0.9.0

.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "category": "productivity",
       "source": "./plugins/workfile",
       "description": "Repository-native Work, Docs, History and Memory for humans and agents. Registers the MCP server, adds slash commands, and makes card claims an executable guard rail.",
-      "version": "0.8.1",
+      "version": "0.9.0",
       "author": {
         "name": "illodev"
       },

.claude/commands/claim.md

@@ -1,5 +1,5 @@
 ---
-# workfile kind=claude-command-claim version=0.8.1 digest=sha256:1a5ad0b0ff6e21b7d2d15a371a32232196365a8ce0d1d36a7bccde2e1e19d185
+# workfile kind=claude-command-claim version=0.9.0 digest=sha256:1a5ad0b0ff6e21b7d2d15a371a32232196365a8ce0d1d36a7bccde2e1e19d185
 description: "Claim a card before working on it"
 argument-hint: "[T-0042] [scope,paths]"
 allowed-tools: "Bash(pnpm workfile card claim *)"

.claude/commands/context.md

@@ -1,5 +1,5 @@
 ---
-# workfile kind=claude-command-context version=0.8.1 digest=sha256:4db7ba53833f4d5886cf8ddbc9173df7ab795773d719f5cafdf1e177616d7ee3
+# workfile kind=claude-command-context version=0.9.0 digest=sha256:4db7ba53833f4d5886cf8ddbc9173df7ab795773d719f5cafdf1e177616d7ee3
 description: "Load the protocol context for a card"
 argument-hint: "[T-0042]"
 allowed-tools: "Bash(pnpm workfile agents context *)"

.claude/commands/done.md

@@ -1,5 +1,5 @@
 ---
-# workfile kind=claude-command-done version=0.8.1 digest=sha256:8c5f5d74e6308e72f0f151dc444169322891ccd7e6330a79d3cdc397363e5d01
+# workfile kind=claude-command-done version=0.9.0 digest=sha256:8c5f5d74e6308e72f0f151dc444169322891ccd7e6330a79d3cdc397363e5d01
 description: "Finish a card: verify, record, release"
 argument-hint: "[T-0042]"
 allowed-tools: "Bash(pnpm workfile card transition *), Bash(pnpm workfile changelog add *), Bash(pnpm workfile doctor *)"

.claude/commands/next.md

@@ -1,5 +1,5 @@
 ---
-# workfile kind=claude-command-next version=0.8.1 digest=sha256:26a73ffdf0aa92081f3cab88e0630e202d86d9890081fbcc4e8c836e08ef489f
+# workfile kind=claude-command-next version=0.9.0 digest=sha256:26a73ffdf0aa92081f3cab88e0630e202d86d9890081fbcc4e8c836e08ef489f
 description: "Show the cards that can be started right now"
 allowed-tools: "Bash(pnpm workfile card list *)"
 ---

.claude/skills/workfile/SKILL.md

@@ -1,5 +1,5 @@
 ---
-# workfile kind=claude-skill version=0.8.1 digest=sha256:e155cb8be3ebed6c1837a0779b3876d7589a703306eb745158a70a0902f12315
+# workfile kind=claude-skill version=0.9.0 digest=sha256:e155cb8be3ebed6c1837a0779b3876d7589a703306eb745158a70a0902f12315
 name: "workfile"
 description: "How to read and change Work, Docs, History and Memory in this repository. Load before touching anything under .project/."
 ---

.project/agents/protocol.md

@@ -1,4 +1,4 @@
-<!-- workfile:begin kind=canonical-agent-protocol version=0.8.1 digest=sha256:68844c761465e6e77d8b7391ee4ff03b2327702fc9a51978ef7ff309376de766 -->
+<!-- workfile:begin kind=canonical-agent-protocol version=0.9.0 digest=sha256:68844c761465e6e77d8b7391ee4ff03b2327702fc9a51978ef7ff309376de766 -->
 # Repository operating protocol
 
 This repository uses **Repository Workfile schema v2**. Repository Markdown files are canonical. The UI, CLI and every agent adapter must use the same services and rules.

.project/agents/workflows/discovered-work.md

@@ -1,4 +1,4 @@
-<!-- workfile:begin kind=workflow-discovered-work version=0.8.1 digest=sha256:12376b89f8f78ca0b7b5873ff3c8a1d998d46e2014c950c4d27a72bd0201a1d8 -->
+<!-- workfile:begin kind=workflow-discovered-work version=0.9.0 digest=sha256:12376b89f8f78ca0b7b5873ff3c8a1d998d46e2014c950c4d27a72bd0201a1d8 -->
 # Discovered work
 
 When actionable pending work appears during another task:

.project/agents/workflows/finish-work.md

@@ -1,4 +1,4 @@
-<!-- workfile:begin kind=workflow-finish-work version=0.8.1 digest=sha256:0da282f5f7bb1041cf5fd83b9e0216c6d9a4be1a274e13777fd844827a800c40 -->
+<!-- workfile:begin kind=workflow-finish-work version=0.9.0 digest=sha256:0da282f5f7bb1041cf5fd83b9e0216c6d9a4be1a274e13777fd844827a800c40 -->
 # Finish work
 
 1. Run relevant tests, typecheck, lint and verification.

.project/agents/workflows/record-knowledge.md

@@ -1,4 +1,4 @@
-<!-- workfile:begin kind=workflow-record-knowledge version=0.8.1 digest=sha256:3059fc6f92d46dd84cc6e9f5b27c66d8c14e9dd66f50e0e791b259ce439245c3 -->
+<!-- workfile:begin kind=workflow-record-knowledge version=0.9.0 digest=sha256:3059fc6f92d46dd84cc6e9f5b27c66d8c14e9dd66f50e0e791b259ce439245c3 -->
 # Record knowledge
 
 Choose the record first, then the collection:

.project/agents/workflows/start-work.md

@@ -1,4 +1,4 @@
-<!-- workfile:begin kind=workflow-start-work version=0.8.1 digest=sha256:083b468ad449da55976d344b793321791208ab4b5fee3cff3b58666777eb5417 -->
+<!-- workfile:begin kind=workflow-start-work version=0.9.0 digest=sha256:083b468ad449da55976d344b793321791208ab4b5fee3cff3b58666777eb5417 -->
 # Start work
 
 1. Run `pnpm workfile agents context --card <ID>`.

.project/changelog/releases/0-9-0/REL-0022-0-9-0.md

@@ -0,0 +1,9 @@
+---
+id: REL-0022
+title: Version 0.9.0
+version: 0.9.0
+date: 2026-08-08
+fragments: [CHG-0149, CHG-0150, CHG-0151, CHG-0152, CHG-0153, CHG-0154, CHG-0155, CHG-0156, CHG-0157, CHG-0158, CHG-0159, CHG-0160]
+---
+
+

.project/generated/claude-code.json

@@ -9,5 +9,5 @@
       "hooks.PostToolUse"
     ]
   },
-  "version": "0.8.1"
+  "version": "0.9.0"
 }

AGENTS.md

@@ -1,4 +1,4 @@
-<!-- workfile:begin kind=adapter-agents-md version=0.8.1 digest=sha256:096ede336ee0056a67f11e2f98806d75e5d946dd74502e88cf92877ffeb90211 -->
+<!-- workfile:begin kind=adapter-agents-md version=0.9.0 digest=sha256:096ede336ee0056a67f11e2f98806d75e5d946dd74502e88cf92877ffeb90211 -->
 # Workfile for AGENTS.md
 
 Before substantial changes, read `.project/agents/protocol.md` and the relevant workflow under `.project/agents/workflows`.

CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 0.9.0 — 2026-08-08
+
+### Added
+
+- A card says whether a person reported it or an agent derived it (T-0210)
+- CI runs the checks a card declares and records what they proved (T-0189, T-0161)
+- Every kind of record can be read in sequence, not only cards (T-0207)
+
+### Changed
+
+- Every doctor finding says which module produced it (T-0218, T-0223)
+
+### Fixed
+
+- An explicit --root is checked the way a discovered one always was (T-0160)
+- The scope guard sees two agents that share an actor (T-0219)
+- The MCP byte ceiling stops overwriting a tool's own truncation flag (T-0147)
+- The hosted demo matches a search the way a real workspace does (T-0202)
+- The record views' filters survive a reload (T-0201)
+
+### Security
+
+- A trailing strip over an uncapped body no longer backtracks (T-0224)
+- search-local runs on onnxruntime-web, clearing four high advisories it used to ship (T-0221, ADR-0021)
+
 ## 0.8.1 — 2026-08-07
 
 ### Added

CLAUDE.md

@@ -1,4 +1,4 @@
-<!-- workfile:begin kind=adapter-claude version=0.8.1 digest=sha256:aa3901da1c12d46b145804133aeb1aacf682f40ac19e583ff1c0dbd3b1b0a3b5 -->
+<!-- workfile:begin kind=adapter-claude version=0.9.0 digest=sha256:aa3901da1c12d46b145804133aeb1aacf682f40ac19e583ff1c0dbd3b1b0a3b5 -->
 # Workfile for Claude Code
 
 Before substantial changes, read `.project/agents/protocol.md` and the relevant workflow under `.project/agents/workflows`.

package.json

@@ -1,7 +1,7 @@
 {
   "name": "workfile-monorepo",
   "private": true,
-  "version": "0.8.1",
+  "version": "0.9.0",
   "type": "module",
   "packageManager": "pnpm@10.33.0",
   "description": "pnpm workspace for @illodev/workfile and its provider packages. The published manifests live under packages/.",

packages/search-local/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@illodev/workfile-search-local",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "type": "module",
   "description": "Local embeddings semantic search provider for Workfile. Models run on-device; repository content never leaves the machine.",
   "repository": {

packages/workfile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@illodev/workfile",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "type": "module",
   "mcpName": "io.github.illodev/workfile",
   "description": "Repository-native protocol and local MCP server for Work, Docs, History and durable project Memory.",

packages/workfile/test/cli.test.ts

@@ -1567,9 +1567,15 @@ test("doctor --new gates on what appeared since the accepted baseline", async ()
         assert.equal(quietReport.baseline.known, accepted.baseline.accepted);
         assert.equal(quietReport.baseline.resolved, 0);
 
+        // `--raised` because a card filed from now on says how it came to be, and
+        // this one is about the baseline gate rather than about that: without it
+        // the card earns a second, unrelated finding and the assertion below stops
+        // measuring what it is for. Which is the rule reaching the CLI, so it is
+        // worth the two words rather than worth loosening the count.
         await run([
             "card", "create", "--root", root,
-            "--title", "Freshly broken", "--source", "docs/brand-new.md"
+            "--title", "Freshly broken", "--source", "docs/brand-new.md",
+            "--raised", "derived"
         ]);
         const regressed = await outcome(["doctor", "--root", root, "--new", "--json"]);
         assert.equal(regressed.code, 1, "a new issue must fail the gate");

plugins/workfile/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "workfile",
   "displayName": "Workfile",
   "description": "Work, Docs, History and Memory as Markdown in the repository, with an MCP server and claim-aware guard rails.",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "author": {
     "name": "illodev"
   },

server.json

@@ -3,7 +3,7 @@
   "name": "io.github.illodev/workfile",
   "title": "Workfile",
   "description": "Repository-native protocol and local MCP server for Work, Docs, History and durable project Memory.",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "websiteUrl": "https://workfiledemo.illodev.com",
   "repository": {
     "url": "https://github.com/illodev/workfile",
@@ -13,7 +13,7 @@
     {
       "registryType": "npm",
       "identifier": "@illodev/workfile",
-      "version": "0.8.1",
+      "version": "0.9.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"