# Development status and evidence

[Onboarding](../README.md) · [0.6.0 tool contracts](agent-tools.md) · [Changelog](../CHANGELOG.md)

## 0.6.8 candidate — authorized tag publication pending

Owner authorized switching to tag automation and running the first new-version release after verified 0.6.7 publication. npm 0.6.8 and remote `v0.6.8` were absent. The reviewed workflow is tag-only, checks out the event SHA, validates exact stable tag/package/lockfile versions and names, and runs clean install, validation, audit and pack checks before unchanged token-free OIDC/provenance publication. All 23 offline guard cases passed. No runtime or dependency changes.

Clean npm ci, typecheck and **290 tests** (none skipped) passed on Node22.23.3/npm10.9.9. Full/production audits found zero vulnerabilities; pack47, diff and local tarball byte checks passed. Dependencies unchanged.

The current release procedure is [tag-driven](releasing.md): reviewed main commit/push and successful CI, then one annotated matching version tag push. Manual dispatch and GitHub release triggers are removed; immutable tags and no-blind-retry recovery apply. Main-ref OIDC history does not prove tag-ref acceptance; live evidence follows this run. No host install/reload, live bots, runtime secret inspection or external messages; existing Windows, privacy/deletion, two-session, network and host-cancellation limitations remain.

## 0.6.7 released — verified

Public npm `latest` is **0.6.7**, released from [`7d5c3221aba934326c74f7efd43f70ecf1d99e27`](https://github.com/mbundgaard/pi-telegram/commit/7d5c3221aba934326c74f7efd43f70ecf1d99e27). [CI 40837224634](https://github.com/mbundgaard/pi-telegram/actions/runs/40837224634) and [Trusted Publishing 40837337190](https://github.com/mbundgaard/pi-telegram/actions/runs/40837337190), attempt **1**, succeeded at that commit. Exactly one `--ref main` dispatch followed remote-main verification and successful CI. Initial registry lag resolved through read-only polling, without redispatch.

All **47 published files** byte-match the release commit. Downloaded SHA-1 is `158db9f542a2e84c2bc79e8a79fdbaf368aba3df`; registry integrity is `sha512-B+JxJwrGIRYkDhOPDByDRJsFDycykBVJBFVGtH61Z+z4UgyrbWFihV4ur1iFKr/0GmZN0LUos2iS2/du92Ej9A==`. Computed SHA-512 matches both registry integrity and the decoded SLSA subject. Decoded provenance identifies the exact commit, `mbundgaard/pi-telegram`, `.github/workflows/publish.yml`, main ref and publish run **40837337190**, attempt **1**. This is hash/payload linkage verification, not independent DSSE/certificate-chain/Rekor verification.

Clean npm ci, typecheck and **290 tests** (none skipped) passed on Node **22.23.3** / npm **10.9.9**; full/production audits found zero vulnerabilities, pack47 and diff checks passed, and all local package files byte-matched the tree before commit. Dependencies unchanged. No host install/reload, live Telegram/secret tests, runtime-secret inspection or external messages. Windows replacement remains untested live; privacy/deletion, two-session, network and host-cancellation limits remain. The owner's original immediate failure is not proven fixed. Published docs retain their candidate snapshot; this later evidence does not change the immutable artifact. Do not republish **0.6.7**.

## Historical 0.6.7 candidate — authorized publication pending

Owner authorized patch bump, scoped release commit/push and one main-ref Trusted Publishing dispatch after gates. Registry latest was 0.6.6 and 0.6.7 was absent. Independent release review covered the complete pending source, guidance and test diff: safe-target revalidation and authenticated content guards remain; no prompt-time truncate or unlink fallback, and upload safeguards are unchanged. No host API changes were needed.

Fresh clean npm ci, typecheck and **290 tests** (none skipped), full and production audits zero vulnerabilities, pack **47 files**, and diff checks passed. Dependencies are unchanged. No runtime secret inspection, live bot/API secret tests, host install/reload or external messages. Windows, live privacy/deletion, two-session, network and host-cancellation limitations remain; the owner's original immediate failure is not proven fixed. Publication evidence will follow verification.

## Historical unreleased owner-authorized secret replacement — review pending

Explicit authorization permits same-filename replacement without another confirmation. Preflight accepts safe regular single-link files; content receipt retains exact current owner/private/prompt and assignment guards. A new private same-directory temporary is written/fsynced/closed, target safety is rechecked, then rename replaces the directory entry. No prompt-time truncate, unlink fallback or mutation of an existing inode. Symlinks, directories and hard-linked targets are refused; successful replacement uses a new 0600 inode even when the previous file had broader modes. Precommit cancellation/failure preserves old contents. Generic save errors no longer incorrectly suggest that existence alone is a blocker.

Same-directory Node rename supports replacement on POSIX and Windows, but sharing/access restrictions can fail safely; no Windows live validation or ACL guarantee is claimed. Directory-entry crash durability and isolation from hostile concurrent filesystem/Git mutation remain unsupported. Earlier no-clobber statements below describe historical releases only. Mandatory/skill/user guidance now describes replacement and uncertain-save precautions.

Validation: typecheck and **290 tests** pass, none skipped; audit zero vulnerabilities, pack **47 files**, diff check passes. Dummy fixtures cover repeated direct/menu replacement, exact bytes, empty/oversize rejection, prompt/cancellation preservation, old open inode preservation, modes and unsafe targets. An initial skill-size check failed after added guidance; guidance was shortened and the full suite passed. No runtime secrets inspected, live bot/API test, external messages, install/reload, version/dependency change, commit/push/publication. Main review is required before activation.

## 0.6.6 released — verified

Public npm `latest` is **0.6.6**, released from [`67d3f91228ac7a758f4e7ed4d755188f1169026c`](https://github.com/mbundgaard/pi-telegram/commit/67d3f91228ac7a758f4e7ed4d755188f1169026c). [CI 40494051971](https://github.com/mbundgaard/pi-telegram/actions/runs/40494051971) and [Trusted Publishing 40494178057](https://github.com/mbundgaard/pi-telegram/actions/runs/40494178057), attempt **1**, succeeded at that commit. Exactly one `--ref main` dispatch followed verified remote-main identity and successful CI. Registry lag resolved through read-only checks, with no redispatch.

All **47 published files** byte-match the release commit. SHA-1: `ea5f7fb33763db06effedc0a72b590ec4c4b35f2`; computed SHA-512 matches registry integrity `sha512-KMXCrbZ/qL34wX6IqxIUunvoFSTcJCf3qLBDlu8CMqR74+36OhCX1e/9DZaf7urB/pKxg/pmgeV095BOvwfP7w==` and the decoded SLSA subject. Payload linkage matches the commit, repository `mbundgaard/pi-telegram`, `.github/workflows/publish.yml`, main ref and run **40494178057**, attempt **1**. This is hash/payload verification, not independent DSSE/certificate-chain/Rekor cryptographic verification.

Clean npm ci, typecheck, **288 tests** (none skipped), full/production audits zero vulnerabilities, pack47, diff checks and all47 local tarball byte comparisons passed. Dependencies unchanged. No running-host install/reload, live Telegram/secret testing, runtime-private-state inspection or external messages. The reported immediate secret failure remains unresolved; live group timing/network, privacy/deletion, two-session and host-cancellation limitations remain. Published docs retain their candidate snapshot; this evidence-only checkpoint does not alter the artifact. Do not republish 0.6.6.

## Historical 0.6.6 candidate — authorized publication pending

Owner authorized the patch bump, release commit/push and one main-ref Trusted Publishing dispatch after gates. Public latest was 0.6.5 and 0.6.6 returned E404 before preparation. Main independently reviewed grouped intake; release review covered the pending secret and group source/tests. Dependencies remain unchanged.

Supported document/photo groups collect for 800 ms quiet / 3 s maximum, including admission-time enforcement when timers are delayed. Separate groups and single/voice files remain separate. FIFO bounds include running work: 4 batches / 30 files, 10 per group, 120-second active deadline. Sequential saving retains per-file/inbox safeguards; partial success emits one authenticated follow-up with failures/captions, all-failed batches do not reach the model. Stop/disconnect suppresses unfinished receipts, not already-saved files. No group-end marker, durable queue/deduplication, automatic retry or processing is claimed; late/full items require resend.

Secret lifetime checks no longer retain the completed startup attempt's 30-second deadline. Initialization cancellation and ready/current session, lease and saved-assignment checks remain. Sanitized fixed preflight categories distinguish destination failures from connection/assignment verification without native error, path or content leakage. Bare `/secret` does not prepare a destination before its filename prompt. Dummy fixtures reproduce the startup deadline regression and exercise direct/menu saves through startup/reconnect; the owner's reported immediate failure remains unknown/unresolved, not proven fixed. Storage safety gates remain unchanged.

Clean npm ci, typecheck and **288 tests** (none skipped), full/production audits **zero vulnerabilities**, pack **47 files** and diff checks passed on Node22.23.3/npm10.9.9. Local tarball byte verification is required before dispatch. No host installation/reload, live Telegram/secret tests, runtime-private-state inspection or external messages. Live group timing/network behavior, secret privacy/deletion, two-session and host-cancellation limitations remain. Publication evidence will be recorded only after verification; published documentation retains this candidate snapshot.

## 0.6.5 released — verified

Public npm `latest` is **0.6.5**, released from [`06353ac38af79a6263808bdf04a3cd9a9fb35c5d`](https://github.com/mbundgaard/pi-telegram/commit/06353ac38af79a6263808bdf04a3cd9a9fb35c5d). [CI 40188722832](https://github.com/mbundgaard/pi-telegram/actions/runs/40188722832) and [Trusted Publishing 40188777235](https://github.com/mbundgaard/pi-telegram/actions/runs/40188777235), attempt **1**, succeeded at that exact commit. Dispatch occurred exactly once with `--ref main`, after checking main's exact SHA and successful CI. Registry visibility lagged; only read-only verification was repeated, never publication.

All **46 published files** byte-match the release commit. Downloaded SHA-1: `7041252d72b24e2565e4b8ff88e3e0a2af4c4c76`; computed SHA-512 matches registry integrity `sha512-1WtckjDii88e36QvJ9cZlkPQrGc20kp5WPjeO0xWT7uaeqVjUk3exutidITxcdqmgmdu75j+kdZWlvuSd4/rUQ==` and the decoded SLSA subject. Decoded payload linkage identifies the exact commit, repository `mbundgaard/pi-telegram`, `.github/workflows/publish.yml`, main ref and run **40188777235**, attempt **1**. This is hash/payload verification, not independent DSSE/certificate-chain/Rekor cryptographic verification.

Release gates passed: clean npm ci, typecheck, **271 tests** (none skipped), full/production audits **zero vulnerabilities**, pack46 and diff checks, local tarball byte comparison; CI/publish validation also succeeded. Reviewed development-only scoped undici remediation is detailed below; production dependencies and consumers' running hosts are unchanged. No running-host installation/reload/restart, live Telegram/secret testing, private runtime inspection or external messages. Source/mocks do not prove live privacy/deletion, two-session, cancellation or adverse-network behavior. Published docs retain the candidate snapshot; this postpublication checkpoint does not alter the immutable artifact. Do not republish 0.6.5.

## Historical 0.6.5 candidate — authorized publication pending

Registry latest was 0.6.4 and 0.6.5 returned E404 before preparation. Owner authorized the patch bump, commit/push and one main-ref Trusted Publishing dispatch after gates. Independent release review of the secret diff found owner/private/current-prompt checks before buffering, exact acknowledged ID revalidation before save, bounded one-candidate memory and explicit disposal, metadata-only callbacks, synchronous replacement/generation fencing and unchanged atomic no-clobber storage. Queued/inflight question and feedback callbacks cannot restore retired interactions. This is source/mock evidence, not live privacy or deletion verification.

Authorized development remediation uses only `overrides["@earendil-works/pi-coding-agent"].undici = "8.12.2"`. SDK remains locked at 1.3.0 (its direct pin was 8.10.2); SDK 1.4.0 also pins 8.10.2. The resulting graph deduplicates the SDK's direct and nested pi-ai/openai undici onto 8.12.2, marked dev-only. Both SDK and patched undici require Node >=22.19.0; validation uses Node 22.23.3/npm 10.9.9. Reviewed upstream release notes from 8.11.0 through 8.12.2, including HTTP/proxy/redirect fixes and the 8.12.2 TLS, cache, decompression, SRI, EventSource and WebSocket security fixes; no required SDK API removal identified. SDK dispatcher uses Client, Pool, EnvHttpProxyAgent, setGlobalDispatcher and optional install; these remain available. This is a real dependency replacement, not an audit suppression or force fix. Production dependency declarations are unchanged. npm root overrides are development-checkout policy and do not remediate a consumer's host SDK or installed running Pi.

Clean npm ci, typecheck and **271 tests** (none skipped) pass; full and production audits report **zero vulnerabilities**. Pack/diff checks passed and all **46 local tarball files** byte-matched the candidate tree. No running-host installation/reload/restart, live bot/secret test, runtime-secret inspection or external messages. Two-session, host-cancellation and adverse-network limitations remain.

## Historical unreleased simplified secret intake — prior audit blocker

Valid standalone `/secret` now replaces an agent question, native feedback or earlier intake, including pending sends. Filename syntax/readiness/download checks happen before replacement; filesystem/assignment preflight still precedes content prompting. Replacement retires callbacks and advances the existing private question generation; queued/inflight questions cannot revive, and new button questions are refused during intake. No agent cancellation/approval or feedback submission is implied. Existing feedback retirement handles its pending UI. Downloads remain a blocker: their asynchronous completion can still independently admit an attachment follow-up, so concurrency was not widened here.

Fast visible-prompt replies are no longer simply rejected: one bounded own-current-prompt candidate is kept in memory, then processed only after the send acknowledgement confirms its exact message ID. Nonce text alone never grants authority. Cancel/replacement/expiry/uncertain failure drops it; no automatic replay or content logging/model input. Fixed TTL, owner/private/current-connection guards, exact reply binding, stale-prompt rejection, literal `/secret` content replies and no-clobber/upload protections remain. Prior prompt/preparation diagnostics are preserved. Standalone replacement cancels an earlier intake, but cannot undo a file already committed before replacement.

Dummy-only validation: typecheck and **271 tests** pass (none skipped); pack **46 files** and diff checks pass. Full audit currently fails with **2 vulnerabilities (1 moderate, 1 high)** through the development Pi SDK's undici dependency (three advisories); production audit reports **zero vulnerabilities**. No dependency changes or force fix were made. Earlier clean audit evidence below is historical, not a current release gate. No live secret/API calls, secret/settings/inbox inspection, installation/reload, version bump, commit/push/publication, external messages or task spawning. Main must review before activation; mocks do not establish real Telegram delivery/deletion/privacy.

## 0.6.4 released — verified

Public npm `latest` is **0.6.4**, released from [`7634637214bbeea9fec82656c3c6ddfded28d141`](https://github.com/mbundgaard/pi-telegram/commit/7634637214bbeea9fec82656c3c6ddfded28d141). [CI 39979864026](https://github.com/mbundgaard/pi-telegram/actions/runs/39979864026) and [Trusted Publishing 39980073990](https://github.com/mbundgaard/pi-telegram/actions/runs/39980073990), attempt **1**, completed successfully at that exact commit. One successful main-ref dispatch created the publish run. A preceding SHA-ref dispatch request was rejected HTTP 422 (no ref) without creating a run; it did not publish anything. No workflow or publication retry occurred during verification. Public registry visibility lagged before latest/version confirmation.

All **46 published files** byte-match the release commit. Downloaded SHA-1 is `bd2f479f104d625063e327d0a24dbef1192caa03`; computed SHA-512 matches registry integrity `sha512-f4wJlBpyrScTH18xgJOAW+a+HTIca6yk8GXGOv1xl1NLjXv6mPwKb8KKG5pEzCGzWK8ng5jU4EPjMYo5GX4ZBg==` and the decoded SLSA subject hash. Decoded SLSA v1 links the exact commit, repository `mbundgaard/pi-telegram`, `.github/workflows/publish.yml`, `refs/heads/main` and run **39980073990**, attempt **1**. Hash and payload linkage checks are not independent DSSE/certificate-chain/Rekor cryptographic verification.

Pre-publication clean `npm ci`, typecheck, **264 tests** (none skipped), full/production audits (**zero vulnerabilities**), pack (**46 files**) and diff checks passed; release-commit CI and publication validation also succeeded. Dependencies are unchanged. Scope is main-reviewed native compaction notices and actionable secret-blocker diagnostics/repeated-save tests, not a proven fix for the owner's exact live refusal.

No installation into running Pi, reload/restart, live compaction/secret/bot tests, runtime-secret inspection or external owner messages were performed. Compaction hooks were source-verified for Pi 0.87.1 and development SDK 1.3.0, not universally; pre-hook pauses and absent outcomes remain unobservable, and success must not be inferred. Secret privacy/deletion, two-session, host-cancellation and adverse-network limitations remain as documented below. Published documentation retains its pre-publication snapshot; this documentation-only checkpoint does not change the immutable artifact. Do not republish 0.6.4.

## Historical 0.6.4 release candidate — publication pending

Owner authorized the patch release, explicit commit/push and one Trusted Publishing dispatch after validation. Registry latest was 0.6.3 and 0.6.4 was unused. Main reviewed native compaction notices; release review also checked the secret diagnostics and repeated-operation tests. Scope is compaction notifications and actionable secret-blocker errors, not a proven fix for the owner's exact live refusal. Dependencies are unchanged. No running-host installation/reload/restart or live compaction/secret/Telegram tests are authorized. Clean `npm ci`, typecheck and **264 tests** (none skipped), full and production audits (**zero vulnerabilities**), pack check (**46 files**) and diff check passed. Publication evidence will be recorded after verification.

## Historical unreleased native compaction notices — main review required

Native extension hooks now enqueue fixed start and trustworthy success/failure/cancellation notices through the existing bounded supervised control transport, independent of model/tool calls. Manual and automatic threshold/overflow compaction use the same hooks. No summaries, transcript data, token counts or raw errors are read; no receipts, Stop authority, Working/Thinking or startup notices change. Ready connection/session/assignment checks run again at delivery; disconnect/replacement invalidates pending notices. Existing secret-refusal changes are preserved.

Actual installed Pi **0.87.1** declarations and manual/automatic runtime emission support `session_before_compact`, `session_compact` and `session_compact_failed`; checkout **1.3.0** has the same notification ordering. SDK compaction events are not assumed to be extension events. The general 0.84.4 baseline was not independently available for this feature review; missing terminal hooks never cause inferred success. Pre-hook failures/pauses, earlier extension cancellation, branch summaries and direct compaction-entry writes are not exhaustively observable. See [compaction review](compaction-notices-review.md) for exact evidence, limitations and the proposed stronger host contract.

Validation: typecheck and **264 tests** passed (none skipped), pack **46 files**, diff check passed. No dependency/version changes, installation/reload, live compaction/bot calls, external messages, commit/push/publication. Main review and separately authorized activation remain pending.

## Historical unreleased repeated-secret investigation — main review required

The reported 0.6.3 refusal comes from `SecretFlow.start`: `dispatch` combines download, native feedback and pending agent-question state; absent options/bot identity or failed connection `current()` share the same old message. It is **not** the active-secret branch: an unfinished secret flow intercepts incoming text earlier with a different refusal. Successful save calls `cancel(false)` (clears flow/timer, aborts its controller) before the metadata-only follow-up. Deletion failure also reaches that cleanup; cancel during cleanup preserves the already committed file and suppresses the follow-up. No leaked successful-save fence was found.

Mocked successive direct/menu saves work with metadata receipts queued, begun and settled through the actual response-routing handlers. Four new/expanded lifecycle tests also pass against an isolated copy of the exact 0.6.3 release source (`b7aa4ce`), including repeats after deletion failure, collision and cancellation; this is not merely a pass against the diagnostic changes. Those handlers change request provenance, not secret readiness. Connection readiness separately checks ready/current connection, epoch, lease/connect abort signals and session identity; disk verification additionally checks assignment/token/owner equality. Download state clears in its reception promise's `finally`; feedback retires its own state; neither is set by secret saving. Agent questions, however, remain pending after the agent turn settles. Posting a button question after a save reproduces refusal on every subsequent `/secret`, including after `/cancel`; ordinary non-sensitive answering clears it and the next save succeeds. This is a **reproduced candidate, not proof of the owner's live cause**. No runtime state was inspected.

Source now distinguishes readiness, download, feedback and question refusals with safe actionable text, without bypassing any guard. `/cancel` does not dismiss agent questions; the old user-guide wording obscured that distinction and is corrected. New/expanded dummy tests cover six successive alternating saves, routing lifecycle, legitimate question blocking/recovery, readiness recovery, download/feedback reason selection, deletion failure, pre/postcommit cancellation and write-collision recovery. Existing owner/private/exact-reply, stale-connection, no-clobber and content-isolation tests remain.

Validation: typecheck and **258 tests** (none skipped), full audit zero vulnerabilities, pack45 and diff checks passed. No live Telegram calls, actual secrets/settings/inbox inspection, installation/reload, dependency/version change, commit/push/publication or external messages. Main must review before activation. Safe diagnostic question for the unmodified installed release: **“After the first save, is there an unanswered agent button question, an unfinished feedback prompt, or a download? Does answering the question with non-sensitive text allow a new `/secret`? Please report only which state applies, not values, filenames, screenshots or logs.”** If none applies, check native `/ping` and local connection status; source diagnostics require separately approved activation and are not claimed live.

## 0.6.3 released — verified

Public npm `latest` is **0.6.3**, released from [`b7aa4ceeacf25afac9294af4ae7fc8f0d9536455`](https://github.com/mbundgaard/pi-telegram/commit/b7aa4ceeacf25afac9294af4ae7fc8f0d9536455). [CI 38978048307](https://github.com/mbundgaard/pi-telegram/actions/runs/38978048307) and [Trusted Publishing 38978137401](https://github.com/mbundgaard/pi-telegram/actions/runs/38978137401) succeeded. Exactly one workflow dispatch; registry visibility lagged before latest/version confirmation, without publication retry.

All **45 published files** byte-match the release commit. Downloaded SHA-1 is `dc13098aafe2b5648f5fa9884632b92139494087`; computed SHA-512 matches registry integrity `sha512-S19Epkdz57UyC8TBj0doNsijG2sf77MnorPVvIdYowGXFhnFzTgWPxm3Kk/ur+0aR/5mHBgB2hXmNsSMuAx0qA==` and the decoded SLSA subject hash. Decoded SLSA v1 links the exact commit, `mbundgaard/pi-telegram`, `.github/workflows/publish.yml` and run **38978137401**, attempt **1**. Hash and payload linkage verification is not independent DSSE/certificate-chain/Rekor cryptographic verification.

Fresh clean `npm ci`, typecheck and **255 tests** (zero failures/skips), full and production audits (**zero vulnerabilities**), pack (**45 allowlisted files**) and diff checks passed. A fresh local artifact also byte-matched the tree; registry bytes match its hash. Only root package/lock versions changed; no dependency churn. Hidden runtime state, secrets, artifacts, tests and dependencies are excluded from the package. Release commit and subsequent checkpoint stage only explicit intended paths.

No installation into running Pi, reload/restart, live Telegram/secret submission, runtime-secret inspection, external owner messages or task spawning occurred. Source review/mocks do not prove live privacy, masking or deletion: ForceReply is not masked/E2EE, stored data is plaintext and filesystem-accessible, deletion is best effort, filename messages remain, and post-flow standalone text follows ordinary chat routing. Known `/secret`/`/cancel` feedback precedence is documented in the user guide. Windows ACL guarantees, hostile local mutation isolation, crash recovery, two-session testing, host cancellation and adverse-network behavior remain outside verified evidence. Restart and instance-following remain unsupported. Published documentation retains its pre-publication snapshot; this checkpoint does not alter the immutable package. Do not republish 0.6.3.

## Historical 0.6.3 release preparation — publication pending

Owner authorized the patch release, explicit commit/push and one existing Trusted Publishing dispatch after validation. Registry latest was 0.6.2; 0.6.3 was absent. Independent source review and Main's menu-flow review passed. Scope includes both native `/secret` routes, protected storage, metadata-only follow-up, mandatory/skill guidance and source-only dummy-data tests. Dependencies are unchanged.

Known low-severity limitation: `/secret`-prefixed input is intercepted before exact feedback replies and `/cancel` cancels feedback. The user guide now describes that precedence honestly; no unrelated runtime change is included. No live secret intake/deletion, installation, reload/restart or runtime-secret inspection is performed. Existing two-session, host-cancellation and adverse-network limitations remain. Final publication evidence will be recorded after registry/artifact/provenance verification.

## Historical unreleased menu-friendly `/secret` — source implementation, review required

Bare `/secret`, including menu selection, now starts an owner/private/exact-reply filename stage before the separate filename-labelled content ForceReply. The explicit `/secret <filename>` route remains a shortcut. Filename-stage validation errors and unavailable/existing destinations permit correction at the same prompt without quoting the rejected text; malformed/invalid shortcuts retain refusal. Both stages share one five-minute deadline. Synchronous fences prevent duplicate transitions and acceptance during verification/prompt delivery. A strict own-bot filename-prompt marker provides rejection-only stale handling across transition/cancel/expiry/reconnect, including media/captions and edits. Content prompt recognition retains compatibility with the earlier prompt wording. No storage or metadata-follow-up authority was widened.

Only data reply and content prompt IDs receive bounded postcommit deletion; filename prompts/replies intentionally remain for manual cleanup. Mandatory `src/index.ts` guidance, skill/reference, menu/help and user docs describe both routes. Five additional dummy-data tests cover success/duplicates/literal content, corrections/existing destinations/auth/media/edits, stale stage/reconnect, cancelled verification and both prompt sends/error privacy, and original-deadline timer expiry. Typecheck and **255 tests** passed (none skipped); full audit zero vulnerabilities, pack **45 files**, diff check passed. Existing source work and version remain unchanged except the scoped enhancement. No actual secrets/inbox inspection, live API tests, external messages, installation/reload/restart, commit/push or publication. Main must independently review before activation.

## Historical unreleased native `/secret` checkpoint — source implementation, review required

Implemented `src/secret.ts` (native flow) and `src/secret-files.ts` (protected storage), integrated in Telegram transport/connection ownership, and extended outgoing file safeguards. Native `/secret` and `/cancel` menu/help entries are present. No Pi API extension or dependency/version change was needed; metadata uses the existing authenticated follow-up route, never console steering. No data content enters that route. Documentation of exact user-visible behavior and privacy limits is in [the user guide](user-guide.md#native-secret-files-063).

Thirteen new dummy-data tests plus the updated menu expectation cover exact UTF-8/whitespace, byte counts, modes, Git ignore/tracking, no-clobber and symlink/hardlink/upload refusal, native input suppression, owner/private/prompt binding, stale/reloaded prompts/media/edits, blocked download/question/feedback coexistence, prompt-send races, deadline/timer expiry, cancellation/Stop/disconnect/assignment verification, deletion failure without retries and write failure without deleting input. Existing follow-up routing/receipt tests remain unchanged and pass. First full run correctly caught the old menu expectation; it was updated for the new native commands. Final validation: typecheck and **247 tests** passed with no skipped tests, full audit zero vulnerabilities, pack dry-run and diff checks passed. The working tree also contains separately concurrent skill documentation edits, preserved without modification by this task.

Storage uses async content-free preflight followed by a bounded synchronous temporary-file write/fsync and atomic no-clobber hard-link publication. JavaScript cancellation cannot interleave with publication, but synchronous I/O can block the event loop; local hostile filesystem writers and concurrent Git-index manipulation are not isolated by portable Node filesystem APIs. These protections are not an adversarial local-process sandbox. A crash/failed temporary cleanup can leave protected ignored data; directory-entry crash durability is not guaranteed. Bot API deletion is best effort, not Telegram retention proof. Interruption after commit may suppress confirmation/agent notification without undoing the file. Refusing all outgoing hard-linked files is an intentional compatibility tightening. Filesystem-capable agents can later read saved plaintext despite metadata guidance.

No real secrets were read, no live Telegram/API requests or owner messages were sent, and no installation, reload/restart, commit, push or publication was performed. Main must independently scrutinize the security boundary and residual risks before activation. Automated tests do not establish live Telegram visibility/deletion or Windows ACL guarantees.

## 0.6.2 released — verified

Public npm `latest` is **0.6.2**, released from [`2db09f05b17233320a3a9a42ec2f11a132db1c1e`](https://github.com/mbundgaard/pi-telegram/commit/2db09f05b17233320a3a9a42ec2f11a132db1c1e). [CI 38955575579](https://github.com/mbundgaard/pi-telegram/actions/runs/38955575579) and [Trusted Publishing 38955587978](https://github.com/mbundgaard/pi-telegram/actions/runs/38955587978) succeeded. Exactly one new publication dispatch followed the repository-metadata correction below; no version bump or duplicate trigger. Registry visibility initially lagged workflow success, then latest and version metadata confirmed 0.6.2 without retrying publication.

All **42 published files** byte-match that release commit. Downloaded tarball SHA-1: `35f61864d06b1e16bbff639ec7bc5afcdee1c9eb`. Computed SHA-512 matches registry integrity `sha512-+xgAfnK4L+okbwiuLheGE6WBCglItcxwv14oDUtjjiyrUYPrWiwm3jXjlIJxE7b5NEMzaKzCeWjUZwkEbNvFhw==` and the decoded SLSA subject digest. Decoded SLSA v1 links `mbundgaard/pi-telegram`, `.github/workflows/publish.yml`, the exact release commit and run **38955587978**, attempt **1**. This verifies hashes and payload linkage, not independent DSSE/certificate-chain/Rekor cryptographic verification.

Final local checks passed typecheck, **234 tests** (none skipped), full audit **zero vulnerabilities**, pack **42 files** and diff checks. A freshly rebuilt local artifact also byte-matched all 42 tree files before publication. CI and publication validation succeeded. No running installation, reload, restart, live bot tests or external messages were performed; prior two-session/host-cancellation/adverse-network limitations remain. The immutable published tarball retains its pre-publication documentation snapshot; this later documentation checkpoint does not change it. Do not republish 0.6.2.

## Historical 0.6.2 publication diagnosis — repository transfer metadata correction

[Publish run 38954614689 attempt 2](https://github.com/mbundgaard/pi-telegram/actions/runs/38954614689/attempts/2) acquired an OIDC token but failed with E422; the old filter omitted the detailed reason. Registry checks still found latest 0.6.1 and no 0.6.2. Public GitHub metadata identifies the transferred repository as `mbundgaard/pi-telegram`, while package repository/homepage/issues and source release-notes metadata still named `comput-sh/pi-telegram`.

[npm provenance documentation](https://docs.npmjs.com/generating-provenance-statements/) requires package.json's public repository to match the publishing repository **case-sensitively**. [npm CLI provenance generation](https://github.com/npm/cli/blob/latest/workspaces/libnpmpublish/lib/provenance.js) derives the workflow repository and source dependency from `GITHUB_REPOSITORY`, not package metadata. This establishes a concrete violated publication prerequisite consistent with E422, not recovery of the filtered server reason. Corrected those four current metadata URLs; historical release evidence remains unchanged. Added narrowly selected E422 error-line diagnostics with credential and URL query/fragment redaction, never raw HTTP logs. No credentials or private HTTP logs were inspected.

Fresh correction validation passed typecheck, **234 tests** (none skipped), full audit **zero vulnerabilities**, pack **42 files**, and diff checks. Version remains 0.6.2 because it has not been published; one corrected dispatch is authorized after another registry absence check. No running installation/reload/restart, live Telegram tests or external messages.

## Historical 0.6.2 candidate preparation — audit blocker resolved, not published

Registry checks found public latest **0.6.1** and no published 0.6.2. Package/lock root versions are now **0.6.2**, a local candidate only. This supersedes earlier source-version/audit gates below without rewriting their historical evidence.

Scope: silent startup/resume/reconnect; native owner `/ping`; explicitly requested new-Telegram-runtime reload acknowledgement; inert original-byte voice intake. Removed refusal-only `/restart` from native menu/help and user command advertising, retaining safe native refusal and internal investigation. Process restart and instance-following remain unsupported. The preparation request reports original-format voice preservation locally verified in the prior owner workflow; no live sample was inspected here and no transcription/cloud behavior was added.

Actual 0.84.4/0.87.1/1.3.0 runner and AgentSession implementations were checked: context getters return the stored session manager and reload constructs a fresh runner with the same manager and explicit reload lifecycle reasons. Documented baseline: Pi 0.84.4+, candidate tests use 1.3.0, Node 22.19.0+. Standard `*` peers follow Pi package guidance, not universal compatibility. Missing reasons/replaced manager suppress acknowledgement; no full-host reload-success guarantee or live activation claim.

**Audit remediation completed:** targeted sharp **0.35.5** fixes the production finding. The initial development SDK 0.87.1 candidate fixed undici but its shrinkwrap retained vulnerable brace-expansion 5.0.9; ordinary update/audit-fix and a subsequently removed scoped override did not resolve it. Under the authorized development-tool remediation, the development SDK is now **^1.3.0**, locked to stable registry latest **1.3.0** at review. Its published tarball has **no npm-shrinkwrap.json** and directly pins **brace-expansion 5.0.12** and **undici 8.10.2**; installed minimatch 10.2.6 also deduplicates to brace-expansion 5.0.12. This removes, rather than bypasses, the obsolete shrinkwrap constraint. The package's declared Node engine remains **>=20.9.0**; the documented supported runtime baseline is **22.19.0+** to satisfy the examined Pi hosts. Reviewed published extension/SDK/package/TUI documentation, exported declarations, reload example and actual runner/reload implementation; all existing source and tests compile and pass unchanged. Standard `*` host peers remain per current Pi packaging guidance, with the documented minimum and tested version rather than universal compatibility. No forced fix, suppression, manual dependency patch or runtime feature change. Both full and production audits now report **zero vulnerabilities**.

Candidate validation: `npm run validate` passed typecheck and **234 tests**, zero failures/skips, on Node **22.23.3** / npm **10.9.9**; `npm run pack:check` lists **42 files**; `git diff --check` passed. After a clean `npm ci` with SDK 1.3.0, full and production audits both report **zero vulnerabilities**. The README wording initially failed the historical public-baseline assertion; clarified the still-public 0.6.1 baseline and reran all tests, without weakening that test. Local tarball `artifacts/comput-pi-telegram-0.6.2.tgz` is Git-ignored; all 42 package entries are checked byte-for-byte against the candidate tree, including `src/reload-intent.ts` and the retained refusal module. Only source, skills, the three allowlisted guides, README/changelog/license and package metadata are included; no runtime state, credentials, tests or node_modules. No commit, push, tag, publication, running-Pi installation, reload, bot tests, external messages or task spawning. Development-checkout npm installs were exclusively for audit remediation. Existing unrelated changes and private runtime directories were preserved, not inspected or packaged.

## Historical explicit Telegram reload acknowledgement — implemented, unreleased

Main accepted the narrow statement `Telegram reloaded · v<loadedVersion>`: a fresh Telegram factory loaded and its same verified assignment is ready, not full Pi/core/UI reload success. Native authenticated `/reload` now uses a bounded, random, one-use, 30-second process-owned Symbol namespace handoff, exact canonical project/session-manager/session/bot/owner/credential-fingerprint binding, reload shutdown/start reasons and different factory generations. Internal command names alone grant no authority; busy/pending/download/update guards, Stop/disconnect cancellation, fresh outbound identity/readiness/expiry checks and consume-before-send prevent stale notices/replay. Ordinary startup/reconnection stays silent; updater reload still uses `/ping` guidance. No files, tokens, message contents or inherited environment state are stored.

Implementation and test evidence are described in [`reload-completion-review.md`](reload-completion-review.md). Fresh `npm run validate` passed typecheck and **234 tests** (no failures/skips); `npm run pack:check` passed (**42 files**), and `git diff --check` passed. Native-to-fresh-factory tests cover success, one-time delivery, original-runtime failure and changed owner/credentials/session-manager/lifecycle reason; helper tests cover exact binding, expiry and duplicate/same-factory rejection. No live reload, installation, outward messages, task spawning, dependency/version changes, commit, push or publication. Current audit findings below are unchanged.

### Historical design-only checkpoint (superseded)

Read-only Pi **1.0.4** review found a concrete success-boundary ambiguity: new-runtime `session_start(reason: "reload")` precedes remaining core/resource and interactive reload work, and the interactive reload handler catches failures without returning a failure result. Neither fresh startup nor fulfillment of `ctx.reload()` proves full Pi reload success. Lifecycle reasons exist in both examined 1.0.4 and checkout 0.84.4 declarations; missing reasons are not the blocker.

[`reload-completion-review.md`](reload-completion-review.md) records exact evidence and two options: explicitly narrow completion to **new Pi Telegram runtime loaded and verified ready** with a bounded process-owned handoff, or obtain a correlated host completion result after all reload work. No handoff, success notice, updater wording change or new lifecycle tests were implemented. Existing voice/ping/restart-refusal changes are preserved. Fresh typecheck/**226 tests** (none skipped), pack **41 files**, and diff checks passed; no live reload, installation, external messages, commit/push/version bump or publication.

## Restart re-review and current release gates

Source-only re-review of installed Pi **1.0.4**, herdr **0.9.1** help/schema and tagged herdr **0.9.1/0.9.5** launch source found that public idle shutdown and canonical `agent start` are usable; lack of a Pi restart API is not the blocker. Executable routing can be an explicitly accepted shell compatibility assumption. However, current launch submits quoted text plus Enter without an empty-shell-line/input reservation or conditional exact shell/cwd identity contract. No functional restart/helper was implemented, and the existing refusal-only work was not expanded.

The source checkout's `docs/restart-capability-review.md` records concrete alternatives: explicitly approve a reduced-guarantee exclusive conventional-shell mode, obtain a conditional upstream launch boundary, or defer restart while reviewing other changes. It includes exact evidence, minimal proposed API semantics, required helper tests, and a proposed separately authorized live test/recovery plan. Main must choose the contract; a fake success lifecycle over mocks would not resolve these external guarantees.

Fresh validation passed typecheck and **226 tests** (zero skipped), pack **41 files**, and diff checks. **Release audit gate failed:** full audit reports **4 vulnerabilities (1 moderate, 3 high)**; production-only audit reports **1 high** in `sharp` (fixed range starts at 0.35.5). Other findings involve development-tree `brace-expansion` and `undici`/Pi. No dependency installation or automatic audit fix was performed. Earlier clean-audit checkpoints remain historical; release readiness is not approved. No runtime changes, live restart/launch/pane mutation, installation, external messages, commit/push/version bump or publication in this re-review.

## Silent startup and native ping — unreleased source

Removed the automatic Connected send entirely from connection initialization: passive startup, resume, reload and retry/reconnection are silent. The old notice-acceptance readiness requirement is intentionally superseded. The saved paired bot identity/owner/assignment and host-local lease remain checked; successful webhook/backlog/poll initialization establishes readiness without any sendMessage dependency. Initialization failures still release/retry, webhook refusal remains, and command-menu configuration remains bounded, best-effort background work. Local UI status, explicit setup confirmations, critical errors and update offers are unchanged.

Native owner/private `/ping`, registered in menu/help alongside `/status`, replies `Pong · project · vLoadedVersion`. It uses the captured package version and project basename, without Git or host/IP calls. It creates no Pi input, receipt, steering or file/Stop authority and works while the model is busy. The connection-bound effect checks readiness, connection/epoch/session and lease at execution; disconnect aborts transport and stale work cannot send via the replacement. Exact feedback prompt replies remain literal feedback. `/status` retains detailed host/branch output. The updater now directs users to `/ping` after reload.

Tests cover silent initialization/reloads/recovery, failed initialization retry, slow/failed menu independence, native busy ping without model/file authority, owner/private filtering, loaded version, and queued stale/session/disconnected/replacement suppression. Prior restart refusal-only, inert voice intake and blocked instance-following work remain intact. No Pi API changes or new dependencies. No installation, reload, live Telegram requests, version bump, commit, push or publication; main review required before activation.

Validation: `npm run validate` passed TypeScript typecheck and **226 tests** (zero failures/skips); `npm run pack:check` passed with **41 files**; `git diff --check` passed. These are mocked/local checks, not live activation or network visibility evidence.

## Instance-following assignment — blocked design investigation (not implemented)

The requested explicit setup choice, **Bind to this session** (existing default) versus **Follow this Pi instance**, is not implemented. No assignment schema, setup UI, startup routing, lease or request-authority behavior changed in this investigation. Existing persistent-session assignments remain the only supported mode. In particular, an unassigned bot is not eligible for passive startup.

Read-only review covered configuration, assignment CAS/rollback, setup flows, connection ownership monitoring, extension startup/shutdown and response routing, settings locks and runtime leases. Installed Pi **0.87.1** extension documentation and **1.0.4** extension/SDK/session documentation, exported extension declarations, and `reload-runtime.ts`, `event-bus.ts` and SDK `13-session-runtime.ts` examples were examined. These installed files are reference evidence, not verification of the parent's loaded host; this checkout's test SDK is **0.84.4**.

**Unresolved prerequisite:** the examined public extension API does not establish a process-lifetime, non-inheritable identity/state slot that survives extension-runtime replacement. `session_start` and `session_shutdown` expose lifecycle reasons in 1.0.4, but no handover capability or process-instance identifier. The SDK documents that new/resume/fork replace the active `AgentSession` and recreate services, and extension documentation explicitly invalidates old contexts on replacement/reload. `withSession` supplies a fresh context only for a replacement initiated through that command API; it is not a hook covering ordinary user switches or reload. `pi.appendEntry()` is durable session data, not process-local authorization. `pi.events` is an inter-extension communication API, not a documented lifetime store. Neither retained factory closures nor module-cache/event-bus identity may be assumed to survive these boundaries.

A Node-owned `globalThis`/`process` singleton could be separately evaluated, but it is not an established Pi lifecycle/state contract in the examined references. This investigation did not introduce one, mutate environment variables, derive reusable authorization from PID/start-time heuristics, or persist a session-file bearer capability. This is a blocker under the requested supported-host-API requirement, not a claim that a separately specified process-local mechanism is impossible.

### Required design before implementation

- Obtain a documented host-owned identity/handover contract (or explicit review and approval of an alternative process-local state mechanism). It must survive new/resume/fork/reload, distinguish concurrent runtimes where applicable, and disappear on true process exit without being inherited by a child process.
- Keep session binding backward compatible and the first/default explicit setup choice. An instance binding must be a distinct tagged assignment, never `sessionId: null` interpreted as available. Passive startup must require a matching live instance capability plus the canonical project scope; unknown identity must refuse, not silently downgrade to session binding.
- Preserve credentials after exit/release. After true exit, an instance-bound bot requires explicit local selection and transfer confirmation in the next process. Cross-project switches must disconnect and must not extend authority; any return-to-project policy needs an explicit specification.
- Bind every activation to a fresh session/connection generation. Shutdown must retire receipts, buttons, drafts, Stop/file authority and downloads before new-session activation. Old callbacks/queued replies cannot gain authority over the replacement session, even when the bot is unchanged.
- Extend the locked assignment snapshot/CAS, rollback, release, removal, startup retry and ownership monitor consistently. The existing host-local polling lease is still required: exclusion is not permission to claim an instance binding. A transfer must invalidate the previous capability; failed rollback must not resurrect a superseded owner.
- Add mocked tests for both modes, independent processes, every lifecycle reason including fresh extension factories, cross-project switches, cancellation, stale queued replies/uploads, transfer/release/removal/rollback and legacy settings. No instance-following tests or live claims are warranted until the identity prerequisite is resolved.

Validation of the unchanged runtime plus documentation checkpoint: `npm run validate` passed typecheck and **225 tests** (zero failures/skips); `npm run pack:check` passed with **41 files**; `git diff --check` passed. These are existing regression checks, not evidence for the unimplemented binding mode.

This is a documentation-only blocked checkpoint, not partial feature completion. Existing voice intake and refusal-only restart changes are preserved. No credential settings or hidden runtime directories were inspected; no live setup, polling, Bot API calls, installation, reload/restart, external messages, commit, push, version bump or publication was performed. Main review and a supported identity decision are required before implementation/activation.

## Unreleased incoming voice-note intake

Only `message.voice` joins private owner document/photo intake; `message.audio`, video notes and other media remain unsupported. The existing download, getFile, timeout/cancellation, inbox quotas/path safeguards and authenticated follow-up flow are reused. Original bytes are stored inertly as generated `*-voice.bin`; bounded claimed MIME/duration are retained in the agent receipt as untrusted metadata alongside actual byte count, never as codec proof. Missing/invalid claims become unknown; arbitrary MIME text is not forwarded. No file IDs or raw updates enter the receipt. Captions remain instructions, not commands; captionless notes ask for instructions before inspection. No automatic decoding/transcription, provider or dependency added.

Validation: typecheck and **225 tests** passed (none skipped), `git diff --check` and pack dry-run **41 files** passed. Mocked coverage includes owner/private admission, caption/captionless handling, missing/misleading/invalid metadata, inert bytes, size/quota cleanup, cancellation/disconnect isolation, concurrent text/extra attachments and continued audio/video rejection. Existing refusal-only restart work is preserved. No live Bot API/download/sample, reload, install or publication; real voice-sample testing remains pending. Version/dependencies are unchanged.

## Unreleased native `/restart` — refusal-only capability boundary

Native owner/private-chat `/restart` is registered in the menu and help, but **process restart is not enabled**. It is distinct from `/reload` and never enters model input, queues a turn, waits for idle, invokes shutdown, spawns a helper, or mutates a pane. Refusals leave the current Pi usable. Repeated requests cannot arm a later restart. No new dependency or required herdr installation.

Admission checks cover current ready connection/session, host idle/pending work (missing pending API refuses), Telegram receipts not yet begun, downloads, and approved/in-progress package updates. Linux, TUI mode and `HERDR_ENV=1` are necessary hints only, never proof that this process occupies a pane. Background processes can inherit those markers. Stale connection callbacks refuse. No claims are made about peer-extension task cancellation or atomic host admission freezing.

Read-only investigation used installed Pi **0.99.2** extension/CLI/session docs and extension declarations, plus herdr **0.9.1** help, bundled skill and API schema. The loaded session host can differ; version alone does not enable capability. `pane current --current` and `pane process-info` can expose pane identity, shell PID, foreground process group and processes; these would require correlation to the original process identity, not the investigating background process. No live pane data or process argv/environment was dumped.

**Critical unresolved launch guarantee:** supported `herdr agent start NAME --kind pi --pane ID [--timeout MS] -- ARGS...` uses the canonical `pi` command in an existing interactive shell. It has no explicit executable/cwd override or read-only attestation of that shell's command resolution. The process-info schema does not expose aliases/functions/hash/PATH resolution for the shell's next command. Resolving `pi` in a helper or checking the current Pi executable cannot prove that this shell will launch the intended updated ordinary interactive Pi. No private endpoint, guessed flag, shell-input probe, or `pane run` fallback is acceptable. Therefore all otherwise-eligible requests refuse before session inspection or shutdown; no partially armed helper is shipped.

To enable later: prove the original Linux foreground Pi and stable shell/pane identity, the exact saved session file/header/ID and canonical project cwd, and the updated launcher as resolved by the same shell; reject ambiguous launch flags and never replay initial prompts or use `--continue`. Then implement a directly spawned detached helper with no terminal inheritance, bounded readiness and exit deadlines, process-start identity/PID-reuse checks, same-pane occupancy/cwd rechecks, one-shot launch and bounded private diagnostics. Pi's documented `ctx.shutdown(): void` is a request, not an acknowledged exit/cancellation protocol; cancellation/timeouts must disarm relaunch, not leave a helper that restarts after a later unrelated exit. Own-input fencing and idle/pending rechecks do not freeze other host producers. These are **unimplemented prerequisites**, not tested guarantees.

Validation: `npm run validate` passed typecheck and **218 tests** (none skipped); `git diff --check` passed; `npm run pack:check` passed with **41 files**, including the refusal module and no private runtime artifacts. Mocked tests cover refusal policy, pending receipts, owner/private routing, duplicate requests, download refusal, menu registration, and stale/session-replaced connections. Helper readiness, graceful exit, session-file/cwd validation, launch arguments and uncertain launch outcomes are not implemented or validated. No live restart, shutdown, launch, pane mutation, installation, reload or publication was performed.

## Released 0.6.1 — verified checkpoint

Source package and lockfile root versions are **0.6.1**; dependencies are unchanged. This preparation includes the busy-console routing fix below and native `/feedback` with the owner-approved `https://feedback.comput.sh/` endpoint. Explicit one-use Submit consent, feedback/version-only payload and owner/private-chat safeguards remain unchanged. Endpoint tests intercept HTTP; no live feedback submission is claimed.

Public npm `latest` is **0.6.1**, released from [`bcdec735cb12f0e73f3bdaa2e5b19a1772bbaf02`](https://github.com/comput-sh/pi-telegram/commit/bcdec735cb12f0e73f3bdaa2e5b19a1772bbaf02). [CI 36313665938](https://github.com/comput-sh/pi-telegram/actions/runs/36313665938) and [Trusted Publishing 36313671023](https://github.com/comput-sh/pi-telegram/actions/runs/36313671023) succeeded. The existing workflow was dispatched exactly once; no GitHub release trigger was added.

Independent download verification found **40 files**, all byte-identical to the release commit. SHA-1: `06659ab7ae5bd235963f342b86ef422a93bea16b`. Computed SHA-512 matches registry integrity `sha512-cFsJYkfztdSINl8l2EQSwvdv6mNa8nvDudnakvoQ+Vsp+0fAcKcRQx0uH3fVV++ef30xi8FCm28XtK3pH1K0jw==` and the decoded SLSA subject digest. The SLSA v1 payload identifies `comput-sh/pi-telegram`, `.github/workflows/publish.yml`, the exact release commit and run **36313671023**, attempt **1**. This checks hashes and decoded provenance linkage, not independent DSSE/Sigstore certificate-chain/Rekor verification.

No installation, reload or live feedback submission was performed; live routing activation remains unverified. Historical release/source checkpoints and accepted live-test limitations below are preserved. The immutable published tarball contains its pre-publication documentation snapshot; this documentation-only checkpoint does not change it. Do not republish 0.6.1.

Local validation passed: `npm run validate` (typecheck and **213 tests**, zero failures/skips), `npm audit --audit-level=moderate` (zero vulnerabilities), `npm run pack:check` (**40 files**) and `git diff --check`. The local artifact is `artifacts/comput-pi-telegram-0.6.1.tgz`. Packaging uses the existing source/skill/docs allowlist plus npm's package metadata; hidden runtime directories, credentials, tests, dependencies and local artifacts are excluded. `artifacts/` is Git-ignored. These local checks were rerun before commit; release-commit CI/publication evidence is recorded above. They do not prove live activation.

### Independent follow-up routing

Ordinary owner text and explicit `/steer` now use Pi's `followUp` delivery when busy work has no current Telegram destination, rather than emitting the local-console refusal. This queues a later turn in the same Pi session, never steering the unrelated console task. Authenticated active Telegram work still receives steering. Intake remains asynchronous with no queued acknowledgement; mere enqueue/input admission does not grant console work Stop/file/reminder authority. Existing stale-receipt and connection boundaries remain. No other extension is detected or integrated. Automated extension integration tests exercise queue admission before later user-message start; live activation is unverified. The released 0.6.0 evidence below describes the earlier behavior.

## Historical released 0.6.0 — verified checkpoint

Public npm `latest` at that checkpoint was **0.6.0**, released from `9ab9c133daeef0f23b96b7afefe773581bca0c87`. CI **36181107612** and Trusted Publishing run **36181188483** succeeded. The earlier attempt **36180596310** failed validation; its publication step was skipped.

Independent download verification found **38 files**, all byte-identical to that release commit. SHA-1 is `e0f8a6c455c65c91386a3e03c5ae11cc6e2758d3`. Computed SHA-512 matches registry integrity `sha512-BlLloQEmVOd8DgktFvOVVntA9cOGto26JlfRIIzx4JxLI929d5Y+s2/9Y1+mGGmYDgG1HLnmYzgCMfXhLertsg==` and the decoded SLSA subject digest. The SLSA v1 payload identifies `comput-sh/pi-telegram`, `.github/workflows/publish.yml`, the exact commit and run **36181188483**, attempt **1**. This verifies hashes and decoded payload linkage, not an independent DSSE/Sigstore certificate-chain/Rekor verification.

Final validation passed typecheck and **195 tests** (none skipped) under Node22/npm10 and isolated Node24/npm12, audit with zero vulnerabilities, pack38 and diff checks. The additional test-only fix handles npm12's name-keyed pack JSON alongside the earlier array format, rejects malformed/multiple/empty package results and preserves all package safety assertions. No runtime/dependency change was needed.

The Trusted Publisher mapping is now verified working through actual publication. Installed/shared npm remains **0.5.0**: source testing and the user-reported reload are not an npm installation. This release did not install or reload anything. Live observations and accepted limitations below remain scoped; the original busy-console guard is not fixed.

The immutable published tarball contains the pre-publication documentation snapshot. This post-publication checkpoint is a later documentation-only update, not a new package or permission to republish 0.6.0.

## Historical pre-publication checkpoint — 2026-09-25

At this checkpoint, candidate package metadata is **0.6.0**; publication is pending final checks and CI. Public npm and the shared npm installation remain **0.5.0**. Development source is activated in a single testing session; this is not a new npm installation or publication. New Post/Draft/Edit/Activity tools, Thinking lifecycle, typing diagnostic, omitted-reply reminder and bundled usage skill are unreleased. Do not instruct npm 0.5.0 users to call those tools.

The published 0.5.0 release added state-based incoming text, literal leading bangs, no queued acknowledgements and concise inbound guidance. Its generic `telegram_send` API remains documented in the changelog. Release provenance and exact historical installation checkpoints are preserved in the repository's [AGENTS.md](https://github.com/comput-sh/pi-telegram/blob/main/AGENTS.md); later source testing does not rewrite those release-time facts.

Historical 0.4.1 switched previews from Rich Drafts to plain `sendMessageDraft`, bounded to 4,096 characters with marked truncation, while retaining full snapshots for prefix matching/final persistence. The owner confirmed that single-session plain-preview/replacement/finalization test. The unreleased explicit API instead uses returned draft references and full replacements, without prefix inference.

Request-driven embedded action buttons and advanced-layout recipes are a further unreleased addition. They do not change public/shared npm 0.5.0. Builder, Transport and independent Reviewer passed typecheck, **193 tests** (none skipped), pack dry-run **38 intended files**, and diff checks, with no new dependencies; independent advanced-layout review approved. The owner subsequently observed inline and row button rendering, clicks and disabled states, compact tables and expandable quotes on an updated client using prior loaded source. These observations do not verify the post-rollback checkout. These results supersede the historical validation counts below, not their scoped live observations.

## Scoped owner observations

The owner confirmed single-session Post/Edit/Draft behavior with the expected two saved messages, and a button follow-up repeating the draft test. Typing alone with a requested 12-second window looked good. Thinking alone with 12-second refresh was clear and expired naturally.

Two explicit **start → stop → handoff → update → finalize** tests were described as “perfect”; visible Thinking lasted about 12–15 seconds despite a deliberate 3-second pause. Latency was not measured, so no cause is attributed. A later test after a user-reported reload confirmed direct handoff without stop, as recorded below. Per-call tool acceptance remains distinct from seeing a client's UI.

The owner also observed live omitted-reply reminder injection on prior loaded source. This is scoped evidence, not post-rollback activation or proof of every suppression race.

### Latest user-reported reload observations

The owner reported single-session Post/Edit/Draft update/finalize and Working clear as “perfect”, and **direct Thinking start → handoff → update → finalize** as “perfect”. Inline callback placement and both choices becoming disabled were “perfect”; compact tables and expandable quotes were “nice”. The omitted-reply reminder actually fired and a reply was posted. These observations follow a user-reported reload; the loaded source path was not independently verified. They do not repeat row-callback testing or prove exact timer duration/no-loop behavior.

The owner explicitly declined two-session testing and accepted it as an untested release limitation. Host cancellation, adverse-network behavior, skill discovery/adherence, and complete photo/reception/setup-completion/update-button/install smoke tests remain unverified. Automated mocks do not establish these results.

## Historical 0.6.0 source independence and steering limitation

The proposed cross-extension steering integration was withdrawn and removed before activation. Pi Telegram uses only its own authenticated receipts and ordinary Pi host APIs. Unknown user-message input clears the current Telegram request association; while that turn is busy, Telegram steering may receive the existing local-console refusal. No replacement steering design is implemented. Request-bound file, Stop and reminder authority remain unchanged.

The local source-launch artifact is Telegram-only and has not been executed. This rollback does not install or reload source, modify settings, or establish live behavior. Fresh rollback validation passed typecheck, **194 tests** (none skipped), package dry-run **38 files** and diff checks. The full production audit covered all 22 modules: own configuration/locks/inbox and Telegram API effects, Git safeguards/metadata, ordinary Pi host APIs and own npm updates only. Credential-like upload protection is now a case-insensitive generic `credentials.json` / `*.credentials.json` rule, retaining the previously protected suffix while broadening privacy protection. Independent rollback review approved with the same **194 passing tests / 38 package files**. All 22 production modules and 30 test files, distributed guidance, manifests, workflows and the unexecuted local launcher were audited; no peer-extension awareness remains. The original busy-console guard is restored. Rollback preparation itself did not change loaded copies. Later user-reported-reload observations are scoped above; they do not independently verify a loaded source path.

## Validation checkpoints

Before the onboarding work, independent lifecycle validation passed typecheck and **167 tests**, package dry-run **33 files**, and diff checks. Earlier 145-test/31-file, 156-test/32-file and 164-test/33-file results are historical, not the latest lifecycle count. Onboarding changes add guide packaging, prerequisite metadata and pairing-render tests. Fresh combined Builder and independent Reviewer validation passed typecheck and **174 tests** (none skipped), pack dry-run **36 intended files**, and diff checks. Independent onboarding review approved; narrow-terminal pairing-render coverage is automated only, not a live pairing or reload test. The lockfile changes only the root Node engine metadata; dependency versions and Pi peer ranges are unchanged. Pairing-render tests are mocked, not a new live pairing run.

The extension's own Node floor is now **20.9.0**, reflecting `sharp` 0.35.4, but that is not a claim current Pi runs on Node 20. The examined Pi versions 0.84.4 (test SDK) and 0.87.1 require **Node 22.19.0 or later**. Use the requirements of your installed Pi as well. Standard Pi peer ranges remain `*`; they are not a tested compatibility matrix. No new OS/architecture support claim follows from metadata or mocks.

## Release verification and future checks

The original candidate passed 194 tests; the npm12 pack-parser regression raised final validation to **195 passing tests**. Independent review, release-commit CI, publication and artifact checks succeeded as recorded above.

- Scope: breaking explicit Post/Draft/Edit/Activity API replacing `telegram_send`, Thinking lifecycle, omitted-reply reminder, requested layouts, optional skill, onboarding and transport isolation. See [migration](agent-tools.md#migration-from-050) and [release notes](../CHANGELOG.md#060).
- The owner-authorized **0.6.0** release is complete. Installation/reload remains separate; future version bumps, commits, pushes and publications require their own authorization.
- Trusted Publisher owner **comput-sh**, repository **pi-telegram**, workflow **publish.yml**, blank environment is verified working by the successful release; artifact hashes and decoded SLSA linkage are recorded above.
- Before any authorized release, rerun typecheck/tests, audit, package allowlist and diff checks on the final versioned tree. Exclude local artifacts, hidden runtime state and credentials; never stage the whole worktree indiscriminately. Current source checks are evidence, not CI on a release commit.
- Single-session observations after the user-reported reload include direct Thinking handoff and the flows listed above. Two-session testing was explicitly declined and accepted as untested; host cancellation/adverse-network behavior remain pending. Those 0.6.0 observations do not verify the 0.6.1 routing fix or its live activation.
- After separate commit/push/publication authorization, verify workflow success, public registry version/tarball and exact commit/workflow provenance. Do not retry publication merely because registry visibility lags. Installation/reload and live verification are separate operations.

## Contributor checks

In a **terminal**, from the package checkout:

```bash
npm ci
npm run validate
npm audit --audit-level=moderate
npm run pack:check
git diff --check
```

Source testing is an advanced alternative, not beginner installation. Avoid loading both the npm and source copies: inspect enabled resources with terminal `pi config` first. In a controlled source-only setup, terminal `pi -e .` loads this checkout. Keep the process running; reload changes only through deliberate local Pi `/reload`. Do not infer installation, reload, live testing or publication from an automated check.

Implementation background: [architecture](https://github.com/comput-sh/pi-telegram/blob/main/docs/architecture.md) and [Rich Message evaluation](https://github.com/comput-sh/pi-telegram/blob/main/docs/telegram-rich-messages.md). These developer references are online repository links, not required for normal setup.