From df5beb7b88bebcffb6b356da884d1b2c8d94bd6e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 10:03:15 +0000 Subject: [PATCH] chore: version packages --- .changeset/1018-cli-refusal-warnings.md | 6 - .changeset/1019-expansion-contract-docs.md | 17 - .changeset/1032-publication-outcome.md | 7 - .changeset/1044-monotonic-cache.md | 7 - .changeset/1070-preserve-topology-errors.md | 7 - .../1087-1091-reconciliation-publication.md | 6 - .changeset/1101-sidecar-skipped-count.md | 6 - .changeset/1139-slack-hostname-case.md | 5 - .changeset/1141-single-slash-file-tails.md | 5 - .changeset/1144-admission-cleanup-errors.md | 7 - .changeset/1148-promoted-route-utc.md | 6 - .changeset/1153-1158-promotion-provenance.md | 6 - .../1173-reconciliation-promoted-content.md | 8 - .changeset/1176-pg-declarations.md | 6 - .changeset/1178-1245-journal-admission.md | 6 - .changeset/1203-prompt-recall-rank-scale.md | 5 - .../1218-native-transcript-block-redaction.md | 7 - .changeset/1237-fenced-source-marker-loss.md | 14 - .../1240-terminal-maintenance-config.md | 7 - .changeset/1247-promotion-acknowledgement.md | 8 - .changeset/1259-hook-fence-finalization.md | 11 - .../1300-migration-wrapper-preflight.md | 6 - .changeset/1306-index-exact-content-digest.md | 9 - .changeset/1307-queued-append-scan.md | 18 - .changeset/1308-import-metadata-refresh.md | 7 - .changeset/1316-message-byte-integrity.md | 7 - .changeset/1321-node-25-floor.md | 16 - .changeset/1338-compact-discovery-locators.md | 14 - .../1347-consumer-token-append-admission.md | 7 - .../1354-promoted-content-serialization.md | 9 - .changeset/1358-scrub-rule-runtime.md | 9 - .changeset/1371-store-dedup.md | 14 - .../1378-1380-transfer-completion-fence.md | 31 - .changeset/1388-batched-canonical-reads.md | 5 - .changeset/1390-1371-sqlite-exact-dedup.md | 17 - .changeset/1390-promote-owner-scope-dedup.md | 9 - .changeset/1416-snapshot-readiness.md | 6 - .changeset/1424-idle-client-error.md | 10 - .../1426-transfer-completion-membership.md | 13 - .changeset/1438-publication-guard-provider.md | 5 - .changeset/1441-sqlite-exact-content-index.md | 5 - .changeset/1459-racy-capture-cache.md | 7 - .../1468-hook-publication-contention.md | 12 - .changeset/1470-1489-batched-closure-reads.md | 6 - .changeset/1471-store-empty-origin.md | 5 - .changeset/1472-sanitizer-url-successor.md | 5 - .../1473-1477-1478-1488-replication-pass.md | 9 - .../1476-1498-1499-migration-evidence.md | 9 - .changeset/1479-1480-1495-cli-docs.md | 7 - .changeset/1502-sanitizer-query-successor.md | 5 - .../1508-copy-writer-system-identifier.md | 7 - .changeset/1511-replication-pending-relink.md | 10 - .changeset/1513-mcp-publication-admission.md | 7 - .changeset/1514-1515-sanitizer-successors.md | 5 - .changeset/1524-convergence-released-lock.md | 9 - .../1530-replication-drain-successors.md | 6 - .changeset/1537-storage-route-fail-closed.md | 6 - .changeset/1538-reads-during-own-sweep.md | 10 - .changeset/1555-rollback-external-abort.md | 10 - .changeset/1558-codex-tool-outcomes.md | 11 - .changeset/1559-codex-native-activity.md | 5 - .changeset/1560-compact-fork-restore.md | 14 - .changeset/1563-pretool-memory-hints.md | 9 - .changeset/1564-codex-connector-readiness.md | 9 - .changeset/1565-codex-lifecycle-guarantees.md | 9 - .../1566-compact-failure-diagnostics.md | 9 - .changeset/1567-native-link-diagnostics.md | 6 - .changeset/1576-lcm-enabled-hooks.md | 5 - .changeset/1577-fifo-transcript-open.md | 9 - .changeset/1578-codex-fork-inherited.md | 8 - .changeset/1581-compaction-event-count.md | 18 - .changeset/1582-shutdown-storage-settle.md | 5 - .changeset/1583-codex-toml-float-finite.md | 6 - .../1584-1586-codex-hooks-strict-parse.md | 10 - .../1599-session-end-completion-diagnostic.md | 8 - .changeset/1600-mixed-group-upgrade-docs.md | 6 - .../1607-activation-runtime-readiness.md | 9 - .changeset/1617-applied-readback.md | 8 - .../1618-activation-uninitialized-home.md | 8 - .changeset/1625-codex-hooks-number-paths.md | 5 - .changeset/1631-doctor-unknown-duplicates.md | 10 - .../1632-referenced-fork-restoration.md | 10 - .changeset/1634-1635-publication-lock-wait.md | 5 - .changeset/1636-hook-stdout-flush.md | 10 - .../1637-pending-age-invalid-sidecar.md | 7 - .changeset/1639-extensions-failure-reason.md | 10 - .../1642-transfer-legacy-column-grants.md | 9 - .changeset/1643-telemetry-guide-intro.md | 6 - .../1648-activation-s7-classification.md | 9 - .changeset/1651-release-window-successor.md | 12 - .changeset/1652-abort-late-effect-route.md | 8 - .changeset/1655-migration-outcome-accuracy.md | 12 - .changeset/1657-set-abort-readback-member.md | 5 - .changeset/1659-abort-retry-evidence.md | 7 - .changeset/1663-rollback-timestamp-compare.md | 5 - .../1667-rollback-checkpoint-incomplete.md | 12 - .changeset/1672-acl-sentinel-namespace.md | 6 - ...3-cutover-set-activation-classification.md | 9 - .../1674-migration-commands-under-hold.md | 9 - .changeset/1675-report-after-rollback.md | 9 - .changeset/1676-empty-project-eligibility.md | 11 - .changeset/1678-migration-alias-identity.md | 10 - .../1679-unroutable-activation-windows.md | 8 - .../1680-set-rollback-report-timestamp.md | 5 - .changeset/1681-rollback-drain-disposition.md | 7 - .changeset/1684-promote-events-contention.md | 5 - .../1689-shared-history-refusal-order.md | 8 - .changeset/1691-alias-lock-timeout.md | 9 - .changeset/1693-cutover-event-replication.md | 11 - .changeset/1694-portable-replicated-inbox.md | 10 - .changeset/1695-passive-batch-collision.md | 9 - .changeset/1696-observe-missing-pg-secrets.md | 10 - .changeset/1698-rollback-pruned-delivery.md | 5 - .changeset/1707-cutover-set-runtime-role.md | 7 - .changeset/1719-codex-prompt-agent-fields.md | 9 - .../1737-sidecar-pending-min-invalid.md | 7 - .changeset/1746-rollback-artifact-applied.md | 6 - .changeset/1754-tier3-exact-gate.md | 5 - .changeset/1755-deprecate-dedup-bm25.md | 7 - .changeset/1763-active-child-successors.md | 5 - .changeset/1764-replication-drain.md | 5 - .changeset/1765-bracket-tail-ownership.md | 6 - .changeset/622-physical-snapshot-lifecycle.md | 11 - .changeset/625-migration-activation.md | 30 - .changeset/626-coordinator-token-seam.md | 12 - .changeset/627-migration-operator-cli.md | 37 - .changeset/638-runtime-health.md | 9 - .changeset/639-incident-diagnostics.md | 6 - .changeset/799-grep-guidance-wording.md | 6 - .changeset/828-project-directory-topology.md | 6 - .../844-coordinator-material-witness.md | 5 - .changeset/849-grep-response.md | 6 - .changeset/859-nested-file-url.md | 6 - .changeset/863-expand-depth-validation.md | 6 - .changeset/865-post-start-admission.md | 8 - .changeset/880-top-level-publication.md | 7 - .changeset/883-installer-drift-diagnostic.md | 6 - .changeset/887-preserve-empty-since.md | 6 - .changeset/898-promoted-fts-tags.md | 6 - .changeset/903-query-prefix-redaction.md | 6 - .changeset/906-preserve-probe-contention.md | 7 - .changeset/907-publication-errors.md | 6 - .changeset/916-recent-cwd.md | 10 - .changeset/930-expand-body-shape.md | 8 - .changeset/931-expand-budget.md | 6 - .changeset/934-codex-teardown-abort.md | 7 - .changeset/944-supervisor-temp-diagnostic.md | 7 - .changeset/966-bounded-birth-admission.md | 8 - .changeset/969-json-object-bodies.md | 9 - .changeset/972-search-cwd.md | 8 - .../974-reconciliation-target-parents.md | 7 - .changeset/988-memory-search-tags.md | 5 - .changeset/999-monotonic-reconciliation.md | 7 - .changeset/abortable-project-opens.md | 9 - .changeset/accept-codex-terminal-events.md | 9 - .changeset/accept-historical-skill-newline.md | 7 - .changeset/active-postgres-projects.md | 5 - .changeset/admit-prompt-search-surfacing.md | 6 - .changeset/atomic-identities-admit.md | 5 - .../authenticate-event-sidecar-parent.md | 6 - ...authenticate-indirect-pg-trgm-operators.md | 5 - ...authenticate-promote-metadata-ancestors.md | 6 - .../authenticate-promote-metadata-parent.md | 7 - ...authenticate-user-namespace-home-parent.md | 8 - .changeset/bind-publication-checkpoints.md | 6 - .changeset/bound-bug-campaign-issue-input.md | 9 - .changeset/bound-fixed-sqlite-controls.md | 6 - .../bound-post-scrub-native-transcripts.md | 9 - .changeset/bound-preliminary-metadata.md | 7 - .changeset/bound-project-discovery.md | 7 - .changeset/bound-status-metadata.md | 7 - .changeset/bound-transcript-locator-fence.md | 6 - .changeset/bounded-legacy-evidence.md | 7 - .changeset/bounded-regex-snippets.md | 5 - .changeset/bright-bugs-close.md | 5 - .changeset/bright-codex-zero-tools.md | 7 - .changeset/bright-query-statistics.md | 5 - .changeset/bright-search-limit.md | 7 - .changeset/brisk-conversations-append.md | 5 - .changeset/bug-783-publication-convergence.md | 7 - .changeset/bug-837-consumer-descriptor.md | 6 - .changeset/bug-839-optional-root.md | 7 - .changeset/bug-866-cli-read-convergence.md | 8 - .changeset/bug-885-missing-codex-guidance.md | 6 - .changeset/bug-910-monotonic-publication.md | 6 - .changeset/busy-daemons-wait.md | 5 - .changeset/calm-betas-draft.md | 5 - .changeset/calm-codex-skill.md | 17 - .changeset/calm-dingos-refuse.md | 7 - .changeset/calm-directories-clean.md | 7 - .changeset/calm-journals-reread.md | 6 - .changeset/calm-launchd-label-release.md | 5 - .changeset/calm-post-tool-bootstrap.md | 6 - .changeset/calm-postgresql-search.md | 5 - .changeset/calm-questions-migrate.md | 5 - .changeset/calm-search-candidate-recall.md | 9 - .changeset/calm-trees-reconcile.md | 5 - .changeset/calm-worktree-config-comments.md | 5 - .../canonical-mcp-search-grep-contracts.md | 13 - .../canonical-source-installer-runtime.md | 8 - .changeset/capture-codex-exec-context.md | 7 - .../clarify-durable-private-publication.md | 8 - .../classify-negative-zero-manifest-counts.md | 7 - .changeset/clean-consumer-descriptors.md | 6 - .changeset/clean-tags-skill.md | 5 - .changeset/cleanup-error-precedence.md | 7 - .changeset/clear-journal-less-recovery.md | 6 - .changeset/clear-postgresql-references.md | 5 - .changeset/clear-store-help-aliases.md | 5 - .changeset/close-exclusive-identity-fds.md | 7 - .changeset/close-postgresql-factory-health.md | 6 - .changeset/close-postgresql-project-health.md | 6 - .changeset/codex-failure-classification.md | 9 - .changeset/codex-subagent-memory.md | 20 - .changeset/codex-terminal-hooks.md | 16 - .changeset/compact-agent-tag-guidance.md | 5 - .changeset/compact-concurrency.md | 6 - .changeset/compact-cwd.md | 7 - .changeset/compact-discovery-yield.md | 12 - .changeset/curated-package-docs.md | 5 - .changeset/cutover-set-commands.md | 5 - .changeset/daemon-publication-contention.md | 9 - .../doctor-authenticated-storage-readiness.md | 5 - .changeset/doctor-monotonic-retry.md | 6 - .../durable-passive-events-replicate.md | 5 - .../enumerate-unbound-postgresql-project.md | 24 - .changeset/events-cli-error-display.md | 6 - .changeset/expose-mcp-grep-mode.md | 7 - .changeset/fair-camels-park.md | 9 - .changeset/fair-dragons-compact.md | 5 - .changeset/fair-spiders-guard.md | 7 - .changeset/faster-portable-batches.md | 7 - .changeset/fence-installer-health-identity.md | 7 - .changeset/fence-scrubber-storage-identity.md | 7 - .changeset/fence-sqlite-factory-health.md | 6 - .changeset/fence-sqlite-project-health.md | 6 - .changeset/fenced-sqlite-copy.md | 9 - .changeset/file-authority-punctuation.md | 6 - .changeset/fix-activation-exit-classes.md | 5 - .changeset/fix-codex-native-user-bus.md | 7 - .changeset/fix-doctor-version-convergence.md | 6 - .changeset/fix-file-url-bracket-paths.md | 6 - .changeset/fix-hook-capture-truncation.md | 5 - .../fix-portable-knowledge-provenance.md | 7 - .../fixed-instruction-cache-reconciliation.md | 5 - .changeset/fixed-promoted-content-nul.md | 8 - .../freeze-reversible-migration-protocol.md | 5 - .changeset/fresh-root-handoff.md | 8 - .changeset/fuzzy-doors-heal.md | 5 - .changeset/g003-managed-path-trust.md | 7 - .changeset/gitleaks-patterns-220.md | 7 - .changeset/green-format.md | 5 - .changeset/grep-session-filter.md | 7 - .changeset/grep-since-datetime.md | 8 - .changeset/grep-since-year-range.md | 6 - .../guard-absent-install-publication.md | 6 - .../guard-sqlite-leaf-initialization.md | 6 - .changeset/guarded-postgresql-conformance.md | 5 - .../harden-promote-sidecar-directory.md | 7 - .changeset/health-backend-unknown.md | 5 - .changeset/health-observation-halt-detail.md | 6 - .changeset/hook-legacy-pattern-identity.md | 5 - .changeset/isolate-reinforcement-failures.md | 6 - .changeset/large-git-configs.md | 5 - .changeset/lucky-moons-arrive.md | 27 - .changeset/machine-project-identities.md | 5 - .changeset/major-connector-transports.md | 24 - .changeset/managed-daemon-clean-env.md | 5 - .changeset/managed-service-recovery.md | 10 - .changeset/marker-spread.md | 5 - .../monotonic-codex-compaction-timeout.md | 6 - .changeset/monotonic-proxy-startup.md | 6 - .changeset/native-claude-install.md | 8 - .changeset/native-ingest-lifecycle.md | 9 - .changeset/native-transcripts.md | 5 - .changeset/olive-donkeys-shave.md | 15 - .changeset/open-unenrolled-sqlite-identity.md | 6 - .changeset/openai-sdk-7-node-22.md | 5 - .changeset/optional-sqlite-receipt-schema.md | 5 - .../passive-event-dangling-predecessor.md | 5 - .changeset/passive-event-predecessor-remap.md | 5 - .changeset/passive-promotion-identity.md | 8 - .changeset/patch-ajv-fast-uri.md | 5 - .changeset/patch-bundled-uri-query-parsers.md | 5 - .../pin-postgresql-runtime-deparsers.md | 6 - .changeset/pin-publication-retry-identity.md | 6 - .changeset/plan-driven-ci.md | 5 - .changeset/portable-predecessor-identity.md | 22 - .changeset/portable-project-storage.md | 9 - .changeset/portable-record-stream.md | 8 - .changeset/portable-snapshot-idle-timeout.md | 33 - .changeset/postgresql-daemon-runtime.md | 7 - .changeset/postgresql-schema-baseline.md | 5 - .changeset/postgresql-storage-config.md | 5 - .changeset/postgresql-summary-context.md | 5 - .../preserve-adjacent-file-url-schemes.md | 6 - ...reserve-bootstrap-authentication-errors.md | 6 - .../preserve-codex-endpoint-after-cleanup.md | 6 - ...eserve-completed-reconciliation-cleanup.md | 7 - .../preserve-pathless-file-url-tails.md | 8 - .../preserve-portable-read-cancellation.md | 6 - ...erve-postgresql-cancellation-machine-id.md | 5 - ...-postgresql-repository-machine-identity.md | 5 - .../preserve-project-admission-errors.md | 7 - .../preserve-promote-resource-errors.md | 7 - .changeset/private-database-parents.md | 6 - .../private-portable-import-metadata.md | 6 - .changeset/private-route-metadata.md | 7 - .changeset/private-write-cleanup-errors.md | 10 - .changeset/procedural-development-skills.md | 6 - .changeset/promote-private-metadata.md | 6 - .changeset/promotion-exact-dedup.md | 7 - .../publication-fence-sidecar-lifetime.md | 7 - .changeset/publish-portable-storage-api.md | 5 - .changeset/quiet-codex-config.md | 5 - .changeset/quiet-codex-effective-endpoint.md | 6 - .changeset/quiet-codex-memory-rule.md | 7 - .changeset/quiet-connectors-format.md | 5 - .changeset/quiet-daemons-recover.md | 5 - .changeset/quiet-diagnostic-observation.md | 5 - .changeset/quiet-dogfooding-reads.md | 8 - .changeset/quiet-memories-coordinate.md | 5 - .changeset/quiet-metadata-stats.md | 7 - .../quiet-missing-cwd-passive-events.md | 5 - .changeset/quiet-paths-hide.md | 6 - .changeset/quiet-pipes-reject.md | 5 - .changeset/quiet-post-tool-contention.md | 6 - .changeset/quiet-postgresql-runtime.md | 5 - .changeset/quiet-publication-reads.md | 16 - .changeset/quiet-pumas-sanitize-paths.md | 6 - .changeset/quiet-stats-databases.md | 6 - .changeset/quiet-timestamps-utc.md | 6 - .changeset/quiet-turtles-listen.md | 7 - .changeset/recent-limit-validation.md | 7 - .../reconcile-backend-worktree-identity.md | 6 - .changeset/reconciliation-message-nul.md | 7 - .../recover-managed-publication-restart.md | 5 - .../redact-drive-after-bracket-content.md | 6 - .changeset/redact-embedded-file-url-quotes.md | 6 - .changeset/redact-file-url-backslash-tails.md | 7 - .changeset/redact-hosted-file-url-paths.md | 6 - .changeset/redact-mcp-braced-credentials.md | 5 - .changeset/redact-pathless-bracket-tails.md | 6 - .changeset/redact-post-bracket-file-paths.md | 6 - .changeset/refuse-replaced-connector-files.md | 23 - .../refuse-restored-promotion-metadata.md | 9 - ...refuse-unsupported-descriptor-platforms.md | 6 - .../reject-negative-zero-checkpoint-counts.md | 6 - .../reject-symlinked-connector-parents.md | 9 - .../reliable-daemon-startup-recovery.md | 5 - .changeset/relinked-replication-rows.md | 10 - .../renew-retired-project-identities.md | 23 - .changeset/repair-clipped-daemon-temp.md | 7 - .changeset/repair-spark-responses.md | 7 - .changeset/require-doctor-runtime-digest.md | 5 - .changeset/restore-codex-rules.md | 8 - .changeset/retain-archive-history-identity.md | 7 - .../retain-promotion-admission-tokens.md | 9 - .changeset/retain-quoted-file-authorities.md | 11 - .changeset/retain-sessionstart-publication.md | 6 - .../retained-reconciliation-journal-parent.md | 8 - .../retry-daemon-storage-factory-close.md | 7 - .changeset/rollback-authoritative-resume.md | 30 - .changeset/s11-identity-map-auth.md | 23 - .changeset/s11-sanitizer-independent.md | 10 - .changeset/s13-cli-enumeration.md | 13 - .changeset/s13-publication-errors.md | 10 - .../safe-codex-publication-diagnostics.md | 8 - .changeset/safe-daemon-pid-publication.md | 10 - .changeset/safe-legacy-daemon-migration.md | 5 - .changeset/safe-postgresql-harness.md | 5 - .changeset/safe-promoted-arrays.md | 5 - .../sanitize-adjacent-file-authorities.md | 8 - .changeset/sanitize-file-path-handoffs.md | 7 - .../sanitize-read-compatibility-errors.md | 7 - .changeset/sanitized-backend-diagnostics.md | 13 - .changeset/sanitizer-ownership-family.md | 5 - .changeset/secure-daemon-health.md | 5 - .changeset/secure-git-metadata-identity.md | 5 - .../secure-immutable-sqlite-snapshots.md | 6 - .changeset/secure-journal-lifecycle.md | 7 - .changeset/secure-project-map-metadata.md | 6 - .../secure-project-metadata-admission.md | 7 - .../secure-publication-directory-witnesses.md | 7 - .changeset/secure-reconciliation-leaves.md | 7 - .changeset/secure-reconciliation-metadata.md | 6 - .changeset/secure-uri-authorities.md | 5 - .changeset/security-alert-campaign.md | 5 - .changeset/security-sidecar-identity.md | 8 - .changeset/settled-codex-config-witness.md | 6 - .../skip-authoritative-empty-source-reads.md | 6 - .changeset/snapshot-final-mode-sync.md | 7 - .changeset/stable-bracketed-url-paths.md | 7 - .changeset/stable-locale-admission.md | 5 - .changeset/stable-managed-admission.md | 5 - .changeset/stable-managed-daemon-tmpdir.md | 6 - .changeset/stats-conversation-denominator.md | 5 - .changeset/steady-backend-publication.md | 7 - .changeset/steady-bootstrap-retries.md | 5 - .changeset/steady-diagnostics-boundaries.md | 8 - .changeset/steady-doctors-repair.md | 5 - .changeset/steady-query-tails.md | 7 - .changeset/steady-recovery-provenance.md | 8 - .changeset/steady-release-publication.md | 5 - .changeset/steady-restart-publication.md | 5 - .changeset/store-dedup-exact-identity.md | 9 - .changeset/store-healthy-daemon-admission.md | 7 - .../strict-authoritative-empty-manifests.md | 5 - .changeset/strict-identity-fences.md | 5 - .changeset/strong-machines-coordinate.md | 5 - .changeset/sturdy-packages-install.md | 5 - ...rface-postgresql-surfacing-log-failures.md | 7 - .changeset/swift-runners-rest.md | 5 - .../terminal-journals-resume-ordinary-work.md | 7 - .changeset/tidy-background-scheduling.md | 5 - .changeset/tidy-claude-transcript-blocks.md | 5 - .changeset/tidy-penguins-walk.md | 5 - .changeset/tidy-pugs-repeat.md | 21 - .changeset/tidy-sqlite-health-admission.md | 5 - .changeset/tidy-test-lifecycles.md | 5 - .changeset/trusted-admission-evidence.md | 5 - .changeset/trusted-lock-helpers.md | 5 - .changeset/trusted-release-provenance.md | 5 - .changeset/upstream-stream-diagnostics.md | 6 - .changeset/utc-message-timestamps.md | 9 - .changeset/validate-fenced-machine-id.md | 8 - .../validate-portable-batch-requests.md | 6 - .../validate-private-tmp-daemon-ownership.md | 8 - .changeset/verified-pnpm-development.md | 5 - .changeset/verify-compact-runtime-digest.md | 6 - ...ify-generation-canonical-reconciliation.md | 91 - .changeset/worktree-project-memory.md | 5 - CHANGELOG.md | 1691 +++++++++++++++++ package.json | 2 +- 434 files changed, 1692 insertions(+), 3411 deletions(-) delete mode 100644 .changeset/1018-cli-refusal-warnings.md delete mode 100644 .changeset/1019-expansion-contract-docs.md delete mode 100644 .changeset/1032-publication-outcome.md delete mode 100644 .changeset/1044-monotonic-cache.md delete mode 100644 .changeset/1070-preserve-topology-errors.md delete mode 100644 .changeset/1087-1091-reconciliation-publication.md delete mode 100644 .changeset/1101-sidecar-skipped-count.md delete mode 100644 .changeset/1139-slack-hostname-case.md delete mode 100644 .changeset/1141-single-slash-file-tails.md delete mode 100644 .changeset/1144-admission-cleanup-errors.md delete mode 100644 .changeset/1148-promoted-route-utc.md delete mode 100644 .changeset/1153-1158-promotion-provenance.md delete mode 100644 .changeset/1173-reconciliation-promoted-content.md delete mode 100644 .changeset/1176-pg-declarations.md delete mode 100644 .changeset/1178-1245-journal-admission.md delete mode 100644 .changeset/1203-prompt-recall-rank-scale.md delete mode 100644 .changeset/1218-native-transcript-block-redaction.md delete mode 100644 .changeset/1237-fenced-source-marker-loss.md delete mode 100644 .changeset/1240-terminal-maintenance-config.md delete mode 100644 .changeset/1247-promotion-acknowledgement.md delete mode 100644 .changeset/1259-hook-fence-finalization.md delete mode 100644 .changeset/1300-migration-wrapper-preflight.md delete mode 100644 .changeset/1306-index-exact-content-digest.md delete mode 100644 .changeset/1307-queued-append-scan.md delete mode 100644 .changeset/1308-import-metadata-refresh.md delete mode 100644 .changeset/1316-message-byte-integrity.md delete mode 100644 .changeset/1321-node-25-floor.md delete mode 100644 .changeset/1338-compact-discovery-locators.md delete mode 100644 .changeset/1347-consumer-token-append-admission.md delete mode 100644 .changeset/1354-promoted-content-serialization.md delete mode 100644 .changeset/1358-scrub-rule-runtime.md delete mode 100644 .changeset/1371-store-dedup.md delete mode 100644 .changeset/1378-1380-transfer-completion-fence.md delete mode 100644 .changeset/1388-batched-canonical-reads.md delete mode 100644 .changeset/1390-1371-sqlite-exact-dedup.md delete mode 100644 .changeset/1390-promote-owner-scope-dedup.md delete mode 100644 .changeset/1416-snapshot-readiness.md delete mode 100644 .changeset/1424-idle-client-error.md delete mode 100644 .changeset/1426-transfer-completion-membership.md delete mode 100644 .changeset/1438-publication-guard-provider.md delete mode 100644 .changeset/1441-sqlite-exact-content-index.md delete mode 100644 .changeset/1459-racy-capture-cache.md delete mode 100644 .changeset/1468-hook-publication-contention.md delete mode 100644 .changeset/1470-1489-batched-closure-reads.md delete mode 100644 .changeset/1471-store-empty-origin.md delete mode 100644 .changeset/1472-sanitizer-url-successor.md delete mode 100644 .changeset/1473-1477-1478-1488-replication-pass.md delete mode 100644 .changeset/1476-1498-1499-migration-evidence.md delete mode 100644 .changeset/1479-1480-1495-cli-docs.md delete mode 100644 .changeset/1502-sanitizer-query-successor.md delete mode 100644 .changeset/1508-copy-writer-system-identifier.md delete mode 100644 .changeset/1511-replication-pending-relink.md delete mode 100644 .changeset/1513-mcp-publication-admission.md delete mode 100644 .changeset/1514-1515-sanitizer-successors.md delete mode 100644 .changeset/1524-convergence-released-lock.md delete mode 100644 .changeset/1530-replication-drain-successors.md delete mode 100644 .changeset/1537-storage-route-fail-closed.md delete mode 100644 .changeset/1538-reads-during-own-sweep.md delete mode 100644 .changeset/1555-rollback-external-abort.md delete mode 100644 .changeset/1558-codex-tool-outcomes.md delete mode 100644 .changeset/1559-codex-native-activity.md delete mode 100644 .changeset/1560-compact-fork-restore.md delete mode 100644 .changeset/1563-pretool-memory-hints.md delete mode 100644 .changeset/1564-codex-connector-readiness.md delete mode 100644 .changeset/1565-codex-lifecycle-guarantees.md delete mode 100644 .changeset/1566-compact-failure-diagnostics.md delete mode 100644 .changeset/1567-native-link-diagnostics.md delete mode 100644 .changeset/1576-lcm-enabled-hooks.md delete mode 100644 .changeset/1577-fifo-transcript-open.md delete mode 100644 .changeset/1578-codex-fork-inherited.md delete mode 100644 .changeset/1581-compaction-event-count.md delete mode 100644 .changeset/1582-shutdown-storage-settle.md delete mode 100644 .changeset/1583-codex-toml-float-finite.md delete mode 100644 .changeset/1584-1586-codex-hooks-strict-parse.md delete mode 100644 .changeset/1599-session-end-completion-diagnostic.md delete mode 100644 .changeset/1600-mixed-group-upgrade-docs.md delete mode 100644 .changeset/1607-activation-runtime-readiness.md delete mode 100644 .changeset/1617-applied-readback.md delete mode 100644 .changeset/1618-activation-uninitialized-home.md delete mode 100644 .changeset/1625-codex-hooks-number-paths.md delete mode 100644 .changeset/1631-doctor-unknown-duplicates.md delete mode 100644 .changeset/1632-referenced-fork-restoration.md delete mode 100644 .changeset/1634-1635-publication-lock-wait.md delete mode 100644 .changeset/1636-hook-stdout-flush.md delete mode 100644 .changeset/1637-pending-age-invalid-sidecar.md delete mode 100644 .changeset/1639-extensions-failure-reason.md delete mode 100644 .changeset/1642-transfer-legacy-column-grants.md delete mode 100644 .changeset/1643-telemetry-guide-intro.md delete mode 100644 .changeset/1648-activation-s7-classification.md delete mode 100644 .changeset/1651-release-window-successor.md delete mode 100644 .changeset/1652-abort-late-effect-route.md delete mode 100644 .changeset/1655-migration-outcome-accuracy.md delete mode 100644 .changeset/1657-set-abort-readback-member.md delete mode 100644 .changeset/1659-abort-retry-evidence.md delete mode 100644 .changeset/1663-rollback-timestamp-compare.md delete mode 100644 .changeset/1667-rollback-checkpoint-incomplete.md delete mode 100644 .changeset/1672-acl-sentinel-namespace.md delete mode 100644 .changeset/1673-cutover-set-activation-classification.md delete mode 100644 .changeset/1674-migration-commands-under-hold.md delete mode 100644 .changeset/1675-report-after-rollback.md delete mode 100644 .changeset/1676-empty-project-eligibility.md delete mode 100644 .changeset/1678-migration-alias-identity.md delete mode 100644 .changeset/1679-unroutable-activation-windows.md delete mode 100644 .changeset/1680-set-rollback-report-timestamp.md delete mode 100644 .changeset/1681-rollback-drain-disposition.md delete mode 100644 .changeset/1684-promote-events-contention.md delete mode 100644 .changeset/1689-shared-history-refusal-order.md delete mode 100644 .changeset/1691-alias-lock-timeout.md delete mode 100644 .changeset/1693-cutover-event-replication.md delete mode 100644 .changeset/1694-portable-replicated-inbox.md delete mode 100644 .changeset/1695-passive-batch-collision.md delete mode 100644 .changeset/1696-observe-missing-pg-secrets.md delete mode 100644 .changeset/1698-rollback-pruned-delivery.md delete mode 100644 .changeset/1707-cutover-set-runtime-role.md delete mode 100644 .changeset/1719-codex-prompt-agent-fields.md delete mode 100644 .changeset/1737-sidecar-pending-min-invalid.md delete mode 100644 .changeset/1746-rollback-artifact-applied.md delete mode 100644 .changeset/1754-tier3-exact-gate.md delete mode 100644 .changeset/1755-deprecate-dedup-bm25.md delete mode 100644 .changeset/1763-active-child-successors.md delete mode 100644 .changeset/1764-replication-drain.md delete mode 100644 .changeset/1765-bracket-tail-ownership.md delete mode 100644 .changeset/622-physical-snapshot-lifecycle.md delete mode 100644 .changeset/625-migration-activation.md delete mode 100644 .changeset/626-coordinator-token-seam.md delete mode 100644 .changeset/627-migration-operator-cli.md delete mode 100644 .changeset/638-runtime-health.md delete mode 100644 .changeset/639-incident-diagnostics.md delete mode 100644 .changeset/799-grep-guidance-wording.md delete mode 100644 .changeset/828-project-directory-topology.md delete mode 100644 .changeset/844-coordinator-material-witness.md delete mode 100644 .changeset/849-grep-response.md delete mode 100644 .changeset/859-nested-file-url.md delete mode 100644 .changeset/863-expand-depth-validation.md delete mode 100644 .changeset/865-post-start-admission.md delete mode 100644 .changeset/880-top-level-publication.md delete mode 100644 .changeset/883-installer-drift-diagnostic.md delete mode 100644 .changeset/887-preserve-empty-since.md delete mode 100644 .changeset/898-promoted-fts-tags.md delete mode 100644 .changeset/903-query-prefix-redaction.md delete mode 100644 .changeset/906-preserve-probe-contention.md delete mode 100644 .changeset/907-publication-errors.md delete mode 100644 .changeset/916-recent-cwd.md delete mode 100644 .changeset/930-expand-body-shape.md delete mode 100644 .changeset/931-expand-budget.md delete mode 100644 .changeset/934-codex-teardown-abort.md delete mode 100644 .changeset/944-supervisor-temp-diagnostic.md delete mode 100644 .changeset/966-bounded-birth-admission.md delete mode 100644 .changeset/969-json-object-bodies.md delete mode 100644 .changeset/972-search-cwd.md delete mode 100644 .changeset/974-reconciliation-target-parents.md delete mode 100644 .changeset/988-memory-search-tags.md delete mode 100644 .changeset/999-monotonic-reconciliation.md delete mode 100644 .changeset/abortable-project-opens.md delete mode 100644 .changeset/accept-codex-terminal-events.md delete mode 100644 .changeset/accept-historical-skill-newline.md delete mode 100644 .changeset/active-postgres-projects.md delete mode 100644 .changeset/admit-prompt-search-surfacing.md delete mode 100644 .changeset/atomic-identities-admit.md delete mode 100644 .changeset/authenticate-event-sidecar-parent.md delete mode 100644 .changeset/authenticate-indirect-pg-trgm-operators.md delete mode 100644 .changeset/authenticate-promote-metadata-ancestors.md delete mode 100644 .changeset/authenticate-promote-metadata-parent.md delete mode 100644 .changeset/authenticate-user-namespace-home-parent.md delete mode 100644 .changeset/bind-publication-checkpoints.md delete mode 100644 .changeset/bound-bug-campaign-issue-input.md delete mode 100644 .changeset/bound-fixed-sqlite-controls.md delete mode 100644 .changeset/bound-post-scrub-native-transcripts.md delete mode 100644 .changeset/bound-preliminary-metadata.md delete mode 100644 .changeset/bound-project-discovery.md delete mode 100644 .changeset/bound-status-metadata.md delete mode 100644 .changeset/bound-transcript-locator-fence.md delete mode 100644 .changeset/bounded-legacy-evidence.md delete mode 100644 .changeset/bounded-regex-snippets.md delete mode 100644 .changeset/bright-bugs-close.md delete mode 100644 .changeset/bright-codex-zero-tools.md delete mode 100644 .changeset/bright-query-statistics.md delete mode 100644 .changeset/bright-search-limit.md delete mode 100644 .changeset/brisk-conversations-append.md delete mode 100644 .changeset/bug-783-publication-convergence.md delete mode 100644 .changeset/bug-837-consumer-descriptor.md delete mode 100644 .changeset/bug-839-optional-root.md delete mode 100644 .changeset/bug-866-cli-read-convergence.md delete mode 100644 .changeset/bug-885-missing-codex-guidance.md delete mode 100644 .changeset/bug-910-monotonic-publication.md delete mode 100644 .changeset/busy-daemons-wait.md delete mode 100644 .changeset/calm-betas-draft.md delete mode 100644 .changeset/calm-codex-skill.md delete mode 100644 .changeset/calm-dingos-refuse.md delete mode 100644 .changeset/calm-directories-clean.md delete mode 100644 .changeset/calm-journals-reread.md delete mode 100644 .changeset/calm-launchd-label-release.md delete mode 100644 .changeset/calm-post-tool-bootstrap.md delete mode 100644 .changeset/calm-postgresql-search.md delete mode 100644 .changeset/calm-questions-migrate.md delete mode 100644 .changeset/calm-search-candidate-recall.md delete mode 100644 .changeset/calm-trees-reconcile.md delete mode 100644 .changeset/calm-worktree-config-comments.md delete mode 100644 .changeset/canonical-mcp-search-grep-contracts.md delete mode 100644 .changeset/canonical-source-installer-runtime.md delete mode 100644 .changeset/capture-codex-exec-context.md delete mode 100644 .changeset/clarify-durable-private-publication.md delete mode 100644 .changeset/classify-negative-zero-manifest-counts.md delete mode 100644 .changeset/clean-consumer-descriptors.md delete mode 100644 .changeset/clean-tags-skill.md delete mode 100644 .changeset/cleanup-error-precedence.md delete mode 100644 .changeset/clear-journal-less-recovery.md delete mode 100644 .changeset/clear-postgresql-references.md delete mode 100644 .changeset/clear-store-help-aliases.md delete mode 100644 .changeset/close-exclusive-identity-fds.md delete mode 100644 .changeset/close-postgresql-factory-health.md delete mode 100644 .changeset/close-postgresql-project-health.md delete mode 100644 .changeset/codex-failure-classification.md delete mode 100644 .changeset/codex-subagent-memory.md delete mode 100644 .changeset/codex-terminal-hooks.md delete mode 100644 .changeset/compact-agent-tag-guidance.md delete mode 100644 .changeset/compact-concurrency.md delete mode 100644 .changeset/compact-cwd.md delete mode 100644 .changeset/compact-discovery-yield.md delete mode 100644 .changeset/curated-package-docs.md delete mode 100644 .changeset/cutover-set-commands.md delete mode 100644 .changeset/daemon-publication-contention.md delete mode 100644 .changeset/doctor-authenticated-storage-readiness.md delete mode 100644 .changeset/doctor-monotonic-retry.md delete mode 100644 .changeset/durable-passive-events-replicate.md delete mode 100644 .changeset/enumerate-unbound-postgresql-project.md delete mode 100644 .changeset/events-cli-error-display.md delete mode 100644 .changeset/expose-mcp-grep-mode.md delete mode 100644 .changeset/fair-camels-park.md delete mode 100644 .changeset/fair-dragons-compact.md delete mode 100644 .changeset/fair-spiders-guard.md delete mode 100644 .changeset/faster-portable-batches.md delete mode 100644 .changeset/fence-installer-health-identity.md delete mode 100644 .changeset/fence-scrubber-storage-identity.md delete mode 100644 .changeset/fence-sqlite-factory-health.md delete mode 100644 .changeset/fence-sqlite-project-health.md delete mode 100644 .changeset/fenced-sqlite-copy.md delete mode 100644 .changeset/file-authority-punctuation.md delete mode 100644 .changeset/fix-activation-exit-classes.md delete mode 100644 .changeset/fix-codex-native-user-bus.md delete mode 100644 .changeset/fix-doctor-version-convergence.md delete mode 100644 .changeset/fix-file-url-bracket-paths.md delete mode 100644 .changeset/fix-hook-capture-truncation.md delete mode 100644 .changeset/fix-portable-knowledge-provenance.md delete mode 100644 .changeset/fixed-instruction-cache-reconciliation.md delete mode 100644 .changeset/fixed-promoted-content-nul.md delete mode 100644 .changeset/freeze-reversible-migration-protocol.md delete mode 100644 .changeset/fresh-root-handoff.md delete mode 100644 .changeset/fuzzy-doors-heal.md delete mode 100644 .changeset/g003-managed-path-trust.md delete mode 100644 .changeset/gitleaks-patterns-220.md delete mode 100644 .changeset/green-format.md delete mode 100644 .changeset/grep-session-filter.md delete mode 100644 .changeset/grep-since-datetime.md delete mode 100644 .changeset/grep-since-year-range.md delete mode 100644 .changeset/guard-absent-install-publication.md delete mode 100644 .changeset/guard-sqlite-leaf-initialization.md delete mode 100644 .changeset/guarded-postgresql-conformance.md delete mode 100644 .changeset/harden-promote-sidecar-directory.md delete mode 100644 .changeset/health-backend-unknown.md delete mode 100644 .changeset/health-observation-halt-detail.md delete mode 100644 .changeset/hook-legacy-pattern-identity.md delete mode 100644 .changeset/isolate-reinforcement-failures.md delete mode 100644 .changeset/large-git-configs.md delete mode 100644 .changeset/lucky-moons-arrive.md delete mode 100644 .changeset/machine-project-identities.md delete mode 100644 .changeset/major-connector-transports.md delete mode 100644 .changeset/managed-daemon-clean-env.md delete mode 100644 .changeset/managed-service-recovery.md delete mode 100644 .changeset/marker-spread.md delete mode 100644 .changeset/monotonic-codex-compaction-timeout.md delete mode 100644 .changeset/monotonic-proxy-startup.md delete mode 100644 .changeset/native-claude-install.md delete mode 100644 .changeset/native-ingest-lifecycle.md delete mode 100644 .changeset/native-transcripts.md delete mode 100644 .changeset/olive-donkeys-shave.md delete mode 100644 .changeset/open-unenrolled-sqlite-identity.md delete mode 100644 .changeset/openai-sdk-7-node-22.md delete mode 100644 .changeset/optional-sqlite-receipt-schema.md delete mode 100644 .changeset/passive-event-dangling-predecessor.md delete mode 100644 .changeset/passive-event-predecessor-remap.md delete mode 100644 .changeset/passive-promotion-identity.md delete mode 100644 .changeset/patch-ajv-fast-uri.md delete mode 100644 .changeset/patch-bundled-uri-query-parsers.md delete mode 100644 .changeset/pin-postgresql-runtime-deparsers.md delete mode 100644 .changeset/pin-publication-retry-identity.md delete mode 100644 .changeset/plan-driven-ci.md delete mode 100644 .changeset/portable-predecessor-identity.md delete mode 100644 .changeset/portable-project-storage.md delete mode 100644 .changeset/portable-record-stream.md delete mode 100644 .changeset/portable-snapshot-idle-timeout.md delete mode 100644 .changeset/postgresql-daemon-runtime.md delete mode 100644 .changeset/postgresql-schema-baseline.md delete mode 100644 .changeset/postgresql-storage-config.md delete mode 100644 .changeset/postgresql-summary-context.md delete mode 100644 .changeset/preserve-adjacent-file-url-schemes.md delete mode 100644 .changeset/preserve-bootstrap-authentication-errors.md delete mode 100644 .changeset/preserve-codex-endpoint-after-cleanup.md delete mode 100644 .changeset/preserve-completed-reconciliation-cleanup.md delete mode 100644 .changeset/preserve-pathless-file-url-tails.md delete mode 100644 .changeset/preserve-portable-read-cancellation.md delete mode 100644 .changeset/preserve-postgresql-cancellation-machine-id.md delete mode 100644 .changeset/preserve-postgresql-repository-machine-identity.md delete mode 100644 .changeset/preserve-project-admission-errors.md delete mode 100644 .changeset/preserve-promote-resource-errors.md delete mode 100644 .changeset/private-database-parents.md delete mode 100644 .changeset/private-portable-import-metadata.md delete mode 100644 .changeset/private-route-metadata.md delete mode 100644 .changeset/private-write-cleanup-errors.md delete mode 100644 .changeset/procedural-development-skills.md delete mode 100644 .changeset/promote-private-metadata.md delete mode 100644 .changeset/promotion-exact-dedup.md delete mode 100644 .changeset/publication-fence-sidecar-lifetime.md delete mode 100644 .changeset/publish-portable-storage-api.md delete mode 100644 .changeset/quiet-codex-config.md delete mode 100644 .changeset/quiet-codex-effective-endpoint.md delete mode 100644 .changeset/quiet-codex-memory-rule.md delete mode 100644 .changeset/quiet-connectors-format.md delete mode 100644 .changeset/quiet-daemons-recover.md delete mode 100644 .changeset/quiet-diagnostic-observation.md delete mode 100644 .changeset/quiet-dogfooding-reads.md delete mode 100644 .changeset/quiet-memories-coordinate.md delete mode 100644 .changeset/quiet-metadata-stats.md delete mode 100644 .changeset/quiet-missing-cwd-passive-events.md delete mode 100644 .changeset/quiet-paths-hide.md delete mode 100644 .changeset/quiet-pipes-reject.md delete mode 100644 .changeset/quiet-post-tool-contention.md delete mode 100644 .changeset/quiet-postgresql-runtime.md delete mode 100644 .changeset/quiet-publication-reads.md delete mode 100644 .changeset/quiet-pumas-sanitize-paths.md delete mode 100644 .changeset/quiet-stats-databases.md delete mode 100644 .changeset/quiet-timestamps-utc.md delete mode 100644 .changeset/quiet-turtles-listen.md delete mode 100644 .changeset/recent-limit-validation.md delete mode 100644 .changeset/reconcile-backend-worktree-identity.md delete mode 100644 .changeset/reconciliation-message-nul.md delete mode 100644 .changeset/recover-managed-publication-restart.md delete mode 100644 .changeset/redact-drive-after-bracket-content.md delete mode 100644 .changeset/redact-embedded-file-url-quotes.md delete mode 100644 .changeset/redact-file-url-backslash-tails.md delete mode 100644 .changeset/redact-hosted-file-url-paths.md delete mode 100644 .changeset/redact-mcp-braced-credentials.md delete mode 100644 .changeset/redact-pathless-bracket-tails.md delete mode 100644 .changeset/redact-post-bracket-file-paths.md delete mode 100644 .changeset/refuse-replaced-connector-files.md delete mode 100644 .changeset/refuse-restored-promotion-metadata.md delete mode 100644 .changeset/refuse-unsupported-descriptor-platforms.md delete mode 100644 .changeset/reject-negative-zero-checkpoint-counts.md delete mode 100644 .changeset/reject-symlinked-connector-parents.md delete mode 100644 .changeset/reliable-daemon-startup-recovery.md delete mode 100644 .changeset/relinked-replication-rows.md delete mode 100644 .changeset/renew-retired-project-identities.md delete mode 100644 .changeset/repair-clipped-daemon-temp.md delete mode 100644 .changeset/repair-spark-responses.md delete mode 100644 .changeset/require-doctor-runtime-digest.md delete mode 100644 .changeset/restore-codex-rules.md delete mode 100644 .changeset/retain-archive-history-identity.md delete mode 100644 .changeset/retain-promotion-admission-tokens.md delete mode 100644 .changeset/retain-quoted-file-authorities.md delete mode 100644 .changeset/retain-sessionstart-publication.md delete mode 100644 .changeset/retained-reconciliation-journal-parent.md delete mode 100644 .changeset/retry-daemon-storage-factory-close.md delete mode 100644 .changeset/rollback-authoritative-resume.md delete mode 100644 .changeset/s11-identity-map-auth.md delete mode 100644 .changeset/s11-sanitizer-independent.md delete mode 100644 .changeset/s13-cli-enumeration.md delete mode 100644 .changeset/s13-publication-errors.md delete mode 100644 .changeset/safe-codex-publication-diagnostics.md delete mode 100644 .changeset/safe-daemon-pid-publication.md delete mode 100644 .changeset/safe-legacy-daemon-migration.md delete mode 100644 .changeset/safe-postgresql-harness.md delete mode 100644 .changeset/safe-promoted-arrays.md delete mode 100644 .changeset/sanitize-adjacent-file-authorities.md delete mode 100644 .changeset/sanitize-file-path-handoffs.md delete mode 100644 .changeset/sanitize-read-compatibility-errors.md delete mode 100644 .changeset/sanitized-backend-diagnostics.md delete mode 100644 .changeset/sanitizer-ownership-family.md delete mode 100644 .changeset/secure-daemon-health.md delete mode 100644 .changeset/secure-git-metadata-identity.md delete mode 100644 .changeset/secure-immutable-sqlite-snapshots.md delete mode 100644 .changeset/secure-journal-lifecycle.md delete mode 100644 .changeset/secure-project-map-metadata.md delete mode 100644 .changeset/secure-project-metadata-admission.md delete mode 100644 .changeset/secure-publication-directory-witnesses.md delete mode 100644 .changeset/secure-reconciliation-leaves.md delete mode 100644 .changeset/secure-reconciliation-metadata.md delete mode 100644 .changeset/secure-uri-authorities.md delete mode 100644 .changeset/security-alert-campaign.md delete mode 100644 .changeset/security-sidecar-identity.md delete mode 100644 .changeset/settled-codex-config-witness.md delete mode 100644 .changeset/skip-authoritative-empty-source-reads.md delete mode 100644 .changeset/snapshot-final-mode-sync.md delete mode 100644 .changeset/stable-bracketed-url-paths.md delete mode 100644 .changeset/stable-locale-admission.md delete mode 100644 .changeset/stable-managed-admission.md delete mode 100644 .changeset/stable-managed-daemon-tmpdir.md delete mode 100644 .changeset/stats-conversation-denominator.md delete mode 100644 .changeset/steady-backend-publication.md delete mode 100644 .changeset/steady-bootstrap-retries.md delete mode 100644 .changeset/steady-diagnostics-boundaries.md delete mode 100644 .changeset/steady-doctors-repair.md delete mode 100644 .changeset/steady-query-tails.md delete mode 100644 .changeset/steady-recovery-provenance.md delete mode 100644 .changeset/steady-release-publication.md delete mode 100644 .changeset/steady-restart-publication.md delete mode 100644 .changeset/store-dedup-exact-identity.md delete mode 100644 .changeset/store-healthy-daemon-admission.md delete mode 100644 .changeset/strict-authoritative-empty-manifests.md delete mode 100644 .changeset/strict-identity-fences.md delete mode 100644 .changeset/strong-machines-coordinate.md delete mode 100644 .changeset/sturdy-packages-install.md delete mode 100644 .changeset/surface-postgresql-surfacing-log-failures.md delete mode 100644 .changeset/swift-runners-rest.md delete mode 100644 .changeset/terminal-journals-resume-ordinary-work.md delete mode 100644 .changeset/tidy-background-scheduling.md delete mode 100644 .changeset/tidy-claude-transcript-blocks.md delete mode 100644 .changeset/tidy-penguins-walk.md delete mode 100644 .changeset/tidy-pugs-repeat.md delete mode 100644 .changeset/tidy-sqlite-health-admission.md delete mode 100644 .changeset/tidy-test-lifecycles.md delete mode 100644 .changeset/trusted-admission-evidence.md delete mode 100644 .changeset/trusted-lock-helpers.md delete mode 100644 .changeset/trusted-release-provenance.md delete mode 100644 .changeset/upstream-stream-diagnostics.md delete mode 100644 .changeset/utc-message-timestamps.md delete mode 100644 .changeset/validate-fenced-machine-id.md delete mode 100644 .changeset/validate-portable-batch-requests.md delete mode 100644 .changeset/validate-private-tmp-daemon-ownership.md delete mode 100644 .changeset/verified-pnpm-development.md delete mode 100644 .changeset/verify-compact-runtime-digest.md delete mode 100644 .changeset/verify-generation-canonical-reconciliation.md delete mode 100644 .changeset/worktree-project-memory.md create mode 100644 CHANGELOG.md diff --git a/.changeset/1018-cli-refusal-warnings.md b/.changeset/1018-cli-refusal-warnings.md deleted file mode 100644 index 2283a6aec..000000000 --- a/.changeset/1018-cli-refusal-warnings.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve fixed owner-preserving umask guidance when daemon start, restart, or a -shared CLI consumer reports the matching managed lifecycle refusal. diff --git a/.changeset/1019-expansion-contract-docs.md b/.changeset/1019-expansion-contract-docs.md deleted file mode 100644 index 04406ef8c..000000000 --- a/.changeset/1019-expansion-contract-docs.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Correct the documented `lcm_expand` contract so it matches the shipped tool. -The README configuration table and the agent-tool reference described a token -cap and full source content that the registered tool never provides: the daemon -expansion route passes no token cap and does not request raw source messages, so -a response carries no message content, a child summary longer than 200 -characters appears as its first 200 characters followed by an ellipsis, and -expanding a leaf summary yields an expansion entry whose children and messages -are both empty. The -`LCM_MAX_EXPAND_TOKENS` entry now names the unregistered -`buildExpansionToolDefinition` helper it actually reaches, and the MCP tool -description no longer promises full source content. The `lcm expand` command -description and help text are corrected the same way, since that command posts -to the same daemon route and returns the same child-summary snippets. diff --git a/.changeset/1032-publication-outcome.md b/.changeset/1032-publication-outcome.md deleted file mode 100644 index d45a8aabc..000000000 --- a/.changeset/1032-publication-outcome.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse private metadata publication earlier when a retained parent or temporary -file changes, and report whether a rename completed or its publication outcome -is unknown when topology changes after the rename attempt. diff --git a/.changeset/1044-monotonic-cache.md b/.changeset/1044-monotonic-cache.md deleted file mode 100644 index d3256c48e..000000000 --- a/.changeset/1044-monotonic-cache.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep the process-local worktree discovery cache on a monotonic elapsed-time -clock so wall-clock corrections cannot extend or shorten its 1,000 millisecond -TTL. diff --git a/.changeset/1070-preserve-topology-errors.md b/.changeset/1070-preserve-topology-errors.md deleted file mode 100644 index f5f781f92..000000000 --- a/.changeset/1070-preserve-topology-errors.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve retained project and event topology diagnostics when reconciliation -fails after a target database commit, while retaining rollback failures as -secondary error evidence. diff --git a/.changeset/1087-1091-reconciliation-publication.md b/.changeset/1087-1091-reconciliation-publication.md deleted file mode 100644 index c944fb48b..000000000 --- a/.changeset/1087-1091-reconciliation-publication.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Bound canonical worktree metadata by its serialized UTF-8 size, and preserve -archived or completed reconciliation evidence when final publication fails. diff --git a/.changeset/1101-sidecar-skipped-count.md b/.changeset/1101-sidecar-skipped-count.md deleted file mode 100644 index 9b262108c..000000000 --- a/.changeset/1101-sidecar-skipped-count.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Report the full number of sidecars skipped by bounded passive-learning scans, -including files remaining after an in-flight timeout or cancellation. diff --git a/.changeset/1139-slack-hostname-case.md b/.changeset/1139-slack-hostname-case.md deleted file mode 100644 index 42c145cca..000000000 --- a/.changeset/1139-slack-hostname-case.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact uppercase and mixed-case Slack webhook hostnames. diff --git a/.changeset/1141-single-slash-file-tails.md b/.changeset/1141-single-slash-file-tails.md deleted file mode 100644 index dae10adaa..000000000 --- a/.changeset/1141-single-slash-file-tails.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact glued single-slash file path tails in the first sanitization pass. diff --git a/.changeset/1144-admission-cleanup-errors.md b/.changeset/1144-admission-cleanup-errors.md deleted file mode 100644 index 84660ded1..000000000 --- a/.changeset/1144-admission-cleanup-errors.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve publication admission callback failures while retaining ordered -bootstrap-lock, home, and parent descriptor cleanup evidence and typed -contention or publication-error classification. diff --git a/.changeset/1148-promoted-route-utc.md b/.changeset/1148-promoted-route-utc.md deleted file mode 100644 index 27f677115..000000000 --- a/.changeset/1148-promoted-route-utc.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Interpret timezone-less promoted-memory timestamps as UTC in prompt-search and -restore age and recency decisions, keeping results consistent across hosts. diff --git a/.changeset/1153-1158-promotion-provenance.md b/.changeset/1153-1158-promotion-provenance.md deleted file mode 100644 index 0191d6fc3..000000000 --- a/.changeset/1153-1158-promotion-provenance.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fix passive promotion deduplication for exact content and PostgreSQL owner-wide -provenance, while retaining the inserted event's remote source identity. diff --git a/.changeset/1173-reconciliation-promoted-content.md b/.changeset/1173-reconciliation-promoted-content.md deleted file mode 100644 index 3ed34dc98..000000000 --- a/.changeset/1173-reconciliation-promoted-content.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse non-text or embedded-NUL promoted-memory rows during legacy worktree -reconciliation instead of importing a truncated value, while preserving -in-place repair and retry behavior. Honor completed source markers without -requesting a source repair that the idempotent merge would skip. diff --git a/.changeset/1176-pg-declarations.md b/.changeset/1176-pg-declarations.md deleted file mode 100644 index 0a36edd9e..000000000 --- a/.changeset/1176-pg-declarations.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Publish the PostgreSQL declaration dependency so strict TypeScript consumers can -use the package root and storage subpaths without installing `@types/pg`. diff --git a/.changeset/1178-1245-journal-admission.md b/.changeset/1178-1245-journal-admission.md deleted file mode 100644 index 73ba4f2bf..000000000 --- a/.changeset/1178-1245-journal-admission.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse unsafe reconciliation journal roots during listing and bind mutating -journal reads to the retained private directory's observed device and inode. diff --git a/.changeset/1203-prompt-recall-rank-scale.md b/.changeset/1203-prompt-recall-rank-scale.md deleted file mode 100644 index c00b19401..000000000 --- a/.changeset/1203-prompt-recall-rank-scale.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Correct prompt recall by scoring native matched-term evidence instead of incomparable backend ranks. Preserve full SQLite Porter matches and default PostgreSQL exact recall, with a four-point bonus only for whole normalized content/query equality and explicit native evidence diagnostics. diff --git a/.changeset/1218-native-transcript-block-redaction.md b/.changeset/1218-native-transcript-block-redaction.md deleted file mode 100644 index fa322e67d..000000000 --- a/.changeset/1218-native-transcript-block-redaction.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Scrub secrets that span supported Claude and Codex native transcript text -blocks before exact message linkage, while preserving the native record shape -and failing closed when conservative redaction differs from parsed content. diff --git a/.changeset/1237-fenced-source-marker-loss.md b/.changeset/1237-fenced-source-marker-loss.md deleted file mode 100644 index 6716046ef..000000000 --- a/.changeset/1237-fenced-source-marker-loss.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Document the third worktree-reconciliation refusal state. The recovery notes -covered an uncommitted source fence that rolls back and a target refusal whose -source fence may already be committed, but not the case where the completed -marker is present at the read-only precheck and durably absent inside the target -transaction. The source fence is committed by then, so the normalized source -recheck refuses against an already-retired source: nothing is copied or -truncated, but the documented in-place `UPDATE promoted` repair aborts against -the retained fence and later runs refuse at the source guard. The privacy -documentation now describes that state and states plainly that no in-place -repair is supported, rather than implying the earlier procedure applies. diff --git a/.changeset/1240-terminal-maintenance-config.md b/.changeset/1240-terminal-maintenance-config.md deleted file mode 100644 index da61b80f6..000000000 --- a/.changeset/1240-terminal-maintenance-config.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Restore normal configuration loading after SQLite migration maintenance is -aborted or target selection completes. Continue to reject active maintenance, -backend mismatches, changed configuration witnesses, and invalid journals. diff --git a/.changeset/1247-promotion-acknowledgement.md b/.changeset/1247-promotion-acknowledgement.md deleted file mode 100644 index 23522a759..000000000 --- a/.changeset/1247-promotion-acknowledgement.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fix passive promotion and event draining failing to acknowledge queued events -after committing their memory or migration receipt. Reuse the current -publication token for acknowledgement, retained-token preparation, and owned -storage cleanup while keeping scrubber setup outside selected storage admission. diff --git a/.changeset/1259-hook-fence-finalization.md b/.changeset/1259-hook-fence-finalization.md deleted file mode 100644 index 61d6c94ef..000000000 --- a/.changeset/1259-hook-fence-finalization.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve hook publication failures when final root validation and descriptor -cleanup succeed. Retain publication journal reasons and ordered evidence when -cleanup also fails, and classify combined missing-evidence, contention, or other -failures as unsafe storage. Keep PreCompact's initial unsafe-storage failures -observable through its existing error logger. Reclassified finalization failures -follow each hook's journal-error policy: some hooks throw, while best-effort -hooks continue returning exit code 0. diff --git a/.changeset/1300-migration-wrapper-preflight.md b/.changeset/1300-migration-wrapper-preflight.md deleted file mode 100644 index 5f8722fce..000000000 --- a/.changeset/1300-migration-wrapper-preflight.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse unsupported SQLite migration capture and dry-run platforms before wrapper -authority reads, append barriers, callbacks, or artifact effects. diff --git a/.changeset/1306-index-exact-content-digest.md b/.changeset/1306-index-exact-content-digest.md deleted file mode 100644 index f7f3548c3..000000000 --- a/.changeset/1306-index-exact-content-digest.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Index owner-scoped exact promoted-content lookup in PostgreSQL with a -generated SHA-256 candidate column and partial btree index, keeping raw -content equality as the residual collision guard. Applying the migration -takes an exclusive schema rewrite and index-build window proportional to -existing promoted-memory data. diff --git a/.changeset/1307-queued-append-scan.md b/.changeset/1307-queued-append-scan.md deleted file mode 100644 index 6b30bb187..000000000 --- a/.changeset/1307-queued-append-scan.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Stop a queued local append from being forced to time out by a mutating -passive-learning sidecar scan. Orphan cleanup now enters the local append order -before it acquires publication consumer admission, so an append that started -first completes and stays durable instead of waiting on a lock the scan is -holding. The scan keeps one retained admission through its diagnostic snapshot, -real close, eligibility check, and prune, and that admission no longer grants -implicit append authority to nested tokenless appends, so an append started -during close cannot write between the snapshot and the prune decision. -Cancellation and the scan deadline are honored before the scan opens anything, -reporting the sidecar as skipped, while unrelated publication contention -remains a per-sidecar error that lets scanning continue. - -The sweep also keeps refusing to run while a backend migration holds -publication, so it cannot delete a sidecar during maintenance. diff --git a/.changeset/1308-import-metadata-refresh.md b/.changeset/1308-import-metadata-refresh.md deleted file mode 100644 index f1846ff23..000000000 --- a/.changeset/1308-import-metadata-refresh.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve concurrent import metadata and retry identities by merging portable -knowledge convergence into the current stored row instead of a stale import -scan snapshot. diff --git a/.changeset/1316-message-byte-integrity.md b/.changeset/1316-message-byte-integrity.md deleted file mode 100644 index 80ddba3e0..000000000 --- a/.changeset/1316-message-byte-integrity.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse malformed UTF-8 bytes in legacy SQLite conversation messages during -worktree reconciliation so retries preserve the original source and target -bytes for deliberate offline repair. diff --git a/.changeset/1321-node-25-floor.md b/.changeset/1321-node-25-floor.md deleted file mode 100644 index 3bb6622f4..000000000 --- a/.changeset/1321-node-25-floor.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -"@donadiosolutions/lcm": major ---- - -Remove Node.js 22 support and declare Node.js 25.4.0 as the supported runtime. -Installing on Node.js 22 now reports an `EBADENGINE` mismatch, which npm -enforces as a refusal only when `engine-strict` is enabled and otherwise -reports as a warning, so the unsupported runtime is stated at install time -instead of failing later at runtime. The previous `>=22.12.0` floor was never -functional: `node:sqlite` does not exist on Node.js 22.12 without -`--experimental-sqlite`, which the CLI never passes. Node.js 22.13 through -22.15 do provide `StatementSync.iterate()` but still lack -`DatabaseSync.isTransaction`, which production code calls without a fallback, -so no Node.js 22 release below 22.16 could run LCM as written. CI now runs the -coverage gate on the declared floor so the supported runtime is exercised -rather than assumed. diff --git a/.changeset/1338-compact-discovery-locators.md b/.changeset/1338-compact-discovery-locators.md deleted file mode 100644 index 23a53def9..000000000 --- a/.changeset/1338-compact-discovery-locators.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"@donadiosolutions/lcm": major ---- - -Resolve compact discovery source locators with one bounded project-level -lookup instead of one native-transcript query per eligible conversation, so -large projects no longer pay an N+1 query pattern or load transcript payloads -that discovery never displays. A session whose provenance cannot be read now -loses only its own source locator (#1338, source Bug #1283). - -BREAKING: NativeTranscriptRepository gains the required member -listUnambiguousSourceLocators. The interface is exported from the public -@donadiosolutions/lcm/storage/native-transcripts entry point, so an external -implementation must add this operation to compile against this release. diff --git a/.changeset/1347-consumer-token-append-admission.md b/.changeset/1347-consumer-token-append-admission.md deleted file mode 100644 index e40a5ef73..000000000 --- a/.changeset/1347-consumer-token-append-admission.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Admit local append work that already holds backend publication instead of -queueing it behind an append that cannot proceed, so daemon promote-events -sidecar scans complete rather than timing out under contention. diff --git a/.changeset/1354-promoted-content-serialization.md b/.changeset/1354-promoted-content-serialization.md deleted file mode 100644 index edf77f97c..000000000 --- a/.changeset/1354-promoted-content-serialization.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Serialize PostgreSQL promoted-memory deduplication decisions for knowledge -import, so two concurrent imports of the same new content can no longer each -observe an empty candidate set and both insert a separate active memory. -Imports into one project now take turns rather than running side by side; -imports into different projects are unaffected. diff --git a/.changeset/1358-scrub-rule-runtime.md b/.changeset/1358-scrub-rule-runtime.md deleted file mode 100644 index aecc7f3a1..000000000 --- a/.changeset/1358-scrub-rule-runtime.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Stop bundled Gitleaks detectors from monopolizing the daemon during native -transcript backfill. Imported patterns collapse redundant nested lazy prefixes, -and structurally verified required keywords now skip rules that cannot match the -current text. Rules without a mechanical proof continue scanning in full. -Secret-free strings also avoid a redundant residual scrub pass. diff --git a/.changeset/1371-store-dedup.md b/.changeset/1371-store-dedup.md deleted file mode 100644 index cba155546..000000000 --- a/.changeset/1371-store-dedup.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -`lcm store` and the `lcm_store` tool now make the same deduplication decision -as knowledge import and `lcm promote`. Storing content that already exists as -an active promoted memory in scope returns that memory's id, with its tags -unioned and its confidence kept at the maximum, instead of creating a second -memory; two identical stores now yield one memory. New content still returns a -fresh id. - -On PostgreSQL a manual store also takes the project-scoped deduplication lock, -so it takes turns with a concurrent import or promote into the same project -rather than racing them into a duplicate. diff --git a/.changeset/1378-1380-transfer-completion-fence.md b/.changeset/1378-1380-transfer-completion-fence.md deleted file mode 100644 index c5dbe6c33..000000000 --- a/.changeset/1378-1380-transfer-completion-fence.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse to complete a PostgreSQL migration copy whose canonical rows changed -after verification. Completion now re-reads every row the run wrote from -inside the transaction that commits it, and holds the project write fence for -that whole transaction, so another writer can no longer modify or delete a -verified row in the window between the check and the commit. Completion reads -the ledger in bounded pages and groups each page's rows so one read never asks -for more than a batch worth of content, which costs a size read per group but -keeps a large run from loading itself into memory while it holds the fence. -Each ledger page is also bounded by the byte size of its native keys (#1461). -Other writes to the same project wait for that completion to commit. - -Let installations that have already run a transfer apply the schema upgrade -this check needs. The transfer ledger retains its rows, so the new required -digest column is added nullable, backfilled for rows written before it -existed, and only then made mandatory. A run that still carries one of those -older rows fails closed instead of completing unverified. - -Report the readback failure that actually caused a migration settlement -attempt to fail, instead of a stale error left over from an earlier retryable -or ambiguous-commit attempt. - -Settle a migration whose rows moved after it completed. The content check -belongs to the transition into the completed state; once that transaction -commits and releases the fence, an ordinary project writer may change a row at -any time. Reading a completed run back now re-proves identity, the run itself -and its checkpoint chain without requiring the content to have stayed still, -so a migration that did complete is no longer reported as a failed settlement. diff --git a/.changeset/1388-batched-canonical-reads.md b/.changeset/1388-batched-canonical-reads.md deleted file mode 100644 index eb3bf123a..000000000 --- a/.changeset/1388-batched-canonical-reads.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -PostgreSQL portable source creation and migration verification read canonical rows in bounded batches instead of one query per record. diff --git a/.changeset/1390-1371-sqlite-exact-dedup.md b/.changeset/1390-1371-sqlite-exact-dedup.md deleted file mode 100644 index 63d1ebabb..000000000 --- a/.changeset/1390-1371-sqlite-exact-dedup.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -The exact-content dedup lookup added for PostgreSQL now runs on every -backend. Knowledge import and passive promotion previously merged -content with no searchable lexical terms (for example, punctuation-only -text) into an existing active memory only on PostgreSQL; on SQLite, -ranked search returned no candidates for such content and two identical -writes produced two active memories. SQLite's exact-content lookup is -indexed by project, with no lexical dependency, but still compares full -content per active row in that project rather than using a content -index the way PostgreSQL's does, and is now consulted the same way -PostgreSQL's already was, within SQLite's existing source-scoped -boundary. `lcm store` and `lcm promote` reach this same lookup on -every backend as part of the separate dedup changes documented -alongside this one. diff --git a/.changeset/1390-promote-owner-scope-dedup.md b/.changeset/1390-promote-owner-scope-dedup.md deleted file mode 100644 index ad9ac0ace..000000000 --- a/.changeset/1390-promote-owner-scope-dedup.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Compaction-driven promotion on PostgreSQL now deduplicates against the bound -project's whole provenance and consults the exact-content lookup, as knowledge -import and passive promotion already do. A promoted summary whose exact -content is already an active memory merges into it even when ranked search -cannot recall that content, so it is no longer stored twice. diff --git a/.changeset/1416-snapshot-readiness.md b/.changeset/1416-snapshot-readiness.md deleted file mode 100644 index 70966cd9a..000000000 --- a/.changeset/1416-snapshot-readiness.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Re-check PostgreSQL schema readiness inside the portable source's read-only -snapshot so catalog changes between admission and snapshot are not exported. diff --git a/.changeset/1424-idle-client-error.md b/.changeset/1424-idle-client-error.md deleted file mode 100644 index 2a0573076..000000000 --- a/.changeset/1424-idle-client-error.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Handle the asynchronous connection error that PostgreSQL emits when it kills an -idle checked-out connection, for example through -`idle_in_transaction_session_timeout`. Previously a query or transaction whose -callback sat idle past the server timeout could raise an unhandled error and -crash the process; the operation now fails with a storage error and the dead -connection is discarded instead of returned to the pool. diff --git a/.changeset/1426-transfer-completion-membership.md b/.changeset/1426-transfer-completion-membership.md deleted file mode 100644 index 975693d2e..000000000 --- a/.changeset/1426-transfer-completion-membership.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse to complete a PostgreSQL migration copy whose destination gained -canonical rows after verification. While holding the project publication -fence, completion now compares, per non-identity domain, a database-side -count of the destination's canonical rows with the run's transfer-ledger -tally. A surplus refuses as `destination-unexpected-rows` and a deficit -refuses as `verification-failed`, so a row committed by another writer -between verification and completion no longer completes silently. Identity -domains stay outside the comparison, and the post-commit readback of an -already completed run does not repeat it. diff --git a/.changeset/1438-publication-guard-provider.md b/.changeset/1438-publication-guard-provider.md deleted file mode 100644 index 8455b6bcb..000000000 --- a/.changeset/1438-publication-guard-provider.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -The backend publication coordinator refuses to record the guarded or released phases without a complete remote-guard provider when the publication has projects. Completed publication material is retained indefinitely by design. diff --git a/.changeset/1441-sqlite-exact-content-index.md b/.changeset/1441-sqlite-exact-content-index.md deleted file mode 100644 index b285dda8f..000000000 --- a/.changeset/1441-sqlite-exact-content-index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -SQLite exact-content dedup lookups are index-backed. Result order is unchanged. diff --git a/.changeset/1459-racy-capture-cache.md b/.changeset/1459-racy-capture-cache.md deleted file mode 100644 index eafdef0a2..000000000 --- a/.changeset/1459-racy-capture-cache.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Portable SQLite sources now detect same-timestamp writes after capture. A -captured file whose timestamps are within two seconds of its authenticating -read is re-hashed on every check instead of trusted from unchanged metadata. diff --git a/.changeset/1468-hook-publication-contention.md b/.changeset/1468-hook-publication-contention.md deleted file mode 100644 index bd26d43ac..000000000 --- a/.changeset/1468-hook-publication-contention.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Installed hook entrypoints (restore, session-end, session-snapshot, user-prompt, -and `compact --hook`) no longer fail with exit code 1 when the backend -publication lock is busy. They skip the CLI legacy-root migration preflight, and -the hook dispatcher treats lock contention while loading the hook configuration -as a best-effort exit 0 for compact, restore, and session-end. Session snapshots -no longer load the configuration at all. UserPromptSubmit's durable local -enqueue stays retry-required (non-zero exit) when its append barrier stays busy -past the bounded wait. diff --git a/.changeset/1470-1489-batched-closure-reads.md b/.changeset/1470-1489-batched-closure-reads.md deleted file mode 100644 index 714596bb2..000000000 --- a/.changeset/1470-1489-batched-closure-reads.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -PostgreSQL portable export and verification read conversation messages and -record pages in batches, and batch memory accounting now includes record keys. diff --git a/.changeset/1471-store-empty-origin.md b/.changeset/1471-store-empty-origin.md deleted file mode 100644 index 4fe392a69..000000000 --- a/.changeset/1471-store-empty-origin.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Treat an empty or non-string `metadata.projectId` in `lcm store` as the `manual` origin so it cannot merge into another origin's memory on SQLite. diff --git a/.changeset/1472-sanitizer-url-successor.md b/.changeset/1472-sanitizer-url-successor.md deleted file mode 100644 index dd49708d1..000000000 --- a/.changeset/1472-sanitizer-url-successor.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact a path root that follows an ampersand after a file URL path in the first sanitization pass. diff --git a/.changeset/1473-1477-1478-1488-replication-pass.md b/.changeset/1473-1477-1478-1488-replication-pass.md deleted file mode 100644 index b680e2250..000000000 --- a/.changeset/1473-1477-1478-1488-replication-pass.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Make the passive-event replication pass open the sidecar the sweep scanned, -stop a pass from uploading new rows to a project that was relinked mid-pass -while still finishing its work against that project, hold and retry an -outbox whose close failed instead of opening a second one, and cancel an -in-flight storage health check on daemon shutdown. diff --git a/.changeset/1476-1498-1499-migration-evidence.md b/.changeset/1476-1498-1499-migration-evidence.md deleted file mode 100644 index 0fd0496eb..000000000 --- a/.changeset/1476-1498-1499-migration-evidence.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Treat an existing journal-less backend-publication directory as unresolvable -PostgreSQL publication evidence, bind a migration copy to the destination's -PostgreSQL system identifier (manifests written before this change must be -copied again to be verified), and accept only canonical positive decimal pids -in the activation restart check. diff --git a/.changeset/1479-1480-1495-cli-docs.md b/.changeset/1479-1480-1495-cli-docs.md deleted file mode 100644 index 939f02cf6..000000000 --- a/.changeset/1479-1480-1495-cli-docs.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Import prints the unbound-project remedy once per project when a mapped alias -clone and the canonical checkout both have sessions. Docs describe direct -export failure lines and correct the capture-cache residual cases. diff --git a/.changeset/1502-sanitizer-query-successor.md b/.changeset/1502-sanitizer-query-successor.md deleted file mode 100644 index 96d4fa32b..000000000 --- a/.changeset/1502-sanitizer-query-successor.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact a path root that follows a question mark or equals sign after a file URL path in the first sanitization pass. diff --git a/.changeset/1508-copy-writer-system-identifier.md b/.changeset/1508-copy-writer-system-identifier.md deleted file mode 100644 index 4eb2fa489..000000000 --- a/.changeset/1508-copy-writer-system-identifier.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse migration copy writes, including lease acquire, renew and release, to a -PostgreSQL cluster whose system identifier differs from the one recorded when -the copy probed the destination. diff --git a/.changeset/1511-replication-pending-relink.md b/.changeset/1511-replication-pending-relink.md deleted file mode 100644 index 37b16d606..000000000 --- a/.changeset/1511-replication-pending-relink.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -A passive event whose upload reached the previous remote project before a -relink, but was not recorded locally, is now delivered to the new project, and -the other events of its upload batch are no longer held back. When an upload -fails and the new project lacks some of the rows, the previous project's copies -are withdrawn, acknowledged, or kept quarantined as for other relinked rows, and -the batch is uploaded once more without the rows that cannot go. diff --git a/.changeset/1513-mcp-publication-admission.md b/.changeset/1513-mcp-publication-admission.md deleted file mode 100644 index 4926bf1ab..000000000 --- a/.changeset/1513-mcp-publication-admission.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -`lcm mcp` now waits briefly for the managed daemon's own publication work at -startup instead of exiting with a publication-busy error. Any other lock owner -or unverifiable daemon still fails closed. diff --git a/.changeset/1514-1515-sanitizer-successors.md b/.changeset/1514-1515-sanitizer-successors.md deleted file mode 100644 index db5c0159a..000000000 --- a/.changeset/1514-1515-sanitizer-successors.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact a path root that follows a fragment marker after a file URL path, or that follows a URL scheme inside a redacted path, in the first sanitization pass. diff --git a/.changeset/1524-convergence-released-lock.md b/.changeset/1524-convergence-released-lock.md deleted file mode 100644 index b9e8e0ed6..000000000 --- a/.changeset/1524-convergence-released-lock.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Authenticate the publication lock owner recorded when contention occurs, so -`lcm mcp` startup after a daemon restart no longer exits when the daemon -releases the lock before convergence can read it again. The retry stays within -the existing two-second window, and contention on other locks, missing daemon -identity, and foreign, malformed, stale, or unhealthy owners still fail closed. diff --git a/.changeset/1530-replication-drain-successors.md b/.changeset/1530-replication-drain-successors.md deleted file mode 100644 index d7214cac3..000000000 --- a/.changeset/1530-replication-drain-successors.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Drain a machine's whole ready backlog of PostgreSQL passive events in one -replication pass instead of one event per pass, up to the batch size. diff --git a/.changeset/1537-storage-route-fail-closed.md b/.changeset/1537-storage-route-fail-closed.md deleted file mode 100644 index 317b720ff..000000000 --- a/.changeset/1537-storage-route-fail-closed.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -PostgreSQL read routes return a sanitized 503 instead of empty results when -project storage or publication admission fails. diff --git a/.changeset/1538-reads-during-own-sweep.md b/.changeset/1538-reads-during-own-sweep.md deleted file mode 100644 index c1f3a5556..000000000 --- a/.changeset/1538-reads-during-own-sweep.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -PostgreSQL daemon read routes (`/search`, `/grep`, `/recent`, `/describe`, `/expand`) -no longer fail while the daemon's own publication work, such as a replication -sweep phase, holds the publication lock. A read that contends retries once, -waiting up to one second for a turn in the daemon's publication queue, and -otherwise returns the sanitized `503`; contention and an expired wait are -retryable, while a genuine storage failure keeps `retryable: false`. diff --git a/.changeset/1555-rollback-external-abort.md b/.changeset/1555-rollback-external-abort.md deleted file mode 100644 index 946b46978..000000000 --- a/.changeset/1555-rollback-external-abort.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Re-running a migration rollback now completes it when its own backend -publication was aborted by something else. The restored configuration and -project map are checked against what the publication recorded, the destination -and the activation authority are verified again, and the publication then -resumes forward; a drifted destination refuses with the effect pending and the -lease held. diff --git a/.changeset/1558-codex-tool-outcomes.md b/.changeset/1558-codex-tool-outcomes.md deleted file mode 100644 index 08db71e95..000000000 --- a/.changeset/1558-codex-tool-outcomes.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Interpret current Codex tool outcomes correctly. Passive capture now accepts the -`Bash` tool name Codex emits for shell commands, keeps the legacy -`functions.exec` names as aliases, and no longer treats a shell command as -successful just because Codex reported no status: git and install commands with -no structured status are stored as a `tool_outcome_unknown` observation, which -is never promoted, reinforced or correlated as the fix for an earlier error. -Codex MCP calls are recorded as before when the result is a success. diff --git a/.changeset/1559-codex-native-activity.md b/.changeset/1559-codex-native-activity.md deleted file mode 100644 index a23136eb1..000000000 --- a/.changeset/1559-codex-native-activity.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Capture bounded file changes, subagent dispatches, answered questions, and explained plan revisions from native Codex `apply_patch`, `spawn_agent`, `request_user_input`, and `update_plan` tool calls. diff --git a/.changeset/1560-compact-fork-restore.md b/.changeset/1560-compact-fork-restore.md deleted file mode 100644 index 515984d5f..000000000 --- a/.changeset/1560-compact-fork-restore.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Restore LCM memory in Codex after compaction and into forked conversations. The -Codex SessionStart hook now also runs for `compact` and `fork`, prefixes each -restoration with an `` line, and skips `resume`, `fork`, -and `compact` when the session's own rollout already holds a restoration since -the latest compaction or rollback. A Codex compaction restores recent summaries, -promoted knowledge, and passive insights instead of orientation only, and a -recent LCM summarization no longer strips a Codex `resume` or `clear`. The -per-session restore lock is now released when the hook returns. Re-run -`lcm connectors install codex` to update the matcher; Codex may ask to re-trust -the changed hook. diff --git a/.changeset/1563-pretool-memory-hints.md b/.changeset/1563-pretool-memory-hints.md deleted file mode 100644 index e481be1b3..000000000 --- a/.changeset/1563-pretool-memory-hints.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add an opt-in Codex PreToolUse hook that surfaces up to two relevant memories -as advisory context before a shell command, `apply_patch` edit, or MCP tool -call. It is off by default: set `hooks.preToolRecall` to `true` with -`lcm config set hooks.preToolRecall true --json` and reinstall with -`lcm connectors install codex`. diff --git a/.changeset/1564-codex-connector-readiness.md b/.changeset/1564-codex-connector-readiness.md deleted file mode 100644 index b2c257242..000000000 --- a/.changeset/1564-codex-connector-readiness.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -`lcm connectors doctor codex` now reports whether Codex can actually run each -LCM hook (missing, disabled, untrusted, modified, or ready) instead of -only checking that the hook is installed, and reinstalling the Codex hooks -keeps your per-hook enable and trust choices and any explicit -`[features] hooks = false`. diff --git a/.changeset/1565-codex-lifecycle-guarantees.md b/.changeset/1565-codex-lifecycle-guarantees.md deleted file mode 100644 index 22146b000..000000000 --- a/.changeset/1565-codex-lifecycle-guarantees.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Document the Codex lifecycle guarantees verified against native Codex 0.163.0 -sessions: which edges are verified, best-effort, not covered or unverified, how -failures and context limits behave, and where to look when a hook does not run. -Correct the Codex MCP bundle setup (register with `codex mcp add lcm -- lcm mcp` -first) and document the `hooks.snapshotIntervalSec` Stop throttle. diff --git a/.changeset/1566-compact-failure-diagnostics.md b/.changeset/1566-compact-failure-diagnostics.md deleted file mode 100644 index c7cfe72e2..000000000 --- a/.changeset/1566-compact-failure-diagnostics.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Make `lcm compact` report actionable per-session failures. Failed sessions now -name the cause (lost daemon connection, rejected authentication, unavailable -daemon, daemon error, or unbound project) and the next step instead of a -generic "compaction request failed", without echoing raw daemon or provider -error text. diff --git a/.changeset/1567-native-link-diagnostics.md b/.changeset/1567-native-link-diagnostics.md deleted file mode 100644 index e6098e3dc..000000000 --- a/.changeset/1567-native-link-diagnostics.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Name the condition code and source ordinal in native transcript linkage -failures so logged ingest errors identify which record failed and why. diff --git a/.changeset/1576-lcm-enabled-hooks.md b/.changeset/1576-lcm-enabled-hooks.md deleted file mode 100644 index d8411db25..000000000 --- a/.changeset/1576-lcm-enabled-hooks.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Honor the documented `LCM_ENABLED=false` setting by making every native Claude and Codex hook a no-op, including the legacy `lcm compact` PreCompact command. diff --git a/.changeset/1577-fifo-transcript-open.md b/.changeset/1577-fifo-transcript-open.md deleted file mode 100644 index 309ef9fdb..000000000 --- a/.changeset/1577-fifo-transcript-open.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject FIFO and other special-file transcript paths without blocking the -daemon. Native ingest and the pathname transcript readers used by compaction -now open the file non-blocking and check that it is a regular file before -reading, so a FIFO with no writer returns the empty-input result instead of -hanging the request. diff --git a/.changeset/1578-codex-fork-inherited.md b/.changeset/1578-codex-fork-inherited.md deleted file mode 100644 index f5cd8f3be..000000000 --- a/.changeset/1578-codex-fork-inherited.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Stop storing a Codex fork's copied parent history again. A fork that copied its -parent's rollout now stores, and links in the native transcript archive, only -the messages after its own settings event, in both `/ingest` and `/compact`. -A session that was stored before keeps following the history it already holds. diff --git a/.changeset/1581-compaction-event-count.md b/.changeset/1581-compaction-event-count.md deleted file mode 100644 index a7fffedad..000000000 --- a/.changeset/1581-compaction-event-count.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Store transcript messages that follow a compaction event. `/ingest` and -`/compact` no longer count compaction event rows as transcript messages when -deciding what is new, so a session that was compacted keeps ingesting its later -messages, and native linkage skips event rows. -`postgresql-runtime-transcript-grants.sql` now also grants column-limited -`SELECT` on `message_parts` so native linkage can recognize event rows. The -conversation grants' table `SELECT` on `message_parts` already covers that read -and runtime readiness, so these column grants are the least-privilege delta for -a role without that table `SELECT`; re-applying the transcript script is -harmless and not required. - -Custom `ConversationRepository` implementations must add the new required -`getTranscriptSlotSnapshot` method, which returns the session-wide transcript -row count and the compaction event rows with their slot markers. diff --git a/.changeset/1582-shutdown-storage-settle.md b/.changeset/1582-shutdown-storage-settle.md deleted file mode 100644 index 0515a976f..000000000 --- a/.changeset/1582-shutdown-storage-settle.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Daemon shutdown no longer closes storage while a cancelled background ingest is still opening a project. diff --git a/.changeset/1583-codex-toml-float-finite.md b/.changeset/1583-codex-toml-float-finite.md deleted file mode 100644 index 3a9155e80..000000000 --- a/.changeset/1583-codex-toml-float-finite.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Treat Codex config.toml files with overflowing float values as invalid TOML, so -doctor reports hook state as unknown and install leaves the file unchanged. diff --git a/.changeset/1584-1586-codex-hooks-strict-parse.md b/.changeset/1584-1586-codex-hooks-strict-parse.md deleted file mode 100644 index 01d291f87..000000000 --- a/.changeset/1584-1586-codex-hooks-strict-parse.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Make `lcm connectors install codex` stop, leaving `hooks.json` and -`config.toml` untouched, when `hooks.json` is not valid JSON or repeats a key, -instead of replacing it with only the LCM hooks. `lcm doctor` now also reports -a `hooks.json` with a key repeated in the file, a group or a handler, or a -non-integer command or MCP tool `timeout` or command `additionalContextLimit`, -as unreadable. diff --git a/.changeset/1599-session-end-completion-diagnostic.md b/.changeset/1599-session-end-completion-diagnostic.md deleted file mode 100644 index 733ea702f..000000000 --- a/.changeset/1599-session-end-completion-diagnostic.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Report a fixed stderr line when the daemon does not acknowledge a Claude -SessionEnd completion within its one-second wait, naming a timeout, an HTTP -status, or an unavailable daemon, without changing the hook's exit code or -stdout. diff --git a/.changeset/1600-mixed-group-upgrade-docs.md b/.changeset/1600-mixed-group-upgrade-docs.md deleted file mode 100644 index abd7c2921..000000000 --- a/.changeset/1600-mixed-group-upgrade-docs.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Document how to upgrade the Codex `SessionStart` matcher when the LCM restore -hook shares its group with other hooks. diff --git a/.changeset/1607-activation-runtime-readiness.md b/.changeset/1607-activation-runtime-readiness.md deleted file mode 100644 index 81870d129..000000000 --- a/.changeset/1607-activation-runtime-readiness.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Require a distinct runtime-role URL for migration activation, verify the -runtime and transfer grant profiles together during activation, and leave -only transfer-grant revocation as the post-activation privilege step. -`activate --set` stays transfer-only and reports its stale-daemon refusal as -`set-restart-required`, whose remedy names the full grant swap. diff --git a/.changeset/1617-applied-readback.md b/.changeset/1617-applied-readback.md deleted file mode 100644 index c9bbf435b..000000000 --- a/.changeset/1617-applied-readback.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Report an interrupted migration activation as applied only when the live -configuration and project map match the published witnesses, and as not applied -only when they still match the pre-publication source; any other state is -unknown. diff --git a/.changeset/1618-activation-uninitialized-home.md b/.changeset/1618-activation-uninitialized-home.md deleted file mode 100644 index 465fe630e..000000000 --- a/.changeset/1618-activation-uninitialized-home.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Migration activation on an uninitialized LCM home now returns the classified -`manifest-absent` refusal instead of throwing, and an unreadable machine -identity or census scratch directory is reported as a `state-unresolvable` -outcome rather than an exception. diff --git a/.changeset/1625-codex-hooks-number-paths.md b/.changeset/1625-codex-hooks-number-paths.md deleted file mode 100644 index 1582a09da..000000000 --- a/.changeset/1625-codex-hooks-number-paths.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep the Codex hooks.json strict parse linear in input size when ignored members have long names and many fractional values. diff --git a/.changeset/1631-doctor-unknown-duplicates.md b/.changeset/1631-doctor-unknown-duplicates.md deleted file mode 100644 index cd8371925..000000000 --- a/.changeset/1631-doctor-unknown-duplicates.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Stop `lcm doctor` from reporting every Codex hook as `hooks-file-unreadable` -when `hooks.json` repeats a member that Codex ignores, such as an extra note -on a matcher group or a handler. Doctor now rejects a repeated member only when -Codex's own struct for that object knows it (any root member, an event name, a -group's `matcher` or `hooks`, or a field of the handler's `type`), as Codex -does. Install still refuses every repeated key. diff --git a/.changeset/1632-referenced-fork-restoration.md b/.changeset/1632-referenced-fork-restoration.md deleted file mode 100644 index 2ce965175..000000000 --- a/.changeset/1632-referenced-fork-restoration.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Stop Codex referenced (paginated-history) forks from receiving a second LCM -restoration block. The restore hook now follows the fork's `history_base` to -its parent rollout and checks the inherited history, so a restoration the fork -already carries suppresses the block unless the fork's own records compacted or -rolled it back. A parent that cannot be found or verified still prints a fresh -block. diff --git a/.changeset/1634-1635-publication-lock-wait.md b/.changeset/1634-1635-publication-lock-wait.md deleted file mode 100644 index c8fe4009a..000000000 --- a/.changeset/1634-1635-publication-lock-wait.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Wait briefly for another process's backend-publication lock instead of dropping the work. Restore, compact, Stop, SubagentStop, PreCompact and SubagentStart hooks now wait up to 5 seconds in total, Codex Interrupt and SessionEnd hand-offs wait inside their own time budget, and the daemon waits for the lock before it ingests or restores. A lock held longer than that window still skips the snapshot or restoration as before. Closes #1634 and #1635. diff --git a/.changeset/1636-hook-stdout-flush.md b/.changeset/1636-hook-stdout-flush.md deleted file mode 100644 index ad0fa9c8f..000000000 --- a/.changeset/1636-hook-stdout-flush.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Deliver the complete output of the compact, restore, session-end, user-prompt, -post-tool, pre-tool and session-snapshot hooks when stdout is a pipe. The hooks -called `process.exit()` right after writing, which discarded output still -queued in the pipe, so a restoration larger than about 8 KiB could reach Codex -truncated. They now wait for the write to be flushed (or to fail, for example -when the reader has gone away) before exiting with the same exit code. diff --git a/.changeset/1637-pending-age-invalid-sidecar.md b/.changeset/1637-pending-age-invalid-sidecar.md deleted file mode 100644 index 4242a0f25..000000000 --- a/.changeset/1637-pending-age-invalid-sidecar.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Omit the local pending age from runtime health telemetry when any local sidecar -reports an invalid oldest pending timestamp, instead of letting a valid sibling -hide it. diff --git a/.changeset/1639-extensions-failure-reason.md b/.changeset/1639-extensions-failure-reason.md deleted file mode 100644 index b897ecf31..000000000 --- a/.changeset/1639-extensions-failure-reason.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Report the classified failure reason in the `extensions` runtime health -family of the backend diagnostic snapshot. When the PostgreSQL health check -failed without returning extension records, the family kept a generic -`unavailable` status even for a permission or timeout failure; it now reports -`permission-denied` or `timeout` like the other families that were never -observed. diff --git a/.changeset/1642-transfer-legacy-column-grants.md b/.changeset/1642-transfer-legacy-column-grants.md deleted file mode 100644 index d3caaeb98..000000000 --- a/.changeset/1642-transfer-legacy-column-grants.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Admit PostgreSQL transfer roles provisioned before the `message_parts` column -grants again. Transfer readiness no longer requires the four direct -`message_parts` column `SELECT` grants when the role holds the table-level -`SELECT` that already covers those reads, so such a role stays ready without -re-applying the transcript grants. diff --git a/.changeset/1643-telemetry-guide-intro.md b/.changeset/1643-telemetry-guide-intro.md deleted file mode 100644 index 6dcc9bc8d..000000000 --- a/.changeset/1643-telemetry-guide-intro.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Update the PostgreSQL telemetry guide introduction to list the implemented -statement statistics, runtime health, and incident runbook surfaces. diff --git a/.changeset/1648-activation-s7-classification.md b/.changeset/1648-activation-s7-classification.md deleted file mode 100644 index 735b87192..000000000 --- a/.changeset/1648-activation-s7-classification.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Migration activation now refuses, or reports an interrupted roll-forward on -re-entry, when a destination identity query (S0, S5 or S7) or the S7 census -read fails because the PostgreSQL target is unhealthy or unreachable, instead -of rejecting the whole activation. Unknown errors and cancellations still -reject. diff --git a/.changeset/1651-release-window-successor.md b/.changeset/1651-release-window-successor.md deleted file mode 100644 index 93abb7a2a..000000000 --- a/.changeset/1651-release-window-successor.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Let a migration activation or cutover-set retry finish when a crash left the -backend publication journal at `releasing` or `abort-releasing` after the -remote fence was released and another home's publication acquired the released -lease row. The PostgreSQL remote guard now offers a release-reconciliation -read, and the coordinator treats a row of another identity with a strictly -greater fencing token as proof that its own fence was released, without -touching the successor's row. Without that proof, or for a corrupt row, the -retry still fails closed. diff --git a/.changeset/1652-abort-late-effect-route.md b/.changeset/1652-abort-late-effect-route.md deleted file mode 100644 index 175b9f597..000000000 --- a/.changeset/1652-abort-late-effect-route.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Classify a pending migration effect that appears after `lcm migration abort`'s -first route, so the refusal names `resume` only when `resume` may run it, and -otherwise reports the router's refusal (such as operator required, exit 7) or -`abort-journal-moved` when abort is still admitted. diff --git a/.changeset/1655-migration-outcome-accuracy.md b/.changeset/1655-migration-outcome-accuracy.md deleted file mode 100644 index 513733534..000000000 --- a/.changeset/1655-migration-outcome-accuracy.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Correct three `lcm migration` outcome-accuracy defects. `apply --dry-run` no -longer reports `applied: true` when an unexpected failure interrupts it before -any write. A failed fresh hold entry now reports `applied: true` when it left a -`maintenance-entering` hold (or the journal cannot be read back), so the -operator inspects it with `lcm migration report` before recovering. A -`maintenance-aborted` journal that belongs to another generation is no longer -routed as that generation's abort cell: it lands on the route-contradiction -cell, and the unreachable `abort-other-generation` refusal is removed. diff --git a/.changeset/1657-set-abort-readback-member.md b/.changeset/1657-set-abort-readback-member.md deleted file mode 100644 index f27a0dd81..000000000 --- a/.changeset/1657-set-abort-readback-member.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Name the member generation in cutover-set abort readback refusal evidence. diff --git a/.changeset/1659-abort-retry-evidence.md b/.changeset/1659-abort-retry-evidence.md deleted file mode 100644 index a02b2ae47..000000000 --- a/.changeset/1659-abort-retry-evidence.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Seal the manifest abort report of a retried migration abort to the evidence -the aborted journal persisted, so an abort interrupted after the journal was -terminalized settles byte-identically to an uninterrupted one. diff --git a/.changeset/1663-rollback-timestamp-compare.md b/.changeset/1663-rollback-timestamp-compare.md deleted file mode 100644 index 707ccb789..000000000 --- a/.changeset/1663-rollback-timestamp-compare.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Rollback no longer refuses local outbox events whose stored timestamp differs from the archive only in format. diff --git a/.changeset/1667-rollback-checkpoint-incomplete.md b/.changeset/1667-rollback-checkpoint-incomplete.md deleted file mode 100644 index ee49fc65c..000000000 --- a/.changeset/1667-rollback-checkpoint-incomplete.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Make `lcm migration report --set` and the write detection of `rollback --set` -distinguish a rollback checkpoint whose member records were written but never -committed from an empty store: `report --set` now prints -`rollbackRecords: incomplete`, and a rollback that stopped at the checkpoint -step after writing member records is reported as having applied a write. A -rollback whose stored checkpoint records differ from the ones it would write is -now refused before any member record is written when the stored records can be -read. diff --git a/.changeset/1672-acl-sentinel-namespace.md b/.changeset/1672-acl-sentinel-namespace.md deleted file mode 100644 index c1605590d..000000000 --- a/.changeset/1672-acl-sentinel-namespace.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -PostgreSQL readiness now refuses an extra ACL grantee whose role name equals -`runtime`, `owner`, or `public` instead of treating it as a sanctioned grant. diff --git a/.changeset/1673-cutover-set-activation-classification.md b/.changeset/1673-cutover-set-activation-classification.md deleted file mode 100644 index e9066ae40..000000000 --- a/.changeset/1673-cutover-set-activation-classification.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Cutover-set activation now allocates census scratch only for a member census, -reports a storage failure of a destination identity query or census read as a -target refusal naming the member, and reports an interrupted run as applied -only when the live configuration and project map agree with the publication -journal or the set's pre-publication source. diff --git a/.changeset/1674-migration-commands-under-hold.md b/.changeset/1674-migration-commands-under-hold.md deleted file mode 100644 index c0437b413..000000000 --- a/.changeset/1674-migration-commands-under-hold.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Run every `lcm migration` subcommand while a maintenance hold exists. The root -legacy-home bootstrap ran before each of them and its publication admission -refused during the hold, so `report`, `verify`, `resume`, `abort`, -`activate` and `rollback` exited 1 without printing an envelope. The bootstrap -still runs first when a legacy home is waiting to be moved. diff --git a/.changeset/1675-report-after-rollback.md b/.changeset/1675-report-after-rollback.md deleted file mode 100644 index 89aa92be4..000000000 --- a/.changeset/1675-report-after-rollback.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Route a completed rollback to its settled cell. The router only recognised the -activation publication as the generation's own, so after a successful rollback -`report`, the settled `rollback` re-entry and `activate` were refused with -`route-foreign-publication` (exit 5). The generation's derived rollback -publication is now recognised as its own too. diff --git a/.changeset/1676-empty-project-eligibility.md b/.changeset/1676-empty-project-eligibility.md deleted file mode 100644 index c75c2c587..000000000 --- a/.changeset/1676-empty-project-eligibility.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Let a migration verification of a project with no messages become activation -eligible. The search probe previously reported not-run whenever the source had -no message to search for, so an empty enrolled project could never pass. The -probe now runs the production search once on a fixed query and, when it returns -no rows while the source and the fenced destination census both report zero -messages, records the public-search receipt. Projects with messages keep the -correlated self-match proof unchanged. diff --git a/.changeset/1678-migration-alias-identity.md b/.changeset/1678-migration-alias-identity.md deleted file mode 100644 index 589f41859..000000000 --- a/.changeset/1678-migration-alias-identity.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -`lcm migration apply` now carries a project's project-map aliases to -PostgreSQL with the project, so a project with extra alias paths no longer -fails the copy after the hold. It refuses with `alias-conflict` before the -hold when the aliases cannot be minted exactly. A generation that an earlier -version already held and failed stays on `resume`: abort it, then run a fresh -`plan` and `apply`. diff --git a/.changeset/1679-unroutable-activation-windows.md b/.changeset/1679-unroutable-activation-windows.md deleted file mode 100644 index b96b48045..000000000 --- a/.changeset/1679-unroutable-activation-windows.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Route the two interrupted `lcm migration` activation windows (after -`prepare-activation` completes and after the publication drive completes) to -`activate` so it resumes them, instead of refusing every command with -route-contradiction (exit 5). diff --git a/.changeset/1680-set-rollback-report-timestamp.md b/.changeset/1680-set-rollback-report-timestamp.md deleted file mode 100644 index ba262dab1..000000000 --- a/.changeset/1680-set-rollback-report-timestamp.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fix cutover-set rollback sometimes failing to complete a member with "migration report timestamp is outside the effect boundary" when the clock advanced between the report timestamp and the completion timestamp. diff --git a/.changeset/1681-rollback-drain-disposition.md b/.changeset/1681-rollback-drain-disposition.md deleted file mode 100644 index 48584aed2..000000000 --- a/.changeset/1681-rollback-drain-disposition.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Accept a passive event the daemon already drained while PostgreSQL's inbox -still lists it as pending when rolling back to SQLite, and refuse a genuine -divergence before the rollback publishes anything. diff --git a/.changeset/1684-promote-events-contention.md b/.changeset/1684-promote-events-contention.md deleted file mode 100644 index 3058283c0..000000000 --- a/.changeset/1684-promote-events-contention.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Make `lcm events promote` (and `--all`) answer a retryable busy status instead of a server error when publication work holds the backend lock, such as the daemon's background sweep. The command now prints "backend publication work is in progress; retry the promotion" and exits non-zero. The daemon also waits briefly for another process holding the lock before answering. diff --git a/.changeset/1689-shared-history-refusal-order.md b/.changeset/1689-shared-history-refusal-order.md deleted file mode 100644 index c23f356f6..000000000 --- a/.changeset/1689-shared-history-refusal-order.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse `lcm migration apply` for a project that is already linked to a -PostgreSQL project before it creates any local or destination project -identity, so the refusal reports `applied: false` and leaves PostgreSQL -untouched. diff --git a/.changeset/1691-alias-lock-timeout.md b/.changeset/1691-alias-lock-timeout.md deleted file mode 100644 index 3852535d3..000000000 --- a/.changeset/1691-alias-lock-timeout.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Report a migration `apply` that cannot reconcile the destination project's -aliases because another session holds an uncommitted alias write as a -`migration-target-identity-unresolvable` refusal with evidence -`alias-lock-timeout`, after a 5 second wait, instead of a generic storage -error once the statement timeout cancels the lock request. diff --git a/.changeset/1693-cutover-event-replication.md b/.changeset/1693-cutover-event-replication.md deleted file mode 100644 index 537723d99..000000000 --- a/.changeset/1693-cutover-event-replication.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Deliver pending hook events that crossed a PostgreSQL cutover on the first -replication pass, and let `lcm events validate` accept their migrated copies. -A copy already in the project now matches the local event when they differ only -in the textual form of the creation time or in a `previousEventId` that only -the local side carries (values that both sides carry must still be equal). A -copy that is still pending is applied once, and one that was already applied is -acknowledged without a second apply, instead of failing the whole batch. diff --git a/.changeset/1694-portable-replicated-inbox.md b/.changeset/1694-portable-replicated-inbox.md deleted file mode 100644 index 3eff0f746..000000000 --- a/.changeset/1694-portable-replicated-inbox.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fix portable export and rollback of a PostgreSQL project whose passive-event -inbox still holds rows that the replication pass uploaded. Those rows carry the -local `previousEventId` pointer, which the export refused with -`record-unrepresentable`, so the whole project failed to export. The export now -accepts the pointer (absent, null, or a positive integer) and leaves it out of -the portable record, as the SQLite source already does. diff --git a/.changeset/1695-passive-batch-collision.md b/.changeset/1695-passive-batch-collision.md deleted file mode 100644 index 134b0e709..000000000 --- a/.changeset/1695-passive-batch-collision.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Passive-event replication no longer holds back the healthy rows of an upload -batch because one row's copy in the bound project differs from it. That row is -now retried on its own, and quarantined locally once it has been attempted the -configured number of times, whichever row of the batch the failed upload named; -the other rows upload in the same pass. diff --git a/.changeset/1696-observe-missing-pg-secrets.md b/.changeset/1696-observe-missing-pg-secrets.md deleted file mode 100644 index 545e36821..000000000 --- a/.changeset/1696-observe-missing-pg-secrets.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Let the authenticated `GET /health/observe` endpoint answer for a daemon that -started on SQLite when the on-disk selection is PostgreSQL and the daemon's own -environment lacks `LCM_POSTGRES_URL`, `LCM_POSTGRES_CA_FILE`, or the migration -role. `lcm migration report` and an `activate` retry now report exit 8 -restart-required instead of exit 5 for that stale daemon; present values are -still validated, and a daemon binary from before this fix still gives exit 5. diff --git a/.changeset/1698-rollback-pruned-delivery.md b/.changeset/1698-rollback-pruned-delivery.md deleted file mode 100644 index 6d61068eb..000000000 --- a/.changeset/1698-rollback-pruned-delivery.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Rollback from PostgreSQL to SQLite now accepts local passive events that the replication worker delivered and whose PostgreSQL inbox rows it then pruned, instead of refusing them as events PostgreSQL does not hold. diff --git a/.changeset/1707-cutover-set-runtime-role.md b/.changeset/1707-cutover-set-runtime-role.md deleted file mode 100644 index 760ba92e5..000000000 --- a/.changeset/1707-cutover-set-runtime-role.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Require `LCM_POSTGRES_RUNTIME_URL` for cutover-set activation, prove the -runtime and transfer grant profiles together, and report transfer-grant -revocation as the only remaining privilege step after activation. diff --git a/.changeset/1719-codex-prompt-agent-fields.md b/.changeset/1719-codex-prompt-agent-fields.md deleted file mode 100644 index c8534309f..000000000 --- a/.changeset/1719-codex-prompt-agent-fields.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Stop `lcm doctor` from reporting every Codex hook as `hooks-file-unreadable` -when `hooks.json` gives a `prompt` or `agent` handler a `timeout` or -`statusMessage` that is not valid. Codex ignores both members on those handler -types and loads the file, so doctor no longer checks them there. Command and -`mcp_tool` handlers keep the existing checks. diff --git a/.changeset/1737-sidecar-pending-min-invalid.md b/.changeset/1737-sidecar-pending-min-invalid.md deleted file mode 100644 index 23f8d67d5..000000000 --- a/.changeset/1737-sidecar-pending-min-invalid.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Report the local pending age as out of range when a sidecar holds an invalid -capture time on a pending or retry event, even if the same sidecar also holds -a valid one. diff --git a/.changeset/1746-rollback-artifact-applied.md b/.changeset/1746-rollback-artifact-applied.md deleted file mode 100644 index 90f0b48f6..000000000 --- a/.changeset/1746-rollback-artifact-applied.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Report `applied: true` when `rollback --set` is refused at the checkpoint step -after it durably published the reverse activation artifact. diff --git a/.changeset/1754-tier3-exact-gate.md b/.changeset/1754-tier3-exact-gate.md deleted file mode 100644 index 466a9bfec..000000000 --- a/.changeset/1754-tier3-exact-gate.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Passive learning no longer promotes a one-off file-access or tool-usage event just because lexical search found a related memory. It now only re-confirms an existing entry with identical text; three occurrences across two sessions still bootstrap a new memory. diff --git a/.changeset/1755-deprecate-dedup-bm25.md b/.changeset/1755-deprecate-dedup-bm25.md deleted file mode 100644 index 76d09d7a1..000000000 --- a/.changeset/1755-deprecate-dedup-bm25.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Deprecate the ignored `compaction.promotionThresholds.dedupBm25Threshold` -setting: existing configs keep loading, `lcm config get/set` reject the path, -and `lcm doctor` warns when it holds a non-default value. diff --git a/.changeset/1763-active-child-successors.md b/.changeset/1763-active-child-successors.md deleted file mode 100644 index 736204cd8..000000000 --- a/.changeset/1763-active-child-successors.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact home, root, and separator-run successors after a nested file URL in the first sanitization pass. diff --git a/.changeset/1764-replication-drain.md b/.changeset/1764-replication-drain.md deleted file mode 100644 index 970101b1b..000000000 --- a/.changeset/1764-replication-drain.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Passive-event replication now drains a saturated backlog in short follow-up passes about one second apart instead of moving one bounded batch every five minutes. Follow-ups yield to local promotion and continue only while a pass is still saturated and made terminal progress. diff --git a/.changeset/1765-bracket-tail-ownership.md b/.changeset/1765-bracket-tail-ownership.md deleted file mode 100644 index b32db4165..000000000 --- a/.changeset/1765-bracket-tail-ownership.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact rooted query values in bracketed URLs that follow a rooted file tail or -an inherited-quote successor on the first sanitization pass. diff --git a/.changeset/622-physical-snapshot-lifecycle.md b/.changeset/622-physical-snapshot-lifecycle.md deleted file mode 100644 index 7871e5108..000000000 --- a/.changeset/622-physical-snapshot-lifecycle.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep local hook appends and SQLite physical close operations ordered with -immutable migration capture, and refuse capture when an enrolled canonical -outbox is missing. Retry the one authenticated lock-owner disappearance race -that can occur while a valid owner releases its lock. Keep SessionStart outbox -pruning inside one composed consumer and append admission. Reuse the live -request token for project close, and publish a registered migration identity -only after its exact receipt epoch is durable. diff --git a/.changeset/625-migration-activation.md b/.changeset/625-migration-activation.md deleted file mode 100644 index babb78436..000000000 --- a/.changeset/625-migration-activation.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add the migration activation orchestrator: the cutover that switches one -verified, activation-eligible SQLite generation to its PostgreSQL destination. -Activation re-reads every precondition live before it changes anything (the -manifest and its verification report, the held maintenance window and writer -quiescence, the project's fenced lease, single-project stored-data coverage, -the destination identity, project-map and copy bindings, a fresh destination -census, and the authenticated target health), and a failed check is a refusal -that begins no effect. Once the checks pass it records durable evidence in a -fixed order (the sealed publication artifact, the generation link, the -activation epoch, attempt and witness, the witness and selection bindings), -publishes the PostgreSQL selection through the same coordinator rollback -uses, stores an immutable activation report and settles the manifest active. -Every step is resumable after a crash: a retry classifies the durable state -it finds and rolls forward, never re-mints an attempt a selection already -carries, and reports whether the publication is known to have been applied as -yes, no or unknown rather than guessing. A maintenance window entered from -PostgreSQL (a rollback window) is foreign to activation and is refused. A -non-predictive preview describes the durable state without taking locks or -touching PostgreSQL. Activation connects as the transfer role that copied and -verified the generation (its settings are supplied for both settings fields) -and admits the target through the transfer readiness check; it does not prove -that the daemon can start. The operator applies the runtime grants, revokes -the transfer grants and then starts the daemon, as docs/migration-cutover.md -describes. There is no operator-facing command for this yet; it ships as an -internal capability that #627 will expose. - diff --git a/.changeset/626-coordinator-token-seam.md b/.changeset/626-coordinator-token-seam.md deleted file mode 100644 index db1f2890d..000000000 --- a/.changeset/626-coordinator-token-seam.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Accept an optional lockToken on BackendPublicationCoordinator's -prepareMaintenanceSelection, completeMaintenanceSelection, -abortMaintenance, prepare, resume, abort and recoverPending, mirroring -the existing enterMaintenance parameter. A caller already holding the -publication lock can now invoke these methods without contending with -itself. The parameter is optional, the untokened #locked branch is -unedited, and the seven methods have zero production callers today, so -omitting the token preserves today's behaviour exactly. diff --git a/.changeset/627-migration-operator-cli.md b/.changeset/627-migration-operator-cli.md deleted file mode 100644 index b70792ceb..000000000 --- a/.changeset/627-migration-operator-cli.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add the `lcm migration` command group for the reversible SQLite-to-PostgreSQL -cutover: `plan`, `dry-run`, `apply`, `resume`, `verify`, `report`, `abort`, -`activate` and `rollback`. `plan` previews the next migration generation without -mutating anything; `dry-run` checks the SQLite source in isolation; `apply` -captures the source, mints a migration manifest, and copies the captured data to -PostgreSQL; `resume` runs the one step a held generation is waiting for and stops -at the next checkpoint; `verify` verifies a copied generation against PostgreSQL, -finishes a pending verification from persisted evidence, and confirms a verified -one; `activate` switches a verified generation to PostgreSQL and releases the -maintenance hold; `rollback` returns an activated generation to SQLite; `report` -is a read-only account of one generation that names the command to run next, -shows the activation and rollback evidence, and checks whether a daemon needs a -restart; `abort` is the recovery exit from a held attempt and is safe to repeat. - -Every command that acts on an existing generation asks one router which command -owns the state it is in, so a command that does not own it refuses and names the -one that does. `activate` and `rollback` each need `--confirm-generation` and -`--confirm-backend` (`postgresql` and `sqlite`), their `--dry-run` never exits 0 -because it cannot evaluate the checks that decide the outcome, and their exit -codes are a closed table: an interrupted activation is exit 6 (run it again), and -a running daemon that still holds the previous backend is exit 8. `apply` no -longer creates the local project map entry or the destination PostgreSQL project -until its `--confirm-generation` matches, and never creates either while a hold -exists. - -**`activate` runs under the PostgreSQL transfer role, so swap the grants before -starting the daemon:** add the runtime grants to the daemon's runtime role, then -revoke the transfer grants. `rollback` refuses while any other project is -remotely bound, because the backend selection is global. - -See `docs/migration-operations.md` for the full operator runbook, including the -exit-code vocabulary, refusal reasons, the JSON envelope, the daemon-presence -policy, and what this command group does and does not protect against. diff --git a/.changeset/638-runtime-health.md b/.changeset/638-runtime-health.md deleted file mode 100644 index c754228f2..000000000 --- a/.changeset/638-runtime-health.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add pool, migration, extension, and queue health families to the PostgreSQL -backend diagnostic snapshot shown by `lcm stats`, `lcm status`, and -`lcm doctor`. Each family reports its status, a health of healthy, degraded, -or unavailable, the fields it could not observe, and a fixed next action. A -degraded family raises a healthy snapshot to degraded. diff --git a/.changeset/639-incident-diagnostics.md b/.changeset/639-incident-diagnostics.md deleted file mode 100644 index 0855e5b66..000000000 --- a/.changeset/639-incident-diagnostics.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Publish a least-privilege PostgreSQL incident runbook with bounded evidence, -private restore and rotation procedures, and executable privacy canaries. diff --git a/.changeset/799-grep-guidance-wording.md b/.changeset/799-grep-guidance-wording.md deleted file mode 100644 index 6809c0c6e..000000000 --- a/.changeset/799-grep-guidance-wording.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Clarify that MCP `lcm_grep` queries are interpreted according to the selected -full-text or regular-expression mode. diff --git a/.changeset/828-project-directory-topology.md b/.changeset/828-project-directory-topology.md deleted file mode 100644 index 507940c1b..000000000 --- a/.changeset/828-project-directory-topology.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject untrusted project-directory topology during admission and metadata -publication, with descriptor-bound mode tightening for directories LCM creates. diff --git a/.changeset/844-coordinator-material-witness.md b/.changeset/844-coordinator-material-witness.md deleted file mode 100644 index 156a83945..000000000 --- a/.changeset/844-coordinator-material-witness.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Bind coordinator recovery-material authentication to the locked publication-directory witness and fail closed on directory identity drift. diff --git a/.changeset/849-grep-response.md b/.changeset/849-grep-response.md deleted file mode 100644 index 699a28179..000000000 --- a/.changeset/849-grep-response.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Correct the `lcm_grep` documentation to describe its response envelope, hit -fields, timestamp serialization, and empty-response compatibility behavior. diff --git a/.changeset/859-nested-file-url.md b/.changeset/859-nested-file-url.md deleted file mode 100644 index f5b302b82..000000000 --- a/.changeset/859-nested-file-url.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact literal nested `file://` paths in URL query, fragment, and assignment -values while preserving the surrounding URL text. diff --git a/.changeset/863-expand-depth-validation.md b/.changeset/863-expand-depth-validation.md deleted file mode 100644 index f9037f81c..000000000 --- a/.changeset/863-expand-depth-validation.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Validate `lcm expand` depth inputs as positive integers before project -admission and document the matching CLI and MCP contract. diff --git a/.changeset/865-post-start-admission.md b/.changeset/865-post-start-admission.md deleted file mode 100644 index 1796ae069..000000000 --- a/.changeset/865-post-start-admission.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Converge a managed daemon's final backend-publication admission after startup -when its initial passive sweep briefly holds the publication lock. The bounded -retry is restricted to the exact authenticated child and fails closed on -identity, credential, birth, health, timeout, or cancellation changes. diff --git a/.changeset/880-top-level-publication.md b/.changeset/880-top-level-publication.md deleted file mode 100644 index 51a6b0cae..000000000 --- a/.changeset/880-top-level-publication.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep nested `lcm connectors install` on ordinary root migration and -connector-owned verification instead of applying the top-level installer's -publication-convergence retry. diff --git a/.changeset/883-installer-drift-diagnostic.md b/.changeset/883-installer-drift-diagnostic.md deleted file mode 100644 index 989c4fa7f..000000000 --- a/.changeset/883-installer-drift-diagnostic.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Present lock-free installer configuration drift as a stable diagnostic while -preserving the installer's fail-closed admission behavior. diff --git a/.changeset/887-preserve-empty-since.md b/.changeset/887-preserve-empty-since.md deleted file mode 100644 index 89960e3ad..000000000 --- a/.changeset/887-preserve-empty-since.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve explicit empty `grep --since` values so the daemon can reject them -instead of treating them as an omitted filter. diff --git a/.changeset/898-promoted-fts-tags.md b/.changeset/898-promoted-fts-tags.md deleted file mode 100644 index e6f13c8bb..000000000 --- a/.changeset/898-promoted-fts-tags.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Apply promoted search tag filters before the result limit so tagged searches -return the requested number of eligible records. diff --git a/.changeset/903-query-prefix-redaction.md b/.changeset/903-query-prefix-redaction.md deleted file mode 100644 index 597bdf7bb..000000000 --- a/.changeset/903-query-prefix-redaction.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact literal `file://` paths after query and fragment value prefixes so error -messages do not expose local paths embedded in wrapped URL values. diff --git a/.changeset/906-preserve-probe-contention.md b/.changeset/906-preserve-probe-contention.md deleted file mode 100644 index 4c97d03c6..000000000 --- a/.changeset/906-preserve-probe-contention.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve the original publication-lock contention when authenticated process -birth or health probes settle after the shared convergence deadline, while -continuing to fail closed without retrying unverifiable evidence. diff --git a/.changeset/907-publication-errors.md b/.changeset/907-publication-errors.md deleted file mode 100644 index a7c7ff3aa..000000000 --- a/.changeset/907-publication-errors.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Document the current-versus-first publication contention reported by CLI -inspection and installer retries after recognized deadline expiry. diff --git a/.changeset/916-recent-cwd.md b/.changeset/916-recent-cwd.md deleted file mode 100644 index 9de6e4a74..000000000 --- a/.changeset/916-recent-cwd.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Repair `memory.recent` to send an absolute project directory as `cwd`, making -the existing `/recent` retrieval path reachable. Calls that supplied a project -hash as `projectId` must migrate to the corresponding directory; hashes are -not interpreted as paths and no ambient working-directory fallback is added. -After project admission, existing HTTP 409 storage identity and HTTP 503 -PostgreSQL failures remain observable; invalid limits continue to return 400. diff --git a/.changeset/930-expand-body-shape.md b/.changeset/930-expand-body-shape.md deleted file mode 100644 index 88e30a7ab..000000000 --- a/.changeset/930-expand-body-shape.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject non-object JSON request bodies for `lcm expand` with HTTP 400 -(`invalid request body`) before project admission. Literal `null`, arrays, and -other JSON primitives now share that stable shape error; malformed JSON syntax -keeps its existing server error behavior. diff --git a/.changeset/931-expand-budget.md b/.changeset/931-expand-budget.md deleted file mode 100644 index 6a2bd0d64..000000000 --- a/.changeset/931-expand-budget.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Correct the expansion architecture documentation to match the daemon-backed -HTTP, MCP, and CLI behavior and distinguish the unregistered helper's cap. diff --git a/.changeset/934-codex-teardown-abort.md b/.changeset/934-codex-teardown-abort.md deleted file mode 100644 index b0b907fe9..000000000 --- a/.changeset/934-codex-teardown-abort.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject Codex configuration resolution with `AbortError` when the caller -cancels during owned app-server teardown, after termination settles, instead -of returning the validated endpoint or token-class default. diff --git a/.changeset/944-supervisor-temp-diagnostic.md b/.changeset/944-supervisor-temp-diagnostic.md deleted file mode 100644 index 7af9562cb..000000000 --- a/.changeset/944-supervisor-temp-diagnostic.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve fixed owner-preserving umask retry guidance when managed daemon -lifecycle operations refuse startup after a newly created temporary directory -loses required owner permissions. diff --git a/.changeset/966-bounded-birth-admission.md b/.changeset/966-bounded-birth-admission.md deleted file mode 100644 index f641cd7ae..000000000 --- a/.changeset/966-bounded-birth-admission.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Bound optional process-birth sampling during daemon startup admission so -authenticated diagnostics retain part of the shared lifecycle deadline. -Unavailable birth evidence still admits an otherwise authenticated daemon but -does not authorize publication-convergence recovery. diff --git a/.changeset/969-json-object-bodies.md b/.changeset/969-json-object-bodies.md deleted file mode 100644 index bc13aacfc..000000000 --- a/.changeset/969-json-object-bodies.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject non-object JSON request bodies across daemon memory, lifecycle, stale -review, and passive-event routes with HTTP 400 (`invalid request body`) before -route effects. The `/recent` endpoint now rejects primitives that it previously -treated as an empty request; empty bodies and malformed JSON syntax keep their -existing route-specific behavior. diff --git a/.changeset/972-search-cwd.md b/.changeset/972-search-cwd.md deleted file mode 100644 index 0b910f631..000000000 --- a/.changeset/972-search-cwd.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Add an optional absolute `cwd` to `memory.search` so callers can reach the -existing project-scoped `/search` storage path. The daemon remains responsible -for validation; omitted `cwd` keeps the existing empty-result behavior, and -`projectId` is not treated as a project selector. diff --git a/.changeset/974-reconciliation-target-parents.md b/.changeset/974-reconciliation-target-parents.md deleted file mode 100644 index 46d9a2d7c..000000000 --- a/.changeset/974-reconciliation-target-parents.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Retain authenticated reconciliation target directories through database, -pattern, metadata, archival, and project-map publication boundaries. Block on -directory identity or private-mode drift, and refuse unsafe snapshot cleanup. diff --git a/.changeset/988-memory-search-tags.md b/.changeset/988-memory-search-tags.md deleted file mode 100644 index ce9bc4057..000000000 --- a/.changeset/988-memory-search-tags.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Expose the promoted-memory `tags` filter in the typed `memory.search` API. diff --git a/.changeset/999-monotonic-reconciliation.md b/.changeset/999-monotonic-reconciliation.md deleted file mode 100644 index e296ccb8d..000000000 --- a/.changeset/999-monotonic-reconciliation.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep worktree-reconciliation lock retries bounded by monotonic elapsed time so -wall-clock corrections cannot extend, shorten, or otherwise distort contention -waits. diff --git a/.changeset/abortable-project-opens.md b/.changeset/abortable-project-opens.md deleted file mode 100644 index 361106156..000000000 --- a/.changeset/abortable-project-opens.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Cancel pending project opens when requests disconnect or the daemon shuts -down, preventing cancelled reads and restores from returning false success. -Cancelled project opens now use intentional cancellation errors, while -`/promote` retains its existing cancelled-response (499) behavior for -existing-mode cancellation. diff --git a/.changeset/accept-codex-terminal-events.md b/.changeset/accept-codex-terminal-events.md deleted file mode 100644 index 2491d710d..000000000 --- a/.changeset/accept-codex-terminal-events.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Accept Codex process summaries when the authenticated Responses stream reaches -its successful terminal event, even if Codex closes before HTTP transport EOF. -Malformed, failed, incomplete, terminal-chunk suffix, and truncated streams -continue to fail closed without requiring an exact Codex CLI version. Unread -upstream bytes after the terminal frame are canceled rather than relayed. diff --git a/.changeset/accept-historical-skill-newline.md b/.changeset/accept-historical-skill-newline.md deleted file mode 100644 index c388a6906..000000000 --- a/.changeset/accept-historical-skill-newline.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -`lcm install` and `lcm doctor` repair can migrate the exact historical -trailing-blank-line skill while unknown or modified collisions remain -preserved and refused. diff --git a/.changeset/active-postgres-projects.md b/.changeset/active-postgres-projects.md deleted file mode 100644 index 86be2678b..000000000 --- a/.changeset/active-postgres-projects.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add a curated `@donadiosolutions/lcm/storage/postgresql` production factory for explicit programmatic callers, with eager PostgreSQL 18 schema, exact extension ownership, hardened least-privilege readiness, publication-admitted cross-machine project identity, and deterministic lifecycle handling. diff --git a/.changeset/admit-prompt-search-surfacing.md b/.changeset/admit-prompt-search-surfacing.md deleted file mode 100644 index 1d0b0321b..000000000 --- a/.changeset/admit-prompt-search-surfacing.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Retain backend publication admission through prompt-search surfacing metadata -writes, and return a sanitized HTTP 503 when publication admission is blocked. diff --git a/.changeset/atomic-identities-admit.md b/.changeset/atomic-identities-admit.md deleted file mode 100644 index 6bda67459..000000000 --- a/.changeset/atomic-identities-admit.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Make worktree reconciliation, project identity mutations, staged PostgreSQL admission, and cross-project import/export fail closed around one verified project snapshot. diff --git a/.changeset/authenticate-event-sidecar-parent.md b/.changeset/authenticate-event-sidecar-parent.md deleted file mode 100644 index f934e742f..000000000 --- a/.changeset/authenticate-event-sidecar-parent.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Retain and revalidate the private events-directory identity throughout sidecar -health scans and orphan pruning so a replaced parent cannot redirect cleanup. diff --git a/.changeset/authenticate-indirect-pg-trgm-operators.md b/.changeset/authenticate-indirect-pg-trgm-operators.md deleted file mode 100644 index 68ce2bd89..000000000 --- a/.changeset/authenticate-indirect-pg-trgm-operators.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Authenticate indirect pg_trgm operator provenance during PostgreSQL readiness. diff --git a/.changeset/authenticate-promote-metadata-ancestors.md b/.changeset/authenticate-promote-metadata-ancestors.md deleted file mode 100644 index a772ab74b..000000000 --- a/.changeset/authenticate-promote-metadata-ancestors.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject project root or `projects` ancestor symlinks during promote metadata -updates, and retain the authenticated ancestor chain through publication. diff --git a/.changeset/authenticate-promote-metadata-parent.md b/.changeset/authenticate-promote-metadata-parent.md deleted file mode 100644 index d9eb2588e..000000000 --- a/.changeset/authenticate-promote-metadata-parent.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Authenticate the immediate project metadata parent before promotion reads -`meta.json`, and retain that identity through bounded reading and atomic -publication so directory replacement fails closed. diff --git a/.changeset/authenticate-user-namespace-home-parent.md b/.changeset/authenticate-user-namespace-home-parent.md deleted file mode 100644 index bee10964d..000000000 --- a/.changeset/authenticate-user-namespace-home-parent.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Allow secure LCM home admission from Linux user namespaces when a normal host -context has recorded a matching direct-root parent witness, and bootstrap -that witness from a constrained namespace through a bounded user-manager -host-view helper when no witness exists yet. diff --git a/.changeset/bind-publication-checkpoints.md b/.changeset/bind-publication-checkpoints.md deleted file mode 100644 index 06c8ce8c5..000000000 --- a/.changeset/bind-publication-checkpoints.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject backend-publication checkpoint writes when the publication directory -no longer matches the coordinator's retained operation witness. diff --git a/.changeset/bound-bug-campaign-issue-input.md b/.changeset/bound-bug-campaign-issue-input.md deleted file mode 100644 index 1b0bc6609..000000000 --- a/.changeset/bound-bug-campaign-issue-input.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Provide a trusted Bug-campaign GitHub intake that emits complete-wrapper-bounded, -union-redacted untrusted data across triage, persistence, worker handoffs, and -remediation without silently pre-truncating safe input. Mark comments, -reproduction, and evidence as uncollected so empty arrays cannot be mistaken for -absent issue data. diff --git a/.changeset/bound-fixed-sqlite-controls.md b/.changeset/bound-fixed-sqlite-controls.md deleted file mode 100644 index 00f60f1b2..000000000 --- a/.changeset/bound-fixed-sqlite-controls.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Bound fixed SQLite transfer-ledger controls before driver materialization so a -malformed resume database cannot return an oversized scalar before refusal. diff --git a/.changeset/bound-post-scrub-native-transcripts.md b/.changeset/bound-post-scrub-native-transcripts.md deleted file mode 100644 index b44e9dfbe..000000000 --- a/.changeset/bound-post-scrub-native-transcripts.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Bound explicit native-transcript backfill and embedded API records after -scrubbing as well as before it. Records whose sanitized canonical UTF-8 form -exceeds 10 MiB are now quarantined locally as `record-too-large` rather than -imported; expansive custom patterns may therefore produce new bounded -quarantine metadata. diff --git a/.changeset/bound-preliminary-metadata.md b/.changeset/bound-preliminary-metadata.md deleted file mode 100644 index d54682c1a..000000000 --- a/.changeset/bound-preliminary-metadata.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject preliminary project metadata that would exceed 1 MiB after UTF-8 -serialization, preserving any existing metadata instead of publishing a file -that the next initialization cannot read. diff --git a/.changeset/bound-project-discovery.md b/.changeset/bound-project-discovery.md deleted file mode 100644 index 7b382d99e..000000000 --- a/.changeset/bound-project-discovery.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject unsafe or oversized project metadata before all-project import, batch -compaction, and periodic daemon transcript discovery consume its working -directory. diff --git a/.changeset/bound-status-metadata.md b/.changeset/bound-status-metadata.md deleted file mode 100644 index f37625ce7..000000000 --- a/.changeset/bound-status-metadata.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Read `lcm status` project timestamps through bounded, single-link regular-file -metadata admission, with current-UID ownership checks where numeric UIDs are -available, while preserving null timestamp fallbacks for unavailable metadata. diff --git a/.changeset/bound-transcript-locator-fence.md b/.changeset/bound-transcript-locator-fence.md deleted file mode 100644 index 7b3fc8960..000000000 --- a/.changeset/bound-transcript-locator-fence.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -A removed or unresolvable bound transcript locator is rejected even when the -filesystem change cookie did not move, for example on ZFS. diff --git a/.changeset/bounded-legacy-evidence.md b/.changeset/bounded-legacy-evidence.md deleted file mode 100644 index ae1606983..000000000 --- a/.changeset/bounded-legacy-evidence.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Bound legacy daemon migration PID and token evidence reads, and refuse FIFOs, -oversized files, path replacements, and other unsafe leaves without blocking -restart recovery. diff --git a/.changeset/bounded-regex-snippets.md b/.changeset/bounded-regex-snippets.md deleted file mode 100644 index c45a72e60..000000000 --- a/.changeset/bounded-regex-snippets.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact and bound regex snippets returned by the default SQLite search backend. diff --git a/.changeset/bright-bugs-close.md b/.changeset/bright-bugs-close.md deleted file mode 100644 index 3970333ea..000000000 --- a/.changeset/bright-bugs-close.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Extend automated issue triage to identify, link, and close high-confidence duplicate bug reports. diff --git a/.changeset/bright-codex-zero-tools.md b/.changeset/bright-codex-zero-tools.md deleted file mode 100644 index e4d39ae1d..000000000 --- a/.changeset/bright-codex-zero-tools.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Route Codex process compaction through a single-use loopback Responses gateway -that replaces inherited prompt and tool state with the LCM summarizer prompt and -an explicit zero-tools request. diff --git a/.changeset/bright-query-statistics.md b/.changeset/bright-query-statistics.md deleted file mode 100644 index 8a91032e4..000000000 --- a/.changeset/bright-query-statistics.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Expose bounded, reset-aware PostgreSQL query statistics through the shared stats, status, MCP, and doctor diagnostic snapshot without reading or emitting statement text. diff --git a/.changeset/bright-search-limit.md b/.changeset/bright-search-limit.md deleted file mode 100644 index 931ce3611..000000000 --- a/.changeset/bright-search-limit.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Validate `lcm_search` limits at the daemon boundary as positive integers from -1 through 1000, with a default of 5 and a stable HTTP 400 error for invalid -values. diff --git a/.changeset/brisk-conversations-append.md b/.changeset/brisk-conversations-append.md deleted file mode 100644 index 01091c2de..000000000 --- a/.changeset/brisk-conversations-append.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Add the staged PostgreSQL conversation, message, and ordered message-part repository with collision-safe session segments, canonical project-scoped advisory locking, atomic contiguous append allocation, nonnegative safe-integer and U+0000-free text inputs, bigint-safe part ordinals, isolation-fenced scoped transactions, serialized scoped operations, and reviewed least-privilege runtime grants. diff --git a/.changeset/bug-783-publication-convergence.md b/.changeset/bug-783-publication-convergence.md deleted file mode 100644 index 4f12fea71..000000000 --- a/.changeset/bug-783-publication-convergence.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Bound `lcm install` and `lcm doctor` publication-lock admission retries to a -single authenticated managed daemon and shared timeout, preserving fail-closed -behavior for foreign or unverifiable owners. diff --git a/.changeset/bug-837-consumer-descriptor.md b/.changeset/bug-837-consumer-descriptor.md deleted file mode 100644 index 913c0ab82..000000000 --- a/.changeset/bug-837-consumer-descriptor.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Release temporary consumer directory descriptors when backend publication -admission is refused. diff --git a/.changeset/bug-839-optional-root.md b/.changeset/bug-839-optional-root.md deleted file mode 100644 index d8676ce26..000000000 --- a/.changeset/bug-839-optional-root.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fail closed when a canonical LCM root is interrupted during authentication -after its descriptor is opened, while preserving compatibility for roots that -are absent at the initial read-only probe. diff --git a/.changeset/bug-866-cli-read-convergence.md b/.changeset/bug-866-cli-read-convergence.md deleted file mode 100644 index 32f9091bc..000000000 --- a/.changeset/bug-866-cli-read-convergence.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Retry authenticated publication contention for local CLI inspection and -export preparation, while emitting each read result or export exactly once. -Exhausted or rejected export admission now fails the command, including when -an all-project export has already written earlier projects. diff --git a/.changeset/bug-885-missing-codex-guidance.md b/.changeset/bug-885-missing-codex-guidance.md deleted file mode 100644 index c0c523a0a..000000000 --- a/.changeset/bug-885-missing-codex-guidance.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Restore actionable guidance when Codex compaction cannot find the Codex CLI, -while keeping other endpoint-discovery failures generic and secret-free. diff --git a/.changeset/bug-910-monotonic-publication.md b/.changeset/bug-910-monotonic-publication.md deleted file mode 100644 index af0d9d9a9..000000000 --- a/.changeset/bug-910-monotonic-publication.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep shared CLI and installer publication-lock retries bounded by monotonic -elapsed time across wall-clock corrections. diff --git a/.changeset/busy-daemons-wait.md b/.changeset/busy-daemons-wait.md deleted file mode 100644 index 51654bf42..000000000 --- a/.changeset/busy-daemons-wait.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve an owned daemon that may be busy when bounded health checks remain unavailable instead of signaling it and starting a replacement. diff --git a/.changeset/calm-betas-draft.md b/.changeset/calm-betas-draft.md deleted file mode 100644 index c5b3e3c47..000000000 --- a/.changeset/calm-betas-draft.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Support Changesets beta releases with Codex-generated, pull-request-linked draft GitHub notes and publish npm only after a maintainer publishes the draft. diff --git a/.changeset/calm-codex-skill.md b/.changeset/calm-codex-skill.md deleted file mode 100644 index f3603e7c4..000000000 --- a/.changeset/calm-codex-skill.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Make generated Markdown connector installs byte-idempotent, preserving the -established LF or CRLF style in normal rules append-mode installs and avoiding -extra blank lines in generated `SKILL.md` files. Rules installs heal recognized -duplicate current or legacy managed blocks, including the maximal union of -overlapping or touching recognized ranges, and recover the narrowly recognized -header-only partial region consisting of a current marker followed only by -exact `# Workflow Instruction` lines. Arbitrary ambiguous or malformed -unmatched marker/header combinations remain preserved conservatively and may -require a second reinstall to become byte-stable; user-authored Markdown, -including heading lines, outside recognized regions is not removed. Removing a -rules connector preserves spaces, tabs, form-feed, and other non-CR/LF user -Markdown bytes with exactly one established terminal EOL, while blank-line-only -content is deleted. diff --git a/.changeset/calm-dingos-refuse.md b/.changeset/calm-dingos-refuse.md deleted file mode 100644 index ff9ce171e..000000000 --- a/.changeset/calm-dingos-refuse.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject non-regular legacy source pattern paths during future worktree -reconciliations instead of treating them as absent before snapshot, merge, or -archive verification. diff --git a/.changeset/calm-directories-clean.md b/.changeset/calm-directories-clean.md deleted file mode 100644 index 9349d6dbe..000000000 --- a/.changeset/calm-directories-clean.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve private-directory authentication failures when descriptor cleanup -also fails, reporting both errors while keeping the authentication failure as -the cause. diff --git a/.changeset/calm-journals-reread.md b/.changeset/calm-journals-reread.md deleted file mode 100644 index 5f5522723..000000000 --- a/.changeset/calm-journals-reread.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve structured backend-publication errors when a terminal journal changes -between initial admission and its archive reread. diff --git a/.changeset/calm-launchd-label-release.md b/.changeset/calm-launchd-label-release.md deleted file mode 100644 index 6105cba40..000000000 --- a/.changeset/calm-launchd-label-release.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Stabilize macOS launchd startup when the GUI domain temporarily retains an absent service label or exposes a transient malformed registration projection after bootstrap. For an exact bootstrap returning numeric code 5 (input/output error), LCM confirms absence before and after each bounded settle and continues only within the same lifecycle deadline, including terminal-job stop/start recovery. Transient malformed metadata is re-observed without mutation during both bounded launchd recovery windows, while persistent malformed state, permission, transport, timeout, ambiguous, registered, other, and deadline-exhausted states remain classified errors. diff --git a/.changeset/calm-post-tool-bootstrap.md b/.changeset/calm-post-tool-bootstrap.md deleted file mode 100644 index caa0a9148..000000000 --- a/.changeset/calm-post-tool-bootstrap.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep Codex PostToolUse capture out of legacy-root bootstrap migration so -concurrent LCM activity cannot fail the observer hook before payload dispatch. diff --git a/.changeset/calm-postgresql-search.md b/.changeset/calm-postgresql-search.md deleted file mode 100644 index 65261ae17..000000000 --- a/.changeset/calm-postgresql-search.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Add the staged PostgreSQL lexical-search repository with full-text ranking, database-normalized bounded trigram eligibility, strict runtime limit validation, regex paths, exact project and filter scoping, timeout-safe transaction handling, least-privilege grants, and PostgreSQL 18 conformance evidence. diff --git a/.changeset/calm-questions-migrate.md b/.changeset/calm-questions-migrate.md deleted file mode 100644 index 1a7604dfc..000000000 --- a/.changeset/calm-questions-migrate.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Document safe initial and incremental native Question issue-type rollouts. diff --git a/.changeset/calm-search-candidate-recall.md b/.changeset/calm-search-candidate-recall.md deleted file mode 100644 index 4e2c5c45f..000000000 --- a/.changeset/calm-search-candidate-recall.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Restore deep episodic search recall by giving messages and summaries at least -50 candidates (and up to the requested maximum) before the final result slice. -Tag filters now apply only to promoted memories, so tagged searches continue -to return untagged episodic history. The combined episodic response still fills -messages first and may reach its maximum before summaries appear. diff --git a/.changeset/calm-trees-reconcile.md b/.changeset/calm-trees-reconcile.md deleted file mode 100644 index 64c070988..000000000 --- a/.changeset/calm-trees-reconcile.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep worktree reconciliation available when an unrelated stale project-map path crosses a regular file, while preserving strict filesystem validation for the requested project. diff --git a/.changeset/calm-worktree-config-comments.md b/.changeset/calm-worktree-config-comments.md deleted file mode 100644 index 4cbf928fc..000000000 --- a/.changeset/calm-worktree-config-comments.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Recognize Git-compatible inline comments on `extensions.worktreeConfig` when resolving submodule project identity. diff --git a/.changeset/canonical-mcp-search-grep-contracts.md b/.changeset/canonical-mcp-search-grep-contracts.md deleted file mode 100644 index e80b1c129..000000000 --- a/.changeset/canonical-mcp-search-grep-contracts.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"@donadiosolutions/lcm": major ---- - -Canonicalize MCP search layers to `episodic` and `promoted` (defaulting to -both) and grep scopes to `messages`, `summaries`, and `both` (defaulting to -`both`). Deprecated `semantic` and `all` inputs remain accepted as aliases. -This is a compile-time breaking migration: the previously published required -`SearchResult.semantic` field never matched runtime and is removed. Callers -and typed mocks must migrate to the required canonical `promoted` field. -Daemon/runtime responses continue to return only `episodic` and `promoted` and -never include an own `semantic` key. The deprecated `semantic` and `all` input -aliases remain accepted at the input boundary and are not advertised. diff --git a/.changeset/canonical-source-installer-runtime.md b/.changeset/canonical-source-installer-runtime.md deleted file mode 100644 index 4b9372084..000000000 --- a/.changeset/canonical-source-installer-runtime.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Align the source-clone installer with the packaged `dist/lcm.mjs` CLI -entrypoint. Existing authenticated daemons started from an older source or -intermediate entrypoint may require one restart to adopt the canonical runtime -identity on the next install or use. diff --git a/.changeset/capture-codex-exec-context.md b/.changeset/capture-codex-exec-context.md deleted file mode 100644 index 0b57fc0c0..000000000 --- a/.changeset/capture-codex-exec-context.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Capture bounded semantic context from Codex `functions.exec` and -`functions.exec_command` PostToolUse events, and validate the installed Codex -hook with structural and no-write functional connector checks. diff --git a/.changeset/clarify-durable-private-publication.md b/.changeset/clarify-durable-private-publication.md deleted file mode 100644 index 865112206..000000000 --- a/.changeset/clarify-durable-private-publication.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject the misleading `expectedContentSha256` option in the generic durable -private-file writer and document the portable same-UID replacement boundary. -Callers that require conditional replacement must use a protocol-specific -operation with its own recovery grammar. diff --git a/.changeset/classify-negative-zero-manifest-counts.md b/.changeset/classify-negative-zero-manifest-counts.md deleted file mode 100644 index 790f71351..000000000 --- a/.changeset/classify-negative-zero-manifest-counts.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Classify negative-zero portable manifest record counts as `malformed-manifest` -before checksum canonicalization while preserving checkpoint and record error -taxonomy compatibility. diff --git a/.changeset/clean-consumer-descriptors.md b/.changeset/clean-consumer-descriptors.md deleted file mode 100644 index 1a023cb01..000000000 --- a/.changeset/clean-consumer-descriptors.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve backend publication consumer failures while closing every retained -directory descriptor and reporting any independent cleanup failures. diff --git a/.changeset/clean-tags-skill.md b/.changeset/clean-tags-skill.md deleted file mode 100644 index c07cc2cb5..000000000 --- a/.changeset/clean-tags-skill.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Correct the `lcm-context` skill examples to use the supported repeatable `--tag` option. diff --git a/.changeset/cleanup-error-precedence.md b/.changeset/cleanup-error-precedence.md deleted file mode 100644 index 52c65fc72..000000000 --- a/.changeset/cleanup-error-precedence.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve home, migration-entry, and private-file publication failures when -descriptor or temporary-file cleanup also fails, retaining cleanup errors as -ordered secondary evidence. diff --git a/.changeset/clear-journal-less-recovery.md b/.changeset/clear-journal-less-recovery.md deleted file mode 100644 index fb6ee32f9..000000000 --- a/.changeset/clear-journal-less-recovery.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Clarify operator recovery guidance for a present backend-publication directory -without a journal, including the maintainer-assisted support path. diff --git a/.changeset/clear-postgresql-references.md b/.changeset/clear-postgresql-references.md deleted file mode 100644 index af2078797..000000000 --- a/.changeset/clear-postgresql-references.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Add an audience-based documentation index and move the packaged PostgreSQL implementation guides and runtime grant scripts into the storage reference tree. diff --git a/.changeset/clear-store-help-aliases.md b/.changeset/clear-store-help-aliases.md deleted file mode 100644 index c016781dd..000000000 --- a/.changeset/clear-store-help-aliases.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Honor help before required CLI arguments and accept both repeatable store tag spellings. diff --git a/.changeset/close-exclusive-identity-fds.md b/.changeset/close-exclusive-identity-fds.md deleted file mode 100644 index 68b727d19..000000000 --- a/.changeset/close-exclusive-identity-fds.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Close atomic exclusive-write temporary descriptors when file or parent identity -capture fails while preserving ordered cleanup evidence and authenticated-only -temporary-file removal. diff --git a/.changeset/close-postgresql-factory-health.md b/.changeset/close-postgresql-factory-health.md deleted file mode 100644 index be470770d..000000000 --- a/.changeset/close-postgresql-factory-health.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Return a closed health status when PostgreSQL factory shutdown races with an -in-flight runtime health probe. diff --git a/.changeset/close-postgresql-project-health.md b/.changeset/close-postgresql-project-health.md deleted file mode 100644 index 82722a20a..000000000 --- a/.changeset/close-postgresql-project-health.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Ensure PostgreSQL project health reports the closed state when project shutdown -begins, without exposing query details from an in-flight probe. diff --git a/.changeset/codex-failure-classification.md b/.changeset/codex-failure-classification.md deleted file mode 100644 index fd437e1b5..000000000 --- a/.changeset/codex-failure-classification.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Classify bounded Codex process failures into safe usage, authentication, -unavailable-model, and invalid-request guidance while preserving the existing -compatibility fallback for unknown diagnostics. Usage and authentication -categories also recognize the loopback Responses gateway's upstream 429 and -401 statuses without exposing provider response details. diff --git a/.changeset/codex-subagent-memory.md b/.changeset/codex-subagent-memory.md deleted file mode 100644 index 026f9c37d..000000000 --- a/.changeset/codex-subagent-memory.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Record and recall Codex subagents as their own sessions. The Codex hook -connector now registers `SubagentStart` and `SubagentStop`, so a subagent -receives project memory when it starts and its rollout is ingested under its own -thread id when it finishes. Subagent tool events and compaction snapshots are -keyed by that id instead of the shared tree session, so they no longer mix into -the parent conversation, and parent-authored delegation prompts are not stored -as user decisions. A forked subagent's rollout no longer re-stores the parent -history it inherited when Codex records where the subagent's own history -starts. Run `lcm connectors install codex` to register the new hooks. - -Each subagent conversation also records its immediate parent session in a new -nullable `conversations.parent_session_id` column on SQLite and PostgreSQL -(PostgreSQL migration 0009), filled once from the subagent's rollout and kept -by portable transfer. This changes the portable schema digest, so transfer and -migration artifacts produced by an older release fail closed with -`incompatible-schema`; finish or abandon in-flight transfers before upgrading. diff --git a/.changeset/codex-terminal-hooks.md b/.changeset/codex-terminal-hooks.md deleted file mode 100644 index 6661983eb..000000000 --- a/.changeset/codex-terminal-hooks.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Save Codex memory when a turn is interrupted or a session ends. The Codex hook -connector now also registers `Interrupt` and `SessionEnd` hooks that run -`lcm session-snapshot --client codex --terminal` within Codex's three second -limit. The command only hands the transcript to the already running, verified -daemon (it never starts or repairs one, compacts, or promotes), exits 0 with no -output, and records a short reason in the hook error log when it could not hand -the save over. The daemon accepts the request on the new authenticated -`POST /ingest/terminal` route, answers before any storage work, and ingests the -transcript after the hook has exited, combining closely spaced requests so the -newest tail is read once. Reinstall the connector and approve the two new hook -definitions in Codex to enable them. - diff --git a/.changeset/compact-agent-tag-guidance.md b/.changeset/compact-agent-tag-guidance.md deleted file mode 100644 index 02fb8233b..000000000 --- a/.changeset/compact-agent-tag-guidance.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Replace alias-oriented generated agent instructions with seven compact canonical tag conventions and one concrete store example, and clarify that `signal:memory_used` requires a paired `memory_id:` tag for recall usage counting. diff --git a/.changeset/compact-concurrency.md b/.changeset/compact-concurrency.md deleted file mode 100644 index 1a6470995..000000000 --- a/.changeset/compact-concurrency.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add bounded manual compaction concurrency with replay ordering, dry-run -validation, invocation leases, and drain-safe cancellation diagnostics. diff --git a/.changeset/compact-cwd.md b/.changeset/compact-cwd.md deleted file mode 100644 index 22e107152..000000000 --- a/.changeset/compact-cwd.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Repair `memory.compact` so it sends the project `cwd` required by the daemon, -while preserving two-argument callers through an invocation-time working -directory default and supporting explicit project directories. diff --git a/.changeset/compact-discovery-yield.md b/.changeset/compact-discovery-yield.md deleted file mode 100644 index db694f7b4..000000000 --- a/.changeset/compact-discovery-yield.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -`lcm compact` discovery now yields to the event loop between projects, -conversations, message pages, and source-locator lookups, so the invocation -lease heartbeat keeps running during a long scan and Ctrl+C or `SIGTERM` stops -discovery before the next project or conversation instead of after the whole -scan. An interrupted scan closes the storage it opened, records no failure for -the interrupted project, and sends no compact request. Requests to the local -daemon also use a fresh loopback connection each time, so a connection the -daemon closed at its keep-alive timeout can no longer fail with `write EPIPE`. diff --git a/.changeset/curated-package-docs.md b/.changeset/curated-package-docs.md deleted file mode 100644 index 356ae7a67..000000000 --- a/.changeset/curated-package-docs.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Publish the documented public guides from an explicit package file list. diff --git a/.changeset/cutover-set-commands.md b/.changeset/cutover-set-commands.md deleted file mode 100644 index f309201ed..000000000 --- a/.changeset/cutover-set-commands.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add `lcm migration --set` operations to prepare, activate, inspect, resume and roll back every project in a home through one fenced cutover. Set previews and per-member reports retain the existing JSON envelope and exit classes; single-project commands keep their behavior. diff --git a/.changeset/daemon-publication-contention.md b/.changeset/daemon-publication-contention.md deleted file mode 100644 index 097f6542d..000000000 --- a/.changeset/daemon-publication-contention.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Serialize publication admission between operations in the same daemon so -session completion and promotion can wait for in-flight storage work instead -of failing with publication contention. Keep project identity checks fenced, -prevent canceled queued work from opening storage, and retain the native -hook's existing bounded best-effort completion policy. diff --git a/.changeset/doctor-authenticated-storage-readiness.md b/.changeset/doctor-authenticated-storage-readiness.md deleted file mode 100644 index 6567d204d..000000000 --- a/.changeset/doctor-authenticated-storage-readiness.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Use authenticated daemon health when doctor reports storage readiness and distinguish unavailable storage from readiness that could not be verified. diff --git a/.changeset/doctor-monotonic-retry.md b/.changeset/doctor-monotonic-retry.md deleted file mode 100644 index 51a92579d..000000000 --- a/.changeset/doctor-monotonic-retry.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep doctor publication-convergence retries bounded by monotonic elapsed time -when the system wall clock jumps forward or backward. diff --git a/.changeset/durable-passive-events-replicate.md b/.changeset/durable-passive-events-replicate.md deleted file mode 100644 index fe6a49453..000000000 --- a/.changeset/durable-passive-events-replicate.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add durable, versioned local passive-event envelopes; staged PostgreSQL inbox delivery, fenced completion, retry, quarantine, exact replay, and crash-safe acknowledgement/pruning; and operator status, validation, quarantine-inspection, and replay commands while keeping hooks fully local and offline. diff --git a/.changeset/enumerate-unbound-postgresql-project.md b/.changeset/enumerate-unbound-postgresql-project.md deleted file mode 100644 index eb0ab3ef5..000000000 --- a/.changeset/enumerate-unbound-postgresql-project.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Enumerate an unbound PostgreSQL project instead of aborting `--all` discovery. - -`lcm compact --all`, `lcm import --all`, `lcm export --all`, and -`lcm promote --all` call `listCliProjects()` to select every authenticated -local project. With `storage.backend` set to `postgresql`, a single local -project that had never been linked with `lcm project create` or -`lcm project link ` made `listCliProjects()` reject outright, -so none of these commands processed any other project either. The unbound -entry now enumerates under its own local identity, the same way an already -supported retired-identity fence does, so every other selected project -still runs. `lcm compact --all` and `lcm export --all` report it as that -project's own failure and name the `lcm project create` / `lcm project link` -remedy; `lcm compact --all` previously aborted the whole run with -`project discovery failed` and compacted nothing. `lcm promote --all` -reports a generic per-project failure naming the project path, without -the remedy. `lcm import --all` is session-driven, not project-driven: it -fails that project's sessions rather than naming the project, and a -project with no sessions to import produces no failure at all. -`lcm import --all --dry-run` contacts no project storage, so it does not -surface this condition at all. diff --git a/.changeset/events-cli-error-display.md b/.changeset/events-cli-error-display.md deleted file mode 100644 index 619fa6eac..000000000 --- a/.changeset/events-cli-error-display.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Use fixed text errors for passive-event operator failures, including a retry -hint for busy promotion, while preserving the original structured JSON error. diff --git a/.changeset/expose-mcp-grep-mode.md b/.changeset/expose-mcp-grep-mode.md deleted file mode 100644 index e73fbcf8d..000000000 --- a/.changeset/expose-mcp-grep-mode.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Expose `lcm_grep` search modes through MCP. Callers can choose `full_text` or -`regex`; omitting `mode` remains `full_text`, while malformed explicit modes -(including `null`) are rejected instead of silently defaulting to `full_text`. diff --git a/.changeset/fair-camels-park.md b/.changeset/fair-camels-park.md deleted file mode 100644 index 3b83055c3..000000000 --- a/.changeset/fair-camels-park.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Tighten promotion of passive-learning events when a project working directory -has disappeared so the flow no longer creates spurious project-map entries for -never-seen paths, repairs private-directory permissions on existing sidecars, -and fails closed on malformed or inconsistent persisted parking state during -both runtime observation and worktree reconciliation. diff --git a/.changeset/fair-dragons-compact.md b/.changeset/fair-dragons-compact.md deleted file mode 100644 index 9b94fd6f6..000000000 --- a/.changeset/fair-dragons-compact.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Restart same-version stale daemons, safely recover the exact empty legacy SQLite instruction cache, and surface per-project compaction scan failures. diff --git a/.changeset/fair-spiders-guard.md b/.changeset/fair-spiders-guard.md deleted file mode 100644 index c23a8f2b1..000000000 --- a/.changeset/fair-spiders-guard.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject unsafe project sensitive-pattern leaves before listing, testing, adding, -or removing patterns. Project pattern files must now be regular, owned by the -current user when the platform exposes an effective user ID, and single-link. diff --git a/.changeset/faster-portable-batches.md b/.changeset/faster-portable-batches.md deleted file mode 100644 index 17e8619df..000000000 --- a/.changeset/faster-portable-batches.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reuse validated canonical record bytes to keep maximum-size portable batches -within the coverage gate while preserving existing portable limits and wire -semantics. diff --git a/.changeset/fence-installer-health-identity.md b/.changeset/fence-installer-health-identity.md deleted file mode 100644 index 066d87a75..000000000 --- a/.changeset/fence-installer-health-identity.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Discard an installer publication-retry identity when the daemon configuration, -publication journal, or authenticated private LCM root changes during the -health exchange. diff --git a/.changeset/fence-scrubber-storage-identity.md b/.changeset/fence-scrubber-storage-identity.md deleted file mode 100644 index 2be1d65be..000000000 --- a/.changeset/fence-scrubber-storage-identity.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Prevent store, ingest, and promote from using project-sensitive scrubber -patterns when the authenticated project identity changes before storage opens. -Identity drift now returns the bounded backend-publication blocked response. diff --git a/.changeset/fence-sqlite-factory-health.md b/.changeset/fence-sqlite-factory-health.md deleted file mode 100644 index 4cd564ab8..000000000 --- a/.changeset/fence-sqlite-factory-health.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fence SQLite factory health during shutdown races so in-flight active and idle -project probes return closed without exposing probe details. diff --git a/.changeset/fence-sqlite-project-health.md b/.changeset/fence-sqlite-project-health.md deleted file mode 100644 index 96a15e697..000000000 --- a/.changeset/fence-sqlite-project-health.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fence SQLite project health during shutdown races so in-flight probes return -closed without exposing probe details. diff --git a/.changeset/fenced-sqlite-copy.md b/.changeset/fenced-sqlite-copy.md deleted file mode 100644 index d7efe0b3f..000000000 --- a/.changeset/fenced-sqlite-copy.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add the internal bounded SQLite-to-PostgreSQL migration copy and resume API. -Authenticated snapshots, a project-wide database lease, exact transfer receipts, -and durable local effects keep retries from duplicating data or advancing local -progress ahead of a proven commit. Copy completion preserves SQLite selection -and maintenance; verification and activation remain separate operations. diff --git a/.changeset/file-authority-punctuation.md b/.changeset/file-authority-punctuation.md deleted file mode 100644 index 5cb66f59f..000000000 --- a/.changeset/file-authority-punctuation.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact hosted `file://` paths when authorities contain supported punctuation -before the first path separator. diff --git a/.changeset/fix-activation-exit-classes.md b/.changeset/fix-activation-exit-classes.md deleted file mode 100644 index f576d86c8..000000000 --- a/.changeset/fix-activation-exit-classes.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fix two exit classes in the migration cutover. `lcm migration activate` now refuses a fenced-lease row it cannot decode with exit 5 `activation-refused-evidence` (`lease-unresolvable`) instead of an unexpected failure that claims `applied`; a decodable lease held by another publication keeps exit 4. A daemon left running on the previous backend now answers `GET /health/observe` with its identity, so the restart check reports exit 8 (restart required) instead of exit 5 `cutover-restart-contradiction`. A daemon binary from before this change still gives exit 5; run `lcm daemon status`, resolve it, then run `report`. diff --git a/.changeset/fix-codex-native-user-bus.md b/.changeset/fix-codex-native-user-bus.md deleted file mode 100644 index 27e05895a..000000000 --- a/.changeset/fix-codex-native-user-bus.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Allow native Codex MCP connector commands to reach the authenticated current -user's Linux session bus through an exact, filesystem-validated environment -pair while continuing to reject unrelated or untrusted inherited values. diff --git a/.changeset/fix-doctor-version-convergence.md b/.changeset/fix-doctor-version-convergence.md deleted file mode 100644 index 0d5bdd962..000000000 --- a/.changeset/fix-doctor-version-convergence.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Make `lcm doctor` fail closed on publication contention when the installed -package version is unavailable or blank. diff --git a/.changeset/fix-file-url-bracket-paths.md b/.changeset/fix-file-url-bracket-paths.md deleted file mode 100644 index 94ca3b71f..000000000 --- a/.changeset/fix-file-url-bracket-paths.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact paths in malformed bracketed file URLs while preserving valid bracketed -IPv6 authorities. diff --git a/.changeset/fix-hook-capture-truncation.md b/.changeset/fix-hook-capture-truncation.md deleted file mode 100644 index ddea82e24..000000000 --- a/.changeset/fix-hook-capture-truncation.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Scrub complete selected hook events before applying the durable capture limit, and omit oversized events instead of retaining partial secrets. diff --git a/.changeset/fix-portable-knowledge-provenance.md b/.changeset/fix-portable-knowledge-provenance.md deleted file mode 100644 index eb26de549..000000000 --- a/.changeset/fix-portable-knowledge-provenance.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Include normal PostgreSQL promotions in knowledge exports and import deduplication, retaining metadata and retry identities across provenance forms. Normalize authenticated local and remote self-provenance during canonical PostgreSQL and SQLite transfers while preserving external origins and SQLite knowledge-export filtering. - -Merge exact promoted-memory content independently of the backend search rank, including negative PostgreSQL and SQLite ranks below the fuzzy-match threshold. Nonidentical matches keep the existing threshold (#1153). diff --git a/.changeset/fixed-instruction-cache-reconciliation.md b/.changeset/fixed-instruction-cache-reconciliation.md deleted file mode 100644 index 283494d5f..000000000 --- a/.changeset/fixed-instruction-cache-reconciliation.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Isolate restored instruction caches by project, machine, client, session, verified worktree, and exact working directory; authenticate linked-worktree metadata bidirectionally and discard unscoped legacy instruction rows during a transactional upgrade. diff --git a/.changeset/fixed-promoted-content-nul.md b/.changeset/fixed-promoted-content-nul.md deleted file mode 100644 index 4adff3dc1..000000000 --- a/.changeset/fixed-promoted-content-nul.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject embedded NUL characters in new SQLite promoted-memory content before -writing, and fail closed on selected legacy rows instead of returning the -truncated scalar value. Preserve explicit clean replacements and NUL-bearing -JSON tags. diff --git a/.changeset/freeze-reversible-migration-protocol.md b/.changeset/freeze-reversible-migration-protocol.md deleted file mode 100644 index 92026ac5a..000000000 --- a/.changeset/freeze-reversible-migration-protocol.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add the checksum-sealed reversible-migration manifest, legal transition protocol, and crash-recoverable private revision journal used by SQLite/PostgreSQL cutover workflows. diff --git a/.changeset/fresh-root-handoff.md b/.changeset/fresh-root-handoff.md deleted file mode 100644 index 60cd38d33..000000000 --- a/.changeset/fresh-root-handoff.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fail closed when a newly bootstrapped LCM root disappears, is rebound, or -changes contents during backend publication handoff. The bootstrap retains -the root descriptor and compares its authenticated pre-handoff tree before -refreshing the home-parent witness. diff --git a/.changeset/fuzzy-doors-heal.md b/.changeset/fuzzy-doors-heal.md deleted file mode 100644 index 659ee4de3..000000000 --- a/.changeset/fuzzy-doors-heal.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep PreCompact hooks best-effort when PostgreSQL credentials are unavailable, require SQLite health checks to prove rollback-safe writes, and retire pooled handles whose rollback fails. diff --git a/.changeset/g003-managed-path-trust.md b/.changeset/g003-managed-path-trust.md deleted file mode 100644 index 3cb468861..000000000 --- a/.changeset/g003-managed-path-trust.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Restrict package-manager bins derived for managed daemon PATHs to recognized -per-user layouts rooted at an authenticated owner home, while preserving -legitimate `~/.local` installs and directly observed executable paths. diff --git a/.changeset/gitleaks-patterns-220.md b/.changeset/gitleaks-patterns-220.md deleted file mode 100644 index e8f8abe70..000000000 --- a/.changeset/gitleaks-patterns-220.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Update generated gitleaks redaction patterns to 220 rules. -Correct Slack webhook and Sidekiq URL rules to require literal service -hostnames instead of treating hostname dots as regular-expression wildcards. diff --git a/.changeset/green-format.md b/.changeset/green-format.md deleted file mode 100644 index b8ed7dd9b..000000000 --- a/.changeset/green-format.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject unsupported `lcm export --format` values instead of silently exporting JSON. diff --git a/.changeset/grep-session-filter.md b/.changeset/grep-session-filter.md deleted file mode 100644 index 651cf878c..000000000 --- a/.changeset/grep-session-filter.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Honor the `lcm_grep` sessionId filter by selecting the canonical newest -conversation, rejecting malformed identifiers, and returning an empty result -for unknown sessions. diff --git a/.changeset/grep-since-datetime.md b/.changeset/grep-since-datetime.md deleted file mode 100644 index ae5f1e09d..000000000 --- a/.changeset/grep-since-datetime.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Validate `lcm_grep` `since` values at the daemon boundary. The inclusive -lower bound now accepts only full timezone-qualified ISO datetimes with an -optional 1-3 digit fractional second and returns a stable `invalid since` -error before project or storage access for malformed values. diff --git a/.changeset/grep-since-year-range.md b/.changeset/grep-since-year-range.md deleted file mode 100644 index 06954803e..000000000 --- a/.changeset/grep-since-year-range.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject grep `since` values whose normalized UTC year falls outside 0001-9999 -before accessing project storage. diff --git a/.changeset/guard-absent-install-publication.md b/.changeset/guard-absent-install-publication.md deleted file mode 100644 index 7d05f0207..000000000 --- a/.changeset/guard-absent-install-publication.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject backend-publication journal changes while the installer verifies that -its configuration is absent. diff --git a/.changeset/guard-sqlite-leaf-initialization.md b/.changeset/guard-sqlite-leaf-initialization.md deleted file mode 100644 index 0d6dc768e..000000000 --- a/.changeset/guard-sqlite-leaf-initialization.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject changed SQLite database paths before changing their permissions or -running initialization PRAGMAs, including newly created database files. diff --git a/.changeset/guarded-postgresql-conformance.md b/.changeset/guarded-postgresql-conformance.md deleted file mode 100644 index 6732d0956..000000000 --- a/.changeset/guarded-postgresql-conformance.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Make the staged PostgreSQL conformance harness validate its complete run identity before database mutation, require every exposed project repository adapter to register a backend-neutral contract suite, raise nested signal-probe readiness from 30 to 90 seconds with the bounded `LCM_TEST_POSTGRES_SIGNAL_READY_TIMEOUT_MS` override, register signal runs before readiness, exhaustively audit every registered run and Docker resource class, converge transient whole-run cleanup failures before signal exit, retain bounded sanitized cleanup diagnostics, remove verified private directories after orphan reclamation, fail signal tests when Docker cleanup does not complete, and tolerate an exactly owned Docker resource disappearing during concurrent orphan recovery. diff --git a/.changeset/harden-promote-sidecar-directory.md b/.changeset/harden-promote-sidecar-directory.md deleted file mode 100644 index dfbd31a7a..000000000 --- a/.changeset/harden-promote-sidecar-directory.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject unsafe promote sidecar-root topology instead of creating project -directories through raw recursive `mkdir`. Dry runs remain free of metadata -and project-storage writes. diff --git a/.changeset/health-backend-unknown.md b/.changeset/health-backend-unknown.md deleted file mode 100644 index 18174e01c..000000000 --- a/.changeset/health-backend-unknown.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Stop treating a daemon whose `/health` omits its storage backend as SQLite unless it is a published release through 1.4.3. A newer daemon that omits the backend is now unknown and is refused for reuse, unauthenticated replacement, and restart. diff --git a/.changeset/health-observation-halt-detail.md b/.changeset/health-observation-halt-detail.md deleted file mode 100644 index 095cc1fe6..000000000 --- a/.changeset/health-observation-halt-detail.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep passive-event halt diagnostics on bearer-gated daemon observation instead -of anonymous health. diff --git a/.changeset/hook-legacy-pattern-identity.md b/.changeset/hook-legacy-pattern-identity.md deleted file mode 100644 index cffb3c761..000000000 --- a/.changeset/hook-legacy-pattern-identity.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Apply authenticated legacy project patterns to passive hook events before local storage. diff --git a/.changeset/isolate-reinforcement-failures.md b/.changeset/isolate-reinforcement-failures.md deleted file mode 100644 index 0dd1250bd..000000000 --- a/.changeset/isolate-reinforcement-failures.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Prevent transient passive reinforcement lookup failures from propagating to -sibling events while continuing to cache successful values within the batch. diff --git a/.changeset/large-git-configs.md b/.changeset/large-git-configs.md deleted file mode 100644 index de6662ab0..000000000 --- a/.changeset/large-git-configs.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Accept Git config files up to 4 MiB during project identity resolution while retaining the stricter 64 KiB limit for Git topology pointers. diff --git a/.changeset/lucky-moons-arrive.md b/.changeset/lucky-moons-arrive.md deleted file mode 100644 index dd60bf605..000000000 --- a/.changeset/lucky-moons-arrive.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Start passive-event replication automatically on PostgreSQL-backed daemons. A -PostgreSQL daemon now uploads local hook events to the remote inbox on its own -passive-event sweep, once at startup and then every five minutes, where before -that only happened when a worker was run explicitly. Because nothing ran it, -local events could never reach the acknowledged and remote-pruned state that -local retention depends on, so a project's event table only grew. - -A pass runs for a project only when the backend is PostgreSQL, a machine -identity is registered, the project is linked to a remote project id, and -PostgreSQL reports healthy. The first three are quiet skips; an unhealthy -backend and a machine identity that exists but cannot be read are reported -instead. A SQLite-backed daemon never opens a PostgreSQL connection, so -its behaviour is unchanged. - -Each sweep phase runs under its own short publication admission, so hook -appends proceed between phases instead of waiting behind a whole sweep. - -`lcm status` now reports what replication has done under `passiveEvents`: -whether it is enabled, when the last pass ran, and how many events were -uploaded, applied, acknowledged, pruned, retried and quarantined. `enabled` -reports backend capability, not progress. `passes` and `lastPassAt` advance on -every sweep, and `projects` counts passes that returned a result, so an enabled -daemon with passes and no projects is skipping or failing. diff --git a/.changeset/machine-project-identities.md b/.changeset/machine-project-identities.md deleted file mode 100644 index 5d48d1ae5..000000000 --- a/.changeset/machine-project-identities.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": major ---- - -Replace `lcm map` with unified machine registration and project identity commands, preserving local SQLite hashes while adding explicit PostgreSQL UUIDv7 project pairing and reimage recovery. Add `lcm postgres migrate` as the supported packaged administrator workflow for provisioning the PostgreSQL schema. diff --git a/.changeset/major-connector-transports.md b/.changeset/major-connector-transports.md deleted file mode 100644 index 4a0cc74bb..000000000 --- a/.changeset/major-connector-transports.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -"@donadiosolutions/lcm": major ---- - -Replace component-oriented connector installation with one complete transport -bundle per agent. The former `--type` option is removed; use -`lcm connectors install --transport cli|mcp` and remove a whole bundle -with `lcm connectors remove `. Explicit transport choices take -precedence over stored `connectors.transports.` choices and registry -defaults, while implicit defaults are not persisted. - -Claude Code, Qwen Code, and Zed default to MCP. Codex and every other agent -default to CLI. Cline and Augment are CLI-only until verifiable MCP adapters -exist. Codex's default CLI bundle is hook+skill and does not inspect MCP; -explicit MCP uses native `codex mcp` commands. Guidance is transport-pure, and -transport migration removes only exact LCM-owned MCP state where applicable. - -Migration examples: - -```bash -lcm connectors install codex --transport cli -lcm connectors install codex --transport mcp -lcm connectors remove codex -``` diff --git a/.changeset/managed-daemon-clean-env.md b/.changeset/managed-daemon-clean-env.md deleted file mode 100644 index 4bb50455e..000000000 --- a/.changeset/managed-daemon-clean-env.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Launch managed systemd and launchd daemons through a bounded clean environment so ambient manager variables cannot override staged credentials. Consume authenticated launchd credential files once and retain their immutable in-memory startup snapshot for in-process configuration reloads. diff --git a/.changeset/managed-service-recovery.md b/.changeset/managed-service-recovery.md deleted file mode 100644 index b7864e491..000000000 --- a/.changeset/managed-service-recovery.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Manage daemon recovery through the current user's systemd or launchd service -manager, recreate normally idle services on demand, preserve the tri-state -no-response boundary, and provide canonical doctor, restart, and connector -repair guidance instead of offline process recovery. - -Foreground or detached compatibility daemons are not eligible for automatic offline force recovery: if they stop returning HTTP responses, `lcm daemon restart` refuses and gives operator/manual recovery guidance instead of signaling or replacing the process. diff --git a/.changeset/marker-spread.md b/.changeset/marker-spread.md deleted file mode 100644 index 616c8bfb8..000000000 --- a/.changeset/marker-spread.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Handle many separate managed rules blocks during connector install and removal. diff --git a/.changeset/monotonic-codex-compaction-timeout.md b/.changeset/monotonic-codex-compaction-timeout.md deleted file mode 100644 index 28b8a8de3..000000000 --- a/.changeset/monotonic-codex-compaction-timeout.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep the configured Codex compaction timeout monotonic across config discovery, -gateway startup, and execution. diff --git a/.changeset/monotonic-proxy-startup.md b/.changeset/monotonic-proxy-startup.md deleted file mode 100644 index 60d59d033..000000000 --- a/.changeset/monotonic-proxy-startup.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep internal proxy startup health polling on a monotonic elapsed-time -deadline so wall-clock changes cannot extend or shorten the startup budget. diff --git a/.changeset/native-claude-install.md b/.changeset/native-claude-install.md deleted file mode 100644 index 42240b921..000000000 --- a/.changeset/native-claude-install.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": major ---- - -Replace direct Claude Marketplace distribution with an npm-owned native Claude -Code integration. Install or update LCM with npm, then run `lcm install`; the -installer migrates recognized legacy Marketplace installations before -registering native hooks, MCP, commands, and skills. diff --git a/.changeset/native-ingest-lifecycle.md b/.changeset/native-ingest-lifecycle.md deleted file mode 100644 index 9cce920fe..000000000 --- a/.changeset/native-ingest-lifecycle.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep native transcript parsing and archival on the same source snapshot, retry one concurrent source change, and drain active ingest work before closing storage on cancellation. Intentional cancellation returns HTTP 499 without recording an ingest error. - -Prevent the retry from hiding a source or quarantine cleanup failure; retain both failures and return the existing sanitized ingest failure. - -Keep transcript and scrubber preparation outside backend publication admission on every attempt. Drain and close each attempt before retrying, and revalidate publication state and project identity before further writes. diff --git a/.changeset/native-transcripts.md b/.changeset/native-transcripts.md deleted file mode 100644 index d71ec255f..000000000 --- a/.changeset/native-transcripts.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Add locally scrubbed, append-only PostgreSQL native transcript ingestion with exact message provenance, resumable checkpoints, metadata-only local quarantine, and least-privilege runtime access. diff --git a/.changeset/olive-donkeys-shave.md b/.changeset/olive-donkeys-shave.md deleted file mode 100644 index d5c7483cc..000000000 --- a/.changeset/olive-donkeys-shave.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Report a stalled daemon instead of retrying it forever. When the configured -storage backend is changed while a daemon is already running, that daemon keeps -the backend it authenticated at startup, so its background passive-event work -can never be admitted again. It previously retried on its five-minute sweep -interval indefinitely and only wrote a log line, so a machine could sit with -passive-event promotion silently stopped. The daemon now stops the sweep after -the first refusal, reports it once, and exposes a `passiveEvents` object with -`halted`, `haltedReason`, and `haltedMessage` on the unauthenticated -`/health` response for as long as the halt lasts. Health is the surface that -answers here, because every other route is refused under the same mismatch. The -next hook run still replaces the daemon and clears the halt. diff --git a/.changeset/open-unenrolled-sqlite-identity.md b/.changeset/open-unenrolled-sqlite-identity.md deleted file mode 100644 index d4c839206..000000000 --- a/.changeset/open-unenrolled-sqlite-identity.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep proven-unenrolled SQLite projects available when their optional machine -identity is missing or damaged, while refusing ambiguous receipt-era state. diff --git a/.changeset/openai-sdk-7-node-22.md b/.changeset/openai-sdk-7-node-22.md deleted file mode 100644 index a6c46bf87..000000000 --- a/.changeset/openai-sdk-7-node-22.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": major ---- - -Update the optional OpenAI peer dependency to OpenAI SDK 7.3.0. diff --git a/.changeset/optional-sqlite-receipt-schema.md b/.changeset/optional-sqlite-receipt-schema.md deleted file mode 100644 index 4624b5790..000000000 --- a/.changeset/optional-sqlite-receipt-schema.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Allow the exact optional migration receipt v1 epoch/event table pair in captured SQLite sources and resumed portable destinations. Legacy schemas remain supported; partial or malformed pairs still fail closed. Receipt metadata stays private to migration orchestration and is neither authenticated nor copied by canonical transfer. diff --git a/.changeset/passive-event-dangling-predecessor.md b/.changeset/passive-event-dangling-predecessor.md deleted file mode 100644 index 0f7819da8..000000000 --- a/.changeset/passive-event-dangling-predecessor.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Allow worktree reconciliation to preserve an identical passive-event predecessor after that predecessor has been pruned from both local event databases. diff --git a/.changeset/passive-event-predecessor-remap.md b/.changeset/passive-event-predecessor-remap.md deleted file mode 100644 index 0b05588e3..000000000 --- a/.changeset/passive-event-predecessor-remap.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Prevent worktree reconciliation from changing passive-event predecessor identity after delivery may have reached PostgreSQL. diff --git a/.changeset/passive-promotion-identity.md b/.changeset/passive-promotion-identity.md deleted file mode 100644 index aaee9e280..000000000 --- a/.changeset/passive-promotion-identity.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Pair passive-event scrubber paths with the project identity admitted by the -selected storage backend. Identity drift now blocks promotion with a sanitized -503 response before backend open or event acknowledgement, leaving the batch -pending for a later retry. diff --git a/.changeset/patch-ajv-fast-uri.md b/.changeset/patch-ajv-fast-uri.md deleted file mode 100644 index 8e401bcff..000000000 --- a/.changeset/patch-ajv-fast-uri.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Update Ajv's bundled fast-uri dependency to a patched 3.x release. diff --git a/.changeset/patch-bundled-uri-query-parsers.md b/.changeset/patch-bundled-uri-query-parsers.md deleted file mode 100644 index af5e3dbc1..000000000 --- a/.changeset/patch-bundled-uri-query-parsers.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Patch the bundled URI and query-string parsers against authority confusion, authority injection, and query parsing advisories. diff --git a/.changeset/pin-postgresql-runtime-deparsers.md b/.changeset/pin-postgresql-runtime-deparsers.md deleted file mode 100644 index 8439be0ab..000000000 --- a/.changeset/pin-postgresql-runtime-deparsers.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Pin PostgreSQL runtime deparser settings during readiness checks so hostile -session settings cannot change validated schema fingerprints. diff --git a/.changeset/pin-publication-retry-identity.md b/.changeset/pin-publication-retry-identity.md deleted file mode 100644 index 64a4cbe8a..000000000 --- a/.changeset/pin-publication-retry-identity.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Pin backend-publication contention retries to the complete authenticated daemon -identity, including its entrypoint and runtime digest. diff --git a/.changeset/plan-driven-ci.md b/.changeset/plan-driven-ci.md deleted file mode 100644 index 4a6da123b..000000000 --- a/.changeset/plan-driven-ci.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Restructure the GitHub Actions CI pipeline into a plan-driven job graph: pull requests and merge-queue entries run only the test files related to the change, pushes to `main`/`release` run the complete suite sharded across runners with the merged 100% coverage gate, and the PostgreSQL conformance harness runs once on an 8 vCPU runner with CPU-derived workers. diff --git a/.changeset/portable-predecessor-identity.md b/.changeset/portable-predecessor-identity.md deleted file mode 100644 index 07cc03fb1..000000000 --- a/.changeset/portable-predecessor-identity.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse a portable batch successor that duplicates its predecessor's -identitySha256, matching the official manifest scanner instead of -letting createPortableBatch admit a stream the scanner would reject -downstream. Four domains carry an order field outside their logical -key (passive-events' machineSequence, project-aliases' path, -summary-message-links' and summary-parent-links' ordinal), so a -successor could previously repeat a predecessor's identity while its -order still advanced, which the existing order-regression check does -not catch. Batches built from any portable record source, including -the SQLite-to-PostgreSQL migration copy path, now refuse this case -at construction with a `duplicate-identity` error instead of -accepting it. - -A successor whose order exactly ties its predecessor's (rather than -advancing past it) now also surfaces `duplicate-identity` instead of -`order-regression`. Both are non-retryable and belong to the same -transfer classification, so no caller behavior changes on this exact -tie case beyond the reported error code. diff --git a/.changeset/portable-project-storage.md b/.changeset/portable-project-storage.md deleted file mode 100644 index 9a846e6c2..000000000 --- a/.changeset/portable-project-storage.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Route CLI retrieval, compaction discovery, transcript import and version 1 knowledge transfer through the configured SQLite or PostgreSQL backend. Preserve clean JSON output, authenticated project bindings and atomic retry of knowledge imports. Native imports now retain scrubbed transcript records with message links and checkpoints on both backends. - -Add production canonical SQLite and PostgreSQL transfer adapters with bounded preflight, durable batch receipts, resume validation and complete SQL readback. SQLite recovery archives expose typed native transcript, checkpoint, instruction and passive-event reads. Snapshot creation, migration fencing, cutover and archive activation remain separate operations. - -Keep publication admission held throughout selected CLI storage work and cleanup. Retry only before project preparation starts, so a later failure cannot automatically replay committed work. diff --git a/.changeset/portable-record-stream.md b/.changeset/portable-record-stream.md deleted file mode 100644 index 59b0b6678..000000000 --- a/.changeset/portable-record-stream.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Publish the versioned backend-neutral portable record stream compatibility -contract and its operator/adapter documentation as groundwork for later -import/export and migration workflows. This does not activate CLI, cutover, or -runtime backend routing. diff --git a/.changeset/portable-snapshot-idle-timeout.md b/.changeset/portable-snapshot-idle-timeout.md deleted file mode 100644 index 9cf7d9495..000000000 --- a/.changeset/portable-snapshot-idle-timeout.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add `storage.postgresql.snapshotIdleTimeoutMs` (default 300000 ms) so a -portable transfer's read-only snapshot transaction has its own -idle-in-transaction bound, independent of `statementTimeoutMs`. - -This setting does NOT relax any protection: it bounds only the longest -single idle gap between statements inside the snapshot, because -PostgreSQL resets that timer every time the snapshot issues a query. A -live transfer that keeps reading, however long it takes overall, is -never killed by this setting; only a snapshot that genuinely stalls or -is abandoned for longer than the bound is reclaimed, exactly as before, -just measured against its own correct bound instead of the connection's -much shorter statement-execution bound. - -Previously the snapshot's idle-in-transaction bound was derived from -`statementTimeoutMs`, so a healthy portable cross-backend transfer whose -snapshot merely sat open between reads for longer than that -statement-scale duration could be killed by PostgreSQL (SQLSTATE 25P03) -for doing exactly what a snapshot is designed to do, and the transfer -would fail with a sanitized `source-unavailable` error. Separating the -two bounds fixes that false-positive kill. The new setting is optional -on the public `PostgreSqlConnectionSettings` type, so this change is -additive, not breaking. - -A genuine idle-kill (or a connection actually torn while the snapshot -was idle) is now classified as retryable `source-unavailable` instead -of non-retryable `source-invalid`, and `PortableStreamError` gains an -optional, non-serialized `cause` carrying the already-sanitized -underlying storage error, so operators can see why a retry is -recommended without exposing raw driver detail in logs or JSON. diff --git a/.changeset/postgresql-daemon-runtime.md b/.changeset/postgresql-daemon-runtime.md deleted file mode 100644 index 94c49d7de..000000000 --- a/.changeset/postgresql-daemon-runtime.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Activate verified PostgreSQL project-storage routing for the daemon and MCP -paths, including bounded cancellation, shutdown cleanup, and fail-closed -identity and backend errors. diff --git a/.changeset/postgresql-schema-baseline.md b/.changeset/postgresql-schema-baseline.md deleted file mode 100644 index 2cdda29f1..000000000 --- a/.changeset/postgresql-schema-baseline.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Add the transactional PostgreSQL 18 schema, backend-neutral project identity, bounded exact session-ID lookup, complete applied-baseline inventory verification, identity-function drift fingerprinting, scoped privilege hardening, and namespace-aware extension readiness for upcoming PostgreSQL storage adapters. diff --git a/.changeset/postgresql-storage-config.md b/.changeset/postgresql-storage-config.md deleted file mode 100644 index c7d35d94c..000000000 --- a/.changeset/postgresql-storage-config.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add secure SQLite/PostgreSQL backend selection and PostgreSQL connection configuration, while retaining SQLite as the zero-configuration default. diff --git a/.changeset/postgresql-summary-context.md b/.changeset/postgresql-summary-context.md deleted file mode 100644 index 2d384d2a1..000000000 --- a/.changeset/postgresql-summary-context.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Add staged PostgreSQL summary-DAG, context-item, and large-file repositories with deterministic traversal, transactional graph integrity, fenced mutation support, least-privilege grants, conformance coverage, and operator diagnostics. diff --git a/.changeset/preserve-adjacent-file-url-schemes.md b/.changeset/preserve-adjacent-file-url-schemes.md deleted file mode 100644 index a15b659fb..000000000 --- a/.changeset/preserve-adjacent-file-url-schemes.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve every recognized nested `file://` scheme while redacting adjacent -private paths so repeated error sanitization remains stable. diff --git a/.changeset/preserve-bootstrap-authentication-errors.md b/.changeset/preserve-bootstrap-authentication-errors.md deleted file mode 100644 index 1bfbff593..000000000 --- a/.changeset/preserve-bootstrap-authentication-errors.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve the original directory authentication failure during LCM home -bootstrap when closing the rejected descriptor also fails. diff --git a/.changeset/preserve-codex-endpoint-after-cleanup.md b/.changeset/preserve-codex-endpoint-after-cleanup.md deleted file mode 100644 index f778fbcfa..000000000 --- a/.changeset/preserve-codex-endpoint-after-cleanup.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve a validated Codex endpoint when the one-shot app-server settles after -forced cleanup. diff --git a/.changeset/preserve-completed-reconciliation-cleanup.md b/.changeset/preserve-completed-reconciliation-cleanup.md deleted file mode 100644 index e33e010e9..000000000 --- a/.changeset/preserve-completed-reconciliation-cleanup.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve a durably completed worktree reconciliation journal when retained -directory cleanup fails after final validation, while still reporting the -cleanup error and allowing later discovery of newly eligible work. diff --git a/.changeset/preserve-pathless-file-url-tails.md b/.changeset/preserve-pathless-file-url-tails.md deleted file mode 100644 index 14140d450..000000000 --- a/.changeset/preserve-pathless-file-url-tails.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve nested non-file URLs after an unquoted pathless `file://` query or -fragment boundary while continuing to redact standalone and nested filesystem -paths, including query or fragment values quoted around paths containing -spaces. diff --git a/.changeset/preserve-portable-read-cancellation.md b/.changeset/preserve-portable-read-cancellation.md deleted file mode 100644 index 1908fca5b..000000000 --- a/.changeset/preserve-portable-read-cancellation.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve retryable `aborted` errors when a portable source page rejects after -its read signal is cancelled, without advancing the caller's checkpoint. diff --git a/.changeset/preserve-postgresql-cancellation-machine-id.md b/.changeset/preserve-postgresql-cancellation-machine-id.md deleted file mode 100644 index 6a8d1cd25..000000000 --- a/.changeset/preserve-postgresql-cancellation-machine-id.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve scoped machine identity in sanitized PostgreSQL cancellation errors. diff --git a/.changeset/preserve-postgresql-repository-machine-identity.md b/.changeset/preserve-postgresql-repository-machine-identity.md deleted file mode 100644 index 37a9f7ed5..000000000 --- a/.changeset/preserve-postgresql-repository-machine-identity.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Carry PostgreSQL coordination and explicitly fenced repository machine identity into sanitized cancellation diagnostics. diff --git a/.changeset/preserve-project-admission-errors.md b/.changeset/preserve-project-admission-errors.md deleted file mode 100644 index 3888af767..000000000 --- a/.changeset/preserve-project-admission-errors.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve project-directory admission and permission failures when closing the -acquired child handle also fails, while still reporting cleanup failures and -closing retained ancestor handles. diff --git a/.changeset/preserve-promote-resource-errors.md b/.changeset/preserve-promote-resource-errors.md deleted file mode 100644 index 915aea71f..000000000 --- a/.changeset/preserve-promote-resource-errors.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep completed promotion successful when the best-effort metadata timestamp -cannot reopen its parent because file descriptors or filesystem space are -exhausted. Untrusted or invalid parent topology remains a promotion error. diff --git a/.changeset/private-database-parents.md b/.changeset/private-database-parents.md deleted file mode 100644 index bbc02fddb..000000000 --- a/.changeset/private-database-parents.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Authenticate SQLite parent directories before creating, repairing, or pooling -database connections, and reject unsafe or replaced parents without mutation. diff --git a/.changeset/private-portable-import-metadata.md b/.changeset/private-portable-import-metadata.md deleted file mode 100644 index ca20393c6..000000000 --- a/.changeset/private-portable-import-metadata.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Create missing `import-knowledge` project metadata atomically with owner-only -permissions while preserving existing metadata and legacy temporary paths. diff --git a/.changeset/private-route-metadata.md b/.changeset/private-route-metadata.md deleted file mode 100644 index 09212f287..000000000 --- a/.changeset/private-route-metadata.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Harden final ingest and compact metadata timestamp updates with bounded, -single-link reads, owner validation when a process user ID is available, and -atomic private publication. diff --git a/.changeset/private-write-cleanup-errors.md b/.changeset/private-write-cleanup-errors.md deleted file mode 100644 index c48fd517c..000000000 --- a/.changeset/private-write-cleanup-errors.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve write/setup failures when temporary descriptor close also fails in -atomic private-file writers. Retain temporary cleanup errors in ordinary -replacement and non-durable exclusive creation, and ordered descriptor, -temporary-file, and parent cleanup errors in durable writes. Existing -best-effort temporary cleanup in retained-parent exclusive publication and -`writePrivateFileExclusive` remains unchanged. diff --git a/.changeset/procedural-development-skills.md b/.changeset/procedural-development-skills.md deleted file mode 100644 index 17107c4ae..000000000 --- a/.changeset/procedural-development-skills.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Document the extracted procedural-development and implement-epic skills and the -revised native Bug triage workflow. diff --git a/.changeset/promote-private-metadata.md b/.changeset/promote-private-metadata.md deleted file mode 100644 index 262772ded..000000000 --- a/.changeset/promote-private-metadata.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Harden automatic promotion metadata updates with bounded reads and atomic -owner-private publication, including permission tightening for legacy files. diff --git a/.changeset/promotion-exact-dedup.md b/.changeset/promotion-exact-dedup.md deleted file mode 100644 index 962630db9..000000000 --- a/.changeset/promotion-exact-dedup.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Prevent passive PostgreSQL promotion and portable knowledge import from creating -duplicate memories when an exact live owner row falls outside the bounded fuzzy -search page. diff --git a/.changeset/publication-fence-sidecar-lifetime.md b/.changeset/publication-fence-sidecar-lifetime.md deleted file mode 100644 index d4544a2cb..000000000 --- a/.changeset/publication-fence-sidecar-lifetime.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Retain backend publication admission through passive sidecar diagnostics, -resource close, and orphan pruning so concurrent hook appends cannot be deleted -from a stale snapshot. diff --git a/.changeset/publish-portable-storage-api.md b/.changeset/publish-portable-storage-api.md deleted file mode 100644 index 295f2c1cd..000000000 --- a/.changeset/publish-portable-storage-api.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Publish the documented canonical transfer API at `@donadiosolutions/lcm/storage/portable`, including TypeScript declarations, record and checkpoint codecs, and SQLite/PostgreSQL adapters. Keep backend publication and coordination internals outside this curated package surface. diff --git a/.changeset/quiet-codex-config.md b/.changeset/quiet-codex-config.md deleted file mode 100644 index 9a41d7546..000000000 --- a/.changeset/quiet-codex-config.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Prevent Codex-backed compaction from rejecting otherwise valid user configuration when LCM applies reasoning-effort or fast-mode overrides. diff --git a/.changeset/quiet-codex-effective-endpoint.md b/.changeset/quiet-codex-effective-endpoint.md deleted file mode 100644 index 847bcf4da..000000000 --- a/.changeset/quiet-codex-effective-endpoint.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Honor Codex's effective OpenAI-compatible endpoint during process compaction -while preserving managed credential routing and fail-closed lifecycle behavior. diff --git a/.changeset/quiet-codex-memory-rule.md b/.changeset/quiet-codex-memory-rule.md deleted file mode 100644 index 8366b10a8..000000000 --- a/.changeset/quiet-codex-memory-rule.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Limit the managed Codex memory-retrieval rule to substantive work and requests -for further project understanding so passive hook injection does not trigger a -redundant explicit memory search. diff --git a/.changeset/quiet-connectors-format.md b/.changeset/quiet-connectors-format.md deleted file mode 100644 index 3341b9b16..000000000 --- a/.changeset/quiet-connectors-format.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject unsupported `lcm connectors list --format` values before connector inventory work. diff --git a/.changeset/quiet-daemons-recover.md b/.changeset/quiet-daemons-recover.md deleted file mode 100644 index 86cb89259..000000000 --- a/.changeset/quiet-daemons-recover.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Bound doctor health checks and recover the managed daemon once when automatic post-compaction promotion loses its transport. diff --git a/.changeset/quiet-diagnostic-observation.md b/.changeset/quiet-diagnostic-observation.md deleted file mode 100644 index 756aa0d06..000000000 --- a/.changeset/quiet-diagnostic-observation.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve existing SQLite sidecars when status, pool statistics, and doctor authenticate an already-running daemon. These diagnostics now observe process identity without invoking active storage readiness. Doctor reports that readiness and passive queue draining remain unverified, separately from its backend read diagnostics. diff --git a/.changeset/quiet-dogfooding-reads.md b/.changeset/quiet-dogfooding-reads.md deleted file mode 100644 index 4adb96ab7..000000000 --- a/.changeset/quiet-dogfooding-reads.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep healthy-daemon memory and status reads available while publication holds -the exclusive lock, buffer and revalidate each result across publication -changes, and recognize the Codex 0.147.0 prefixed MCP absence diagnostic -without weakening fail-closed connector verification. diff --git a/.changeset/quiet-memories-coordinate.md b/.changeset/quiet-memories-coordinate.md deleted file mode 100644 index 6e90c15b1..000000000 --- a/.changeset/quiet-memories-coordinate.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add staged PostgreSQL promoted-memory, recall, redaction-administration, and session-coordination repositories with SQLite metadata parity, atomic scoped purge, least-privilege grants, and shared conformance coverage. diff --git a/.changeset/quiet-metadata-stats.md b/.changeset/quiet-metadata-stats.md deleted file mode 100644 index 3e9437f54..000000000 --- a/.changeset/quiet-metadata-stats.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Allow aggregate SQLite diagnostics to omit admitted project directories whose -databases have not been initialized while preserving fail-closed selected and -topology-changing observations. diff --git a/.changeset/quiet-missing-cwd-passive-events.md b/.changeset/quiet-missing-cwd-passive-events.md deleted file mode 100644 index 2896f2d95..000000000 --- a/.changeset/quiet-missing-cwd-passive-events.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Persist missing-working-directory confirmation and reversible local-promotion parking in each existing passive-learning sidecar. Three observations at least five minutes apart now survive daemon restarts and sparse sweep rotations without a fixed expiry. Parking no longer advances event `processed_at`: unprocessed events, history, and delivery state remain intact, repeated absent sweeps return a quiet terminal state, and a later cwd recovery clears the state and promotes the preserved backlog normally. diff --git a/.changeset/quiet-paths-hide.md b/.changeset/quiet-paths-hide.md deleted file mode 100644 index 77e2f97d3..000000000 --- a/.changeset/quiet-paths-hide.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact doubled-colon drive segments inside recognized local paths so malformed -Windows path tails cannot remain visible in sanitized errors. diff --git a/.changeset/quiet-pipes-reject.md b/.changeset/quiet-pipes-reject.md deleted file mode 100644 index 055b1fea6..000000000 --- a/.changeset/quiet-pipes-reject.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Prevent bounded reads from blocking on special files such as FIFOs. diff --git a/.changeset/quiet-post-tool-contention.md b/.changeset/quiet-post-tool-contention.md deleted file mode 100644 index 46cb15358..000000000 --- a/.changeset/quiet-post-tool-contention.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Stop counting successful Codex PostToolUse capture as a hook error when backend -publication metadata reconciliation contends after the event is durably queued. diff --git a/.changeset/quiet-postgresql-runtime.md b/.changeset/quiet-postgresql-runtime.md deleted file mode 100644 index f9dcdddd7..000000000 --- a/.changeset/quiet-postgresql-runtime.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Add the internal verified-TLS PostgreSQL 18 pool and migration foundation plus a digest-pinned, run-isolated conformance harness for upcoming PostgreSQL storage adapters. diff --git a/.changeset/quiet-publication-reads.md b/.changeset/quiet-publication-reads.md deleted file mode 100644 index 7315559f4..000000000 --- a/.changeset/quiet-publication-reads.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Let `lcm doctor` and connector transport resolution converge through a managed -daemon's short backend-publication reconciliation immediately after -`lcm install`. Configuration reads use authenticated, descriptor-bound -lock-free snapshots while retaining and revalidating the canonical private LCM -root when one is present. Legacy SQLite reads without an admissible root remain -compatible only while publication evidence is absent. The lock-taking doctor -stages (project map, worktree reconciliation, daemon lifecycle) retry within -one shared two-second budget only while the lock owner is the exact -token-authenticated managed daemon. Platform process-birth helpers and health -probes are bounded by that remaining shared budget. All configuration and -project-map mutations still require the exclusive publication lock, and any -other owner remains fail closed. diff --git a/.changeset/quiet-pumas-sanitize-paths.md b/.changeset/quiet-pumas-sanitize-paths.md deleted file mode 100644 index d9e78a280..000000000 --- a/.changeset/quiet-pumas-sanitize-paths.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact private path continuations around nested public URLs in one stable -sanitization pass while preserving the public URL bytes. diff --git a/.changeset/quiet-stats-databases.md b/.changeset/quiet-stats-databases.md deleted file mode 100644 index 6d765bb30..000000000 --- a/.changeset/quiet-stats-databases.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Authenticate private project database topology before `lcm stats` opens or -migrates existing SQLite state, and never create a missing project database. diff --git a/.changeset/quiet-timestamps-utc.md b/.changeset/quiet-timestamps-utc.md deleted file mode 100644 index 5ba9e28bb..000000000 --- a/.changeset/quiet-timestamps-utc.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Interpret timezone-less SQLite timestamps as UTC across conversation reads, -promoted-memory age calculations, and summary metadata migrations. diff --git a/.changeset/quiet-turtles-listen.md b/.changeset/quiet-turtles-listen.md deleted file mode 100644 index 139941e65..000000000 --- a/.changeset/quiet-turtles-listen.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Wait up to one second for Claude session-completion acknowledgment before the hook exits, so a promptly responding daemon can persist the completion record. Completion remains best-effort on admission or transport failure; a timeout may occur after persistence. Codex turn behavior and background compaction/promotion remain unchanged. - -Read authenticated hook settings before ingestion to avoid dropping completion when a post-ingest configuration reload contends with daemon writes. Settings remain consistent throughout the invocation; configuration admission failures now prevent ingestion before any transcript is stored. diff --git a/.changeset/recent-limit-validation.md b/.changeset/recent-limit-validation.md deleted file mode 100644 index 2455de897..000000000 --- a/.changeset/recent-limit-validation.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Validate the daemon `POST /recent` limit as an integer from 1 through 1000, -defaulting omitted limits to 5 and rejecting malformed values before project -or storage admission. diff --git a/.changeset/reconcile-backend-worktree-identity.md b/.changeset/reconcile-backend-worktree-identity.md deleted file mode 100644 index 45a030516..000000000 --- a/.changeset/reconcile-backend-worktree-identity.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reconcile verified legacy Git worktree identity before Codex import and remote -passive-event operator admission so existing PostgreSQL bindings are retained. diff --git a/.changeset/reconciliation-message-nul.md b/.changeset/reconciliation-message-nul.md deleted file mode 100644 index d39dc7e98..000000000 --- a/.changeset/reconciliation-message-nul.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse legacy conversation message content with embedded NUL bytes or a -non-TEXT SQLite type during worktree reconciliation, preserving source and -target data for repair and retry. diff --git a/.changeset/recover-managed-publication-restart.md b/.changeset/recover-managed-publication-restart.md deleted file mode 100644 index f130ff8f5..000000000 --- a/.changeset/recover-managed-publication-restart.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Allow an explicit daemon restart to recover an exact managed service that owns backend publication but produces no HTTP response, while preserving fail-closed config, journal, process, and manager identity checks. diff --git a/.changeset/redact-drive-after-bracket-content.md b/.changeset/redact-drive-after-bracket-content.md deleted file mode 100644 index bd5e1207c..000000000 --- a/.changeset/redact-drive-after-bracket-content.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact drive-shaped path continuations after earlier content in bracketed -file URL query and fragment values. diff --git a/.changeset/redact-embedded-file-url-quotes.md b/.changeset/redact-embedded-file-url-quotes.md deleted file mode 100644 index db99fe7f3..000000000 --- a/.changeset/redact-embedded-file-url-quotes.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact local paths after embedded double quotes in exact `file://` authorities -while preserving matching outer quote boundaries. diff --git a/.changeset/redact-file-url-backslash-tails.md b/.changeset/redact-file-url-backslash-tails.md deleted file mode 100644 index eff142099..000000000 --- a/.changeset/redact-file-url-backslash-tails.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact root-relative Windows paths handed off from bracketed file URL query and -fragment values after punctuation, horizontal spacing, or nested URL content, -including IPv6 URLs with a following path, port, or query. diff --git a/.changeset/redact-hosted-file-url-paths.md b/.changeset/redact-hosted-file-url-paths.md deleted file mode 100644 index a9d095b36..000000000 --- a/.changeset/redact-hosted-file-url-paths.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact paths in hosted file URLs from sanitized error messages while preserving -the URL scheme and authority. diff --git a/.changeset/redact-mcp-braced-credentials.md b/.changeset/redact-mcp-braced-credentials.md deleted file mode 100644 index 633bc4482..000000000 --- a/.changeset/redact-mcp-braced-credentials.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Prevent MCP error diagnostics from exposing suffixes of brace-delimited credentials. diff --git a/.changeset/redact-pathless-bracket-tails.md b/.changeset/redact-pathless-bracket-tails.md deleted file mode 100644 index 9c50d12e4..000000000 --- a/.changeset/redact-pathless-bracket-tails.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact local paths inside or after bracketed query and fragment values on -pathless file URLs. diff --git a/.changeset/redact-post-bracket-file-paths.md b/.changeset/redact-post-bracket-file-paths.md deleted file mode 100644 index ba3f62bd4..000000000 --- a/.changeset/redact-post-bracket-file-paths.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact an adjacent path segment after a closing malformed file URL bracket in -the same sanitizer pass. diff --git a/.changeset/refuse-replaced-connector-files.md b/.changeset/refuse-replaced-connector-files.md deleted file mode 100644 index 2447667dc..000000000 --- a/.changeset/refuse-replaced-connector-files.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Prevent connector removal and install rollback from deleting or overwriting a -replacement at an authenticated connector pathname. Linux connector mutations -now stage complete candidates privately, claim existing leaves by atomic rename, -and publish with no-replace hard links. Wholly managed leaves are physically -removed after validation; concurrent replacements remain intact and named -recovery artifacts are reported when compensation cannot restore the receipt. - -Bind connector publication and rollback authority to immutable pre-link -certificates (SHA-256, size, full mode, and canonical device/inode identity), -so post-link edits to either alias cannot be adopted as LCM state. Certified -restore candidates preserve logical initial bytes and mode on a new inode; -external hard links remain attached to the old inode. Evidence and named -recovery artifacts are retained when a claim, compensation, or finalization -cannot be validated. - -Sanitize connector removal and rollback diagnostics so retained descriptor -operation paths and nested low-level error causes are never exposed publicly. -Refuse connector leaves and snapshots larger than 4 MiB before read allocation -or mutation. diff --git a/.changeset/refuse-restored-promotion-metadata.md b/.changeset/refuse-restored-promotion-metadata.md deleted file mode 100644 index eba10a91b..000000000 --- a/.changeset/refuse-restored-promotion-metadata.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse promotion metadata publication when a restored or concurrent `meta.json` -appears after a missing-file observation, preserving the existing file instead -of replacing it. Report post-link cleanup or single-link verification failures -as critical published outcomes so an ambiguous `meta.json` cannot be hidden by -best-effort metadata handling. diff --git a/.changeset/refuse-unsupported-descriptor-platforms.md b/.changeset/refuse-unsupported-descriptor-platforms.md deleted file mode 100644 index f06048755..000000000 --- a/.changeset/refuse-unsupported-descriptor-platforms.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse SQLite migration snapshots and queue evidence when the platform cannot -authenticate UID or retained descriptor traversal. diff --git a/.changeset/reject-negative-zero-checkpoint-counts.md b/.changeset/reject-negative-zero-checkpoint-counts.md deleted file mode 100644 index f4c19823e..000000000 --- a/.changeset/reject-negative-zero-checkpoint-counts.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject negative-zero portable checkpoint counts as `checkpoint-mismatch` -before checksum canonicalization across direct and canonical wire APIs. diff --git a/.changeset/reject-symlinked-connector-parents.md b/.changeset/reject-symlinked-connector-parents.md deleted file mode 100644 index c493fcc86..000000000 --- a/.changeset/reject-symlinked-connector-parents.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Anchor connector parent traversal through retained Linux proc descriptors so -intermediate symlinks cannot redirect project or home writes. Filesystem-backed -connector install/remove now refuse on unsupported platforms or without the -required proc/flag guarantees, and the default pathname-based native Codex MCP -add/remove path emits manual guidance instead of mutating automatically. diff --git a/.changeset/reliable-daemon-startup-recovery.md b/.changeset/reliable-daemon-startup-recovery.md deleted file mode 100644 index 937dd5519..000000000 --- a/.changeset/reliable-daemon-startup-recovery.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Make daemon startup recovery retire authenticated terminal systemd registrations, including stale failed units, before proving absence and recreating the managed service. This completes the #663/#665 daemon startup-recovery lifecycle hardening. diff --git a/.changeset/relinked-replication-rows.md b/.changeset/relinked-replication-rows.md deleted file mode 100644 index 73aefba88..000000000 --- a/.changeset/relinked-replication-rows.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Passive-event replication no longer leaves rows stuck after a project is -relinked to another remote project: rows still awaiting the previous project -are withdrawn from it (or acknowledged, or kept quarantined, depending on -what that project did with them) and uploaded to the new one. The replication -pass also opens the scanned sidecar before resolving the project's identity, -so a missing sidecar no longer creates or publishes project-map evidence. diff --git a/.changeset/renew-retired-project-identities.md b/.changeset/renew-retired-project-identities.md deleted file mode 100644 index c65897268..000000000 --- a/.changeset/renew-retired-project-identities.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Diagnose retired local project identity fences in prompt hooks and batch -compaction, and report that diagnosis for every storage backend rather than -only SQLite. Add an idempotent identity-renewal command that resolves the Git -project anchor first, so it can be run from a nested directory or a linked -worktree as its own diagnostic advises. Renewed projects keep working after -renewal: worktree reconciliation treats an authenticated successor as the -target instead of folding it back into the retired hash, and identity evidence -authenticates a successor id against the retained predecessor fence so a -renewed project can still recover its sidecar when the map is unavailable. -Reconciliation authenticates renewed bindings reached through distinct local -aliases, preserves valid aliases on the successor, and refuses ambiguous or -foreign canonical bindings before source discovery. -After successor map publication becomes observable or its outcome is unknown, -it remains authoritative through later validation or readback failures so -concurrent hook storage cannot be stranded behind a restored retired binding. -Preserve bounded per-item identity and outcomes throughout compact progress and -summaries, keeping invocation-wide failure totals in the live header, the -failure event, and the final summary instead of repeating them on later -per-item lines. diff --git a/.changeset/repair-clipped-daemon-temp.md b/.changeset/repair-clipped-daemon-temp.md deleted file mode 100644 index b23c8b95d..000000000 --- a/.changeset/repair-clipped-daemon-temp.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Remove newly created daemon temporary directories whose owner permissions were -clipped by the process umask, and report an actionable retry requirement while -preserving fail-closed validation for existing paths. diff --git a/.changeset/repair-spark-responses.md b/.changeset/repair-spark-responses.md deleted file mode 100644 index 6df9d176a..000000000 --- a/.changeset/repair-spark-responses.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Repair Codex process compaction with `gpt-5.3-codex-spark` by using the -supported standard Responses shape, accepting its optional stream terminator, -and reporting upstream request failures without misleading CLI upgrade advice. diff --git a/.changeset/require-doctor-runtime-digest.md b/.changeset/require-doctor-runtime-digest.md deleted file mode 100644 index 84578942c..000000000 --- a/.changeset/require-doctor-runtime-digest.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Require an exact local runtime digest before doctor retries daemon-owned publication contention. diff --git a/.changeset/restore-codex-rules.md b/.changeset/restore-codex-rules.md deleted file mode 100644 index d623a2328..000000000 --- a/.changeset/restore-codex-rules.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Restore a minimal managed `~/.codex/AGENTS.md` memory-retrieval rule to the -default Codex CLI connector bundle while preserving the detailed `lcm-memory` -skill and native hooks. Existing user rules remain intact, explicit Codex MCP -bundles omit the CLI-only entry, and reinstalling remains byte-idempotent. diff --git a/.changeset/retain-archive-history-identity.md b/.changeset/retain-archive-history-identity.md deleted file mode 100644 index 5f80456ea..000000000 --- a/.changeset/retain-archive-history-identity.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Retain the authenticated backend-publication history directory through terminal -archive creation, exact replay, and durability flushes so path replacement is -refused without advancing the next publication. diff --git a/.changeset/retain-promotion-admission-tokens.md b/.changeset/retain-promotion-admission-tokens.md deleted file mode 100644 index b48f4a0a3..000000000 --- a/.changeset/retain-promotion-admission-tokens.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reuse retained consumer publication admission while recording missing-working- -directory observations, closing the local outbox, and persisting error-to-fix -correlation. Parking can now reach its third durable observation and correlated -pairs complete local acknowledgement on their first promotion pass without -self-contention. diff --git a/.changeset/retain-quoted-file-authorities.md b/.changeset/retain-quoted-file-authorities.md deleted file mode 100644 index 1cec6ad02..000000000 --- a/.changeset/retain-quoted-file-authorities.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact private paths after ambiguous apostrophes in single-quoted `file://` -authorities, including separately quoted nested file URLs whose paths contain -spaces. Close quoted file paths inside brackets so later standalone paths are -also redacted on the first pass, including backslash paths immediately after -the closing quote in an unmatched bracket or after a root-only quoted path. -Redact backslash paths in an exact file URL's own query or fragment while that -file-URL context remains active. diff --git a/.changeset/retain-sessionstart-publication.md b/.changeset/retain-sessionstart-publication.md deleted file mode 100644 index 72e25e401..000000000 --- a/.changeset/retain-sessionstart-publication.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Retain publication admission while SessionStart prunes the local passive-event -outbox, preventing backend publication from racing destructive maintenance. diff --git a/.changeset/retained-reconciliation-journal-parent.md b/.changeset/retained-reconciliation-journal-parent.md deleted file mode 100644 index 08f1efff9..000000000 --- a/.changeset/retained-reconciliation-journal-parent.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Retain the authenticated reconciliation journal directory throughout each -locked mutation attempt so normal and blocked-state journal writes detect a -replaced parent and fail closed. Refuse lock-contention retries when that -authenticated directory changed during the attempt. diff --git a/.changeset/retry-daemon-storage-factory-close.md b/.changeset/retry-daemon-storage-factory-close.md deleted file mode 100644 index aaab077fe..000000000 --- a/.changeset/retry-daemon-storage-factory-close.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Retry daemon storage-factory cleanup once in the same terminal pass after a -rejected close while preserving concurrent close coalescing and -successful-close idempotence. diff --git a/.changeset/rollback-authoritative-resume.md b/.changeset/rollback-authoritative-resume.md deleted file mode 100644 index a1620fbf3..000000000 --- a/.changeset/rollback-authoritative-resume.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add reversible migration rollback: reverse a completed PostgreSQL -activation back to SQLite. When PostgreSQL was activated but never written to -since, rollback flips the active backend selection back to SQLite -without copying any data. When -PostgreSQL has been written to since activation, rollback builds a -fresh SQLite generation from a fenced PostgreSQL snapshot, verifies -it independently before installing it, and preserves the prior live -database and the original pre-migration snapshot untouched. The -rollback publishes the SQLite selection through the same coordinator as -activation, refuses while another project is still bound to PostgreSQL (installation-wide -rollback is tracked by #1544), -and refuses a generation that never completed an activation, including one -whose project was never bound to PostgreSQL or whose configuration was switched -to PostgreSQL by hand (restore the configuration, or leave it with -`lcm migration abort`). A rollback refused after it entered its maintenance -window leaves PostgreSQL selected: the maintenance journal now records the -backend a window was entered from, and an aborted window keeps that backend -(an aborted activation still selects SQLite). Every step is resumable after a crash, including -after the selection flips and during the coordinator publication: a retry never guesses which -outcome already happened, an interrupted build never reuses a -partial generation, and an incomplete or failed attempt is kept as -evidence rather than deleted. The one exception is a prepared selection whose -PostgreSQL destination was written out of band before the retry: it refuses -fail-closed on every retry until #1529 adds an abort from that state. There is no operator-facing command -for this yet; it ships as an internal capability that a future -release will expose. diff --git a/.changeset/s11-identity-map-auth.md b/.changeset/s11-identity-map-auth.md deleted file mode 100644 index efcfd17ee..000000000 --- a/.changeset/s11-identity-map-auth.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Require local evidence before a project-map key becomes a storage identity, -and stop presenting identities that storage will refuse. - -A key is now admitted only when it is the canonical path hash, a renewal -successor whose retained predecessor fence still authenticates it, or a legacy -hash corroborated by its own project metadata. A key meeting none of these is -refused instead of silently becoming the project id for a directory. - -Renewal successors are decided by their predecessor fence alone, so the -metadata a renewed project writes when storage first opens it cannot stand in -for a fence that has been lost. - -Surfaces that act on a project follow the same rules. `lcm compact --all` and -SQLite compaction preview skip an identity they cannot authenticate and -continue with the remaining projects, and adding an alias to one is refused -before the map is written. `lcm project list` and `lcm project show` mark -such an entry as unauthenticated rather than hiding it, so it stays visible -for repair. - diff --git a/.changeset/s11-sanitizer-independent.md b/.changeset/s11-sanitizer-independent.md deleted file mode 100644 index eb8fa858c..000000000 --- a/.changeset/s11-sanitizer-independent.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact private paths that error sanitization previously left visible after a -nested public URL. A rooted successor is now redacted when the nested URL -carries brackets, such as an IPv6 authority or a bracketed path segment, and a -Windows drive root now arms the same handoff as a slash or backslash root. -Bound terminal fields also count supplementary CJK ideographs as two columns so -live-frame output keeps its promised width. diff --git a/.changeset/s13-cli-enumeration.md b/.changeset/s13-cli-enumeration.md deleted file mode 100644 index fa48847ab..000000000 --- a/.changeset/s13-cli-enumeration.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Report unbound and unopenable projects honestly across CLI enumeration surfaces. - -`lcm --help` now lists `project renew-retired-identity` in the top-level Runtime summary, matching the detailed `lcm project --help` grammar. - -`lcm promote --all` and `lcm import --all` name the static `lcm project create` / `lcm project link ` remedy for an unbound PostgreSQL project instead of a generic per-project failure; other per-project failures keep their generic text. `lcm export --all` names the affected project path on every failure line, and its final summary reports how many projects could not be exported alongside the entries exported. - -Hook-durability identities (`localProjectIdentity`) no longer satisfy call sites that require a PostgreSQL remote binding at compile time; such call sites resolve loudly through a dedicated helper instead of degrading into a permanent unbound refusal. - -When enumeration succeeds but every selected project fails to open, `lcm compact --all` reports how many selected projects failed instead of claiming project discovery failed. diff --git a/.changeset/s13-publication-errors.md b/.changeset/s13-publication-errors.md deleted file mode 100644 index f3567fc5d..000000000 --- a/.changeset/s13-publication-errors.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Distinguish backend-publication absence from unresolvable reads. The -PostgreSQL publication witness now returns a discriminated absent, mismatch, -or unresolvable outcome instead of throwing one undifferentiated failure, and -the publication guard reserves invalid-row for genuinely undecodable rows -while a decodable non-matching row reports fence-mismatch. Synchronous-origin -lock tokens are refused at asynchronous coordinator seams. diff --git a/.changeset/safe-codex-publication-diagnostics.md b/.changeset/safe-codex-publication-diagnostics.md deleted file mode 100644 index e6a2b635a..000000000 --- a/.changeset/safe-codex-publication-diagnostics.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Preserve Codex PostToolUse events across typed publication-lock contention and -surface fail-closed publication admission failures through a fixed, -credential-free diagnostic and protocol-safe `systemMessage` with documented -recovery guidance. diff --git a/.changeset/safe-daemon-pid-publication.md b/.changeset/safe-daemon-pid-publication.md deleted file mode 100644 index a70b27323..000000000 --- a/.changeset/safe-daemon-pid-publication.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Publish foreground and detached daemon PID files through private atomic -replacement. Existing symlink and hardlink targets remain unchanged, the -published PID file is mode `0600`, and its state directory is tightened to -mode `0700`; startup reports a failure when secure publication cannot finish. -Publication failure does not use unpublished PID state to signal a process -that may already have bound or spawned. diff --git a/.changeset/safe-legacy-daemon-migration.md b/.changeset/safe-legacy-daemon-migration.md deleted file mode 100644 index 372fb4401..000000000 --- a/.changeset/safe-legacy-daemon-migration.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Migrate authenticated legacy Linux daemons only after their PID file disappears during exact stop, bind bounded systemd stop/final polling to the exact authenticated invocation ID until unit absence, and refuse every discoverable unit that is not fully authenticated running or PID evidence whose descriptor cannot be closed safely. diff --git a/.changeset/safe-postgresql-harness.md b/.changeset/safe-postgresql-harness.md deleted file mode 100644 index bedfca5ad..000000000 --- a/.changeset/safe-postgresql-harness.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Make the PostgreSQL development harness recover proven stale Docker resources safely and clean up local test consumers reliably after process termination. diff --git a/.changeset/safe-promoted-arrays.md b/.changeset/safe-promoted-arrays.md deleted file mode 100644 index 123d57654..000000000 --- a/.changeset/safe-promoted-arrays.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject accessor-backed and symbol-bearing promoted metadata arrays before reading their values. diff --git a/.changeset/sanitize-adjacent-file-authorities.md b/.changeset/sanitize-adjacent-file-authorities.md deleted file mode 100644 index 71d1212b4..000000000 --- a/.changeset/sanitize-adjacent-file-authorities.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact file URL authority and path tails glued to an already active unquoted -absolute path, including userinfo, ports, and bracketed hosts. This keeps -public error responses stable after one sanitization pass without changing -standalone URL classification. diff --git a/.changeset/sanitize-file-path-handoffs.md b/.changeset/sanitize-file-path-handoffs.md deleted file mode 100644 index 4675b8e4e..000000000 --- a/.changeset/sanitize-file-path-handoffs.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fix error-message path sanitation across quoted URL, drive, nested-bracket, -IPv6-fragment, and scheme-shaped path handoffs. Private path spans are now -removed in the first pass while separate public URLs remain unchanged. diff --git a/.changeset/sanitize-read-compatibility-errors.md b/.changeset/sanitize-read-compatibility-errors.md deleted file mode 100644 index 8c7438092..000000000 --- a/.changeset/sanitize-read-compatibility-errors.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Harden describe and expand compatibility handlers by sanitizing fallback error -messages before response serialization, without changing their external HTTP -status or response shape. diff --git a/.changeset/sanitized-backend-diagnostics.md b/.changeset/sanitized-backend-diagnostics.md deleted file mode 100644 index b8e7c3a59..000000000 --- a/.changeset/sanitized-backend-diagnostics.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"@donadiosolutions/lcm": major ---- - -Make stats, status, pool diagnostics, local MCP statistics, and doctor report a shared sanitized snapshot for the selected SQLite or PostgreSQL backend, with bounded collection and explicit readiness/failure states. Omit unavailable metrics and content-bearing previews instead of exposing private data or reporting false zero totals. - -Make doctor observational throughout: it no longer starts or restarts the daemon, repairs settings or project maps, prunes orphan sidecars, or spawns an MCP server for a handshake. Use the reported explicit installation, connector, or daemon restart commands for repairs. SQLite diagnostics read committed WAL data without schema migration or durable content changes; necessary WAL/SHM read coordination may still occur. - -Show the same complete, safe readiness fields and fixed next actions across diagnostic text output, including failure snapshots. Distinguish aggregate and selected project scope with admitted UUIDs/local hashes, keep unknown selections unavailable, and report absent SQLite machine identity as not applicable without requiring registration. - -Reuse one bounded SQLite diagnostic child across projects and sidecars, preserving the whole-snapshot deadline. Keep an authenticated daemon reported as up when its status request fails, and identify the subsequent local diagnostic observation. - -Preserve independently observed daemon pool counts and the failure latch when the remote diagnostic probe times out or fails, after reauthenticating publication and configuration. Keep the backend failure classification and recovery action distinct from pool-count availability. diff --git a/.changeset/sanitizer-ownership-family.md b/.changeset/sanitizer-ownership-family.md deleted file mode 100644 index b7e6922ca..000000000 --- a/.changeset/sanitizer-ownership-family.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact private paths across nested file, quoted public URL, and wrapper ownership boundaries on the first sanitizer pass, including recognized private-root relative successors after nested file returns. diff --git a/.changeset/secure-daemon-health.md b/.changeset/secure-daemon-health.md deleted file mode 100644 index 73a1a9b75..000000000 --- a/.changeset/secure-daemon-health.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep public daemon health storage-free and path-free while retaining authenticated health diagnostics for lifecycle checks, clients, and doctor. diff --git a/.changeset/secure-git-metadata-identity.md b/.changeset/secure-git-metadata-identity.md deleted file mode 100644 index 9475210f4..000000000 --- a/.changeset/secure-git-metadata-identity.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Require authenticated Git metadata backlinks and contained common directories while parsing bounded worktree configuration without backtracking. diff --git a/.changeset/secure-immutable-sqlite-snapshots.md b/.changeset/secure-immutable-sqlite-snapshots.md deleted file mode 100644 index 23b25c119..000000000 --- a/.changeset/secure-immutable-sqlite-snapshots.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add authenticated, read-only SQLite migration snapshots with durable maintenance -admission, exact passive-event receipts, queue cutoffs, and fail-closed recovery. diff --git a/.changeset/secure-journal-lifecycle.md b/.changeset/secure-journal-lifecycle.md deleted file mode 100644 index ae7e4c919..000000000 --- a/.changeset/secure-journal-lifecycle.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Bind each reconciliation lock and journal callback to one directory identity, -preserve unsafe or substituted journals during reads, listing, and recovery -writes, and create missing journals exclusively. diff --git a/.changeset/secure-project-map-metadata.md b/.changeset/secure-project-map-metadata.md deleted file mode 100644 index 88691e862..000000000 --- a/.changeset/secure-project-map-metadata.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject foreign-owner or multiply linked project metadata before using it to -restore missing project-map entries. diff --git a/.changeset/secure-project-metadata-admission.md b/.changeset/secure-project-metadata-admission.md deleted file mode 100644 index 3370eb1d5..000000000 --- a/.changeset/secure-project-metadata-admission.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject multiply linked or owner-mismatched project metadata before project -admission can parse or rewrite it, while preserving early metadata creation and -malformed snapshot recovery. diff --git a/.changeset/secure-publication-directory-witnesses.md b/.changeset/secure-publication-directory-witnesses.md deleted file mode 100644 index 0d0002a52..000000000 --- a/.changeset/secure-publication-directory-witnesses.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject empty, removed, or rebound backend-publication evidence directories -instead of treating them as legacy SQLite installations without publication -evidence. diff --git a/.changeset/secure-reconciliation-leaves.md b/.changeset/secure-reconciliation-leaves.md deleted file mode 100644 index b43db9688..000000000 --- a/.changeset/secure-reconciliation-leaves.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject wrong-owner or hard-linked reconciliation patterns and reject journals -that are wrong-owner, hard-linked, or not owner-only before trusting their -contents. diff --git a/.changeset/secure-reconciliation-metadata.md b/.changeset/secure-reconciliation-metadata.md deleted file mode 100644 index 4ca8121cb..000000000 --- a/.changeset/secure-reconciliation-metadata.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject untrusted ownership and hard links on canonical reconciliation metadata -before parsing or reusing its content. diff --git a/.changeset/secure-uri-authorities.md b/.changeset/secure-uri-authorities.md deleted file mode 100644 index 6328b52d8..000000000 --- a/.changeset/secure-uri-authorities.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Update the bundled URI parser to a patched release that prevents backslash authority host confusion while preserving the deduplicated MCP SDK and AJV build graph. diff --git a/.changeset/security-alert-campaign.md b/.changeset/security-alert-campaign.md deleted file mode 100644 index 4aca6fda5..000000000 --- a/.changeset/security-alert-campaign.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add the repository's triage-security-issues skill for existing GitHub and Codex Security alerts. It invokes existing assessment and delivery skills, groups related findings before remediation, requires Daybreak Blue security workers, and supports private campaign follow-ups and campaign-scoped Codex authentication. diff --git a/.changeset/security-sidecar-identity.md b/.changeset/security-sidecar-identity.md deleted file mode 100644 index 7be711365..000000000 --- a/.changeset/security-sidecar-identity.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Refuse passive-event promotion when a selected sidecar belongs to a different -project identity. Preserve pending events and durable parking state across -worktree path reuse and project-map changes. -The `--all` discovery now reads sidecars without migrating or pruning them. diff --git a/.changeset/settled-codex-config-witness.md b/.changeset/settled-codex-config-witness.md deleted file mode 100644 index 8d366aeb5..000000000 --- a/.changeset/settled-codex-config-witness.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Clean up Codex configuration resolver witnesses after proven failure, abort, -and timeout settlement while retaining unproven witnesses for reconciliation. diff --git a/.changeset/skip-authoritative-empty-source-reads.md b/.changeset/skip-authoritative-empty-source-reads.md deleted file mode 100644 index 6732af7c6..000000000 --- a/.changeset/skip-authoritative-empty-source-reads.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Skip portable source page reads for authenticated authoritative-empty domains -and return their canonical empty terminal batches. diff --git a/.changeset/snapshot-final-mode-sync.md b/.changeset/snapshot-final-mode-sync.md deleted file mode 100644 index 6feeec0c6..000000000 --- a/.changeset/snapshot-final-mode-sync.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Seal private SQLite snapshot artifacts to read-only mode before the final file -sync, so that sync includes the final permission metadata before the committed -snapshot marker is published. diff --git a/.changeset/stable-bracketed-url-paths.md b/.changeset/stable-bracketed-url-paths.md deleted file mode 100644 index 395e0dfb1..000000000 --- a/.changeset/stable-bracketed-url-paths.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Make bracketed slash-prefixed URL-shaped paths converge to one redacted marker -on the first error-sanitization pass while preserving ordinary nested URLs and -independent filesystem-path redaction. diff --git a/.changeset/stable-locale-admission.md b/.changeset/stable-locale-admission.md deleted file mode 100644 index fe8ddc6d4..000000000 --- a/.changeset/stable-locale-admission.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep healthy managed daemons admissible when callers differ only in shell locale or time-zone presentation settings. diff --git a/.changeset/stable-managed-admission.md b/.changeset/stable-managed-admission.md deleted file mode 100644 index 5061adc3f..000000000 --- a/.changeset/stable-managed-admission.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep default managed daemon start, doctor, and restart calls on one packaged runtime identity, and wait through an exact bounded systemd stop transition before recreating the service. diff --git a/.changeset/stable-managed-daemon-tmpdir.md b/.changeset/stable-managed-daemon-tmpdir.md deleted file mode 100644 index 2db9f3058..000000000 --- a/.changeset/stable-managed-daemon-tmpdir.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Managed background daemons now use a stable, private state-root temporary -directory independent of the caller's `TMPDIR`, `TMP`, and `TEMP` values. diff --git a/.changeset/stats-conversation-denominator.md b/.changeset/stats-conversation-denominator.md deleted file mode 100644 index ebb942fa2..000000000 --- a/.changeset/stats-conversation-denominator.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Correct `lcm stats` compression output to compare compacted conversations with the total conversation count. diff --git a/.changeset/steady-backend-publication.md b/.changeset/steady-backend-publication.md deleted file mode 100644 index 4ad43dd40..000000000 --- a/.changeset/steady-backend-publication.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Document the crash-recoverable backend-publication admission boundary, secure -local state-root establishment, staged PostgreSQL privilege posture, and -fail-closed operator behavior. diff --git a/.changeset/steady-bootstrap-retries.md b/.changeset/steady-bootstrap-retries.md deleted file mode 100644 index 843ab898f..000000000 --- a/.changeset/steady-bootstrap-retries.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Retry short authenticated root-bootstrap contention during a bounded window across CLI startup—20 total attempts at 50 ms intervals, up to about 950 ms—so read-only commands such as `lcm search` continue after a competing bootstrap completes, while ambiguous or unsafe lock states still fail closed. diff --git a/.changeset/steady-diagnostics-boundaries.md b/.changeset/steady-diagnostics-boundaries.md deleted file mode 100644 index 73b10534a..000000000 --- a/.changeset/steady-diagnostics-boundaries.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Run source and packaged SQLite diagnostic workers with explicit Node -type-stripping and SQLite flags, retain authenticated SQLite pool -counts across bounded collection timeouts, and preserve known backend identity -when daemon statistics routes sanitize unexpected failures. diff --git a/.changeset/steady-doctors-repair.md b/.changeset/steady-doctors-repair.md deleted file mode 100644 index 7cb1ee79a..000000000 --- a/.changeset/steady-doctors-repair.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Repair an authenticated managed daemon with stale service configuration during `lcm doctor` while preserving fail-closed lifecycle refusals and reporting the repaired restart. diff --git a/.changeset/steady-query-tails.md b/.changeset/steady-query-tails.md deleted file mode 100644 index d116df76a..000000000 --- a/.changeset/steady-query-tails.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Redact slash-prefixed local paths after word-bearing query or fragment text -following a quoted `file://` path in one sanitization pass, keeping repeated -sanitization byte-stable. diff --git a/.changeset/steady-recovery-provenance.md b/.changeset/steady-recovery-provenance.md deleted file mode 100644 index 748bf0528..000000000 --- a/.changeset/steady-recovery-provenance.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Allow trusted immutable-release recovery to authenticate a manually published -release when an exact failed draft workflow for the same signed tag and commit -completed before publication, while preserving all tag, ancestry, history, -artifact, and npm ordering checks. diff --git a/.changeset/steady-release-publication.md b/.changeset/steady-release-publication.md deleted file mode 100644 index 2b4092ced..000000000 --- a/.changeset/steady-release-publication.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Harden release publication against local tarball path ambiguity and delayed npm registry propagation. diff --git a/.changeset/steady-restart-publication.md b/.changeset/steady-restart-publication.md deleted file mode 100644 index 9ea61c13e..000000000 --- a/.changeset/steady-restart-publication.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Wait through authenticated backend-publication sweep contention at explicit daemon restart boundaries without replaying the restart or weakening PID, token, process-birth, manager, and runtime identity checks. Preserve the original typed contention when bounded admission cannot converge, while reporting an ordinary later publication failure unchanged. diff --git a/.changeset/store-dedup-exact-identity.md b/.changeset/store-dedup-exact-identity.md deleted file mode 100644 index 0f7395357..000000000 --- a/.changeset/store-dedup-exact-identity.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fix `lcm store`, promotion, passive events and knowledge import merging new -content into an unrelated memory (#1727). The deduplication decision now merges -only text that is exactly the same as an active memory; a BM25 match above -`compaction.promotionThresholds.dedupBm25Threshold` no longer discards the -incoming text. Memories damaged by earlier false merges are not repaired. diff --git a/.changeset/store-healthy-daemon-admission.md b/.changeset/store-healthy-daemon-admission.md deleted file mode 100644 index a63a8032e..000000000 --- a/.changeset/store-healthy-daemon-admission.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Complete legacy-home admission before `lcm store`, then reuse an authenticated -healthy daemon without redundant lifecycle discovery while preserving the -locked fallback and daemon-side mutation admission. diff --git a/.changeset/strict-authoritative-empty-manifests.md b/.changeset/strict-authoritative-empty-manifests.md deleted file mode 100644 index fa0f7f6a9..000000000 --- a/.changeset/strict-authoritative-empty-manifests.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject portable manifests that mark a domain authoritative-empty while claiming a nonzero record count or a prefix digest other than the seeded empty-domain digest. diff --git a/.changeset/strict-identity-fences.md b/.changeset/strict-identity-fences.md deleted file mode 100644 index ab9ce29b1..000000000 --- a/.changeset/strict-identity-fences.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Honor Git's final `extensions.worktreeConfig` assignment and keep exact retired event fences out of sidecar health scans while surfacing malformed candidates. diff --git a/.changeset/strong-machines-coordinate.md b/.changeset/strong-machines-coordinate.md deleted file mode 100644 index 59e5af313..000000000 --- a/.changeset/strong-machines-coordinate.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add staged PostgreSQL cross-machine transaction locks, fenced leases, final-write validation, fair passive-inbox claims, bounded cleanup, diagnostics, and least-privilege runtime grants. diff --git a/.changeset/sturdy-packages-install.md b/.changeset/sturdy-packages-install.md deleted file mode 100644 index fd9becdeb..000000000 --- a/.changeset/sturdy-packages-install.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep MCP SDK build dependencies out of published consumer dependency paths, install and verify native Claude settings before removing Marketplace plugins, normalize legacy HTTP/SSE entries to stdio while preserving compatible options, and preview native settings changes without mutating them during dry-run. diff --git a/.changeset/surface-postgresql-surfacing-log-failures.md b/.changeset/surface-postgresql-surfacing-log-failures.md deleted file mode 100644 index 39f451f76..000000000 --- a/.changeset/surface-postgresql-surfacing-log-failures.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Surface typed PostgreSQL surfacing-log failures from `/prompt-search` as -sanitized HTTP 503 responses without falling back to SQLite, while keeping the -prompt hook's optional hint behavior fail-open. diff --git a/.changeset/swift-runners-rest.md b/.changeset/swift-runners-rest.md deleted file mode 100644 index 214372273..000000000 --- a/.changeset/swift-runners-rest.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Replace polling external admission with event-driven evaluation and add a default-branch `repository_dispatch` recovery path for exact commit SHAs. diff --git a/.changeset/terminal-journals-resume-ordinary-work.md b/.changeset/terminal-journals-resume-ordinary-work.md deleted file mode 100644 index d1bebf9ca..000000000 --- a/.changeset/terminal-journals-resume-ordinary-work.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Resume ordinary local outbox upgrades and backend publication after migration -maintenance is aborted or target selection completes. Preserve terminal journal -evidence for retry when observation or replacement fails. diff --git a/.changeset/tidy-background-scheduling.md b/.changeset/tidy-background-scheduling.md deleted file mode 100644 index 345e330a7..000000000 --- a/.changeset/tidy-background-scheduling.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep session-end background scheduling failures independent so ordinary publication contention does not prevent later promotion requests or Claude session completion. Preserve fail-closed handling of local publication-journal errors. diff --git a/.changeset/tidy-claude-transcript-blocks.md b/.changeset/tidy-claude-transcript-blocks.md deleted file mode 100644 index cff4b3b15..000000000 --- a/.changeset/tidy-claude-transcript-blocks.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep valid Claude transcript text when malformed sibling blocks are present. diff --git a/.changeset/tidy-penguins-walk.md b/.changeset/tidy-penguins-walk.md deleted file mode 100644 index d25c966b9..000000000 --- a/.changeset/tidy-penguins-walk.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fix PostgreSQL daemon startup in the installed CLI by resolving SQL assets from their packaged location. Missing or modified migration files continue to fail verification without falling back to source files or SQLite. diff --git a/.changeset/tidy-pugs-repeat.md b/.changeset/tidy-pugs-repeat.md deleted file mode 100644 index 5e839959d..000000000 --- a/.changeset/tidy-pugs-repeat.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Restore 7-day local event retention on SQLite installs. SessionStart prunes -processed passive-learning events older than seven days, but since the durable -PostgreSQL replication work landed, that prune also required each row to have -been acknowledged and pruned by a remote inbox. A SQLite-backed install has no -remote inbox and the schema cannot mark such a row acknowledged, so the prune -deleted nothing at all and the local events table grew without bound. -Retention now waits for remote proof only where PostgreSQL replication can -actually claim the rows. An event that never entered the remote pipeline is -reclaimed on age again, while any event still carrying remote state keeps the -full drained proof, so nothing is destroyed before replication has it. - -Upgrading a SQLite install reclaims the backlog on the first SessionStart: -processed events older than seven days that were never claimed for remote -delivery are deleted, including everything accumulated since the replication -gate made the prune a no-op (2026-07-30). That prune runs under the hook -publication fence, so a large backlog also lengthens that hold on the -first start after upgrading. diff --git a/.changeset/tidy-sqlite-health-admission.md b/.changeset/tidy-sqlite-health-admission.md deleted file mode 100644 index 9712d5bc2..000000000 --- a/.changeset/tidy-sqlite-health-admission.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Fix SQLite health checks incorrectly reporting unavailable after multiple projects are opened in the same home. Factory health probes now run sequentially per home, including overlapping health requests, while preserving maintenance and real contention checks. diff --git a/.changeset/tidy-test-lifecycles.md b/.changeset/tidy-test-lifecycles.md deleted file mode 100644 index 191b436f3..000000000 --- a/.changeset/tidy-test-lifecycles.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Harden PostgreSQL test-process and orphan-resource teardown, and clean isolated Vitest homes at the end of each run. diff --git a/.changeset/trusted-admission-evidence.md b/.changeset/trusted-admission-evidence.md deleted file mode 100644 index c25caaec2..000000000 --- a/.changeset/trusted-admission-evidence.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Bind external admission to authenticated exact-head CI and DCO evidence, including the canonical pull-request CI run, before accepting a pull request. diff --git a/.changeset/trusted-lock-helpers.md b/.changeset/trusted-lock-helpers.md deleted file mode 100644 index b0bbb974c..000000000 --- a/.changeset/trusted-lock-helpers.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Prevent private mutation-lock ownership checks from executing process-birth helpers found through an untrusted `PATH` or working directory. diff --git a/.changeset/trusted-release-provenance.md b/.changeset/trusted-release-provenance.md deleted file mode 100644 index e03f8e856..000000000 --- a/.changeset/trusted-release-provenance.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Validate release markers and publication history with trusted default-branch policy before tagged package code is available. diff --git a/.changeset/upstream-stream-diagnostics.md b/.changeset/upstream-stream-diagnostics.md deleted file mode 100644 index 38b9bfa6a..000000000 --- a/.changeset/upstream-stream-diagnostics.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Report bounded upstream Responses stream failures with retry guidance instead -of suggesting a Codex CLI upgrade. diff --git a/.changeset/utc-message-timestamps.md b/.changeset/utc-message-timestamps.md deleted file mode 100644 index 417b48303..000000000 --- a/.changeset/utc-message-timestamps.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Interpret timezone-less SQLite message timestamps as UTC across message reads -and message search results, preserving millisecond precision and qualified ISO -instants. Newly generated compaction summaries use the corrected message -instants at creation. The separate SQLite metadata backfill issue #1092 can -still rewrite summary bounds when the database is reopened. diff --git a/.changeset/validate-fenced-machine-id.md b/.changeset/validate-fenced-machine-id.md deleted file mode 100644 index 5c52028ca..000000000 --- a/.changeset/validate-fenced-machine-id.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Validate fenced PostgreSQL summary, context, and large-file repository machine -identities as canonical UUIDv7 values. Case-insensitive inputs are normalized -to lowercase, while invalid identities fail synchronously without exposing the -supplied value in diagnostics. diff --git a/.changeset/validate-portable-batch-requests.md b/.changeset/validate-portable-batch-requests.md deleted file mode 100644 index 27324c59a..000000000 --- a/.changeset/validate-portable-batch-requests.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Reject unknown portable domains and invalid read limits before a portable -source adapter authenticates or reads the requested page. diff --git a/.changeset/validate-private-tmp-daemon-ownership.md b/.changeset/validate-private-tmp-daemon-ownership.md deleted file mode 100644 index c1d9bdd63..000000000 --- a/.changeset/validate-private-tmp-daemon-ownership.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Keep managed daemon validation working inside Linux `PrivateTmp` user -namespaces by matching the loopback listener's kernel cgroup to the exact -systemd service while preserving fail-closed PID, health, and manager identity -checks. diff --git a/.changeset/verified-pnpm-development.md b/.changeset/verified-pnpm-development.md deleted file mode 100644 index 409ab9ff4..000000000 --- a/.changeset/verified-pnpm-development.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Use integrity-verified pnpm for source installation, development, and release builds. Source installs use the frozen lockfile, and source pattern-regeneration guidance uses the shared development script. Published npm installation and the Node runtime remain unchanged. diff --git a/.changeset/verify-compact-runtime-digest.md b/.changeset/verify-compact-runtime-digest.md deleted file mode 100644 index 12bf83859..000000000 --- a/.changeset/verify-compact-runtime-digest.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@donadiosolutions/lcm": patch ---- - -Require compact drain recovery to verify that a replacement daemon has the -same packaged runtime digest as the invoking CLI. diff --git a/.changeset/verify-generation-canonical-reconciliation.md b/.changeset/verify-generation-canonical-reconciliation.md deleted file mode 100644 index a23e36a76..000000000 --- a/.changeset/verify-generation-canonical-reconciliation.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Add migration verification with canonical reconciliation evidence for the -reversible SQLite-to-PostgreSQL cutover. A copied generation is now -independently re-verified against the immutable source snapshot and the live -destination inside a single fenced read-only window, producing a durable, -content-addressed report before any activation step may consider the -generation. - -Publication requires both a clean report (no recorded mismatches, including -the public-probe sample class) and full reconciliation class coverage and -full public-probe coverage; the persisted report records all three as -`classCoverage`, `publicProbeCoverage` and `activationEligible` fields -(the two coverage vectors are independent, so a genuine listing-ordering -mismatch is never discarded just because the unrelated search probe could -not evaluate that pass), so eligibility is provable from the artifact -rather than assumed. Both coverage vectors are earned, not declared: a class -or probe is marked as run only when the comparisons behind it completed in -that pass, so a comparison that was never invoked leaves its bit false and -the report ineligible. A report with mismatches is still persisted in full -as operator evidence, but requires explicit abort and a new generation -rather than an in-place retry. -Reconciliation now includes a sequence self-consistency bound (an identity -sequence's on-disk state must not allow the next allocation to collide with -a copied row, distinguishing a privilege gap from a genuinely never-called -sequence rather than collapsing both into the same refusal), and the -step-5 public reads run two probes through the real PostgreSQL repository -paths: an ordered-listing probe compared against the source's own canonical -entries as identity and title pairs per millisecond (so two conversations -that trade titles inside one millisecond are caught), and a search -self-match probe that finds a sampled message by its own content through -`lcm.search_v1`, sampled from a fixed-size early -slice of the source's canonical order rather than the whole domain. If no -sampled message can be found this way, the search probe is marked not-run -in `publicProbeCoverage` and activation eligibility is refused for that -pass rather than silently treated as a pass, since a search configuration -wrong in a way no digest comparison can see is exactly what this probe -exists to catch. - -Reconciliation also includes a foreign-key edge-set equality check (a -`relation`-class mismatch names the child record whose reference no -longer matches the source, catching a remapped-to-the-wrong-parent -identity that an ordinary dangling-reference check cannot see) and a -transfer-ledger check (a `ledger`-class mismatch when the destination's -recorded transfer run, batch checkpoints or identity mapping disagree -with the manifest or the census). The destination-schema witness now -verifies the destination's own applied-migrations history rather than -the currently running binary's compiled-in migration bundle, and a -hand-maintained map of which columns have an identity sequence to bound -is itself checked against the live schema on every run, refusing rather -than silently under-covering a column a future migration adds. - -Verification cost scales with the row count in scope: the census reads and -re-hashes each row individually, so its wall time is roughly linear in row -count rather than a flat per-domain cost, and the census, sequence check and -read-only guard all run inside one fenced window bounded by a single -verification lease that is never renewed mid-window. See -`docs/migration-cutover.md` for how to measure it with -`pnpm run test:postgresql:census-cost` and for the lease sizing guidance. -Verification also keeps the identity and dependency-edge sets of both sides, -one record digest per destination record, and the full conversation listing, -in memory at once; the same guide documents that memory bound. - -The verification lease is held until the report has been durably -persisted, not released beforehand, so a second worker cannot acquire it -and start a concurrent recomputation while this attempt's own persist is -still in flight. - -Verification checks that it still holds that lease right after the census -window closes and again right before the report is written, and refuses -with a `lease-lost` error, writing nothing, when a check finds the lease -lost. It does not renew the lease, and the lease can still expire during the -local report write or while the manifest effect is begun and completed, -which get no new guarantee. - -The sequence self-consistency bound is table-wide, not scoped to the -project being verified: identity sequences are shared per table across -every project, so a colliding row in a different project would otherwise -go undetected whenever the verified project's own copy of that domain -happened to be empty. The search self-match probe now requires a -correlated match, not merely a non-empty result: it resolves each -candidate's own destination-native key through the transfer ledger and -confirms that exact key appears among the search results, so a search -path that returns some unrelated but non-empty result can no longer be -mistaken for a working self-match. The ledger check additionally -reconciles the destination's recorded identity set against the census's -own per-domain identities (not only their count and uniqueness), so a -substitution that preserves cardinality and injectivity while recording -the wrong identities is now caught. diff --git a/.changeset/worktree-project-memory.md b/.changeset/worktree-project-memory.md deleted file mode 100644 index e6b2e794e..000000000 --- a/.changeset/worktree-project-memory.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@donadiosolutions/lcm": minor ---- - -Unify linked Git worktrees under one local project, transactionally preserve and merge legacy worktree memory, and conservatively reconcile Codex transcripts from deleted managed worktrees. diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 000000000..0a46c6758 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,1691 @@ +# @donadiosolutions/lcm + +## 2.0.0 + +### Major Changes + +- c893dd0: Remove Node.js 22 support and declare Node.js 25.4.0 as the supported runtime. + Installing on Node.js 22 now reports an `EBADENGINE` mismatch, which npm + enforces as a refusal only when `engine-strict` is enabled and otherwise + reports as a warning, so the unsupported runtime is stated at install time + instead of failing later at runtime. The previous `>=22.12.0` floor was never + functional: `node:sqlite` does not exist on Node.js 22.12 without + `--experimental-sqlite`, which the CLI never passes. Node.js 22.13 through + 22.15 do provide `StatementSync.iterate()` but still lack + `DatabaseSync.isTransaction`, which production code calls without a fallback, + so no Node.js 22 release below 22.16 could run LCM as written. CI now runs the + coverage gate on the declared floor so the supported runtime is exercised + rather than assumed. +- 5d38673: Resolve compact discovery source locators with one bounded project-level + lookup instead of one native-transcript query per eligible conversation, so + large projects no longer pay an N+1 query pattern or load transcript payloads + that discovery never displays. A session whose provenance cannot be read now + loses only its own source locator (#1338, source Bug #1283). + + BREAKING: NativeTranscriptRepository gains the required member + listUnambiguousSourceLocators. The interface is exported from the public + @donadiosolutions/lcm/storage/native-transcripts entry point, so an external + implementation must add this operation to compile against this release. +- 9baea9a: Canonicalize MCP search layers to `episodic` and `promoted` (defaulting to + both) and grep scopes to `messages`, `summaries`, and `both` (defaulting to + `both`). Deprecated `semantic` and `all` inputs remain accepted as aliases. + This is a compile-time breaking migration: the previously published required + `SearchResult.semantic` field never matched runtime and is removed. Callers + and typed mocks must migrate to the required canonical `promoted` field. + Daemon/runtime responses continue to return only `episodic` and `promoted` and + never include an own `semantic` key. The deprecated `semantic` and `all` input + aliases remain accepted at the input boundary and are not advertised. +- 991d75b: Replace `lcm map` with unified machine registration and project identity commands, preserving local SQLite hashes while adding explicit PostgreSQL UUIDv7 project pairing and reimage recovery. Add `lcm postgres migrate` as the supported packaged administrator workflow for provisioning the PostgreSQL schema. +- ce530ca: Replace component-oriented connector installation with one complete transport + bundle per agent. The former `--type` option is removed; use + `lcm connectors install --transport cli|mcp` and remove a whole bundle + with `lcm connectors remove `. Explicit transport choices take + precedence over stored `connectors.transports.` choices and registry + defaults, while implicit defaults are not persisted. + + Claude Code, Qwen Code, and Zed default to MCP. Codex and every other agent + default to CLI. Cline and Augment are CLI-only until verifiable MCP adapters + exist. Codex's default CLI bundle is hook+skill and does not inspect MCP; + explicit MCP uses native `codex mcp` commands. Guidance is transport-pure, and + transport migration removes only exact LCM-owned MCP state where applicable. + + Migration examples: + + ```bash + lcm connectors install codex --transport cli + lcm connectors install codex --transport mcp + lcm connectors remove codex + ``` +- fb81d39: Replace direct Claude Marketplace distribution with an npm-owned native Claude + Code integration. Install or update LCM with npm, then run `lcm install`; the + installer migrates recognized legacy Marketplace installations before + registering native hooks, MCP, commands, and skills. +- 92dc218: Update the optional OpenAI peer dependency to OpenAI SDK 7.3.0. +- ff25c98: Make stats, status, pool diagnostics, local MCP statistics, and doctor report a shared sanitized snapshot for the selected SQLite or PostgreSQL backend, with bounded collection and explicit readiness/failure states. Omit unavailable metrics and content-bearing previews instead of exposing private data or reporting false zero totals. + + Make doctor observational throughout: it no longer starts or restarts the daemon, repairs settings or project maps, prunes orphan sidecars, or spawns an MCP server for a handshake. Use the reported explicit installation, connector, or daemon restart commands for repairs. SQLite diagnostics read committed WAL data without schema migration or durable content changes; necessary WAL/SHM read coordination may still occur. + + Show the same complete, safe readiness fields and fixed next actions across diagnostic text output, including failure snapshots. Distinguish aggregate and selected project scope with admitted UUIDs/local hashes, keep unknown selections unavailable, and report absent SQLite machine identity as not applicable without requiring registration. + + Reuse one bounded SQLite diagnostic child across projects and sidecars, preserving the whole-snapshot deadline. Keep an authenticated daemon reported as up when its status request fails, and identify the subsequent local diagnostic observation. + + Preserve independently observed daemon pool counts and the failure latch when the remote diagnostic probe times out or fails, after reauthenticating publication and configuration. Keep the backend failure classification and recovery action distinct from pool-count availability. + +### Minor Changes + +- ea9e005: Capture bounded file changes, subagent dispatches, answered questions, and explained plan revisions from native Codex `apply_patch`, `spawn_agent`, `request_user_input`, and `update_plan` tool calls. +- 99aeb4e: Restore LCM memory in Codex after compaction and into forked conversations. The + Codex SessionStart hook now also runs for `compact` and `fork`, prefixes each + restoration with an `` line, and skips `resume`, `fork`, + and `compact` when the session's own rollout already holds a restoration since + the latest compaction or rollback. A Codex compaction restores recent summaries, + promoted knowledge, and passive insights instead of orientation only, and a + recent LCM summarization no longer strips a Codex `resume` or `clear`. The + per-session restore lock is now released when the hook returns. Re-run + `lcm connectors install codex` to update the matcher; Codex may ask to re-trust + the changed hook. +- fac3921: Add an opt-in Codex PreToolUse hook that surfaces up to two relevant memories + as advisory context before a shell command, `apply_patch` edit, or MCP tool + call. It is off by default: set `hooks.preToolRecall` to `true` with + `lcm config set hooks.preToolRecall true --json` and reinstall with + `lcm connectors install codex`. +- 20f900b: Store transcript messages that follow a compaction event. `/ingest` and + `/compact` no longer count compaction event rows as transcript messages when + deciding what is new, so a session that was compacted keeps ingesting its later + messages, and native linkage skips event rows. + `postgresql-runtime-transcript-grants.sql` now also grants column-limited + `SELECT` on `message_parts` so native linkage can recognize event rows. The + conversation grants' table `SELECT` on `message_parts` already covers that read + and runtime readiness, so these column grants are the least-privilege delta for + a role without that table `SELECT`; re-applying the transcript script is + harmless and not required. + + Custom `ConversationRepository` implementations must add the new required + `getTranscriptSlotSnapshot` method, which returns the session-wide transcript + row count and the compaction event rows with their slot markers. +- a6356af: Require a distinct runtime-role URL for migration activation, verify the + runtime and transfer grant profiles together during activation, and leave + only transfer-grant revocation as the post-activation privilege step. + `activate --set` stays transfer-only and reports its stale-daemon refusal as + `set-restart-required`, whose remedy names the full grant swap. +- 9e65d5b: Require `LCM_POSTGRES_RUNTIME_URL` for cutover-set activation, prove the + runtime and transfer grant profiles together, and report transfer-grant + revocation as the only remaining privilege step after activation. +- d81bc09: Add the migration activation orchestrator: the cutover that switches one + verified, activation-eligible SQLite generation to its PostgreSQL destination. + Activation re-reads every precondition live before it changes anything (the + manifest and its verification report, the held maintenance window and writer + quiescence, the project's fenced lease, single-project stored-data coverage, + the destination identity, project-map and copy bindings, a fresh destination + census, and the authenticated target health), and a failed check is a refusal + that begins no effect. Once the checks pass it records durable evidence in a + fixed order (the sealed publication artifact, the generation link, the + activation epoch, attempt and witness, the witness and selection bindings), + publishes the PostgreSQL selection through the same coordinator rollback + uses, stores an immutable activation report and settles the manifest active. + Every step is resumable after a crash: a retry classifies the durable state + it finds and rolls forward, never re-mints an attempt a selection already + carries, and reports whether the publication is known to have been applied as + yes, no or unknown rather than guessing. A maintenance window entered from + PostgreSQL (a rollback window) is foreign to activation and is refused. A + non-predictive preview describes the durable state without taking locks or + touching PostgreSQL. Activation connects as the transfer role that copied and + verified the generation (its settings are supplied for both settings fields) + and admits the target through the transfer readiness check; it does not prove + that the daemon can start. The operator applies the runtime grants, revokes + the transfer grants and then starts the daemon, as docs/migration-cutover.md + describes. There is no operator-facing command for this yet; it ships as an + internal capability that #627 will expose. +- ae9bb86: Add the `lcm migration` command group for the reversible SQLite-to-PostgreSQL + cutover: `plan`, `dry-run`, `apply`, `resume`, `verify`, `report`, `abort`, + `activate` and `rollback`. `plan` previews the next migration generation without + mutating anything; `dry-run` checks the SQLite source in isolation; `apply` + captures the source, mints a migration manifest, and copies the captured data to + PostgreSQL; `resume` runs the one step a held generation is waiting for and stops + at the next checkpoint; `verify` verifies a copied generation against PostgreSQL, + finishes a pending verification from persisted evidence, and confirms a verified + one; `activate` switches a verified generation to PostgreSQL and releases the + maintenance hold; `rollback` returns an activated generation to SQLite; `report` + is a read-only account of one generation that names the command to run next, + shows the activation and rollback evidence, and checks whether a daemon needs a + restart; `abort` is the recovery exit from a held attempt and is safe to repeat. + + Every command that acts on an existing generation asks one router which command + owns the state it is in, so a command that does not own it refuses and names the + one that does. `activate` and `rollback` each need `--confirm-generation` and + `--confirm-backend` (`postgresql` and `sqlite`), their `--dry-run` never exits 0 + because it cannot evaluate the checks that decide the outcome, and their exit + codes are a closed table: an interrupted activation is exit 6 (run it again), and + a running daemon that still holds the previous backend is exit 8. `apply` no + longer creates the local project map entry or the destination PostgreSQL project + until its `--confirm-generation` matches, and never creates either while a hold + exists. + + **`activate` runs under the PostgreSQL transfer role, so swap the grants before + starting the daemon:** add the runtime grants to the daemon's runtime role, then + revoke the transfer grants. `rollback` refuses while any other project is + remotely bound, because the backend selection is global. + + See `docs/migration-operations.md` for the full operator runbook, including the + exit-code vocabulary, refusal reasons, the JSON envelope, the daemon-presence + policy, and what this command group does and does not protect against. +- 02aa46d: Add pool, migration, extension, and queue health families to the PostgreSQL + backend diagnostic snapshot shown by `lcm stats`, `lcm status`, and + `lcm doctor`. Each family reports its status, a health of healthy, degraded, + or unavailable, the fields it could not observe, and a fixed next action. A + degraded family raises a healthy snapshot to degraded. +- 29c8179: Add a curated `@donadiosolutions/lcm/storage/postgresql` production factory for explicit programmatic callers, with eager PostgreSQL 18 schema, exact extension ownership, hardened least-privilege readiness, publication-admitted cross-machine project identity, and deterministic lifecycle handling. +- 631481b: Extend automated issue triage to identify, link, and close high-confidence duplicate bug reports. +- e8d159f: Expose bounded, reset-aware PostgreSQL query statistics through the shared stats, status, MCP, and doctor diagnostic snapshot without reading or emitting statement text. +- 2f4e59f: Support Changesets beta releases with Codex-generated, pull-request-linked draft GitHub notes and publish npm only after a maintainer publishes the draft. +- a8b0dc0: Record and recall Codex subagents as their own sessions. The Codex hook + connector now registers `SubagentStart` and `SubagentStop`, so a subagent + receives project memory when it starts and its rollout is ingested under its own + thread id when it finishes. Subagent tool events and compaction snapshots are + keyed by that id instead of the shared tree session, so they no longer mix into + the parent conversation, and parent-authored delegation prompts are not stored + as user decisions. A forked subagent's rollout no longer re-stores the parent + history it inherited when Codex records where the subagent's own history + starts. Run `lcm connectors install codex` to register the new hooks. + + Each subagent conversation also records its immediate parent session in a new + nullable `conversations.parent_session_id` column on SQLite and PostgreSQL + (PostgreSQL migration 0009), filled once from the subagent's rollout and kept + by portable transfer. This changes the portable schema digest, so transfer and + migration artifacts produced by an older release fail closed with + `incompatible-schema`; finish or abandon in-flight transfers before upgrading. +- d76ed97: Save Codex memory when a turn is interrupted or a session ends. The Codex hook + connector now also registers `Interrupt` and `SessionEnd` hooks that run + `lcm session-snapshot --client codex --terminal` within Codex's three second + limit. The command only hands the transcript to the already running, verified + daemon (it never starts or repairs one, compacts, or promotes), exits 0 with no + output, and records a short reason in the hook error log when it could not hand + the save over. The daemon accepts the request on the new authenticated + `POST /ingest/terminal` route, answers before any storage work, and ingests the + transcript after the hook has exited, combining closely spaced requests so the + newest tail is read once. Reinstall the connector and approve the two new hook + definitions in Codex to enable them. +- e5bcefc: Add bounded manual compaction concurrency with replay ordering, dry-run + validation, invocation leases, and drain-safe cancellation diagnostics. +- 3cd1bd6: Add `lcm migration --set` operations to prepare, activate, inspect, resume and roll back every project in a home through one fenced cutover. Set previews and per-member reports retain the existing JSON envelope and exit classes; single-project commands keep their behavior. +- 9b3f706: Add durable, versioned local passive-event envelopes; staged PostgreSQL inbox delivery, fenced completion, retry, quarantine, exact replay, and crash-safe acknowledgement/pruning; and operator status, validation, quarantine-inspection, and replay commands while keeping hooks fully local and offline. +- 95a8890: Add the internal bounded SQLite-to-PostgreSQL migration copy and resume API. + Authenticated snapshots, a project-wide database lease, exact transfer receipts, + and durable local effects keep retries from duplicating data or advancing local + progress ahead of a proven commit. Copy completion preserves SQLite selection + and maintenance; verification and activation remain separate operations. +- 5797f91: Add the checksum-sealed reversible-migration manifest, legal transition protocol, and crash-recoverable private revision journal used by SQLite/PostgreSQL cutover workflows. +- 842104b: Launch managed systemd and launchd daemons through a bounded clean environment so ambient manager variables cannot override staged credentials. Consume authenticated launchd credential files once and retain their immutable in-memory startup snapshot for in-process configuration reloads. +- 90a10e4: Manage daemon recovery through the current user's systemd or launchd service + manager, recreate normally idle services on demand, preserve the tri-state + no-response boundary, and provide canonical doctor, restart, and connector + repair guidance instead of offline process recovery. + + Foreground or detached compatibility daemons are not eligible for automatic offline force recovery: if they stop returning HTTP responses, `lcm daemon restart` refuses and gives operator/manual recovery guidance instead of signaling or replacing the process. +- f6b40df: Route CLI retrieval, compaction discovery, transcript import and version 1 knowledge transfer through the configured SQLite or PostgreSQL backend. Preserve clean JSON output, authenticated project bindings and atomic retry of knowledge imports. Native imports now retain scrubbed transcript records with message links and checkpoints on both backends. + + Add production canonical SQLite and PostgreSQL transfer adapters with bounded preflight, durable batch receipts, resume validation and complete SQL readback. SQLite recovery archives expose typed native transcript, checkpoint, instruction and passive-event reads. Snapshot creation, migration fencing, cutover and archive activation remain separate operations. + + Keep publication admission held throughout selected CLI storage work and cleanup. Retry only before project preparation starts, so a later failure cannot automatically replay committed work. +- 8cd22b8: Publish the versioned backend-neutral portable record stream compatibility + contract and its operator/adapter documentation as groundwork for later + import/export and migration workflows. This does not activate CLI, cutover, or + runtime backend routing. +- 12cc03f: Add `storage.postgresql.snapshotIdleTimeoutMs` (default 300000 ms) so a + portable transfer's read-only snapshot transaction has its own + idle-in-transaction bound, independent of `statementTimeoutMs`. + + This setting does NOT relax any protection: it bounds only the longest + single idle gap between statements inside the snapshot, because + PostgreSQL resets that timer every time the snapshot issues a query. A + live transfer that keeps reading, however long it takes overall, is + never killed by this setting; only a snapshot that genuinely stalls or + is abandoned for longer than the bound is reclaimed, exactly as before, + just measured against its own correct bound instead of the connection's + much shorter statement-execution bound. + + Previously the snapshot's idle-in-transaction bound was derived from + `statementTimeoutMs`, so a healthy portable cross-backend transfer whose + snapshot merely sat open between reads for longer than that + statement-scale duration could be killed by PostgreSQL (SQLSTATE 25P03) + for doing exactly what a snapshot is designed to do, and the transfer + would fail with a sanitized `source-unavailable` error. Separating the + two bounds fixes that false-positive kill. The new setting is optional + on the public `PostgreSqlConnectionSettings` type, so this change is + additive, not breaking. + + A genuine idle-kill (or a connection actually torn while the snapshot + was idle) is now classified as retryable `source-unavailable` instead + of non-retryable `source-invalid`, and `PortableStreamError` gains an + optional, non-serialized `cause` carrying the already-sanitized + underlying storage error, so operators can see why a retry is + recommended without exposing raw driver detail in logs or JSON. +- 6fac804: Activate verified PostgreSQL project-storage routing for the daemon and MCP + paths, including bounded cancellation, shutdown cleanup, and fail-closed + identity and backend errors. +- 87d5179: Add secure SQLite/PostgreSQL backend selection and PostgreSQL connection configuration, while retaining SQLite as the zero-configuration default. +- da03d2d: Add staged PostgreSQL promoted-memory, recall, redaction-administration, and session-coordination repositories with SQLite metadata parity, atomic scoped purge, least-privilege grants, and shared conformance coverage. +- b4a0ea9: Add reversible migration rollback: reverse a completed PostgreSQL + activation back to SQLite. When PostgreSQL was activated but never written to + since, rollback flips the active backend selection back to SQLite + without copying any data. When + PostgreSQL has been written to since activation, rollback builds a + fresh SQLite generation from a fenced PostgreSQL snapshot, verifies + it independently before installing it, and preserves the prior live + database and the original pre-migration snapshot untouched. The + rollback publishes the SQLite selection through the same coordinator as + activation, refuses while another project is still bound to PostgreSQL (installation-wide + rollback is tracked by #1544), + and refuses a generation that never completed an activation, including one + whose project was never bound to PostgreSQL or whose configuration was switched + to PostgreSQL by hand (restore the configuration, or leave it with + `lcm migration abort`). A rollback refused after it entered its maintenance + window leaves PostgreSQL selected: the maintenance journal now records the + backend a window was entered from, and an aborted window keeps that backend + (an aborted activation still selects SQLite). Every step is resumable after a crash, including + after the selection flips and during the coordinator publication: a retry never guesses which + outcome already happened, an interrupted build never reuses a + partial generation, and an incomplete or failed attempt is kept as + evidence rather than deleted. The one exception is a prepared selection whose + PostgreSQL destination was written out of band before the retry: it refuses + fail-closed on every retry until #1529 adds an abort from that state. There is no operator-facing command + for this yet; it ships as an internal capability that a future + release will expose. +- 02abe68: Add authenticated, read-only SQLite migration snapshots with durable maintenance + admission, exact passive-event receipts, queue cutoffs, and fail-closed recovery. +- b3ff6ba: Add the repository's triage-security-issues skill for existing GitHub and Codex Security alerts. It invokes existing assessment and delivery skills, groups related findings before remediation, requires Daybreak Blue security workers, and supports private campaign follow-ups and campaign-scoped Codex authentication. +- e2b4b63: Add staged PostgreSQL cross-machine transaction locks, fenced leases, final-write validation, fair passive-inbox claims, bounded cleanup, diagnostics, and least-privilege runtime grants. +- 64a019b: Add migration verification with canonical reconciliation evidence for the + reversible SQLite-to-PostgreSQL cutover. A copied generation is now + independently re-verified against the immutable source snapshot and the live + destination inside a single fenced read-only window, producing a durable, + content-addressed report before any activation step may consider the + generation. + + Publication requires both a clean report (no recorded mismatches, including + the public-probe sample class) and full reconciliation class coverage and + full public-probe coverage; the persisted report records all three as + `classCoverage`, `publicProbeCoverage` and `activationEligible` fields + (the two coverage vectors are independent, so a genuine listing-ordering + mismatch is never discarded just because the unrelated search probe could + not evaluate that pass), so eligibility is provable from the artifact + rather than assumed. Both coverage vectors are earned, not declared: a class + or probe is marked as run only when the comparisons behind it completed in + that pass, so a comparison that was never invoked leaves its bit false and + the report ineligible. A report with mismatches is still persisted in full + as operator evidence, but requires explicit abort and a new generation + rather than an in-place retry. + Reconciliation now includes a sequence self-consistency bound (an identity + sequence's on-disk state must not allow the next allocation to collide with + a copied row, distinguishing a privilege gap from a genuinely never-called + sequence rather than collapsing both into the same refusal), and the + step-5 public reads run two probes through the real PostgreSQL repository + paths: an ordered-listing probe compared against the source's own canonical + entries as identity and title pairs per millisecond (so two conversations + that trade titles inside one millisecond are caught), and a search + self-match probe that finds a sampled message by its own content through + `lcm.search_v1`, sampled from a fixed-size early + slice of the source's canonical order rather than the whole domain. If no + sampled message can be found this way, the search probe is marked not-run + in `publicProbeCoverage` and activation eligibility is refused for that + pass rather than silently treated as a pass, since a search configuration + wrong in a way no digest comparison can see is exactly what this probe + exists to catch. + + Reconciliation also includes a foreign-key edge-set equality check (a + `relation`-class mismatch names the child record whose reference no + longer matches the source, catching a remapped-to-the-wrong-parent + identity that an ordinary dangling-reference check cannot see) and a + transfer-ledger check (a `ledger`-class mismatch when the destination's + recorded transfer run, batch checkpoints or identity mapping disagree + with the manifest or the census). The destination-schema witness now + verifies the destination's own applied-migrations history rather than + the currently running binary's compiled-in migration bundle, and a + hand-maintained map of which columns have an identity sequence to bound + is itself checked against the live schema on every run, refusing rather + than silently under-covering a column a future migration adds. + + Verification cost scales with the row count in scope: the census reads and + re-hashes each row individually, so its wall time is roughly linear in row + count rather than a flat per-domain cost, and the census, sequence check and + read-only guard all run inside one fenced window bounded by a single + verification lease that is never renewed mid-window. See + `docs/migration-cutover.md` for how to measure it with + `pnpm run test:postgresql:census-cost` and for the lease sizing guidance. + Verification also keeps the identity and dependency-edge sets of both sides, + one record digest per destination record, and the full conversation listing, + in memory at once; the same guide documents that memory bound. + + The verification lease is held until the report has been durably + persisted, not released beforehand, so a second worker cannot acquire it + and start a concurrent recomputation while this attempt's own persist is + still in flight. + + Verification checks that it still holds that lease right after the census + window closes and again right before the report is written, and refuses + with a `lease-lost` error, writing nothing, when a check finds the lease + lost. It does not renew the lease, and the lease can still expire during the + local report write or while the manifest effect is begun and completed, + which get no new guarantee. + + The sequence self-consistency bound is table-wide, not scoped to the + project being verified: identity sequences are shared per table across + every project, so a colliding row in a different project would otherwise + go undetected whenever the verified project's own copy of that domain + happened to be empty. The search self-match probe now requires a + correlated match, not merely a non-empty result: it resolves each + candidate's own destination-native key through the transfer ledger and + confirms that exact key appears among the search results, so a search + path that returns some unrelated but non-empty result can no longer be + mistaken for a working self-match. The ledger check additionally + reconciles the destination's recorded identity set against the census's + own per-domain identities (not only their count and uniqueness), so a + substitution that preserves cardinality and injectivity while recording + the wrong identities is now caught. +- 5ab4b25: Unify linked Git worktrees under one local project, transactionally preserve and merge legacy worktree memory, and conservatively reconcile Codex transcripts from deleted managed worktrees. + +### Patch Changes + +- d08d3b6: Preserve fixed owner-preserving umask guidance when daemon start, restart, or a + shared CLI consumer reports the matching managed lifecycle refusal. +- 02d0835: Correct the documented `lcm_expand` contract so it matches the shipped tool. + The README configuration table and the agent-tool reference described a token + cap and full source content that the registered tool never provides: the daemon + expansion route passes no token cap and does not request raw source messages, so + a response carries no message content, a child summary longer than 200 + characters appears as its first 200 characters followed by an ellipsis, and + expanding a leaf summary yields an expansion entry whose children and messages + are both empty. The + `LCM_MAX_EXPAND_TOKENS` entry now names the unregistered + `buildExpansionToolDefinition` helper it actually reaches, and the MCP tool + description no longer promises full source content. The `lcm expand` command + description and help text are corrected the same way, since that command posts + to the same daemon route and returns the same child-summary snippets. +- bce07ed: Refuse private metadata publication earlier when a retained parent or temporary + file changes, and report whether a rename completed or its publication outcome + is unknown when topology changes after the rename attempt. +- 8c2bdd5: Keep the process-local worktree discovery cache on a monotonic elapsed-time + clock so wall-clock corrections cannot extend or shorten its 1,000 millisecond + TTL. +- a6c57d2: Preserve retained project and event topology diagnostics when reconciliation + fails after a target database commit, while retaining rollback failures as + secondary error evidence. +- cb390a0: Bound canonical worktree metadata by its serialized UTF-8 size, and preserve + archived or completed reconciliation evidence when final publication fails. +- 1fbc7d8: Report the full number of sidecars skipped by bounded passive-learning scans, + including files remaining after an in-flight timeout or cancellation. +- af72a56: Redact uppercase and mixed-case Slack webhook hostnames. +- 661765e: Redact glued single-slash file path tails in the first sanitization pass. +- 3ea92bb: Preserve publication admission callback failures while retaining ordered + bootstrap-lock, home, and parent descriptor cleanup evidence and typed + contention or publication-error classification. +- f2ddddb: Interpret timezone-less promoted-memory timestamps as UTC in prompt-search and + restore age and recency decisions, keeping results consistent across hosts. +- 9ab2969: Fix passive promotion deduplication for exact content and PostgreSQL owner-wide + provenance, while retaining the inserted event's remote source identity. +- 7f2192e: Refuse non-text or embedded-NUL promoted-memory rows during legacy worktree + reconciliation instead of importing a truncated value, while preserving + in-place repair and retry behavior. Honor completed source markers without + requesting a source repair that the idempotent merge would skip. +- ac7c13c: Publish the PostgreSQL declaration dependency so strict TypeScript consumers can + use the package root and storage subpaths without installing `@types/pg`. +- b4d2513: Refuse unsafe reconciliation journal roots during listing and bind mutating + journal reads to the retained private directory's observed device and inode. +- aa26227: Correct prompt recall by scoring native matched-term evidence instead of incomparable backend ranks. Preserve full SQLite Porter matches and default PostgreSQL exact recall, with a four-point bonus only for whole normalized content/query equality and explicit native evidence diagnostics. +- 0c65cd1: Scrub secrets that span supported Claude and Codex native transcript text + blocks before exact message linkage, while preserving the native record shape + and failing closed when conservative redaction differs from parsed content. +- cb18b13: Document the third worktree-reconciliation refusal state. The recovery notes + covered an uncommitted source fence that rolls back and a target refusal whose + source fence may already be committed, but not the case where the completed + marker is present at the read-only precheck and durably absent inside the target + transaction. The source fence is committed by then, so the normalized source + recheck refuses against an already-retired source: nothing is copied or + truncated, but the documented in-place `UPDATE promoted` repair aborts against + the retained fence and later runs refuse at the source guard. The privacy + documentation now describes that state and states plainly that no in-place + repair is supported, rather than implying the earlier procedure applies. +- 879d7ce: Restore normal configuration loading after SQLite migration maintenance is + aborted or target selection completes. Continue to reject active maintenance, + backend mismatches, changed configuration witnesses, and invalid journals. +- b1e991d: Fix passive promotion and event draining failing to acknowledge queued events + after committing their memory or migration receipt. Reuse the current + publication token for acknowledgement, retained-token preparation, and owned + storage cleanup while keeping scrubber setup outside selected storage admission. +- 3fd9d40: Preserve hook publication failures when final root validation and descriptor + cleanup succeed. Retain publication journal reasons and ordered evidence when + cleanup also fails, and classify combined missing-evidence, contention, or other + failures as unsafe storage. Keep PreCompact's initial unsafe-storage failures + observable through its existing error logger. Reclassified finalization failures + follow each hook's journal-error policy: some hooks throw, while best-effort + hooks continue returning exit code 0. +- d1ff02b: Refuse unsupported SQLite migration capture and dry-run platforms before wrapper + authority reads, append barriers, callbacks, or artifact effects. +- 28e977d: Index owner-scoped exact promoted-content lookup in PostgreSQL with a + generated SHA-256 candidate column and partial btree index, keeping raw + content equality as the residual collision guard. Applying the migration + takes an exclusive schema rewrite and index-build window proportional to + existing promoted-memory data. +- 030313f: Stop a queued local append from being forced to time out by a mutating + passive-learning sidecar scan. Orphan cleanup now enters the local append order + before it acquires publication consumer admission, so an append that started + first completes and stays durable instead of waiting on a lock the scan is + holding. The scan keeps one retained admission through its diagnostic snapshot, + real close, eligibility check, and prune, and that admission no longer grants + implicit append authority to nested tokenless appends, so an append started + during close cannot write between the snapshot and the prune decision. + Cancellation and the scan deadline are honored before the scan opens anything, + reporting the sidecar as skipped, while unrelated publication contention + remains a per-sidecar error that lets scanning continue. + + The sweep also keeps refusing to run while a backend migration holds + publication, so it cannot delete a sidecar during maintenance. +- 34e7196: Preserve concurrent import metadata and retry identities by merging portable + knowledge convergence into the current stored row instead of a stale import + scan snapshot. +- e764a3e: Refuse malformed UTF-8 bytes in legacy SQLite conversation messages during + worktree reconciliation so retries preserve the original source and target + bytes for deliberate offline repair. +- 67d3c38: Admit local append work that already holds backend publication instead of + queueing it behind an append that cannot proceed, so daemon promote-events + sidecar scans complete rather than timing out under contention. +- 99c7a83: Serialize PostgreSQL promoted-memory deduplication decisions for knowledge + import, so two concurrent imports of the same new content can no longer each + observe an empty candidate set and both insert a separate active memory. + Imports into one project now take turns rather than running side by side; + imports into different projects are unaffected. +- c1e8387: Stop bundled Gitleaks detectors from monopolizing the daemon during native + transcript backfill. Imported patterns collapse redundant nested lazy prefixes, + and structurally verified required keywords now skip rules that cannot match the + current text. Rules without a mechanical proof continue scanning in full. + Secret-free strings also avoid a redundant residual scrub pass. +- caf6f1b: `lcm store` and the `lcm_store` tool now make the same deduplication decision + as knowledge import and `lcm promote`. Storing content that already exists as + an active promoted memory in scope returns that memory's id, with its tags + unioned and its confidence kept at the maximum, instead of creating a second + memory; two identical stores now yield one memory. New content still returns a + fresh id. + + On PostgreSQL a manual store also takes the project-scoped deduplication lock, + so it takes turns with a concurrent import or promote into the same project + rather than racing them into a duplicate. +- 0676f31: Refuse to complete a PostgreSQL migration copy whose canonical rows changed + after verification. Completion now re-reads every row the run wrote from + inside the transaction that commits it, and holds the project write fence for + that whole transaction, so another writer can no longer modify or delete a + verified row in the window between the check and the commit. Completion reads + the ledger in bounded pages and groups each page's rows so one read never asks + for more than a batch worth of content, which costs a size read per group but + keeps a large run from loading itself into memory while it holds the fence. + Each ledger page is also bounded by the byte size of its native keys (#1461). + Other writes to the same project wait for that completion to commit. + + Let installations that have already run a transfer apply the schema upgrade + this check needs. The transfer ledger retains its rows, so the new required + digest column is added nullable, backfilled for rows written before it + existed, and only then made mandatory. A run that still carries one of those + older rows fails closed instead of completing unverified. + + Report the readback failure that actually caused a migration settlement + attempt to fail, instead of a stale error left over from an earlier retryable + or ambiguous-commit attempt. + + Settle a migration whose rows moved after it completed. The content check + belongs to the transition into the completed state; once that transaction + commits and releases the fence, an ordinary project writer may change a row at + any time. Reading a completed run back now re-proves identity, the run itself + and its checkpoint chain without requiring the content to have stayed still, + so a migration that did complete is no longer reported as a failed settlement. +- 585e8c1: PostgreSQL portable source creation and migration verification read canonical rows in bounded batches instead of one query per record. +- db67722: The exact-content dedup lookup added for PostgreSQL now runs on every + backend. Knowledge import and passive promotion previously merged + content with no searchable lexical terms (for example, punctuation-only + text) into an existing active memory only on PostgreSQL; on SQLite, + ranked search returned no candidates for such content and two identical + writes produced two active memories. SQLite's exact-content lookup is + indexed by project, with no lexical dependency, but still compares full + content per active row in that project rather than using a content + index the way PostgreSQL's does, and is now consulted the same way + PostgreSQL's already was, within SQLite's existing source-scoped + boundary. `lcm store` and `lcm promote` reach this same lookup on + every backend as part of the separate dedup changes documented + alongside this one. +- d4275a0: Compaction-driven promotion on PostgreSQL now deduplicates against the bound + project's whole provenance and consults the exact-content lookup, as knowledge + import and passive promotion already do. A promoted summary whose exact + content is already an active memory merges into it even when ranked search + cannot recall that content, so it is no longer stored twice. +- 0e0c2f6: Re-check PostgreSQL schema readiness inside the portable source's read-only + snapshot so catalog changes between admission and snapshot are not exported. +- 9a3513e: Handle the asynchronous connection error that PostgreSQL emits when it kills an + idle checked-out connection, for example through + `idle_in_transaction_session_timeout`. Previously a query or transaction whose + callback sat idle past the server timeout could raise an unhandled error and + crash the process; the operation now fails with a storage error and the dead + connection is discarded instead of returned to the pool. +- ae625a2: Refuse to complete a PostgreSQL migration copy whose destination gained + canonical rows after verification. While holding the project publication + fence, completion now compares, per non-identity domain, a database-side + count of the destination's canonical rows with the run's transfer-ledger + tally. A surplus refuses as `destination-unexpected-rows` and a deficit + refuses as `verification-failed`, so a row committed by another writer + between verification and completion no longer completes silently. Identity + domains stay outside the comparison, and the post-commit readback of an + already completed run does not repeat it. +- 15e797d: The backend publication coordinator refuses to record the guarded or released phases without a complete remote-guard provider when the publication has projects. Completed publication material is retained indefinitely by design. +- 27b5378: SQLite exact-content dedup lookups are index-backed. Result order is unchanged. +- b449698: Portable SQLite sources now detect same-timestamp writes after capture. A + captured file whose timestamps are within two seconds of its authenticating + read is re-hashed on every check instead of trusted from unchanged metadata. +- 838fbd4: Installed hook entrypoints (restore, session-end, session-snapshot, user-prompt, + and `compact --hook`) no longer fail with exit code 1 when the backend + publication lock is busy. They skip the CLI legacy-root migration preflight, and + the hook dispatcher treats lock contention while loading the hook configuration + as a best-effort exit 0 for compact, restore, and session-end. Session snapshots + no longer load the configuration at all. UserPromptSubmit's durable local + enqueue stays retry-required (non-zero exit) when its append barrier stays busy + past the bounded wait. +- 087b4fa: PostgreSQL portable export and verification read conversation messages and + record pages in batches, and batch memory accounting now includes record keys. +- 72e87e8: Treat an empty or non-string `metadata.projectId` in `lcm store` as the `manual` origin so it cannot merge into another origin's memory on SQLite. +- 8fcc3a4: Redact a path root that follows an ampersand after a file URL path in the first sanitization pass. +- 62d4023: Make the passive-event replication pass open the sidecar the sweep scanned, + stop a pass from uploading new rows to a project that was relinked mid-pass + while still finishing its work against that project, hold and retry an + outbox whose close failed instead of opening a second one, and cancel an + in-flight storage health check on daemon shutdown. +- 62709e3: Treat an existing journal-less backend-publication directory as unresolvable + PostgreSQL publication evidence, bind a migration copy to the destination's + PostgreSQL system identifier (manifests written before this change must be + copied again to be verified), and accept only canonical positive decimal pids + in the activation restart check. +- 8fd2224: Import prints the unbound-project remedy once per project when a mapped alias + clone and the canonical checkout both have sessions. Docs describe direct + export failure lines and correct the capture-cache residual cases. +- 6bd0dc8: Redact a path root that follows a question mark or equals sign after a file URL path in the first sanitization pass. +- d6d0787: Refuse migration copy writes, including lease acquire, renew and release, to a + PostgreSQL cluster whose system identifier differs from the one recorded when + the copy probed the destination. +- aafcaac: A passive event whose upload reached the previous remote project before a + relink, but was not recorded locally, is now delivered to the new project, and + the other events of its upload batch are no longer held back. When an upload + fails and the new project lacks some of the rows, the previous project's copies + are withdrawn, acknowledged, or kept quarantined as for other relinked rows, and + the batch is uploaded once more without the rows that cannot go. +- f397350: `lcm mcp` now waits briefly for the managed daemon's own publication work at + startup instead of exiting with a publication-busy error. Any other lock owner + or unverifiable daemon still fails closed. +- 041f677: Redact a path root that follows a fragment marker after a file URL path, or that follows a URL scheme inside a redacted path, in the first sanitization pass. +- 6324d88: Authenticate the publication lock owner recorded when contention occurs, so + `lcm mcp` startup after a daemon restart no longer exits when the daemon + releases the lock before convergence can read it again. The retry stays within + the existing two-second window, and contention on other locks, missing daemon + identity, and foreign, malformed, stale, or unhealthy owners still fail closed. +- 5b15d3e: Drain a machine's whole ready backlog of PostgreSQL passive events in one + replication pass instead of one event per pass, up to the batch size. +- 1e08c10: PostgreSQL read routes return a sanitized 503 instead of empty results when + project storage or publication admission fails. +- 2b454ab: PostgreSQL daemon read routes (`/search`, `/grep`, `/recent`, `/describe`, `/expand`) + no longer fail while the daemon's own publication work, such as a replication + sweep phase, holds the publication lock. A read that contends retries once, + waiting up to one second for a turn in the daemon's publication queue, and + otherwise returns the sanitized `503`; contention and an expired wait are + retryable, while a genuine storage failure keeps `retryable: false`. +- 0fd55ef: Re-running a migration rollback now completes it when its own backend + publication was aborted by something else. The restored configuration and + project map are checked against what the publication recorded, the destination + and the activation authority are verified again, and the publication then + resumes forward; a drifted destination refuses with the effect pending and the + lease held. +- 6663b76: Interpret current Codex tool outcomes correctly. Passive capture now accepts the + `Bash` tool name Codex emits for shell commands, keeps the legacy + `functions.exec` names as aliases, and no longer treats a shell command as + successful just because Codex reported no status: git and install commands with + no structured status are stored as a `tool_outcome_unknown` observation, which + is never promoted, reinforced or correlated as the fix for an earlier error. + Codex MCP calls are recorded as before when the result is a success. +- fdc4fef: `lcm connectors doctor codex` now reports whether Codex can actually run each + LCM hook (missing, disabled, untrusted, modified, or ready) instead of + only checking that the hook is installed, and reinstalling the Codex hooks + keeps your per-hook enable and trust choices and any explicit + `[features] hooks = false`. +- e4d488c: Document the Codex lifecycle guarantees verified against native Codex 0.163.0 + sessions: which edges are verified, best-effort, not covered or unverified, how + failures and context limits behave, and where to look when a hook does not run. + Correct the Codex MCP bundle setup (register with `codex mcp add lcm -- lcm mcp` + first) and document the `hooks.snapshotIntervalSec` Stop throttle. +- f984fd5: Make `lcm compact` report actionable per-session failures. Failed sessions now + name the cause (lost daemon connection, rejected authentication, unavailable + daemon, daemon error, or unbound project) and the next step instead of a + generic "compaction request failed", without echoing raw daemon or provider + error text. +- 9e8fec2: Name the condition code and source ordinal in native transcript linkage + failures so logged ingest errors identify which record failed and why. +- 3d7dc06: Honor the documented `LCM_ENABLED=false` setting by making every native Claude and Codex hook a no-op, including the legacy `lcm compact` PreCompact command. +- 6bdc0e8: Reject FIFO and other special-file transcript paths without blocking the + daemon. Native ingest and the pathname transcript readers used by compaction + now open the file non-blocking and check that it is a regular file before + reading, so a FIFO with no writer returns the empty-input result instead of + hanging the request. +- b1032c3: Stop storing a Codex fork's copied parent history again. A fork that copied its + parent's rollout now stores, and links in the native transcript archive, only + the messages after its own settings event, in both `/ingest` and `/compact`. + A session that was stored before keeps following the history it already holds. +- 54cfd9f: Daemon shutdown no longer closes storage while a cancelled background ingest is still opening a project. +- 72c0c4e: Treat Codex config.toml files with overflowing float values as invalid TOML, so + doctor reports hook state as unknown and install leaves the file unchanged. +- 474b815: Make `lcm connectors install codex` stop, leaving `hooks.json` and + `config.toml` untouched, when `hooks.json` is not valid JSON or repeats a key, + instead of replacing it with only the LCM hooks. `lcm doctor` now also reports + a `hooks.json` with a key repeated in the file, a group or a handler, or a + non-integer command or MCP tool `timeout` or command `additionalContextLimit`, + as unreadable. +- 6dfca1b: Report a fixed stderr line when the daemon does not acknowledge a Claude + SessionEnd completion within its one-second wait, naming a timeout, an HTTP + status, or an unavailable daemon, without changing the hook's exit code or + stdout. +- 6eaaaf2: Document how to upgrade the Codex `SessionStart` matcher when the LCM restore + hook shares its group with other hooks. +- 55504c0: Report an interrupted migration activation as applied only when the live + configuration and project map match the published witnesses, and as not applied + only when they still match the pre-publication source; any other state is + unknown. +- e46a3cd: Migration activation on an uninitialized LCM home now returns the classified + `manifest-absent` refusal instead of throwing, and an unreadable machine + identity or census scratch directory is reported as a `state-unresolvable` + outcome rather than an exception. +- 4e99f48: Keep the Codex hooks.json strict parse linear in input size when ignored members have long names and many fractional values. +- 6805cc2: Stop `lcm doctor` from reporting every Codex hook as `hooks-file-unreadable` + when `hooks.json` repeats a member that Codex ignores, such as an extra note + on a matcher group or a handler. Doctor now rejects a repeated member only when + Codex's own struct for that object knows it (any root member, an event name, a + group's `matcher` or `hooks`, or a field of the handler's `type`), as Codex + does. Install still refuses every repeated key. +- 519a506: Stop Codex referenced (paginated-history) forks from receiving a second LCM + restoration block. The restore hook now follows the fork's `history_base` to + its parent rollout and checks the inherited history, so a restoration the fork + already carries suppresses the block unless the fork's own records compacted or + rolled it back. A parent that cannot be found or verified still prints a fresh + block. +- bb80cc2: Wait briefly for another process's backend-publication lock instead of dropping the work. Restore, compact, Stop, SubagentStop, PreCompact and SubagentStart hooks now wait up to 5 seconds in total, Codex Interrupt and SessionEnd hand-offs wait inside their own time budget, and the daemon waits for the lock before it ingests or restores. A lock held longer than that window still skips the snapshot or restoration as before. Closes #1634 and #1635. +- c6c27fd: Deliver the complete output of the compact, restore, session-end, user-prompt, + post-tool, pre-tool and session-snapshot hooks when stdout is a pipe. The hooks + called `process.exit()` right after writing, which discarded output still + queued in the pipe, so a restoration larger than about 8 KiB could reach Codex + truncated. They now wait for the write to be flushed (or to fail, for example + when the reader has gone away) before exiting with the same exit code. +- f98324d: Omit the local pending age from runtime health telemetry when any local sidecar + reports an invalid oldest pending timestamp, instead of letting a valid sibling + hide it. +- b5ab2d6: Report the classified failure reason in the `extensions` runtime health + family of the backend diagnostic snapshot. When the PostgreSQL health check + failed without returning extension records, the family kept a generic + `unavailable` status even for a permission or timeout failure; it now reports + `permission-denied` or `timeout` like the other families that were never + observed. +- 7842205: Admit PostgreSQL transfer roles provisioned before the `message_parts` column + grants again. Transfer readiness no longer requires the four direct + `message_parts` column `SELECT` grants when the role holds the table-level + `SELECT` that already covers those reads, so such a role stays ready without + re-applying the transcript grants. +- 75d6440: Update the PostgreSQL telemetry guide introduction to list the implemented + statement statistics, runtime health, and incident runbook surfaces. +- aa2b0ee: Migration activation now refuses, or reports an interrupted roll-forward on + re-entry, when a destination identity query (S0, S5 or S7) or the S7 census + read fails because the PostgreSQL target is unhealthy or unreachable, instead + of rejecting the whole activation. Unknown errors and cancellations still + reject. +- b5a04e5: Let a migration activation or cutover-set retry finish when a crash left the + backend publication journal at `releasing` or `abort-releasing` after the + remote fence was released and another home's publication acquired the released + lease row. The PostgreSQL remote guard now offers a release-reconciliation + read, and the coordinator treats a row of another identity with a strictly + greater fencing token as proof that its own fence was released, without + touching the successor's row. Without that proof, or for a corrupt row, the + retry still fails closed. +- 16fd9b2: Classify a pending migration effect that appears after `lcm migration abort`'s + first route, so the refusal names `resume` only when `resume` may run it, and + otherwise reports the router's refusal (such as operator required, exit 7) or + `abort-journal-moved` when abort is still admitted. +- ccfa83f: Correct three `lcm migration` outcome-accuracy defects. `apply --dry-run` no + longer reports `applied: true` when an unexpected failure interrupts it before + any write. A failed fresh hold entry now reports `applied: true` when it left a + `maintenance-entering` hold (or the journal cannot be read back), so the + operator inspects it with `lcm migration report` before recovering. A + `maintenance-aborted` journal that belongs to another generation is no longer + routed as that generation's abort cell: it lands on the route-contradiction + cell, and the unreachable `abort-other-generation` refusal is removed. +- 15aa1da: Name the member generation in cutover-set abort readback refusal evidence. +- f5511f6: Seal the manifest abort report of a retried migration abort to the evidence + the aborted journal persisted, so an abort interrupted after the journal was + terminalized settles byte-identically to an uninterrupted one. +- 8ac9b96: Rollback no longer refuses local outbox events whose stored timestamp differs from the archive only in format. +- 8356f73: Make `lcm migration report --set` and the write detection of `rollback --set` + distinguish a rollback checkpoint whose member records were written but never + committed from an empty store: `report --set` now prints + `rollbackRecords: incomplete`, and a rollback that stopped at the checkpoint + step after writing member records is reported as having applied a write. A + rollback whose stored checkpoint records differ from the ones it would write is + now refused before any member record is written when the stored records can be + read. +- 1b9eeb4: PostgreSQL readiness now refuses an extra ACL grantee whose role name equals + `runtime`, `owner`, or `public` instead of treating it as a sanctioned grant. +- 8ec42d4: Cutover-set activation now allocates census scratch only for a member census, + reports a storage failure of a destination identity query or census read as a + target refusal naming the member, and reports an interrupted run as applied + only when the live configuration and project map agree with the publication + journal or the set's pre-publication source. +- d703756: Run every `lcm migration` subcommand while a maintenance hold exists. The root + legacy-home bootstrap ran before each of them and its publication admission + refused during the hold, so `report`, `verify`, `resume`, `abort`, + `activate` and `rollback` exited 1 without printing an envelope. The bootstrap + still runs first when a legacy home is waiting to be moved. +- 8ca5c61: Route a completed rollback to its settled cell. The router only recognised the + activation publication as the generation's own, so after a successful rollback + `report`, the settled `rollback` re-entry and `activate` were refused with + `route-foreign-publication` (exit 5). The generation's derived rollback + publication is now recognised as its own too. +- cc187d8: Let a migration verification of a project with no messages become activation + eligible. The search probe previously reported not-run whenever the source had + no message to search for, so an empty enrolled project could never pass. The + probe now runs the production search once on a fixed query and, when it returns + no rows while the source and the fenced destination census both report zero + messages, records the public-search receipt. Projects with messages keep the + correlated self-match proof unchanged. +- e4b83e5: `lcm migration apply` now carries a project's project-map aliases to + PostgreSQL with the project, so a project with extra alias paths no longer + fails the copy after the hold. It refuses with `alias-conflict` before the + hold when the aliases cannot be minted exactly. A generation that an earlier + version already held and failed stays on `resume`: abort it, then run a fresh + `plan` and `apply`. +- 6963d7e: Route the two interrupted `lcm migration` activation windows (after + `prepare-activation` completes and after the publication drive completes) to + `activate` so it resumes them, instead of refusing every command with + route-contradiction (exit 5). +- e8ede04: Fix cutover-set rollback sometimes failing to complete a member with "migration report timestamp is outside the effect boundary" when the clock advanced between the report timestamp and the completion timestamp. +- 5954c23: Accept a passive event the daemon already drained while PostgreSQL's inbox + still lists it as pending when rolling back to SQLite, and refuse a genuine + divergence before the rollback publishes anything. +- 8975d21: Make `lcm events promote` (and `--all`) answer a retryable busy status instead of a server error when publication work holds the backend lock, such as the daemon's background sweep. The command now prints "backend publication work is in progress; retry the promotion" and exits non-zero. The daemon also waits briefly for another process holding the lock before answering. +- 8d2619f: Refuse `lcm migration apply` for a project that is already linked to a + PostgreSQL project before it creates any local or destination project + identity, so the refusal reports `applied: false` and leaves PostgreSQL + untouched. +- 7d90e52: Report a migration `apply` that cannot reconcile the destination project's + aliases because another session holds an uncommitted alias write as a + `migration-target-identity-unresolvable` refusal with evidence + `alias-lock-timeout`, after a 5 second wait, instead of a generic storage + error once the statement timeout cancels the lock request. +- af1bf45: Deliver pending hook events that crossed a PostgreSQL cutover on the first + replication pass, and let `lcm events validate` accept their migrated copies. + A copy already in the project now matches the local event when they differ only + in the textual form of the creation time or in a `previousEventId` that only + the local side carries (values that both sides carry must still be equal). A + copy that is still pending is applied once, and one that was already applied is + acknowledged without a second apply, instead of failing the whole batch. +- a025f3f: Fix portable export and rollback of a PostgreSQL project whose passive-event + inbox still holds rows that the replication pass uploaded. Those rows carry the + local `previousEventId` pointer, which the export refused with + `record-unrepresentable`, so the whole project failed to export. The export now + accepts the pointer (absent, null, or a positive integer) and leaves it out of + the portable record, as the SQLite source already does. +- 531d7a5: Passive-event replication no longer holds back the healthy rows of an upload + batch because one row's copy in the bound project differs from it. That row is + now retried on its own, and quarantined locally once it has been attempted the + configured number of times, whichever row of the batch the failed upload named; + the other rows upload in the same pass. +- f3de3ee: Let the authenticated `GET /health/observe` endpoint answer for a daemon that + started on SQLite when the on-disk selection is PostgreSQL and the daemon's own + environment lacks `LCM_POSTGRES_URL`, `LCM_POSTGRES_CA_FILE`, or the migration + role. `lcm migration report` and an `activate` retry now report exit 8 + restart-required instead of exit 5 for that stale daemon; present values are + still validated, and a daemon binary from before this fix still gives exit 5. +- b39f7f1: Rollback from PostgreSQL to SQLite now accepts local passive events that the replication worker delivered and whose PostgreSQL inbox rows it then pruned, instead of refusing them as events PostgreSQL does not hold. +- 2c8f51c: Stop `lcm doctor` from reporting every Codex hook as `hooks-file-unreadable` + when `hooks.json` gives a `prompt` or `agent` handler a `timeout` or + `statusMessage` that is not valid. Codex ignores both members on those handler + types and loads the file, so doctor no longer checks them there. Command and + `mcp_tool` handlers keep the existing checks. +- 0e5912c: Report the local pending age as out of range when a sidecar holds an invalid + capture time on a pending or retry event, even if the same sidecar also holds + a valid one. +- 942d535: Report `applied: true` when `rollback --set` is refused at the checkpoint step + after it durably published the reverse activation artifact. +- c849d32: Passive learning no longer promotes a one-off file-access or tool-usage event just because lexical search found a related memory. It now only re-confirms an existing entry with identical text; three occurrences across two sessions still bootstrap a new memory. +- d60d6f2: Deprecate the ignored `compaction.promotionThresholds.dedupBm25Threshold` + setting: existing configs keep loading, `lcm config get/set` reject the path, + and `lcm doctor` warns when it holds a non-default value. +- bfaf582: Redact home, root, and separator-run successors after a nested file URL in the first sanitization pass. +- cb9050a: Passive-event replication now drains a saturated backlog in short follow-up passes about one second apart instead of moving one bounded batch every five minutes. Follow-ups yield to local promotion and continue only while a pass is still saturated and made terminal progress. +- fff5748: Redact rooted query values in bracketed URLs that follow a rooted file tail or + an inherited-quote successor on the first sanitization pass. +- 02e8aee: Keep local hook appends and SQLite physical close operations ordered with + immutable migration capture, and refuse capture when an enrolled canonical + outbox is missing. Retry the one authenticated lock-owner disappearance race + that can occur while a valid owner releases its lock. Keep SessionStart outbox + pruning inside one composed consumer and append admission. Reuse the live + request token for project close, and publish a registered migration identity + only after its exact receipt epoch is durable. +- a8b17f9: Accept an optional lockToken on BackendPublicationCoordinator's + prepareMaintenanceSelection, completeMaintenanceSelection, + abortMaintenance, prepare, resume, abort and recoverPending, mirroring + the existing enterMaintenance parameter. A caller already holding the + publication lock can now invoke these methods without contending with + itself. The parameter is optional, the untokened #locked branch is + unedited, and the seven methods have zero production callers today, so + omitting the token preserves today's behaviour exactly. +- 6065f98: Publish a least-privilege PostgreSQL incident runbook with bounded evidence, + private restore and rotation procedures, and executable privacy canaries. +- 46f7cae: Clarify that MCP `lcm_grep` queries are interpreted according to the selected + full-text or regular-expression mode. +- ea52ee3: Reject untrusted project-directory topology during admission and metadata + publication, with descriptor-bound mode tightening for directories LCM creates. +- d7cc6a0: Bind coordinator recovery-material authentication to the locked publication-directory witness and fail closed on directory identity drift. +- 8553302: Correct the `lcm_grep` documentation to describe its response envelope, hit + fields, timestamp serialization, and empty-response compatibility behavior. +- 4039d9b: Redact literal nested `file://` paths in URL query, fragment, and assignment + values while preserving the surrounding URL text. +- 4114886: Validate `lcm expand` depth inputs as positive integers before project + admission and document the matching CLI and MCP contract. +- d9f86cf: Converge a managed daemon's final backend-publication admission after startup + when its initial passive sweep briefly holds the publication lock. The bounded + retry is restricted to the exact authenticated child and fails closed on + identity, credential, birth, health, timeout, or cancellation changes. +- b5503de: Keep nested `lcm connectors install` on ordinary root migration and + connector-owned verification instead of applying the top-level installer's + publication-convergence retry. +- 9600f82: Present lock-free installer configuration drift as a stable diagnostic while + preserving the installer's fail-closed admission behavior. +- 50fbedd: Preserve explicit empty `grep --since` values so the daemon can reject them + instead of treating them as an omitted filter. +- a14b202: Apply promoted search tag filters before the result limit so tagged searches + return the requested number of eligible records. +- 37c3433: Redact literal `file://` paths after query and fragment value prefixes so error + messages do not expose local paths embedded in wrapped URL values. +- 270ec0a: Preserve the original publication-lock contention when authenticated process + birth or health probes settle after the shared convergence deadline, while + continuing to fail closed without retrying unverifiable evidence. +- e1fca51: Document the current-versus-first publication contention reported by CLI + inspection and installer retries after recognized deadline expiry. +- dd2ca47: Repair `memory.recent` to send an absolute project directory as `cwd`, making + the existing `/recent` retrieval path reachable. Calls that supplied a project + hash as `projectId` must migrate to the corresponding directory; hashes are + not interpreted as paths and no ambient working-directory fallback is added. + After project admission, existing HTTP 409 storage identity and HTTP 503 + PostgreSQL failures remain observable; invalid limits continue to return 400. +- d91c4e8: Reject non-object JSON request bodies for `lcm expand` with HTTP 400 + (`invalid request body`) before project admission. Literal `null`, arrays, and + other JSON primitives now share that stable shape error; malformed JSON syntax + keeps its existing server error behavior. +- 24836f7: Correct the expansion architecture documentation to match the daemon-backed + HTTP, MCP, and CLI behavior and distinguish the unregistered helper's cap. +- ee53aff: Reject Codex configuration resolution with `AbortError` when the caller + cancels during owned app-server teardown, after termination settles, instead + of returning the validated endpoint or token-class default. +- 90fcaa6: Preserve fixed owner-preserving umask retry guidance when managed daemon + lifecycle operations refuse startup after a newly created temporary directory + loses required owner permissions. +- 4ab3793: Bound optional process-birth sampling during daemon startup admission so + authenticated diagnostics retain part of the shared lifecycle deadline. + Unavailable birth evidence still admits an otherwise authenticated daemon but + does not authorize publication-convergence recovery. +- b23a590: Reject non-object JSON request bodies across daemon memory, lifecycle, stale + review, and passive-event routes with HTTP 400 (`invalid request body`) before + route effects. The `/recent` endpoint now rejects primitives that it previously + treated as an empty request; empty bodies and malformed JSON syntax keep their + existing route-specific behavior. +- 98c16a0: Add an optional absolute `cwd` to `memory.search` so callers can reach the + existing project-scoped `/search` storage path. The daemon remains responsible + for validation; omitted `cwd` keeps the existing empty-result behavior, and + `projectId` is not treated as a project selector. +- a17e8a0: Retain authenticated reconciliation target directories through database, + pattern, metadata, archival, and project-map publication boundaries. Block on + directory identity or private-mode drift, and refuse unsafe snapshot cleanup. +- 5a15563: Expose the promoted-memory `tags` filter in the typed `memory.search` API. +- 7bab21c: Keep worktree-reconciliation lock retries bounded by monotonic elapsed time so + wall-clock corrections cannot extend, shorten, or otherwise distort contention + waits. +- 4b8544c: Cancel pending project opens when requests disconnect or the daemon shuts + down, preventing cancelled reads and restores from returning false success. + Cancelled project opens now use intentional cancellation errors, while + `/promote` retains its existing cancelled-response (499) behavior for + existing-mode cancellation. +- 1c2c9d0: Accept Codex process summaries when the authenticated Responses stream reaches + its successful terminal event, even if Codex closes before HTTP transport EOF. + Malformed, failed, incomplete, terminal-chunk suffix, and truncated streams + continue to fail closed without requiring an exact Codex CLI version. Unread + upstream bytes after the terminal frame are canceled rather than relayed. +- 26d2238: `lcm install` and `lcm doctor` repair can migrate the exact historical + trailing-blank-line skill while unknown or modified collisions remain + preserved and refused. +- f71889e: Retain backend publication admission through prompt-search surfacing metadata + writes, and return a sanitized HTTP 503 when publication admission is blocked. +- d946542: Make worktree reconciliation, project identity mutations, staged PostgreSQL admission, and cross-project import/export fail closed around one verified project snapshot. +- 9b04984: Retain and revalidate the private events-directory identity throughout sidecar + health scans and orphan pruning so a replaced parent cannot redirect cleanup. +- 11107b5: Authenticate indirect pg_trgm operator provenance during PostgreSQL readiness. +- a3075ab: Reject project root or `projects` ancestor symlinks during promote metadata + updates, and retain the authenticated ancestor chain through publication. +- 8d002d7: Authenticate the immediate project metadata parent before promotion reads + `meta.json`, and retain that identity through bounded reading and atomic + publication so directory replacement fails closed. +- a9cdaee: Allow secure LCM home admission from Linux user namespaces when a normal host + context has recorded a matching direct-root parent witness, and bootstrap + that witness from a constrained namespace through a bounded user-manager + host-view helper when no witness exists yet. +- bb46089: Reject backend-publication checkpoint writes when the publication directory + no longer matches the coordinator's retained operation witness. +- 594c48d: Provide a trusted Bug-campaign GitHub intake that emits complete-wrapper-bounded, + union-redacted untrusted data across triage, persistence, worker handoffs, and + remediation without silently pre-truncating safe input. Mark comments, + reproduction, and evidence as uncollected so empty arrays cannot be mistaken for + absent issue data. +- 72547c4: Bound fixed SQLite transfer-ledger controls before driver materialization so a + malformed resume database cannot return an oversized scalar before refusal. +- 130bb7e: Bound explicit native-transcript backfill and embedded API records after + scrubbing as well as before it. Records whose sanitized canonical UTF-8 form + exceeds 10 MiB are now quarantined locally as `record-too-large` rather than + imported; expansive custom patterns may therefore produce new bounded + quarantine metadata. +- b497571: Reject preliminary project metadata that would exceed 1 MiB after UTF-8 + serialization, preserving any existing metadata instead of publishing a file + that the next initialization cannot read. +- b1f3d0b: Reject unsafe or oversized project metadata before all-project import, batch + compaction, and periodic daemon transcript discovery consume its working + directory. +- 6de16f4: Read `lcm status` project timestamps through bounded, single-link regular-file + metadata admission, with current-UID ownership checks where numeric UIDs are + available, while preserving null timestamp fallbacks for unavailable metadata. +- 4d85680: A removed or unresolvable bound transcript locator is rejected even when the + filesystem change cookie did not move, for example on ZFS. +- ecbffd3: Bound legacy daemon migration PID and token evidence reads, and refuse FIFOs, + oversized files, path replacements, and other unsafe leaves without blocking + restart recovery. +- 186a83d: Redact and bound regex snippets returned by the default SQLite search backend. +- c6bff28: Route Codex process compaction through a single-use loopback Responses gateway + that replaces inherited prompt and tool state with the LCM summarizer prompt and + an explicit zero-tools request. +- e4bfa34: Validate `lcm_search` limits at the daemon boundary as positive integers from + 1 through 1000, with a default of 5 and a stable HTTP 400 error for invalid + values. +- 051c097: Add the staged PostgreSQL conversation, message, and ordered message-part repository with collision-safe session segments, canonical project-scoped advisory locking, atomic contiguous append allocation, nonnegative safe-integer and U+0000-free text inputs, bigint-safe part ordinals, isolation-fenced scoped transactions, serialized scoped operations, and reviewed least-privilege runtime grants. +- 5d1b171: Bound `lcm install` and `lcm doctor` publication-lock admission retries to a + single authenticated managed daemon and shared timeout, preserving fail-closed + behavior for foreign or unverifiable owners. +- a47ac73: Release temporary consumer directory descriptors when backend publication + admission is refused. +- f862b4d: Fail closed when a canonical LCM root is interrupted during authentication + after its descriptor is opened, while preserving compatibility for roots that + are absent at the initial read-only probe. +- 3d173aa: Retry authenticated publication contention for local CLI inspection and + export preparation, while emitting each read result or export exactly once. + Exhausted or rejected export admission now fails the command, including when + an all-project export has already written earlier projects. +- a1507a0: Restore actionable guidance when Codex compaction cannot find the Codex CLI, + while keeping other endpoint-discovery failures generic and secret-free. +- 5ee3383: Keep shared CLI and installer publication-lock retries bounded by monotonic + elapsed time across wall-clock corrections. +- ee87087: Preserve an owned daemon that may be busy when bounded health checks remain unavailable instead of signaling it and starting a replacement. +- 0cc250b: Make generated Markdown connector installs byte-idempotent, preserving the + established LF or CRLF style in normal rules append-mode installs and avoiding + extra blank lines in generated `SKILL.md` files. Rules installs heal recognized + duplicate current or legacy managed blocks, including the maximal union of + overlapping or touching recognized ranges, and recover the narrowly recognized + header-only partial region consisting of a current marker followed only by + exact `# Workflow Instruction` lines. Arbitrary ambiguous or malformed + unmatched marker/header combinations remain preserved conservatively and may + require a second reinstall to become byte-stable; user-authored Markdown, + including heading lines, outside recognized regions is not removed. Removing a + rules connector preserves spaces, tabs, form-feed, and other non-CR/LF user + Markdown bytes with exactly one established terminal EOL, while blank-line-only + content is deleted. +- cb843bf: Reject non-regular legacy source pattern paths during future worktree + reconciliations instead of treating them as absent before snapshot, merge, or + archive verification. +- 192d480: Preserve private-directory authentication failures when descriptor cleanup + also fails, reporting both errors while keeping the authentication failure as + the cause. +- 67b8f8d: Preserve structured backend-publication errors when a terminal journal changes + between initial admission and its archive reread. +- 3bcc75c: Stabilize macOS launchd startup when the GUI domain temporarily retains an absent service label or exposes a transient malformed registration projection after bootstrap. For an exact bootstrap returning numeric code 5 (input/output error), LCM confirms absence before and after each bounded settle and continues only within the same lifecycle deadline, including terminal-job stop/start recovery. Transient malformed metadata is re-observed without mutation during both bounded launchd recovery windows, while persistent malformed state, permission, transport, timeout, ambiguous, registered, other, and deadline-exhausted states remain classified errors. +- ef99469: Keep Codex PostToolUse capture out of legacy-root bootstrap migration so + concurrent LCM activity cannot fail the observer hook before payload dispatch. +- f0e0c66: Add the staged PostgreSQL lexical-search repository with full-text ranking, database-normalized bounded trigram eligibility, strict runtime limit validation, regex paths, exact project and filter scoping, timeout-safe transaction handling, least-privilege grants, and PostgreSQL 18 conformance evidence. +- fa0bd2a: Document safe initial and incremental native Question issue-type rollouts. +- 86a06c3: Restore deep episodic search recall by giving messages and summaries at least + 50 candidates (and up to the requested maximum) before the final result slice. + Tag filters now apply only to promoted memories, so tagged searches continue + to return untagged episodic history. The combined episodic response still fills + messages first and may reach its maximum before summaries appear. +- 603c95b: Keep worktree reconciliation available when an unrelated stale project-map path crosses a regular file, while preserving strict filesystem validation for the requested project. +- b60b8fd: Recognize Git-compatible inline comments on `extensions.worktreeConfig` when resolving submodule project identity. +- c9991c4: Align the source-clone installer with the packaged `dist/lcm.mjs` CLI + entrypoint. Existing authenticated daemons started from an older source or + intermediate entrypoint may require one restart to adopt the canonical runtime + identity on the next install or use. +- 2bd1328: Capture bounded semantic context from Codex `functions.exec` and + `functions.exec_command` PostToolUse events, and validate the installed Codex + hook with structural and no-write functional connector checks. +- eada7df: Reject the misleading `expectedContentSha256` option in the generic durable + private-file writer and document the portable same-UID replacement boundary. + Callers that require conditional replacement must use a protocol-specific + operation with its own recovery grammar. +- c916af6: Classify negative-zero portable manifest record counts as `malformed-manifest` + before checksum canonicalization while preserving checkpoint and record error + taxonomy compatibility. +- f571855: Preserve backend publication consumer failures while closing every retained + directory descriptor and reporting any independent cleanup failures. +- 49957e1: Correct the `lcm-context` skill examples to use the supported repeatable `--tag` option. +- 3c18ddf: Preserve home, migration-entry, and private-file publication failures when + descriptor or temporary-file cleanup also fails, retaining cleanup errors as + ordered secondary evidence. +- 15a0d97: Clarify operator recovery guidance for a present backend-publication directory + without a journal, including the maintainer-assisted support path. +- 38e4106: Add an audience-based documentation index and move the packaged PostgreSQL implementation guides and runtime grant scripts into the storage reference tree. +- 4a54d59: Honor help before required CLI arguments and accept both repeatable store tag spellings. +- b6b1d45: Close atomic exclusive-write temporary descriptors when file or parent identity + capture fails while preserving ordered cleanup evidence and authenticated-only + temporary-file removal. +- b5b0a71: Return a closed health status when PostgreSQL factory shutdown races with an + in-flight runtime health probe. +- cdf9a85: Ensure PostgreSQL project health reports the closed state when project shutdown + begins, without exposing query details from an in-flight probe. +- a3af066: Classify bounded Codex process failures into safe usage, authentication, + unavailable-model, and invalid-request guidance while preserving the existing + compatibility fallback for unknown diagnostics. Usage and authentication + categories also recognize the loopback Responses gateway's upstream 429 and + 401 statuses without exposing provider response details. +- aca3127: Replace alias-oriented generated agent instructions with seven compact canonical tag conventions and one concrete store example, and clarify that `signal:memory_used` requires a paired `memory_id:` tag for recall usage counting. +- c40d702: Repair `memory.compact` so it sends the project `cwd` required by the daemon, + while preserving two-argument callers through an invocation-time working + directory default and supporting explicit project directories. +- 83b835a: `lcm compact` discovery now yields to the event loop between projects, + conversations, message pages, and source-locator lookups, so the invocation + lease heartbeat keeps running during a long scan and Ctrl+C or `SIGTERM` stops + discovery before the next project or conversation instead of after the whole + scan. An interrupted scan closes the storage it opened, records no failure for + the interrupted project, and sends no compact request. Requests to the local + daemon also use a fresh loopback connection each time, so a connection the + daemon closed at its keep-alive timeout can no longer fail with `write EPIPE`. +- 78ee134: Publish the documented public guides from an explicit package file list. +- 4d5fedf: Serialize publication admission between operations in the same daemon so + session completion and promotion can wait for in-flight storage work instead + of failing with publication contention. Keep project identity checks fenced, + prevent canceled queued work from opening storage, and retain the native + hook's existing bounded best-effort completion policy. +- 9ea6006: Use authenticated daemon health when doctor reports storage readiness and distinguish unavailable storage from readiness that could not be verified. +- 75d7af4: Keep doctor publication-convergence retries bounded by monotonic elapsed time + when the system wall clock jumps forward or backward. +- c483823: Enumerate an unbound PostgreSQL project instead of aborting `--all` discovery. + + `lcm compact --all`, `lcm import --all`, `lcm export --all`, and + `lcm promote --all` call `listCliProjects()` to select every authenticated + local project. With `storage.backend` set to `postgresql`, a single local + project that had never been linked with `lcm project create` or + `lcm project link ` made `listCliProjects()` reject outright, + so none of these commands processed any other project either. The unbound + entry now enumerates under its own local identity, the same way an already + supported retired-identity fence does, so every other selected project + still runs. `lcm compact --all` and `lcm export --all` report it as that + project's own failure and name the `lcm project create` / `lcm project link` + remedy; `lcm compact --all` previously aborted the whole run with + `project discovery failed` and compacted nothing. `lcm promote --all` + reports a generic per-project failure naming the project path, without + the remedy. `lcm import --all` is session-driven, not project-driven: it + fails that project's sessions rather than naming the project, and a + project with no sessions to import produces no failure at all. + `lcm import --all --dry-run` contacts no project storage, so it does not + surface this condition at all. +- f5e2b64: Use fixed text errors for passive-event operator failures, including a retry + hint for busy promotion, while preserving the original structured JSON error. +- a2ab334: Expose `lcm_grep` search modes through MCP. Callers can choose `full_text` or + `regex`; omitting `mode` remains `full_text`, while malformed explicit modes + (including `null`) are rejected instead of silently defaulting to `full_text`. +- f6927a0: Tighten promotion of passive-learning events when a project working directory + has disappeared so the flow no longer creates spurious project-map entries for + never-seen paths, repairs private-directory permissions on existing sidecars, + and fails closed on malformed or inconsistent persisted parking state during + both runtime observation and worktree reconciliation. +- eb27833: Restart same-version stale daemons, safely recover the exact empty legacy SQLite instruction cache, and surface per-project compaction scan failures. +- 8c85f1a: Reject unsafe project sensitive-pattern leaves before listing, testing, adding, + or removing patterns. Project pattern files must now be regular, owned by the + current user when the platform exposes an effective user ID, and single-link. +- 8b34a28: Reuse validated canonical record bytes to keep maximum-size portable batches + within the coverage gate while preserving existing portable limits and wire + semantics. +- a263775: Discard an installer publication-retry identity when the daemon configuration, + publication journal, or authenticated private LCM root changes during the + health exchange. +- d21ec1c: Prevent store, ingest, and promote from using project-sensitive scrubber + patterns when the authenticated project identity changes before storage opens. + Identity drift now returns the bounded backend-publication blocked response. +- 3cfdfc3: Fence SQLite factory health during shutdown races so in-flight active and idle + project probes return closed without exposing probe details. +- befd5e4: Fence SQLite project health during shutdown races so in-flight probes return + closed without exposing probe details. +- 77d637f: Redact hosted `file://` paths when authorities contain supported punctuation + before the first path separator. +- c14d1fb: Fix two exit classes in the migration cutover. `lcm migration activate` now refuses a fenced-lease row it cannot decode with exit 5 `activation-refused-evidence` (`lease-unresolvable`) instead of an unexpected failure that claims `applied`; a decodable lease held by another publication keeps exit 4. A daemon left running on the previous backend now answers `GET /health/observe` with its identity, so the restart check reports exit 8 (restart required) instead of exit 5 `cutover-restart-contradiction`. A daemon binary from before this change still gives exit 5; run `lcm daemon status`, resolve it, then run `report`. +- fac33df: Allow native Codex MCP connector commands to reach the authenticated current + user's Linux session bus through an exact, filesystem-validated environment + pair while continuing to reject unrelated or untrusted inherited values. +- b33c87d: Make `lcm doctor` fail closed on publication contention when the installed + package version is unavailable or blank. +- 265d59e: Redact paths in malformed bracketed file URLs while preserving valid bracketed + IPv6 authorities. +- e779694: Scrub complete selected hook events before applying the durable capture limit, and omit oversized events instead of retaining partial secrets. +- bdb9c2e: Include normal PostgreSQL promotions in knowledge exports and import deduplication, retaining metadata and retry identities across provenance forms. Normalize authenticated local and remote self-provenance during canonical PostgreSQL and SQLite transfers while preserving external origins and SQLite knowledge-export filtering. + + Merge exact promoted-memory content independently of the backend search rank, including negative PostgreSQL and SQLite ranks below the fuzzy-match threshold. Nonidentical matches keep the existing threshold (#1153). +- e6167e8: Isolate restored instruction caches by project, machine, client, session, verified worktree, and exact working directory; authenticate linked-worktree metadata bidirectionally and discard unscoped legacy instruction rows during a transactional upgrade. +- 3de5ff7: Reject embedded NUL characters in new SQLite promoted-memory content before + writing, and fail closed on selected legacy rows instead of returning the + truncated scalar value. Preserve explicit clean replacements and NUL-bearing + JSON tags. +- bc501a8: Fail closed when a newly bootstrapped LCM root disappears, is rebound, or + changes contents during backend publication handoff. The bootstrap retains + the root descriptor and compares its authenticated pre-handoff tree before + refreshing the home-parent witness. +- 62dc49a: Keep PreCompact hooks best-effort when PostgreSQL credentials are unavailable, require SQLite health checks to prove rollback-safe writes, and retire pooled handles whose rollback fails. +- ea37ee9: Restrict package-manager bins derived for managed daemon PATHs to recognized + per-user layouts rooted at an authenticated owner home, while preserving + legitimate `~/.local` installs and directly observed executable paths. +- dae1629: Update generated gitleaks redaction patterns to 220 rules. + Correct Slack webhook and Sidekiq URL rules to require literal service + hostnames instead of treating hostname dots as regular-expression wildcards. +- f699d64: Reject unsupported `lcm export --format` values instead of silently exporting JSON. +- a68dcb2: Honor the `lcm_grep` sessionId filter by selecting the canonical newest + conversation, rejecting malformed identifiers, and returning an empty result + for unknown sessions. +- 5c183e9: Validate `lcm_grep` `since` values at the daemon boundary. The inclusive + lower bound now accepts only full timezone-qualified ISO datetimes with an + optional 1-3 digit fractional second and returns a stable `invalid since` + error before project or storage access for malformed values. +- a88419f: Reject grep `since` values whose normalized UTC year falls outside 0001-9999 + before accessing project storage. +- 9648a0f: Reject backend-publication journal changes while the installer verifies that + its configuration is absent. +- 5922866: Reject changed SQLite database paths before changing their permissions or + running initialization PRAGMAs, including newly created database files. +- 6bfc7ab: Make the staged PostgreSQL conformance harness validate its complete run identity before database mutation, require every exposed project repository adapter to register a backend-neutral contract suite, raise nested signal-probe readiness from 30 to 90 seconds with the bounded `LCM_TEST_POSTGRES_SIGNAL_READY_TIMEOUT_MS` override, register signal runs before readiness, exhaustively audit every registered run and Docker resource class, converge transient whole-run cleanup failures before signal exit, retain bounded sanitized cleanup diagnostics, remove verified private directories after orphan reclamation, fail signal tests when Docker cleanup does not complete, and tolerate an exactly owned Docker resource disappearing during concurrent orphan recovery. +- 5c7da67: Reject unsafe promote sidecar-root topology instead of creating project + directories through raw recursive `mkdir`. Dry runs remain free of metadata + and project-storage writes. +- 8f957c4: Stop treating a daemon whose `/health` omits its storage backend as SQLite unless it is a published release through 1.4.3. A newer daemon that omits the backend is now unknown and is refused for reuse, unauthenticated replacement, and restart. +- 0768343: Keep passive-event halt diagnostics on bearer-gated daemon observation instead + of anonymous health. +- dcff16b: Apply authenticated legacy project patterns to passive hook events before local storage. +- 3532a0e: Prevent transient passive reinforcement lookup failures from propagating to + sibling events while continuing to cache successful values within the batch. +- 9c24fae: Accept Git config files up to 4 MiB during project identity resolution while retaining the stricter 64 KiB limit for Git topology pointers. +- 9174f38: Start passive-event replication automatically on PostgreSQL-backed daemons. A + PostgreSQL daemon now uploads local hook events to the remote inbox on its own + passive-event sweep, once at startup and then every five minutes, where before + that only happened when a worker was run explicitly. Because nothing ran it, + local events could never reach the acknowledged and remote-pruned state that + local retention depends on, so a project's event table only grew. + + A pass runs for a project only when the backend is PostgreSQL, a machine + identity is registered, the project is linked to a remote project id, and + PostgreSQL reports healthy. The first three are quiet skips; an unhealthy + backend and a machine identity that exists but cannot be read are reported + instead. A SQLite-backed daemon never opens a PostgreSQL connection, so + its behaviour is unchanged. + + Each sweep phase runs under its own short publication admission, so hook + appends proceed between phases instead of waiting behind a whole sweep. + + `lcm status` now reports what replication has done under `passiveEvents`: + whether it is enabled, when the last pass ran, and how many events were + uploaded, applied, acknowledged, pruned, retried and quarantined. `enabled` + reports backend capability, not progress. `passes` and `lastPassAt` advance on + every sweep, and `projects` counts passes that returned a result, so an enabled + daemon with passes and no projects is skipping or failing. +- 2a84926: Handle many separate managed rules blocks during connector install and removal. +- d2da03c: Keep the configured Codex compaction timeout monotonic across config discovery, + gateway startup, and execution. +- ad1602d: Keep internal proxy startup health polling on a monotonic elapsed-time + deadline so wall-clock changes cannot extend or shorten the startup budget. +- 928cd70: Keep native transcript parsing and archival on the same source snapshot, retry one concurrent source change, and drain active ingest work before closing storage on cancellation. Intentional cancellation returns HTTP 499 without recording an ingest error. + + Prevent the retry from hiding a source or quarantine cleanup failure; retain both failures and return the existing sanitized ingest failure. + + Keep transcript and scrubber preparation outside backend publication admission on every attempt. Drain and close each attempt before retrying, and revalidate publication state and project identity before further writes. +- 9c43b01: Add locally scrubbed, append-only PostgreSQL native transcript ingestion with exact message provenance, resumable checkpoints, metadata-only local quarantine, and least-privilege runtime access. +- 6c293d5: Report a stalled daemon instead of retrying it forever. When the configured + storage backend is changed while a daemon is already running, that daemon keeps + the backend it authenticated at startup, so its background passive-event work + can never be admitted again. It previously retried on its five-minute sweep + interval indefinitely and only wrote a log line, so a machine could sit with + passive-event promotion silently stopped. The daemon now stops the sweep after + the first refusal, reports it once, and exposes a `passiveEvents` object with + `halted`, `haltedReason`, and `haltedMessage` on the unauthenticated + `/health` response for as long as the halt lasts. Health is the surface that + answers here, because every other route is refused under the same mismatch. The + next hook run still replaces the daemon and clears the halt. +- 888c4e6: Keep proven-unenrolled SQLite projects available when their optional machine + identity is missing or damaged, while refusing ambiguous receipt-era state. +- 3d30cf0: Allow the exact optional migration receipt v1 epoch/event table pair in captured SQLite sources and resumed portable destinations. Legacy schemas remain supported; partial or malformed pairs still fail closed. Receipt metadata stays private to migration orchestration and is neither authenticated nor copied by canonical transfer. +- 1332a89: Allow worktree reconciliation to preserve an identical passive-event predecessor after that predecessor has been pruned from both local event databases. +- ff9a468: Prevent worktree reconciliation from changing passive-event predecessor identity after delivery may have reached PostgreSQL. +- 4c7ac9b: Pair passive-event scrubber paths with the project identity admitted by the + selected storage backend. Identity drift now blocks promotion with a sanitized + 503 response before backend open or event acknowledgement, leaving the batch + pending for a later retry. +- a133c7e: Update Ajv's bundled fast-uri dependency to a patched 3.x release. +- e8b64a0: Patch the bundled URI and query-string parsers against authority confusion, authority injection, and query parsing advisories. +- 4fca1ce: Pin PostgreSQL runtime deparser settings during readiness checks so hostile + session settings cannot change validated schema fingerprints. +- 920de9b: Pin backend-publication contention retries to the complete authenticated daemon + identity, including its entrypoint and runtime digest. +- 8016c20: Restructure the GitHub Actions CI pipeline into a plan-driven job graph: pull requests and merge-queue entries run only the test files related to the change, pushes to `main`/`release` run the complete suite sharded across runners with the merged 100% coverage gate, and the PostgreSQL conformance harness runs once on an 8 vCPU runner with CPU-derived workers. +- 7cc1539: Refuse a portable batch successor that duplicates its predecessor's + identitySha256, matching the official manifest scanner instead of + letting createPortableBatch admit a stream the scanner would reject + downstream. Four domains carry an order field outside their logical + key (passive-events' machineSequence, project-aliases' path, + summary-message-links' and summary-parent-links' ordinal), so a + successor could previously repeat a predecessor's identity while its + order still advanced, which the existing order-regression check does + not catch. Batches built from any portable record source, including + the SQLite-to-PostgreSQL migration copy path, now refuse this case + at construction with a `duplicate-identity` error instead of + accepting it. + + A successor whose order exactly ties its predecessor's (rather than + advancing past it) now also surfaces `duplicate-identity` instead of + `order-regression`. Both are non-retryable and belong to the same + transfer classification, so no caller behavior changes on this exact + tie case beyond the reported error code. +- f930c8f: Add the transactional PostgreSQL 18 schema, backend-neutral project identity, bounded exact session-ID lookup, complete applied-baseline inventory verification, identity-function drift fingerprinting, scoped privilege hardening, and namespace-aware extension readiness for upcoming PostgreSQL storage adapters. +- 025030b: Add staged PostgreSQL summary-DAG, context-item, and large-file repositories with deterministic traversal, transactional graph integrity, fenced mutation support, least-privilege grants, conformance coverage, and operator diagnostics. +- 491f307: Preserve every recognized nested `file://` scheme while redacting adjacent + private paths so repeated error sanitization remains stable. +- c0cfd69: Preserve the original directory authentication failure during LCM home + bootstrap when closing the rejected descriptor also fails. +- d16cdc8: Preserve a validated Codex endpoint when the one-shot app-server settles after + forced cleanup. +- ef6124d: Preserve a durably completed worktree reconciliation journal when retained + directory cleanup fails after final validation, while still reporting the + cleanup error and allowing later discovery of newly eligible work. +- 0435b0b: Preserve nested non-file URLs after an unquoted pathless `file://` query or + fragment boundary while continuing to redact standalone and nested filesystem + paths, including query or fragment values quoted around paths containing + spaces. +- 236a250: Preserve retryable `aborted` errors when a portable source page rejects after + its read signal is cancelled, without advancing the caller's checkpoint. +- 4af2d79: Preserve scoped machine identity in sanitized PostgreSQL cancellation errors. +- 752cb0e: Carry PostgreSQL coordination and explicitly fenced repository machine identity into sanitized cancellation diagnostics. +- f235833: Preserve project-directory admission and permission failures when closing the + acquired child handle also fails, while still reporting cleanup failures and + closing retained ancestor handles. +- beeee0c: Keep completed promotion successful when the best-effort metadata timestamp + cannot reopen its parent because file descriptors or filesystem space are + exhausted. Untrusted or invalid parent topology remains a promotion error. +- cd38a66: Authenticate SQLite parent directories before creating, repairing, or pooling + database connections, and reject unsafe or replaced parents without mutation. +- adf3164: Create missing `import-knowledge` project metadata atomically with owner-only + permissions while preserving existing metadata and legacy temporary paths. +- d581941: Harden final ingest and compact metadata timestamp updates with bounded, + single-link reads, owner validation when a process user ID is available, and + atomic private publication. +- 822e10a: Preserve write/setup failures when temporary descriptor close also fails in + atomic private-file writers. Retain temporary cleanup errors in ordinary + replacement and non-durable exclusive creation, and ordered descriptor, + temporary-file, and parent cleanup errors in durable writes. Existing + best-effort temporary cleanup in retained-parent exclusive publication and + `writePrivateFileExclusive` remains unchanged. +- 07115d6: Document the extracted procedural-development and implement-epic skills and the + revised native Bug triage workflow. +- 3e6a991: Harden automatic promotion metadata updates with bounded reads and atomic + owner-private publication, including permission tightening for legacy files. +- adb102f: Prevent passive PostgreSQL promotion and portable knowledge import from creating + duplicate memories when an exact live owner row falls outside the bounded fuzzy + search page. +- 3eb8f91: Retain backend publication admission through passive sidecar diagnostics, + resource close, and orphan pruning so concurrent hook appends cannot be deleted + from a stale snapshot. +- fd05068: Publish the documented canonical transfer API at `@donadiosolutions/lcm/storage/portable`, including TypeScript declarations, record and checkpoint codecs, and SQLite/PostgreSQL adapters. Keep backend publication and coordination internals outside this curated package surface. +- 5ab4b25: Prevent Codex-backed compaction from rejecting otherwise valid user configuration when LCM applies reasoning-effort or fast-mode overrides. +- 544d4f2: Honor Codex's effective OpenAI-compatible endpoint during process compaction + while preserving managed credential routing and fail-closed lifecycle behavior. +- d0111b2: Limit the managed Codex memory-retrieval rule to substantive work and requests + for further project understanding so passive hook injection does not trigger a + redundant explicit memory search. +- 9e7f8b7: Reject unsupported `lcm connectors list --format` values before connector inventory work. +- 388490f: Bound doctor health checks and recover the managed daemon once when automatic post-compaction promotion loses its transport. +- b5c74b9: Preserve existing SQLite sidecars when status, pool statistics, and doctor authenticate an already-running daemon. These diagnostics now observe process identity without invoking active storage readiness. Doctor reports that readiness and passive queue draining remain unverified, separately from its backend read diagnostics. +- 7ef5802: Keep healthy-daemon memory and status reads available while publication holds + the exclusive lock, buffer and revalidate each result across publication + changes, and recognize the Codex 0.147.0 prefixed MCP absence diagnostic + without weakening fail-closed connector verification. +- 1148805: Allow aggregate SQLite diagnostics to omit admitted project directories whose + databases have not been initialized while preserving fail-closed selected and + topology-changing observations. +- f6927a0: Persist missing-working-directory confirmation and reversible local-promotion parking in each existing passive-learning sidecar. Three observations at least five minutes apart now survive daemon restarts and sparse sweep rotations without a fixed expiry. Parking no longer advances event `processed_at`: unprocessed events, history, and delivery state remain intact, repeated absent sweeps return a quiet terminal state, and a later cwd recovery clears the state and promotes the preserved backlog normally. +- edb38bd: Redact doubled-colon drive segments inside recognized local paths so malformed + Windows path tails cannot remain visible in sanitized errors. +- 73bbd65: Prevent bounded reads from blocking on special files such as FIFOs. +- 3fd4957: Stop counting successful Codex PostToolUse capture as a hook error when backend + publication metadata reconciliation contends after the event is durably queued. +- 8114f15: Add the internal verified-TLS PostgreSQL 18 pool and migration foundation plus a digest-pinned, run-isolated conformance harness for upcoming PostgreSQL storage adapters. +- 82f0409: Let `lcm doctor` and connector transport resolution converge through a managed + daemon's short backend-publication reconciliation immediately after + `lcm install`. Configuration reads use authenticated, descriptor-bound + lock-free snapshots while retaining and revalidating the canonical private LCM + root when one is present. Legacy SQLite reads without an admissible root remain + compatible only while publication evidence is absent. The lock-taking doctor + stages (project map, worktree reconciliation, daemon lifecycle) retry within + one shared two-second budget only while the lock owner is the exact + token-authenticated managed daemon. Platform process-birth helpers and health + probes are bounded by that remaining shared budget. All configuration and + project-map mutations still require the exclusive publication lock, and any + other owner remains fail closed. +- c7a1e4d: Redact private path continuations around nested public URLs in one stable + sanitization pass while preserving the public URL bytes. +- e89b1e8: Authenticate private project database topology before `lcm stats` opens or + migrates existing SQLite state, and never create a missing project database. +- e962f17: Interpret timezone-less SQLite timestamps as UTC across conversation reads, + promoted-memory age calculations, and summary metadata migrations. +- b1fc61f: Wait up to one second for Claude session-completion acknowledgment before the hook exits, so a promptly responding daemon can persist the completion record. Completion remains best-effort on admission or transport failure; a timeout may occur after persistence. Codex turn behavior and background compaction/promotion remain unchanged. + + Read authenticated hook settings before ingestion to avoid dropping completion when a post-ingest configuration reload contends with daemon writes. Settings remain consistent throughout the invocation; configuration admission failures now prevent ingestion before any transcript is stored. +- 30b4121: Validate the daemon `POST /recent` limit as an integer from 1 through 1000, + defaulting omitted limits to 5 and rejecting malformed values before project + or storage admission. +- a4be2e7: Reconcile verified legacy Git worktree identity before Codex import and remote + passive-event operator admission so existing PostgreSQL bindings are retained. +- 4fcbd65: Refuse legacy conversation message content with embedded NUL bytes or a + non-TEXT SQLite type during worktree reconciliation, preserving source and + target data for repair and retry. +- c52888b: Allow an explicit daemon restart to recover an exact managed service that owns backend publication but produces no HTTP response, while preserving fail-closed config, journal, process, and manager identity checks. +- 2f1b087: Redact drive-shaped path continuations after earlier content in bracketed + file URL query and fragment values. +- cfff837: Redact local paths after embedded double quotes in exact `file://` authorities + while preserving matching outer quote boundaries. +- 976ea47: Redact root-relative Windows paths handed off from bracketed file URL query and + fragment values after punctuation, horizontal spacing, or nested URL content, + including IPv6 URLs with a following path, port, or query. +- a50fdb5: Redact paths in hosted file URLs from sanitized error messages while preserving + the URL scheme and authority. +- 88bbcbd: Prevent MCP error diagnostics from exposing suffixes of brace-delimited credentials. +- b18d02f: Redact local paths inside or after bracketed query and fragment values on + pathless file URLs. +- 02281cc: Redact an adjacent path segment after a closing malformed file URL bracket in + the same sanitizer pass. +- 3c4894e: Prevent connector removal and install rollback from deleting or overwriting a + replacement at an authenticated connector pathname. Linux connector mutations + now stage complete candidates privately, claim existing leaves by atomic rename, + and publish with no-replace hard links. Wholly managed leaves are physically + removed after validation; concurrent replacements remain intact and named + recovery artifacts are reported when compensation cannot restore the receipt. + + Bind connector publication and rollback authority to immutable pre-link + certificates (SHA-256, size, full mode, and canonical device/inode identity), + so post-link edits to either alias cannot be adopted as LCM state. Certified + restore candidates preserve logical initial bytes and mode on a new inode; + external hard links remain attached to the old inode. Evidence and named + recovery artifacts are retained when a claim, compensation, or finalization + cannot be validated. + + Sanitize connector removal and rollback diagnostics so retained descriptor + operation paths and nested low-level error causes are never exposed publicly. + Refuse connector leaves and snapshots larger than 4 MiB before read allocation + or mutation. +- 07396fd: Refuse promotion metadata publication when a restored or concurrent `meta.json` + appears after a missing-file observation, preserving the existing file instead + of replacing it. Report post-link cleanup or single-link verification failures + as critical published outcomes so an ambiguous `meta.json` cannot be hidden by + best-effort metadata handling. +- ce21f6e: Refuse SQLite migration snapshots and queue evidence when the platform cannot + authenticate UID or retained descriptor traversal. +- 2fcc0b5: Reject negative-zero portable checkpoint counts as `checkpoint-mismatch` + before checksum canonicalization across direct and canonical wire APIs. +- 083fd25: Anchor connector parent traversal through retained Linux proc descriptors so + intermediate symlinks cannot redirect project or home writes. Filesystem-backed + connector install/remove now refuse on unsupported platforms or without the + required proc/flag guarantees, and the default pathname-based native Codex MCP + add/remove path emits manual guidance instead of mutating automatically. +- 0bc28df: Make daemon startup recovery retire authenticated terminal systemd registrations, including stale failed units, before proving absence and recreating the managed service. This completes the #663/#665 daemon startup-recovery lifecycle hardening. +- 456e917: Passive-event replication no longer leaves rows stuck after a project is + relinked to another remote project: rows still awaiting the previous project + are withdrawn from it (or acknowledged, or kept quarantined, depending on + what that project did with them) and uploaded to the new one. The replication + pass also opens the scanned sidecar before resolving the project's identity, + so a missing sidecar no longer creates or publishes project-map evidence. +- b962d58: Diagnose retired local project identity fences in prompt hooks and batch + compaction, and report that diagnosis for every storage backend rather than + only SQLite. Add an idempotent identity-renewal command that resolves the Git + project anchor first, so it can be run from a nested directory or a linked + worktree as its own diagnostic advises. Renewed projects keep working after + renewal: worktree reconciliation treats an authenticated successor as the + target instead of folding it back into the retired hash, and identity evidence + authenticates a successor id against the retained predecessor fence so a + renewed project can still recover its sidecar when the map is unavailable. + Reconciliation authenticates renewed bindings reached through distinct local + aliases, preserves valid aliases on the successor, and refuses ambiguous or + foreign canonical bindings before source discovery. + After successor map publication becomes observable or its outcome is unknown, + it remains authoritative through later validation or readback failures so + concurrent hook storage cannot be stranded behind a restored retired binding. + Preserve bounded per-item identity and outcomes throughout compact progress and + summaries, keeping invocation-wide failure totals in the live header, the + failure event, and the final summary instead of repeating them on later + per-item lines. +- ddffca8: Remove newly created daemon temporary directories whose owner permissions were + clipped by the process umask, and report an actionable retry requirement while + preserving fail-closed validation for existing paths. +- fcc91bc: Repair Codex process compaction with `gpt-5.3-codex-spark` by using the + supported standard Responses shape, accepting its optional stream terminator, + and reporting upstream request failures without misleading CLI upgrade advice. +- a1c9e5e: Require an exact local runtime digest before doctor retries daemon-owned publication contention. +- ddb450f: Restore a minimal managed `~/.codex/AGENTS.md` memory-retrieval rule to the + default Codex CLI connector bundle while preserving the detailed `lcm-memory` + skill and native hooks. Existing user rules remain intact, explicit Codex MCP + bundles omit the CLI-only entry, and reinstalling remains byte-idempotent. +- a9b91f3: Retain the authenticated backend-publication history directory through terminal + archive creation, exact replay, and durability flushes so path replacement is + refused without advancing the next publication. +- 4e0ca7a: Reuse retained consumer publication admission while recording missing-working- + directory observations, closing the local outbox, and persisting error-to-fix + correlation. Parking can now reach its third durable observation and correlated + pairs complete local acknowledgement on their first promotion pass without + self-contention. +- 190e3f9: Redact private paths after ambiguous apostrophes in single-quoted `file://` + authorities, including separately quoted nested file URLs whose paths contain + spaces. Close quoted file paths inside brackets so later standalone paths are + also redacted on the first pass, including backslash paths immediately after + the closing quote in an unmatched bracket or after a root-only quoted path. + Redact backslash paths in an exact file URL's own query or fragment while that + file-URL context remains active. +- 71c32db: Retain publication admission while SessionStart prunes the local passive-event + outbox, preventing backend publication from racing destructive maintenance. +- 4e8b2fd: Retain the authenticated reconciliation journal directory throughout each + locked mutation attempt so normal and blocked-state journal writes detect a + replaced parent and fail closed. Refuse lock-contention retries when that + authenticated directory changed during the attempt. +- 265b46a: Retry daemon storage-factory cleanup once in the same terminal pass after a + rejected close while preserving concurrent close coalescing and + successful-close idempotence. +- 7eb216a: Require local evidence before a project-map key becomes a storage identity, + and stop presenting identities that storage will refuse. + + A key is now admitted only when it is the canonical path hash, a renewal + successor whose retained predecessor fence still authenticates it, or a legacy + hash corroborated by its own project metadata. A key meeting none of these is + refused instead of silently becoming the project id for a directory. + + Renewal successors are decided by their predecessor fence alone, so the + metadata a renewed project writes when storage first opens it cannot stand in + for a fence that has been lost. + + Surfaces that act on a project follow the same rules. `lcm compact --all` and + SQLite compaction preview skip an identity they cannot authenticate and + continue with the remaining projects, and adding an alias to one is refused + before the map is written. `lcm project list` and `lcm project show` mark + such an entry as unauthenticated rather than hiding it, so it stays visible + for repair. +- bc8c4ad: Redact private paths that error sanitization previously left visible after a + nested public URL. A rooted successor is now redacted when the nested URL + carries brackets, such as an IPv6 authority or a bracketed path segment, and a + Windows drive root now arms the same handoff as a slash or backslash root. + Bound terminal fields also count supplementary CJK ideographs as two columns so + live-frame output keeps its promised width. +- 3475f46: Report unbound and unopenable projects honestly across CLI enumeration surfaces. + + `lcm --help` now lists `project renew-retired-identity` in the top-level Runtime summary, matching the detailed `lcm project --help` grammar. + + `lcm promote --all` and `lcm import --all` name the static `lcm project create` / `lcm project link ` remedy for an unbound PostgreSQL project instead of a generic per-project failure; other per-project failures keep their generic text. `lcm export --all` names the affected project path on every failure line, and its final summary reports how many projects could not be exported alongside the entries exported. + + Hook-durability identities (`localProjectIdentity`) no longer satisfy call sites that require a PostgreSQL remote binding at compile time; such call sites resolve loudly through a dedicated helper instead of degrading into a permanent unbound refusal. + + When enumeration succeeds but every selected project fails to open, `lcm compact --all` reports how many selected projects failed instead of claiming project discovery failed. +- c30ae80: Distinguish backend-publication absence from unresolvable reads. The + PostgreSQL publication witness now returns a discriminated absent, mismatch, + or unresolvable outcome instead of throwing one undifferentiated failure, and + the publication guard reserves invalid-row for genuinely undecodable rows + while a decodable non-matching row reports fence-mismatch. Synchronous-origin + lock tokens are refused at asynchronous coordinator seams. +- c2a6d71: Preserve Codex PostToolUse events across typed publication-lock contention and + surface fail-closed publication admission failures through a fixed, + credential-free diagnostic and protocol-safe `systemMessage` with documented + recovery guidance. +- d68cd4a: Publish foreground and detached daemon PID files through private atomic + replacement. Existing symlink and hardlink targets remain unchanged, the + published PID file is mode `0600`, and its state directory is tightened to + mode `0700`; startup reports a failure when secure publication cannot finish. + Publication failure does not use unpublished PID state to signal a process + that may already have bound or spawned. +- fbea2ff: Migrate authenticated legacy Linux daemons only after their PID file disappears during exact stop, bind bounded systemd stop/final polling to the exact authenticated invocation ID until unit absence, and refuse every discoverable unit that is not fully authenticated running or PID evidence whose descriptor cannot be closed safely. +- 2ecc6b4: Make the PostgreSQL development harness recover proven stale Docker resources safely and clean up local test consumers reliably after process termination. +- 9ee092d: Reject accessor-backed and symbol-bearing promoted metadata arrays before reading their values. +- 6e852d9: Redact file URL authority and path tails glued to an already active unquoted + absolute path, including userinfo, ports, and bracketed hosts. This keeps + public error responses stable after one sanitization pass without changing + standalone URL classification. +- 1f11c69: Fix error-message path sanitation across quoted URL, drive, nested-bracket, + IPv6-fragment, and scheme-shaped path handoffs. Private path spans are now + removed in the first pass while separate public URLs remain unchanged. +- b37a2bd: Harden describe and expand compatibility handlers by sanitizing fallback error + messages before response serialization, without changing their external HTTP + status or response shape. +- de30646: Redact private paths across nested file, quoted public URL, and wrapper ownership boundaries on the first sanitizer pass, including recognized private-root relative successors after nested file returns. +- 89c83fb: Keep public daemon health storage-free and path-free while retaining authenticated health diagnostics for lifecycle checks, clients, and doctor. +- 1e5ebcd: Require authenticated Git metadata backlinks and contained common directories while parsing bounded worktree configuration without backtracking. +- 2dbd5a9: Bind each reconciliation lock and journal callback to one directory identity, + preserve unsafe or substituted journals during reads, listing, and recovery + writes, and create missing journals exclusively. +- 0d5f4a5: Reject foreign-owner or multiply linked project metadata before using it to + restore missing project-map entries. +- 31a61a2: Reject multiply linked or owner-mismatched project metadata before project + admission can parse or rewrite it, while preserving early metadata creation and + malformed snapshot recovery. +- b34389f: Reject empty, removed, or rebound backend-publication evidence directories + instead of treating them as legacy SQLite installations without publication + evidence. +- e0d443e: Reject wrong-owner or hard-linked reconciliation patterns and reject journals + that are wrong-owner, hard-linked, or not owner-only before trusting their + contents. +- ff568a0: Reject untrusted ownership and hard links on canonical reconciliation metadata + before parsing or reusing its content. +- dab7f57: Update the bundled URI parser to a patched release that prevents backslash authority host confusion while preserving the deduplicated MCP SDK and AJV build graph. +- 6c05bee: Refuse passive-event promotion when a selected sidecar belongs to a different + project identity. Preserve pending events and durable parking state across + worktree path reuse and project-map changes. + The `--all` discovery now reads sidecars without migrating or pruning them. +- 46c5955: Clean up Codex configuration resolver witnesses after proven failure, abort, + and timeout settlement while retaining unproven witnesses for reconciliation. +- bcc9bab: Skip portable source page reads for authenticated authoritative-empty domains + and return their canonical empty terminal batches. +- ac0565d: Seal private SQLite snapshot artifacts to read-only mode before the final file + sync, so that sync includes the final permission metadata before the committed + snapshot marker is published. +- feb2ef2: Make bracketed slash-prefixed URL-shaped paths converge to one redacted marker + on the first error-sanitization pass while preserving ordinary nested URLs and + independent filesystem-path redaction. +- e3ed05a: Keep healthy managed daemons admissible when callers differ only in shell locale or time-zone presentation settings. +- 10f545c: Keep default managed daemon start, doctor, and restart calls on one packaged runtime identity, and wait through an exact bounded systemd stop transition before recreating the service. +- 33fe5d5: Managed background daemons now use a stable, private state-root temporary + directory independent of the caller's `TMPDIR`, `TMP`, and `TEMP` values. +- e7baaba: Correct `lcm stats` compression output to compare compacted conversations with the total conversation count. +- 8dce7d9: Document the crash-recoverable backend-publication admission boundary, secure + local state-root establishment, staged PostgreSQL privilege posture, and + fail-closed operator behavior. +- aedab5f: Retry short authenticated root-bootstrap contention during a bounded window across CLI startup—20 total attempts at 50 ms intervals, up to about 950 ms—so read-only commands such as `lcm search` continue after a competing bootstrap completes, while ambiguous or unsafe lock states still fail closed. +- ca4502e: Run source and packaged SQLite diagnostic workers with explicit Node + type-stripping and SQLite flags, retain authenticated SQLite pool + counts across bounded collection timeouts, and preserve known backend identity + when daemon statistics routes sanitize unexpected failures. +- 247c55e: Repair an authenticated managed daemon with stale service configuration during `lcm doctor` while preserving fail-closed lifecycle refusals and reporting the repaired restart. +- cb9a7cb: Redact slash-prefixed local paths after word-bearing query or fragment text + following a quoted `file://` path in one sanitization pass, keeping repeated + sanitization byte-stable. +- df2bb7d: Allow trusted immutable-release recovery to authenticate a manually published + release when an exact failed draft workflow for the same signed tag and commit + completed before publication, while preserving all tag, ancestry, history, + artifact, and npm ordering checks. +- 4ccf628: Harden release publication against local tarball path ambiguity and delayed npm registry propagation. +- 821f2f4: Wait through authenticated backend-publication sweep contention at explicit daemon restart boundaries without replaying the restart or weakening PID, token, process-birth, manager, and runtime identity checks. Preserve the original typed contention when bounded admission cannot converge, while reporting an ordinary later publication failure unchanged. +- 01a5cb6: Fix `lcm store`, promotion, passive events and knowledge import merging new + content into an unrelated memory (#1727). The deduplication decision now merges + only text that is exactly the same as an active memory; a BM25 match above + `compaction.promotionThresholds.dedupBm25Threshold` no longer discards the + incoming text. Memories damaged by earlier false merges are not repaired. +- 35d21a8: Complete legacy-home admission before `lcm store`, then reuse an authenticated + healthy daemon without redundant lifecycle discovery while preserving the + locked fallback and daemon-side mutation admission. +- b7cdaf8: Reject portable manifests that mark a domain authoritative-empty while claiming a nonzero record count or a prefix digest other than the seeded empty-domain digest. +- 0aea3d3: Honor Git's final `extensions.worktreeConfig` assignment and keep exact retired event fences out of sidecar health scans while surfacing malformed candidates. +- caa0ed2: Keep MCP SDK build dependencies out of published consumer dependency paths, install and verify native Claude settings before removing Marketplace plugins, normalize legacy HTTP/SSE entries to stdio while preserving compatible options, and preview native settings changes without mutating them during dry-run. +- 040f736: Surface typed PostgreSQL surfacing-log failures from `/prompt-search` as + sanitized HTTP 503 responses without falling back to SQLite, while keeping the + prompt hook's optional hint behavior fail-open. +- 73a82cd: Replace polling external admission with event-driven evaluation and add a default-branch `repository_dispatch` recovery path for exact commit SHAs. +- 995a054: Resume ordinary local outbox upgrades and backend publication after migration + maintenance is aborted or target selection completes. Preserve terminal journal + evidence for retry when observation or replacement fails. +- 3744da4: Keep session-end background scheduling failures independent so ordinary publication contention does not prevent later promotion requests or Claude session completion. Preserve fail-closed handling of local publication-journal errors. +- 9d3b54d: Keep valid Claude transcript text when malformed sibling blocks are present. +- 5dd1a3f: Fix PostgreSQL daemon startup in the installed CLI by resolving SQL assets from their packaged location. Missing or modified migration files continue to fail verification without falling back to source files or SQLite. +- ce6f56a: Restore 7-day local event retention on SQLite installs. SessionStart prunes + processed passive-learning events older than seven days, but since the durable + PostgreSQL replication work landed, that prune also required each row to have + been acknowledged and pruned by a remote inbox. A SQLite-backed install has no + remote inbox and the schema cannot mark such a row acknowledged, so the prune + deleted nothing at all and the local events table grew without bound. + Retention now waits for remote proof only where PostgreSQL replication can + actually claim the rows. An event that never entered the remote pipeline is + reclaimed on age again, while any event still carrying remote state keeps the + full drained proof, so nothing is destroyed before replication has it. + + Upgrading a SQLite install reclaims the backlog on the first SessionStart: + processed events older than seven days that were never claimed for remote + delivery are deleted, including everything accumulated since the replication + gate made the prune a no-op (2026-07-30). That prune runs under the hook + publication fence, so a large backlog also lengthens that hold on the + first start after upgrading. +- 3206568: Fix SQLite health checks incorrectly reporting unavailable after multiple projects are opened in the same home. Factory health probes now run sequentially per home, including overlapping health requests, while preserving maintenance and real contention checks. +- a909b21: Harden PostgreSQL test-process and orphan-resource teardown, and clean isolated Vitest homes at the end of each run. +- cc1ad85: Bind external admission to authenticated exact-head CI and DCO evidence, including the canonical pull-request CI run, before accepting a pull request. +- dbbd850: Prevent private mutation-lock ownership checks from executing process-birth helpers found through an untrusted `PATH` or working directory. +- e5c524c: Validate release markers and publication history with trusted default-branch policy before tagged package code is available. +- fd643dd: Report bounded upstream Responses stream failures with retry guidance instead + of suggesting a Codex CLI upgrade. +- 6106047: Interpret timezone-less SQLite message timestamps as UTC across message reads + and message search results, preserving millisecond precision and qualified ISO + instants. Newly generated compaction summaries use the corrected message + instants at creation. The separate SQLite metadata backfill issue #1092 can + still rewrite summary bounds when the database is reopened. +- 3e5556c: Validate fenced PostgreSQL summary, context, and large-file repository machine + identities as canonical UUIDv7 values. Case-insensitive inputs are normalized + to lowercase, while invalid identities fail synchronously without exposing the + supplied value in diagnostics. +- 1fae45b: Reject unknown portable domains and invalid read limits before a portable + source adapter authenticates or reads the requested page. +- 563d64d: Keep managed daemon validation working inside Linux `PrivateTmp` user + namespaces by matching the loopback listener's kernel cgroup to the exact + systemd service while preserving fail-closed PID, health, and manager identity + checks. +- 0103c51: Use integrity-verified pnpm for source installation, development, and release builds. Source installs use the frozen lockfile, and source pattern-regeneration guidance uses the shared development script. Published npm installation and the Node runtime remain unchanged. +- fc852b6: Require compact drain recovery to verify that a replacement daemon has the + same packaged runtime digest as the invoking CLI. diff --git a/package.json b/package.json index 7af2cbacf..4bbd3ddd2 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@donadiosolutions/lcm", - "version": "1.4.2", + "version": "2.0.0", "description": "Never lose context again. Long Context Manager (LCM) compresses Claude Code sessions into searchable memory — every message preserved, every insight remembered.", "type": "module", "engines": {