diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index d80865b..a2e22bb 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -11,7 +11,7 @@ "category": "productivity", "source": "./plugins/workfile", "description": "Repository-native Work, Docs, History and Memory for humans and agents. Registers the MCP server, adds slash commands, and makes card claims an executable guard rail.", - "version": "0.8.1", + "version": "0.9.0", "author": { "name": "illodev" }, diff --git a/.claude/commands/claim.md b/.claude/commands/claim.md index eea7c08..8bb38ac 100644 --- a/.claude/commands/claim.md +++ b/.claude/commands/claim.md @@ -1,5 +1,5 @@ --- -# workfile kind=claude-command-claim version=0.8.1 digest=sha256:1a5ad0b0ff6e21b7d2d15a371a32232196365a8ce0d1d36a7bccde2e1e19d185 +# workfile kind=claude-command-claim version=0.9.0 digest=sha256:1a5ad0b0ff6e21b7d2d15a371a32232196365a8ce0d1d36a7bccde2e1e19d185 description: "Claim a card before working on it" argument-hint: "[T-0042] [scope,paths]" allowed-tools: "Bash(pnpm workfile card claim *)" diff --git a/.claude/commands/context.md b/.claude/commands/context.md index ffc7974..4ed2550 100644 --- a/.claude/commands/context.md +++ b/.claude/commands/context.md @@ -1,5 +1,5 @@ --- -# workfile kind=claude-command-context version=0.8.1 digest=sha256:4db7ba53833f4d5886cf8ddbc9173df7ab795773d719f5cafdf1e177616d7ee3 +# workfile kind=claude-command-context version=0.9.0 digest=sha256:4db7ba53833f4d5886cf8ddbc9173df7ab795773d719f5cafdf1e177616d7ee3 description: "Load the protocol context for a card" argument-hint: "[T-0042]" allowed-tools: "Bash(pnpm workfile agents context *)" diff --git a/.claude/commands/done.md b/.claude/commands/done.md index 3e7e737..98f8c1d 100644 --- a/.claude/commands/done.md +++ b/.claude/commands/done.md @@ -1,5 +1,5 @@ --- -# workfile kind=claude-command-done version=0.8.1 digest=sha256:8c5f5d74e6308e72f0f151dc444169322891ccd7e6330a79d3cdc397363e5d01 +# workfile kind=claude-command-done version=0.9.0 digest=sha256:8c5f5d74e6308e72f0f151dc444169322891ccd7e6330a79d3cdc397363e5d01 description: "Finish a card: verify, record, release" argument-hint: "[T-0042]" allowed-tools: "Bash(pnpm workfile card transition *), Bash(pnpm workfile changelog add *), Bash(pnpm workfile doctor *)" diff --git a/.claude/commands/next.md b/.claude/commands/next.md index 141ee5d..35a1c81 100644 --- a/.claude/commands/next.md +++ b/.claude/commands/next.md @@ -1,5 +1,5 @@ --- -# workfile kind=claude-command-next version=0.8.1 digest=sha256:26a73ffdf0aa92081f3cab88e0630e202d86d9890081fbcc4e8c836e08ef489f +# workfile kind=claude-command-next version=0.9.0 digest=sha256:26a73ffdf0aa92081f3cab88e0630e202d86d9890081fbcc4e8c836e08ef489f description: "Show the cards that can be started right now" allowed-tools: "Bash(pnpm workfile card list *)" --- diff --git a/.claude/skills/workfile/SKILL.md b/.claude/skills/workfile/SKILL.md index 358f968..fa2aa74 100644 --- a/.claude/skills/workfile/SKILL.md +++ b/.claude/skills/workfile/SKILL.md @@ -1,5 +1,5 @@ --- -# workfile kind=claude-skill version=0.8.1 digest=sha256:e155cb8be3ebed6c1837a0779b3876d7589a703306eb745158a70a0902f12315 +# workfile kind=claude-skill version=0.9.0 digest=sha256:e155cb8be3ebed6c1837a0779b3876d7589a703306eb745158a70a0902f12315 name: "workfile" description: "How to read and change Work, Docs, History and Memory in this repository. Load before touching anything under .project/." --- diff --git a/.project/agents/protocol.md b/.project/agents/protocol.md index cea376b..ac1f137 100644 --- a/.project/agents/protocol.md +++ b/.project/agents/protocol.md @@ -1,4 +1,4 @@ - + # Repository operating protocol This repository uses **Repository Workfile schema v2**. Repository Markdown files are canonical. The UI, CLI and every agent adapter must use the same services and rules. diff --git a/.project/agents/workflows/discovered-work.md b/.project/agents/workflows/discovered-work.md index 354647e..918c365 100644 --- a/.project/agents/workflows/discovered-work.md +++ b/.project/agents/workflows/discovered-work.md @@ -1,4 +1,4 @@ - + # Discovered work When actionable pending work appears during another task: diff --git a/.project/agents/workflows/finish-work.md b/.project/agents/workflows/finish-work.md index 3abe4ed..0d7ed6d 100644 --- a/.project/agents/workflows/finish-work.md +++ b/.project/agents/workflows/finish-work.md @@ -1,4 +1,4 @@ - + # Finish work 1. Run relevant tests, typecheck, lint and verification. diff --git a/.project/agents/workflows/record-knowledge.md b/.project/agents/workflows/record-knowledge.md index 60ff4bd..9120801 100644 --- a/.project/agents/workflows/record-knowledge.md +++ b/.project/agents/workflows/record-knowledge.md @@ -1,4 +1,4 @@ - + # Record knowledge Choose the record first, then the collection: diff --git a/.project/agents/workflows/start-work.md b/.project/agents/workflows/start-work.md index 56a1777..34f0a58 100644 --- a/.project/agents/workflows/start-work.md +++ b/.project/agents/workflows/start-work.md @@ -1,4 +1,4 @@ - + # Start work 1. Run `pnpm workfile agents context --card `. diff --git a/.project/changelog/releases/0-9-0/REL-0022-0-9-0.md b/.project/changelog/releases/0-9-0/REL-0022-0-9-0.md new file mode 100644 index 0000000..73fb1bc --- /dev/null +++ b/.project/changelog/releases/0-9-0/REL-0022-0-9-0.md @@ -0,0 +1,9 @@ +--- +id: REL-0022 +title: Version 0.9.0 +version: 0.9.0 +date: 2026-08-08 +fragments: [CHG-0149, CHG-0150, CHG-0151, CHG-0152, CHG-0153, CHG-0154, CHG-0155, CHG-0156, CHG-0157, CHG-0158, CHG-0159, CHG-0160] +--- + + diff --git a/.project/changelog/unreleased/CHG-0149-search-local-runs-on-onnxruntime-web-clearing-four-high-advisories-it-.md b/.project/changelog/releases/0-9-0/fragments/CHG-0149-search-local-runs-on-onnxruntime-web-clearing-four-high-advisories-it-.md similarity index 100% rename from .project/changelog/unreleased/CHG-0149-search-local-runs-on-onnxruntime-web-clearing-four-high-advisories-it-.md rename to .project/changelog/releases/0-9-0/fragments/CHG-0149-search-local-runs-on-onnxruntime-web-clearing-four-high-advisories-it-.md diff --git a/.project/changelog/unreleased/CHG-0150-the-audit-gates-block-at-moderate-the-floor-dependabot-already-alerts-.md b/.project/changelog/releases/0-9-0/fragments/CHG-0150-the-audit-gates-block-at-moderate-the-floor-dependabot-already-alerts-.md similarity index 100% rename from .project/changelog/unreleased/CHG-0150-the-audit-gates-block-at-moderate-the-floor-dependabot-already-alerts-.md rename to .project/changelog/releases/0-9-0/fragments/CHG-0150-the-audit-gates-block-at-moderate-the-floor-dependabot-already-alerts-.md diff --git a/.project/changelog/unreleased/CHG-0151-the-record-views-filters-survive-a-reload.md b/.project/changelog/releases/0-9-0/fragments/CHG-0151-the-record-views-filters-survive-a-reload.md similarity index 100% rename from .project/changelog/unreleased/CHG-0151-the-record-views-filters-survive-a-reload.md rename to .project/changelog/releases/0-9-0/fragments/CHG-0151-the-record-views-filters-survive-a-reload.md diff --git a/.project/changelog/unreleased/CHG-0152-every-kind-of-record-can-be-read-in-sequence-not-only-cards.md b/.project/changelog/releases/0-9-0/fragments/CHG-0152-every-kind-of-record-can-be-read-in-sequence-not-only-cards.md similarity index 100% rename from .project/changelog/unreleased/CHG-0152-every-kind-of-record-can-be-read-in-sequence-not-only-cards.md rename to .project/changelog/releases/0-9-0/fragments/CHG-0152-every-kind-of-record-can-be-read-in-sequence-not-only-cards.md diff --git a/.project/changelog/unreleased/CHG-0153-the-hosted-demo-matches-a-search-the-way-a-real-workspace-does.md b/.project/changelog/releases/0-9-0/fragments/CHG-0153-the-hosted-demo-matches-a-search-the-way-a-real-workspace-does.md similarity index 100% rename from .project/changelog/unreleased/CHG-0153-the-hosted-demo-matches-a-search-the-way-a-real-workspace-does.md rename to .project/changelog/releases/0-9-0/fragments/CHG-0153-the-hosted-demo-matches-a-search-the-way-a-real-workspace-does.md diff --git a/.project/changelog/unreleased/CHG-0154-ci-runs-the-checks-a-card-declares-and-records-what-they-proved.md b/.project/changelog/releases/0-9-0/fragments/CHG-0154-ci-runs-the-checks-a-card-declares-and-records-what-they-proved.md similarity index 100% rename from .project/changelog/unreleased/CHG-0154-ci-runs-the-checks-a-card-declares-and-records-what-they-proved.md rename to .project/changelog/releases/0-9-0/fragments/CHG-0154-ci-runs-the-checks-a-card-declares-and-records-what-they-proved.md diff --git a/.project/changelog/unreleased/CHG-0155-an-explicit-root-is-checked-the-way-a-discovered-one-always-was.md b/.project/changelog/releases/0-9-0/fragments/CHG-0155-an-explicit-root-is-checked-the-way-a-discovered-one-always-was.md similarity index 100% rename from .project/changelog/unreleased/CHG-0155-an-explicit-root-is-checked-the-way-a-discovered-one-always-was.md rename to .project/changelog/releases/0-9-0/fragments/CHG-0155-an-explicit-root-is-checked-the-way-a-discovered-one-always-was.md diff --git a/.project/changelog/unreleased/CHG-0156-every-doctor-finding-says-which-module-produced-it.md b/.project/changelog/releases/0-9-0/fragments/CHG-0156-every-doctor-finding-says-which-module-produced-it.md similarity index 100% rename from .project/changelog/unreleased/CHG-0156-every-doctor-finding-says-which-module-produced-it.md rename to .project/changelog/releases/0-9-0/fragments/CHG-0156-every-doctor-finding-says-which-module-produced-it.md diff --git a/.project/changelog/unreleased/CHG-0157-the-scope-guard-sees-two-agents-that-share-an-actor.md b/.project/changelog/releases/0-9-0/fragments/CHG-0157-the-scope-guard-sees-two-agents-that-share-an-actor.md similarity index 100% rename from .project/changelog/unreleased/CHG-0157-the-scope-guard-sees-two-agents-that-share-an-actor.md rename to .project/changelog/releases/0-9-0/fragments/CHG-0157-the-scope-guard-sees-two-agents-that-share-an-actor.md diff --git a/.project/changelog/unreleased/CHG-0158-the-mcp-byte-ceiling-stops-overwriting-a-tool-s-own-truncation-flag.md b/.project/changelog/releases/0-9-0/fragments/CHG-0158-the-mcp-byte-ceiling-stops-overwriting-a-tool-s-own-truncation-flag.md similarity index 100% rename from .project/changelog/unreleased/CHG-0158-the-mcp-byte-ceiling-stops-overwriting-a-tool-s-own-truncation-flag.md rename to .project/changelog/releases/0-9-0/fragments/CHG-0158-the-mcp-byte-ceiling-stops-overwriting-a-tool-s-own-truncation-flag.md diff --git a/.project/changelog/unreleased/CHG-0159-a-card-says-whether-a-person-reported-it-or-an-agent-derived-it.md b/.project/changelog/releases/0-9-0/fragments/CHG-0159-a-card-says-whether-a-person-reported-it-or-an-agent-derived-it.md similarity index 100% rename from .project/changelog/unreleased/CHG-0159-a-card-says-whether-a-person-reported-it-or-an-agent-derived-it.md rename to .project/changelog/releases/0-9-0/fragments/CHG-0159-a-card-says-whether-a-person-reported-it-or-an-agent-derived-it.md diff --git a/.project/changelog/unreleased/CHG-0160-a-trailing-strip-over-an-uncapped-body-no-longer-backtracks.md b/.project/changelog/releases/0-9-0/fragments/CHG-0160-a-trailing-strip-over-an-uncapped-body-no-longer-backtracks.md similarity index 100% rename from .project/changelog/unreleased/CHG-0160-a-trailing-strip-over-an-uncapped-body-no-longer-backtracks.md rename to .project/changelog/releases/0-9-0/fragments/CHG-0160-a-trailing-strip-over-an-uncapped-body-no-longer-backtracks.md diff --git a/.project/generated/claude-code.json b/.project/generated/claude-code.json index 5de6d55..c007d80 100644 --- a/.project/generated/claude-code.json +++ b/.project/generated/claude-code.json @@ -9,5 +9,5 @@ "hooks.PostToolUse" ] }, - "version": "0.8.1" + "version": "0.9.0" } diff --git a/AGENTS.md b/AGENTS.md index 0a0a4ba..73063e1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,4 +1,4 @@ - + # Workfile for AGENTS.md Before substantial changes, read `.project/agents/protocol.md` and the relevant workflow under `.project/agents/workflows`. diff --git a/CHANGELOG.md b/CHANGELOG.md index 5df3e31..4299c6b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,30 @@ # Changelog +## 0.9.0 — 2026-08-08 + +### Added + +- A card says whether a person reported it or an agent derived it (T-0210) +- CI runs the checks a card declares and records what they proved (T-0189, T-0161) +- Every kind of record can be read in sequence, not only cards (T-0207) + +### Changed + +- Every doctor finding says which module produced it (T-0218, T-0223) + +### Fixed + +- An explicit --root is checked the way a discovered one always was (T-0160) +- The scope guard sees two agents that share an actor (T-0219) +- The MCP byte ceiling stops overwriting a tool's own truncation flag (T-0147) +- The hosted demo matches a search the way a real workspace does (T-0202) +- The record views' filters survive a reload (T-0201) + +### Security + +- A trailing strip over an uncapped body no longer backtracks (T-0224) +- search-local runs on onnxruntime-web, clearing four high advisories it used to ship (T-0221, ADR-0021) + ## 0.8.1 — 2026-08-07 ### Added diff --git a/CLAUDE.md b/CLAUDE.md index d571765..eb63531 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,4 +1,4 @@ - + # Workfile for Claude Code Before substantial changes, read `.project/agents/protocol.md` and the relevant workflow under `.project/agents/workflows`. diff --git a/package.json b/package.json index d1d99e4..6f93f48 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "workfile-monorepo", "private": true, - "version": "0.8.1", + "version": "0.9.0", "type": "module", "packageManager": "pnpm@10.33.0", "description": "pnpm workspace for @illodev/workfile and its provider packages. The published manifests live under packages/.", diff --git a/packages/search-local/package.json b/packages/search-local/package.json index 2502fa6..318cd1b 100644 --- a/packages/search-local/package.json +++ b/packages/search-local/package.json @@ -1,6 +1,6 @@ { "name": "@illodev/workfile-search-local", - "version": "0.8.1", + "version": "0.9.0", "type": "module", "description": "Local embeddings semantic search provider for Workfile. Models run on-device; repository content never leaves the machine.", "repository": { diff --git a/packages/workfile/package.json b/packages/workfile/package.json index 6595368..f3ec462 100644 --- a/packages/workfile/package.json +++ b/packages/workfile/package.json @@ -1,6 +1,6 @@ { "name": "@illodev/workfile", - "version": "0.8.1", + "version": "0.9.0", "type": "module", "mcpName": "io.github.illodev/workfile", "description": "Repository-native protocol and local MCP server for Work, Docs, History and durable project Memory.", diff --git a/packages/workfile/test/cli.test.ts b/packages/workfile/test/cli.test.ts index d18e9ec..5bf156e 100644 --- a/packages/workfile/test/cli.test.ts +++ b/packages/workfile/test/cli.test.ts @@ -1567,9 +1567,15 @@ test("doctor --new gates on what appeared since the accepted baseline", async () assert.equal(quietReport.baseline.known, accepted.baseline.accepted); assert.equal(quietReport.baseline.resolved, 0); + // `--raised` because a card filed from now on says how it came to be, and + // this one is about the baseline gate rather than about that: without it + // the card earns a second, unrelated finding and the assertion below stops + // measuring what it is for. Which is the rule reaching the CLI, so it is + // worth the two words rather than worth loosening the count. await run([ "card", "create", "--root", root, - "--title", "Freshly broken", "--source", "docs/brand-new.md" + "--title", "Freshly broken", "--source", "docs/brand-new.md", + "--raised", "derived" ]); const regressed = await outcome(["doctor", "--root", root, "--new", "--json"]); assert.equal(regressed.code, 1, "a new issue must fail the gate"); diff --git a/plugins/workfile/.claude-plugin/plugin.json b/plugins/workfile/.claude-plugin/plugin.json index 761e5df..fabaaa5 100644 --- a/plugins/workfile/.claude-plugin/plugin.json +++ b/plugins/workfile/.claude-plugin/plugin.json @@ -2,7 +2,7 @@ "name": "workfile", "displayName": "Workfile", "description": "Work, Docs, History and Memory as Markdown in the repository, with an MCP server and claim-aware guard rails.", - "version": "0.8.1", + "version": "0.9.0", "author": { "name": "illodev" }, diff --git a/server.json b/server.json index 0f494ec..35dfa69 100644 --- a/server.json +++ b/server.json @@ -3,7 +3,7 @@ "name": "io.github.illodev/workfile", "title": "Workfile", "description": "Repository-native protocol and local MCP server for Work, Docs, History and durable project Memory.", - "version": "0.8.1", + "version": "0.9.0", "websiteUrl": "https://workfiledemo.illodev.com", "repository": { "url": "https://github.com/illodev/workfile", @@ -13,7 +13,7 @@ { "registryType": "npm", "identifier": "@illodev/workfile", - "version": "0.8.1", + "version": "0.9.0", "runtimeHint": "npx", "transport": { "type": "stdio"