--home`, `oacp memory init` runs `agent-memory enable`. Kept through 0.5.2, removed in 0.5.3; call `agent-memory` directly.
-
 </details>
 
 If `OACP_HOME` is unset, workspace commands default to `~/oacp`.
@@ -389,6 +384,8 @@ make preflight
 
 ## Documentation
 
+- [Batch verification](docs/guides/batch-verification.md) — Stream message verdicts from stdin paths
+
 - [SPEC.md](SPEC.md) — Full protocol specification
 - [examples/quickstart/](examples/quickstart/) — Hands-on tutorial: send a message to an AI agent
 - [QUICKSTART.md](QUICKSTART.md) — CLI reference walkthrough

{oacp_cli-0.5.2 → oacp_cli-0.5.4}/README.md

@@ -5,7 +5,6 @@
 [![Claude Code](https://img.shields.io/badge/Runtime-Claude_Code-6B4FBB.svg)](https://claude.ai/code)
 [![Codex](https://img.shields.io/badge/Runtime-Codex-74AA9C.svg)](https://openai.com/index/codex/)
 [![Cursor](https://img.shields.io/badge/Runtime-Cursor-222222.svg)](https://cursor.com/)
-[![PRs Welcome](https://img.shields.io/badge/PRs-Welcome-brightgreen)](https://github.com/kiloloop/oacp/pulls)
 
 > Coordinate agents *without* the chaos.
 
@@ -28,7 +27,7 @@ The CLI ships structured tasks between agents and lets you watch the conversatio
 ## Live agent fleet
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/kiloloop/oacp/main/docs/img/oacp-fleet-thread.png" alt="claude / codex / gemini fleet with PR #42 review thread" width="650" />
+  <img src="https://raw.githubusercontent.com/kiloloop/oacp/main/docs/img/oacp-fleet-thread.png" alt="claude / codex fleet with PR #42 review thread" width="650" />
 </p>
 
 Every multi-agent thread is a sequence of typed messages — `review_request`, `review_feedback`, `review_addressed`, `review_lgtm` — with explicit quality gates.
@@ -41,7 +40,6 @@ PROJECT · my-app                                   ● live
 
   C  claude   code           drafting PR #42
   X  codex    cli            reviewing
-  G  gemini   api            idle
 
   claude  →  review_request    "auth refactor"      [codex]
   codex   →  review_feedback   2 minor, 0 blocking  [claude]
@@ -106,7 +104,7 @@ oacp send my-project --from alice --to bob --type task_request \
 ```
 
 By default, `oacp init my-project` creates `claude`, `codex`, and `cursor`
-agents. Pass `--agents` to include Gemini or custom agent names.
+agents. Pass `--agents` to choose your own agent names.
 
 When running inside a configured agent runtime, `--from` can be omitted — OACP infers the sender from `OACP_AGENT`, `AGENT_NAME`, or the agent card. See [QUICKSTART.md](QUICKSTART.md) for a full walkthrough. Or try the [5-minute quickstart →](examples/quickstart/) to send your first message to a real AI agent.
 
@@ -228,29 +226,28 @@ uv tool install .
 <!-- BEGIN GENERATED: oacp commands — do not edit by hand; run `make docs` -->
 | Command | Description |
 |---------|-------------|
-| `oacp init` | Create a project workspace under $OACP_HOME/projects/ |
-| `oacp add-agent` | Add an agent to an existing project workspace |
-| `oacp agent` | Manage global agent profiles (init, sync, show, list) |
+| `oacp init` | Create a new project workspace; preview with --dry-run |
+| `oacp agent` | Add project agents and manage global profiles |
 | `oacp inbox` | List pending inbox messages |
 | `oacp watch` | Emit inbox delta events for Monitor-friendly polling |
-| `oacp retention` | Parked: engine archived outside the kernel; advisory shim until 0.5.3 |
-| `oacp memory` | Run agent-memory (sync, archive, restore); shim until 0.5.3 |
 | `oacp session-init` | Verify Codex startup inputs and emit SessionStart context |
 | `oacp setup` | Generate runtime-specific config files in a repo |
 | `oacp send` | Send a protocol-compliant inbox message |
-| `oacp key` | Generate and inspect message-signing keys |
-| `oacp trust` | Import, inspect, and revoke trust-root entries (catalog + pins) |
-| `oacp org-memory` | Run agent-memory org (init); shim until 0.5.3 |
-| `oacp write-event` | Write an event to org-memory/events/ |
-| `oacp autonomy-outcome` | Record a human approval/decline in an autonomy audit |
-| `oacp autonomy-finalize` | Record checkpoints and terminal states in an autonomy audit |
+| `oacp trust` | Manage local keys and project trust (catalog + pins) |
+| `oacp autonomy` | Record human outcomes, checkpoints, and terminal audit states |
 | `oacp envelope` | Compile, show, or clear the runtime envelope for a task |
 | `oacp doctor` | Check environment and workspace health |
 | `oacp validate` | Validate an inbox/outbox YAML message |
 | `oacp verify` | Verify a message's auth trailer against receiver-local pins |
 <!-- END GENERATED: oacp commands -->
 
-`oacp --version` prints the installed version.
+`oacp --version` prints the installed version. Related operations now use
+`agent add`, `trust keygen|keys`, and `autonomy outcome|finalize`; see the
+[command migration guide](docs/guides/command-migration.md).
+
+Memory operations use [agent-memory](https://github.com/kiloloop/agent-memory)
+directly. The `memory`, `org-memory`, `write-event`, and `retention` commands
+were removed in 0.5.3; see the [migration guide](docs/guides/memory-cli-migration.md).
 
 <details>
 <summary>Key flags</summary>
@@ -261,8 +258,6 @@ uv tool install .
 
 **`oacp doctor`**: `--fix` (auto-fix safe issues), `--json`, `-o/--output`
 
-**`oacp memory`** / **`oacp org-memory`**: exec shims for [agent-memory](https://github.com/kiloloop/agent-memory) (`pip install agent-memory-cli`): argv passes through, `--oacp-dir` becomes `--home`, `oacp memory init` runs `agent-memory enable`. Kept through 0.5.2, removed in 0.5.3; call `agent-memory` directly.
-
 </details>
 
 If `OACP_HOME` is unset, workspace commands default to `~/oacp`.
@@ -361,6 +356,8 @@ make preflight
 
 ## Documentation
 
+- [Batch verification](docs/guides/batch-verification.md) — Stream message verdicts from stdin paths
+
 - [SPEC.md](SPEC.md) — Full protocol specification
 - [examples/quickstart/](examples/quickstart/) — Hands-on tutorial: send a message to an AI agent
 - [QUICKSTART.md](QUICKSTART.md) — CLI reference walkthrough

oacp_cli-0.5.4/SECURITY.md

@@ -0,0 +1,72 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in OACP, please report it responsibly.
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Instead, use [GitHub's private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) on the affected repository when it is enabled. If private reporting is unavailable, use the repository's documented private security contact or another non-public maintainer channel.
+
+## Response Timeline
+
+- **Acknowledgment**: Within 48 hours of receiving your report.
+- **Assessment**: We will evaluate the severity and impact within 7 days.
+- **Fix**: Critical vulnerabilities will be patched within 30 days. We will coordinate disclosure timing with you.
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 0.x     | Yes       |
+
+## Scope
+
+OACP is a file-based coordination protocol. Security considerations include:
+
+- **Message authenticity** — Messages carry an Ed25519 signature trailer (`auth:`) that receivers verify against pinned signer identities (see `docs/protocol/message_signing.md`). Message bodies are not encrypted. Report any case where a receiver in `enforce` mode processes a message that is unsigned, fails verification, or comes from a signer it has not pinned.
+- **Credential scoping** — The protocol defines credential boundaries per agent (see `docs/protocol/credential_scoping.md`). Report issues where these boundaries can be bypassed.
+- **Script injection** — Report any case where user-controlled input in message fields can lead to command injection via OACP scripts.
+- **Path traversal** — Report any case where message fields or script arguments can read or write files outside the intended directories.
+
+### Local forgery: the same-user threat model
+
+Signing keys live under `$OACP_HOME/keys/` as `0600` files in `0700`
+directories, per machine, and are never synced. Every agent runtime on a
+host runs as the same OS user by default, so **any process running as that
+user can read every local agent's private key and produce a valid
+signature as any local agent.** The same process can also write directly
+into any inbox. A shell-capable local agent, a tool with filesystem access,
+or a compromised session can therefore forge a message from any identity on
+that host, and the receiver's verification will pass.
+
+Signing is still worth having. It gives:
+
+- **Tamper evidence** — a message altered after signing fails verification.
+- **Cross-host attribution** — a peer on another machine can verify that a
+  message came from a key enrolled on this one, and a key cannot be used from
+  a host it was never copied to.
+- **Signer control** — receivers accept only pinned keys, and a revoked or
+  unknown key is rejected under `enforce` mode.
+- **An auditable trail** for honest agents, stamped onto each receiver's
+  audit record at intake.
+
+It does not give **same-host anti-impersonation**. A verified signature
+proves that the message was signed with a given key, not which local agent
+held it at the time. On a shared host, treat both the `from:` field and a
+verified signature as **provenance within the trust boundary of the OS
+user**, not as proof of authorship by one agent over another.
+
+Closing the gap is an isolation decision, not a protocol change: one OS user
+per agent with its key directory owned by that user, containers, or separate
+hosts with enforced access controls. Hardware- or keychain-backed signers are
+planned behind the same key-id seam and would protect the key material from
+copying, but they do not isolate a shared filesystem or process space.
+
+Same-user forgery on a shared host is a documented limitation, not a
+vulnerability; please do not report it as one. Do report any case where a
+receiver accepts a message that should have failed verification.
+
+## Acknowledgments
+
+We appreciate responsible disclosure and will credit reporters in release notes (unless you prefer to remain anonymous).

{oacp_cli-0.5.2 → oacp_cli-0.5.4}/docs/from-claude-p.md

@@ -2,8 +2,6 @@
 
 `claude -p` is how most people first script a Claude agent. It works — but if you run agents in automation, it's worth asking a question the one-liner never forces: **why is the agent headless and synchronous in the first place?**
 
-(A pricing footnote, since earlier versions of this page led with it: Anthropic explored moving programmatic usage — `claude -p`, the Agent SDK, Claude Code GitHub Actions — onto a separate metered credit, but paused that change before it took effect; per the June 15 announcement no such credit exists, subscription limits are unchanged, and advance notice is promised before any future version.)
-
 This guide is built to be handed to your agent. Read the first half for the *why*; paste the setup block into your Claude Code session for the *how*.
 
 > **Setup is a one-time ~5 minutes. Every task after that is one `oacp send` — async, non-blocking, observable.**

oacp_cli-0.5.4/docs/guides/batch-verification.md

@@ -0,0 +1,25 @@
+# Streaming message verification
+
+`oacp verify --batch --project <project> --receiver <receiver> --oacp-dir <home>`
+reads one message path per stdin line. Each output line is the existing JSON
+verification object plus `path`, emitted in input order and flushed immediately.
+`--json` is optional in batch mode. Paths containing spaces are preserved; newline
+characters cannot occur within a path. The final input line need not end in a newline.
+
+One invocation loads one receiver pin-policy snapshot and uses it for the entire
+stream. Start a new invocation after changing trust policy. Verification retains
+the existing bounded-byte, signature, sender-binding and payload-digest rules;
+batch output supplies annotations, not intake authority.
+
+Exit status is zero when the complete stream was processed, even if individual
+verdicts are invalid, untrusted, revoked or unsupported. Inspect each `status`.
+Unreadable or non-regular files (including directories and FIFOs) and empty
+input lines produce `invalid` with `read_error: true`, a null payload digest, and
+a read-error reason. The additive `read_error` field distinguishes these rows
+from invalid message content; other rows omit it. Invalid arguments or stream I/O/decoding failures
+exit nonzero; output emitted before a stream failure remains valid partial output.
+An empty stream succeeds without output.
+
+Batch mode cannot combine with a positional message file, `--quarantine` or
+`--attach-audit`. Those effects retain their single-message interface. Existing
+single-message output and exit codes are unchanged.

oacp_cli-0.5.4/docs/guides/command-migration.md

@@ -0,0 +1,70 @@
+# Command namespaces in 0.5.3
+
+OACP 0.5.3 groups related operations under `agent`, `trust`, and `autonomy`.
+Update callers before upgrading; the previous root commands now return an
+unknown-command error with exit code 2 and have no aliases.
+
+| Previous command | Replacement |
+| --- | --- |
+| `oacp add-agent <project> <agent> ...` | `oacp agent add <project> <agent> ...` |
+| `oacp key gen ...` | `oacp trust keygen ...` |
+| `oacp key list ...` | `oacp trust keys ...` |
+| `oacp autonomy-outcome <audit> ...` | `oacp autonomy outcome <audit> ...` |
+| `oacp autonomy-finalize <audit> ...` | `oacp autonomy finalize <audit> ...` |
+
+Arguments, output, and operation exit codes stay with the existing
+implementations. The global agent registry and `agent init|sync|show|list`
+remain available. `trust keygen` and `trust keys` manage local keys without
+requiring a project; `trust list` continues to list project catalog entries
+and receiver pins.
+
+For `agent` and `trust`, `--oacp-dir <path>` or `--oacp-dir=<path>` can appear
+before or after the subcommand; the last occurrence wins. Leaf help works as
+`oacp agent add --help` or `oacp help agent add` (likewise for `trust keygen`
+and `autonomy finalize`).
+
+Stored audit receipts retain the immutable
+`result.finalizer.name: oacp autonomy-finalize` discriminator. It identifies
+the writer format and is independent of the current command spelling.
+
+The separate [memory command migration](memory-cli-migration.md) covers the
+removed memory, event-writing, and retention shims. The root command list now
+contains 13 entries, including `session-init` and `setup`.
+
+## Workflow validators
+
+The bundled `scripts/check_quality_gate.py`, `make quality` target, and
+`templates/github_actions_quality_gate.yaml` have been removed. Configure the owning review
+workflow's versioned validator in skills or CI before upgrading copied
+callers. The workflow owns its findings-status policy and must return a typed
+failure before side effects when validation fails.
+
+Handoff body schemas likewise belong to their owning workflow. The kernel no
+longer emits body-schema advisories; required envelope fields, body type and
+size limits, signing, and admission checks keep their existing behavior. See
+the [validation boundary](../protocol/inbox_outbox.md#validation-boundary).
+
+## Audit directory diagnostics
+
+The autonomy evaluator warns on stderr when `--audit-dir` does not end in
+`autonomy_decisions`. The supplied location remains valid and the decision and
+JSON output are unchanged. Workspace tools continue scanning the canonical
+`agents/<receiver>/audit/autonomy_decisions/` directory.
+
+For custom evaluator invocations, pass the same path to
+`oacp doctor --audit-dir <path>` to include a WARN-level Audit finding. This
+option diagnoses the supplied basename; it does not redirect workspace scans
+or introduce a receiver configuration setting.
+
+
+## Packet and handoff templates
+
+The packet initializer (`scripts/init_packet.sh` and `make packet`), review
+packet template, merge-decision template and handoff packet template are retired.
+Use formats and generators owned by your review or handoff workflow. The public
+v0.5.2 tag preserves the former artifacts for historical reference; upgrading
+does not migrate or delete existing runtime packets.
+
+The findings template and review-loop documentation remain available. Envelope
+validation, signing, admission, and message types are unchanged. Update source
+checkout callers before upgrading; there is no replacement kernel packet verb.

{oacp_cli-0.5.2 → oacp_cli-0.5.4}/docs/guides/doctor.md

@@ -191,9 +191,9 @@ The exit code reflects the overall result:
 
 | Issue | Fix |
 |-------|-----|
-| `workspace.json — not found` | Run `oacp init <project>` to create the workspace |
+| `workspace.json — not found` | Init is create-only: inspect and repair the existing root, or move it aside before re-initializing |
 | `workspace.json — invalid` | Check for JSON syntax errors in the file |
-| `agents/ directory — not found` | Run `oacp init <project>` to recreate the workspace |
+| `agents/ directory — not found` | Restore each intended agent with `oacp agent add <project> <agent>` |
 
 ### Inbox Health
 

oacp_cli-0.5.4/docs/guides/memory-cli-migration.md

@@ -0,0 +1,43 @@
+# Memory command migration for 0.5.3
+
+OACP 0.5.3 removes the `memory`, `org-memory`, `write-event`, and `retention`
+commands. Calls, including `--help` and `oacp help <command>`, now return the
+normal unknown-command error with exit code 2. Update scripts, skills, and
+operator commands before upgrading.
+
+## Memory and events
+
+Install [agent-memory-cli](https://github.com/kiloloop/agent-memory) separately
+and call `agent-memory` directly. Event writing requires a version that provides
+`agent-memory event write` (0.1.1 or later); OACP no longer bundles a fallback.
+
+| Previous command | Direct replacement |
+| --- | --- |
+| `oacp memory init` | `agent-memory enable` |
+| `oacp memory <verb> ...` | `agent-memory <verb> ...` |
+| `oacp org-memory init` | `agent-memory org init` |
+| `oacp write-event ...` | `agent-memory event write ...` |
+
+Replace `--oacp-dir <path>` with `--home <path>` (including the `--flag=value`
+form). Preserve the remaining arguments. For example:
+
+```bash
+agent-memory pull --home "$OACP_HOME"
+agent-memory event write --home "$OACP_HOME" --agent <agent> \
+  --project <project> --type decision --slug api-convention --body "Use REST"
+```
+
+The direct event writer reports `published:` or `idempotent:` rather than the
+old fallback's `OK:`; its dry-run preview goes to stderr. Update callers that
+parse that output. Existing memory files and their layout do not need to move.
+
+If a workspace still registers `.claude/hooks/oacp-memory-pull.sh` or
+`oacp-memory-push.sh`, re-run `oacp setup claude` before upgrading to retire
+the recognized legacy hooks; configure replacement hooks with `agent-memory`
+only when automatic sync is intended.
+
+## Retention
+
+`oacp retention` was an advisory command and performed no pruning. It has no
+replacement inside OACP. Retention remains operator-owned; any external tool
+must preserve the [protected-evidence rules](../protocol/inbox_outbox.md#message-history-retention).