## v1.23.0 (2026-10-20): a quiet session start and a guard inside its budget **SessionStart says only what this run must act on (AS-25).** The hook printed the full `status` at every startup, resume and `/clear`: 834 characters in the hub checkout (measured 2026-10-20), mostly the setup and other runs' residue, closing on "NEXT: acquire a lease", which the family's routing block already says and a read-only session never needs. It now runs `status --brief`: one line naming the leases this run holds, a lease held past `scheduledIntervalSeconds`, this run's own expired locks (with `reap`) and claim tags out of step with the leases, or nothing at all. The brief reads local state only (no record plane, no remote, no vault) and leaves the signal watermark alone, so the next `status` still shows what is new. It prints on `startup` only; `resume` and `clear` still stamp the session (the matcher keeps both, ASY-08) and print nothing, without starting python. `AGENT_SYNC_SESSION_VERBOSE=1` restores the full block; `status` is unchanged. Measured interleaved on this machine at load average ~470: startup 834 to 0 characters, median 1037 to 533 ms (p90 1399 to 853 ms, n=15 each); resume 920 to 63 ms median. **The PreToolUse guard answers inside its budget (AS-26).** In git lease mode the first write of a guarded file took that file's claim on the lease remote, synchronously: one or two `ls-remote` calls (1.6 s each to github.com) and a `push` with no timeout, plus a cloud record-plane append where one is configured. Measured against github.com, the 1.22.2 guard took 8.6, 8.9 and 10.9 s for three first writes; the 2026-10-20 audit saw 10 to 20 s against the hook's 20 s timeout, past which the host lets the call through anyway. The claim now runs in a forked, detached process and the guard waits for it only until `AGENT_SYNC_GUARD_BUDGET` (1.5 s from the coordinator's start by default; `0` restores the synchronous claim). Past the budget the write proceeds under the task lease; the claim then lands and leaves this run's local note, or records the run that holds it, and the next write of that file is refused from that record without a round-trip (rechecked after 60 s). A second write of the same file while the claim is in flight waits for that claim instead of racing it, and a claim this run already won is never reported as another run's. The acquire `push` is bounded at 60 s. Local leases on a local record plane are unchanged: they are a file create and are never backgrounded. Same three files on the same remote with 1.23.0: 4.0, 5.2 and 4.0 s, with the remaining time spent in local file writes on a machine at load average ~500 (two 50-byte writes profiled at 1.2 s). **The skill description is a router again (AS-27):** 445 characters, down from 936; every trigger the hub routes on (`lib/triggers.js`, route `agent-sync`) is still in it, in English and Russian, with the boundary and the refusal phrase. The "before editing a shared registry, even unasked" rule moved into the body. - Tests: `test/hooks_session_test.py` gains 8 cases (7 watched failing on `5bd8bec`); new `test/guard_budget_test.py`, 5 cases over a local bare remote with a git shim that slows `ls-remote` and `push` by 5 s (3 watched failing on `5bd8bec`: guard calls of 11.06 s, 5.51 s and 11.36 s). Both run in `npm test` and CI. - Not covered: the window between a write that proceeds and its claim landing; a run that writes a file another run claimed in that window is refused only from its next write. Trigger evals were not re-measured for the new description (backlog AS-28). ## v1.22.2 — active work keeps a lease alive - Automatic heartbeats renew only claims with recent guarded activity or explicit acquisition/renewal. Unrelated tool calls no longer extend every task indefinitely. Manual renewal remains intentional. The activity window is two renewal intervals; the configured lease TTL still controls exclusion from the last successful renewal. - A guard requires a live task and durable activity/binding metadata. Missing task ownership or an unwritable binding refuses admission while retaining the claim for explicit repair. Expired ambiguous task associations are cleared, not guessed. - Releasing a handed-off task releases its associated file claims without freeing another task's files. Incomplete authority release remains retryable; activity-file cleanup after confirmed release is best-effort and cannot resurrect a lease. - Document prompt release after a pushed PR handoff and distinguish dependency `signal` state from a cross-project board ask. Existing lease keys, arbitration, generations and wire payloads are unchanged. Old installed heartbeats retain their old behavior until upgraded. - Verification: 19 real CLI/fake-clock controls, including same-second metadata failures and a local bare Git remote. The source candidate passed 20 suites and all 75 existing negative plants before this synchronized packaging bump. ## v1.22.1 — the AS-18 commit fallback reads only a command Patch from a re-certification reading of 1.22.0 (`517b4b6`). **A PR body that mentions `git commit` is no longer a commit.** When a Bash command does not tokenise (an odd-quote heredoc), 1.22.0's AS-18 fallback in `bash_writes.py` counted the payload as a commit if `git … commit` appeared ANYWHERE in it — so `gh pr create --body "$(cat <<'EOF' … every git commit … a 12" display … EOF)"` with a guarded file staged and no lease was refused with "this commit … stages a guarded file". The fallback now reads only command text: backslash-newline continuations joined, each balanced `$(…)` and backtick span removed (quote-aware, nested), each heredoc body removed (from the `<` / `-c k=v`). **The fallback checks the repository the commit runs in.** `git -C commit …` and `cd && git commit …` now name that repository's index, not the payload's cwd. A directory it cannot name (`cd -`, `cd "$(…)"`, a `$VAR`, a path that does not exist) falls back to cwd, as `guard.sh` already did for a repo that is not a directory. - `test/coordination_test.py`: case "the untokenisable commit fallback reads only a git commit command" — **52 cases**. Against `517b4b6`, watched failing: the PR body exits 2 (want 0); `git -C commit` with the guarded file staged only in cwd exits 2 (want 0) and with it staged only in `` exits 0 (want 2); `cd && git commit` the same (0, want 2). The existing odd-quote `git commit -m "$(cat <<'EOF'…)"` case stays exit 2. - Blind reading of the first candidate (`ea936ae`, PR #33) failed it: it cut the command at the FIRST `$(` / `<<`, so a commit after a leading substitution was missed — main refused these, the candidate passed them. Added, each watched exiting 0 on `ea936ae` (want 2): `cd "$(git rev-parse --show-toplevel)" && git commit -m `, `MSG="$(cat <<'EOF' … it's "x … EOF)" && git commit -m "$MSG"`, `git add "$(git ls-files -m)" && git commit -m ` (at the parser, `(False, None)` on `ea936ae`, now a commit in cwd), and `git \ commit -m ` (continuation). Regression guards that pass on both: ``echo `date` && git commit -m `` exits 2; a heredoc body saying `git commit` is not a commit. - `references/hooks.md` "A commit" states the fallback; `guard.sh`'s capability matrix has a row for an untokenisable commit. README's `scheduledIntervalSeconds` row and the ledger's S9 row describe the held-too-long notice as one JSON object: `systemMessage` for the person, `hookSpecificOutput.additionalContext` for the model. - Not covered: what an untokenisable command stages before its commit (only the index is read); a `)` in a `case` pattern inside `$(…)` closes the span early; a heredoc opened inside a `$(…)` that closes on the same line keeps its body as command text. ## v1.22.0 — coordination that Fabric and Observatory can lean on Integration wave 3 of the family's 2026-10-11 waves run (hub plan R17–R22), and two fix rounds after blind verifiers failed the first candidate (`27f485a`) and the second (`e32c7c9`, PR #32). `test/coordination_test.py` joins `npm test` with **50 cases**. Against 1.21.7, 30 of the first 33 fail (13 on an assertion, 17 because the code they call does not exist there) and 3 pass — "an id really missing is still a leak", "a short key keeps its readable id" and "the same key is the same run every time" are regression guards. Against the first candidate `27f485a`, the 14 cases added in the first fix round all fail, as do the extended parser case and the long-expired case (its message changed from `> 7d` to `>= 7d`). Against the second candidate `e32c7c9`, the 17 cases added in the second fix round all fail (11 on an assertion, 6 with an exception — three call a function that does not exist there, one a function whose signature changed, one hits the very ImportError it pins, one parses the hook's empty output), as do the extended parser case and the vault-cache case. **`npm test` now runs every CI test suite, sandboxed.** It runs `test/run_gate.py`: every suite CI runs — the five it ran before, every `test/audit_regressions/*.py` (CI ran them and `npm test` did not, so CI went red on FIX-SY-04.02 behind a green local gate) and the installer test — each with its own temporary HOME and without CLAUDE_CODE_SESSION_ID, CLAUDE_SESSION_ID or AGENT_SYNC_RUN_ID, then checks that the HOME it was started with has the same `~/.agent-sync` files as before. A test run had written 14 files into the operator's real `~/.agent-sync/session-repos`: `claim_cell_test.py`'s `cli()` passed the real HOME and the live session id through, and `SESSION_REPOS_DIR` was resolved at import. Every suite now calls `test/_sandbox.py` first (a temp HOME that also holds its `mkdtemp` fixtures, removed at exit), `session_repos_dir()` reads HOME at each call, and the case "the suite never writes the HOME it was given" fails without the sandbox (watched: a sentinel HOME received 3 files). The other direction too: CI's `validate` job had never run `guard_uncoordinated_test.py` or `coordination_test.py`, which `npm test` did; it runs both now, so the two gates run the same set. ### Fix round 2 (second blind reading of `e32c7c9`) - **SKILL.md states the two write modes again (FIX-SY-04.02, CI red).** The compaction had dropped the paragraph its audit regression pins: a task lease authorizes the TASK, never the file; the resource claim is the short transaction lock; heavy overlap takes an isolated worktree + merge; the guard does NOT promise enforcement from a single task owner. Body 4726/4750 tokens (the `$SKILL_DIR` paragraph and the interval line trimmed). - **`git add X && git commit` in one call is guarded (AS-16).** The hook reads the index before the command runs, so X was not staged yet and the commit passed. The commit parser moved into `bash_writes.py --commit` (the same tokeniser as the write parse) and reads what the same command stages — `git add `, `-A`, `-u`, `.`, `git commit -a`, `git commit ` — asking `git ls-files` which files that is; those are checked with the index in ONE coordinator call. - **`status` names a token read from the file as degraded (unit B1).** `status` loaded the file, then Sync() loaded it again, found the token in the environment and relabelled it "from the environment". The source is now assigned once per process. - **The vault is asked once per process, and only where a token is used.** The decision is memoised per root before any child starts (risk b). `renew` and `release --held` no longer ask at all (seam S2/S3): the lease they act on is a local lock or a git ref, and what the token would add is one visibility line in the Notion claims log, whose readers apply the TTL anyway — while renew.sh runs after every tool call (two `use` audit rows per call once a slot existed) and SessionEnd has 2 s, which a probe and a re-run consumed. With the token in the plaintext file they still publish. A re-run keeps the hook's clock: the first process records its start in `AGENT_SYNC_HOOK_T0` before `execv` (risk a). The `run` probe is cached beside the slot answer (a pass for the hour, a refusal for a minute), and a missing slot is asked again after a minute even with no file token (risk g). - **A host without `fcntl`** no longer crashes `acquire` after the lease was won (seam S4). - **The guard is cheaper and gated on the repository that owns the write (seam S5/S6/S8).** `bash_writes.py --guarded` resolves each target's repository by walking to `.git`, drops every target no `guardedFiles` pattern matches, and the hook runs the coordinator once per owning repository with all its targets; `guard` memoises its read-only git questions; a Bash call spawns no interpreter until its payload carries a write shape (a `>`, or tee/sed/cp/mv as a WORD — `used` and `guarantee` no longer match) or `commit`; hook bytecode is cached under `~/.cache/agent-sync/pycache` instead of recompiled. Because the owner decides, a session rooted outside every coordinated repository that writes into one is refused at the write. renew.sh decides without reading stdin wherever it can and reads only the payload's first 4 KB otherwise. Measured interleaved against `e32c7c9` under load average ~45 (absolute numbers on this machine are noisy; the spawn counts are not): a coordinated two-target redirect with the lease held 244 ms (git 2, python3 3) vs 477 ms (git 10, python3 4); renew.sh on a 2 MB PostToolUse payload in an uncoordinated repository 8.1 ms vs 89.1 ms (medians of 15). - **`mv` writes its source too (seam S7)**, and the parser reads `<<\EOF`, `<( … )` and `>( … )`, `cd -L/-P`, `timeout`/`nice`/`stdbuf`/`xargs` prefixes, `sed --expression=`, `env -C DIR`, a `cd` in a pipeline or behind `&` (no move), `<>` (a write), and an absolute `cp`/`mv` destination directory whatever the current directory is (risk d). What it still skips is listed as UNPARSED in `guard.sh` and the module docstring. Its `main()` prefilter no longer misses `sed 's/;/x/' -i f` (risk c). - **A lease held too long is said where the session sees it (seam S9).** R19's warning printed only from `status` at SessionStart, when a fresh session holds nothing. The guard now emits it once per lease per run, as one JSON object with `systemMessage` (the person) and PreToolUse `additionalContext` (the model) — see the final polish below. - **Smaller corrections.** `init --backend outline` no longer says `set -a && . ./.env.agent-sync` (every command and hook reads the file itself); the generated wiring snapshot names the vault slot first for `notion`, the file only as a degraded fallback; `check` enforces the schema's `scheduledIntervalSeconds` minimum of 60; a lease ref is flagged keyless only when its payload parses as a JSON object without `key`, and the warning says it "was written by ≤1.21.2 (ts …)" — a date, not proof of a live writer; citations of project-observatory DECISIONS.md corrected to :2023 and :12873. ### Final polish (third blind reading of `6ab4c47`) - **`git commit --gpg-sign ` is guarded.** The AS-16 parser took `--gpg-sign` as an option with a value, so the pathspec after it was swallowed and the commit passed with a guarded file unleased; the key id attaches only as `--gpg-sign=`. Case added to "git add and commit in one call is guarded" (it fails on `6ab4c47`: the plan staged nothing). - **A heredoc commit message with an odd number of quotes is still a commit (AS-18).** The tokenizer closes a `"…"` string at the first inner quote, so such a message did not parse and the commit check was skipped, staged guarded files included (1.21.x skipped every heredoc commit). It is now checked against the index of the payload's directory. Case added; on `6ab4c47` `commit_plan` answered "not a commit". - **The held-too-long notice reaches the model, once (AS-21).** Claude Code shows a `systemMessage` to the person only, and it reads two JSON lines on stdout as a parse failure that drops both — which a Bash write into two repositories, each with a lease held too long, printed. The guard now prints one object with `systemMessage` and `hookSpecificOutput.additionalContext`, merging several repositories' notices. Cases "a lease held too long is said once where the session sees it" (extended) and "a write into two repositories says both notices in one object" — both failed on `7009bb9`. - **`main()` starts clean.** The git answer memo, the token source and the vault-degraded note are reset per invocation, so a second in-process call never sees the first's. - **Docs.** `fabric-coordination.md` names the real flag (`reserve --key `, not `--rkey`); this entry's feature list sits under its own heading. `npm test` runs every CI *test suite*: the validator self-test, the coordinator smoke test, the stray-SKILL.md check, `claude plugin validate --strict` and the `skill-audit` job stay CI-only. ### Upgrading to 1.22.0 mid-flight - **A session's run id changes.** Claude Code exports CLAUDE_CODE_SESSION_ID to every Bash call, and 1.22.0 reads it: a session whose Bash calls used the shared identity under 1.21.x now resolves to its own id, so a lease it took under the shared id looks like another run's. Release before upgrading, or let it expire. 1.22.0 does NOT adopt the shared entry's id on first sight of a session key — that would merge this session with whichever session last wrote the shared entry, the collision B-150 removed. - **The session list moved.** 1.22.0 keys the list of other repositories by the session (`~/.agent-sync/session-repos/.json`); a list keyed by project slug from a pre-release build is not read. Leases listed only there are renewed and released by hand. - **Observatory's tick changes identity across the upgrade.** `tools/tick.sh` exports `AGENT_SYNC_RUN_ID="ti$$-observatory-tick"`, and `tools/tick_lease.py` acquires and releases in separate processes, each importing the HIGHEST cached plugin version. That id is longer than twelve characters, so 1.22.0 derives a different run id from it (R17): a release under 1.22.0 of a lease acquired under 1.21.7 is refused as another run's until the TTL. Upgrade between ticks — let the running tick release first. - **Sessions started before the upgrade keep the old plugin.** CLAUDE_PLUGIN_ROOT pins the cache directory a session started with (1.21.0–1.21.2 are still in this machine's cache): restart those sessions; a keyless lease ref is what they write. - **Observatory's own config has no `scheduledIntervalSeconds`**, so R19's warning cannot fire there yet. Adding it is the Observatory owner's change (backlog AS-17). ### What changed - **A run id is unique per key (R17).** It was the first twelve `[a-z0-9]` of the key, so `observatory-scheduled-tick-1` and `-2` were one run (`r-observatorys`). Now a key that fits in twelve characters is kept whole, and a longer one keeps six readable characters plus six hex of a sha256 of the whole key (project-observatory DECISIONS.md:2023). Ids already stamped in a marker read back unchanged. **Upgrade effect:** a process that derives its id from a long `AGENT_SYNC_RUN_ID` (or session id) with no marker entry gets a different id than 1.21.7 gave it, so a lease 1.21.7 took under the old id is not this run's after the upgrade — release it before upgrading, or let it expire. A new session entry is also derived from the session id rather than minted at random. - **Ids print and match at the register's own width (AS-08).** A three-digit register (`CO-051`) was handed `CO-0051`, and every id it held was reported as a permanent leak. - **The description cap is the family's 970 (AS-10)**, not the spec's 1024, with a self-test plant in the band between the two. - **A lease held past the repository's scheduled interval is reported (R19).** The new optional `scheduledIntervalSeconds` names the interval; it is in `CONFIG_KEYS` and the schema, so `check` accepts it (the first candidate's `check` called it unknown). `status` warns when a held lease is older, measured from `since`, which `acquire` now writes and `renew` keeps. Observatory's scheduled tick stands aside while a lease is held (DECISIONS.md:12873). - **`reap --long-expired` (AS-11) — a sweep by age, and the operator's decision.** It lists locks on both planes expired at least seven days ago (`--older-than-days N`, at least 1 — `0` used to become 7 silently), each with the classifier's verdict and reason, and with `--apply` clears exactly those through the `--i-own-this` path: live leases refused, each payload printed and journaled, a younger entry of the same key on the other plane left alone. `--apply` or `--older-than-days` without `--long-expired` is refused. `references/lease-protocol.md` carries the dated amendment — reap otherwise never touches foreign state — and `SKILL.md` says `--apply` is never an agent's call. `status` counts candidates in the lock directory only, and says so. - **The `notion` token comes from the Observatory vault first (R20).** A command that touches the record plane, with no token in the environment, re-runs itself under `use_secret.py run --vault-only AGENT_SYNC_NOTION_TOKEN`, so the value never reaches argv. Fixed after the first candidate: `guard`, `write-targets` and `whoami` (and since fix round 2 `renew` and `release --held`) never ask the vault (a vault whose `where` said yes and whose `run` refused locked every Edit, Write and commit with exit 2); `run` is probed with a no-op child before the re-run, and a refusal falls back to the file and is reported; the project is the main worktree's folder (or the remote's name), not the checkout's, so a linked worktree finds its slot; a positive `where` is cached for the hour (a negative for a minute, or the hour while the file still holds a token), and the `use_secret.py` path is cached too; the config's own `backend` counts; the argv of this invocation is the one re-run. A token read from `.env.agent-sync` is reported by `status` as `degraded: plaintext token file` with the `vault.py put` command. `init --backend notion` prints vault-first steps and no longer tells anyone to `source` the file. Vault-first is `notion`-only in this release; `outline` is an open board row. - **A lease in a second repository is renewed and released (AS-07).** `acquire` lists the repository under the SESSION — `~/.agent-sync/session-repos/.json` — and the renew and SessionEnd hooks pass `--session-repos`. Fixed after the first candidate, which keyed the list by `CLAUDE_PROJECT_DIR` (absent from a Bash tool call, so nothing was ever registered from one, and shared by two sessions, so one's SessionEnd dropped the other's repository) and ran every repository in one process (so repository X inherited P's backend, URL, collection and token): each listed repository now runs in its own child process, in parallel, from the environment the hook started with, inside the hook's budget; one failing repository never strands the rest. The identity order gains `CLAUDE_CODE_SESSION_ID` — what Claude Code exports to every Bash call — and the hooks hand the payload's session id to the coordinator, so a shell and a hook resolve one run in a repository no SessionStart stamped. bash and Python name the list file identically for long and non-ASCII keys under any locale. - **The guard sees Bash writes (AS-09).** Into a coordinated repository, `>`, `>>`, `>|`, `&>`, `>& FILE`, `tee`, `sed -i`, `cp` and `mv` into a guarded file need a lease. The parse lives in the small `scripts/bash_writes.py`, because the hook runs on every Bash call. Fixed after the first candidate: it tokenises before it segments, so a heredoc's body (`cat > notes.md <<'EOF'` followed by `> docs/ROADMAP.md`) and a quoted `;` or `|` are no longer read as commands; `( … )` subshells, `cd -` (stop following), `env`/`sudo`/`nohup` prefixes are handled. `$VAR`, backtick and glob targets stay unparsed, and the capability matrix in `guard.sh` lists exactly the shapes the tests cover. - **A full disk no longer locks every Bash call (found live, 2026-10-12).** `guard.sh` fed its parsers through bash here-strings, and bash 3.2 (macOS) writes a here-string to a temp file. With the disk full, the parser read nothing and the guard failed closed: every Bash call was refused, including the cleanup that would have freed space. Payloads now travel through pipes and process substitution, which need no file. The case "the guard needs no temp file to allow a harmless command" runs under `ulimit -f 0`, and 1.21.7 failed it with the exact message seen live. - **Fabric conformance map (R21).** `references/fabric-coordination.md` maps each operation of `fabric-agent-contract@bcada4a` `coordination.md` to the command that implements it (Fabric names no reference implementation). A test checks every named command exists. The gaps are listed: idempotency keys, `release` without an outcome, `reserveId` without count or ttl, scope containment, residue categories, and the contract's "expiry does not prove the writer stopped" against `acquire`'s steal and the age sweep. - **AS-14 reopened, not dropped.** The first candidate dropped it on the premise that no 1.21.2-or-older writer is alive. The Fabric remote disproves that: on 2026-10-12 it held `refs/agent-sync/leases/docs-architecture-report-workspace.md`, with no `key`, written 2026-10-08 by `r-d8d027823`, beside the same path's 1.21.3 ref. That dates a write; it does not prove a live writer — the ref's host is this machine, whose plugin cache still holds 1.21.0–1.21.2, which a session started before an upgrade keeps running. The remedy is to restart such sessions. The drop stays a proposal pending the operator's decision; `residue` flags every lease ref without a `key` in one line, with its timestamp. - **A self-test plant had gone blind.** `since` in the local lock payload moved the anchor of "a local lock records no host", so on the first candidate that plant changed nothing and would have reported MISSED. Re-anchored, run by hand on a copy: detected. ## v1.21.7 — a lease the guard would not recognise is refused, and a worktree finds its session - **`acquire` refuses the shared fallback identity where hooks know their session.** From a shell with no `CLAUDE_SESSION_ID`, `acquire` won the lease under the shared fallback, while the PreToolUse guard — which runs with the session id — refused every edit with "this run holds no lease" (reported 2026-10-11 from a linked worktree). When any session stamp is in reach, `acquire` now exits 2 and names the remedy (`CLAUDE_SESSION_ID`, or `AGENT_SYNC_RUN_ID` for a non-Claude caller). Where no hook stamps sessions, nothing changes: CLI and hook share the fallback and agree. - **A linked worktree reads the main checkout's session stamp.** A session started in the main checkout stamped that checkout's state dir; the walk from a worktree read only its own and fell back to the shared identity. The walk now reads both. Two cases in `test/hooks_session_test.py`, both watched failing first. - **A direct `guard ` in a repository with no coordination allows.** `guard.sh` already exited early there, but `agent_sync.py guard ` called directly still exited 2 with a lease message no lease could satisfy. Recovered from the unmerged 2026-09-11 branch: a missing config is `NotCoordinated`, an answer the guard allows; an unreadable config still denies. `test/guard_uncoordinated_test.py` (4 cases, 2 failing on 1.21.6) joins `npm test`. ## v1.21.6 — a default gate that finishes, and a tag that must be annotated - **`npm test` no longer runs the validator's self-test.** The default gate ran `python3 test/validate.py --self-test` — 74 planted defects, each a full validator run in its own copy of the tree — and locally it did not finish in 58 minutes (measured 2026-10-10). The self-test moves to `npm run test:negatives`, as in the sibling members; `npm run test:all` runs both. Nothing CI enforced moved: `validate.yml` and `release.yml` already invoke `validate.py --self-test` directly, not through `npm test`. - **The release refuses a lightweight tag.** A new step right after checkout in `release.yml` fails unless `git cat-file -t ` is `tag`. `git describe` and `git submodule status` see annotated tags only; on 2026-10-09 four family members cut lightweight tags and the hub read each as its previous release. Same step, same wording, in every member. - Not a code change: ssheleg/sshlg-skills#154 (reported against 1.21.0) was fixed in 1.21.2 — the guard asks the repository that owns the write. Its reproduction exits 2 on the 1.21.0 plugin cache and 0 on 1.21.5 (verified 2026-10-10). ## v1.21.5 — portable paths and measured hook enforcement Resolve scripts from the active skill directory so native, project and custom installs work without assuming a shared global root. Hook guidance now distinguishes the shipped Claude adapter from other hosts' capabilities: unverified adapters require separate runtime evidence, with explicit self-checks. The ledger mutation fixture now plants its invalid version in the current section even when that section has no quoted command output, preserving historical entries. ## v1.21.4 — merge from a linked worktree `merge` run from a linked worktree failed with `could not check out main` whenever another worktree — usually the main checkout — had the integration branch checked out (ssheleg/agent-sync#27). The dry run had just reported no conflicts. That is the ordinary layout of several agents in one repository, and it surfaced landing a guarded file in a shared workspace. - **Lands through a temporary worktree.** With `--push`, the merge, the merge-log entry and the push happen in a detached temporary worktree at `origin/`, removed on every path. The worktree that holds the target is never touched — not its files, not its ref. Without `--push` it refuses before anything is touched and says why. - **The holder's branch no longer moves under it.** The fast-forward of the local target (`update-ref`) is skipped when another worktree has it checked out; it would have shown that worktree the reverse of every change as its own uncommitted edits. - **A rejected push keeps the lease.** `--push` used to release leases first and push after, so a rejected push printed `✗ push failed` with the work's lease already free. The push now comes first, on both paths; a rejection fails and every lease stays held. Check: `check_merge_from_a_linked_worktree` (refusal without `--push`; landing with it; holder unmoved and clean; temporary worktree gone; lease released after the push and kept on a rejected one). Two mutations caught — dropping the holder detection reproduces the original `could not check out main`; releasing before a rejected push is reported. ## v1.21.3 — the key that came back under a different name Under `leaseBackend: "git"` a lease key containing a dot was reported and released under a name nothing had been taken under (ssheleg/agent-sync#25). Reproduced against 1.21.2 with a local bare remote: ``` acquire T-1.2 # won T-1.2 whoami # holds: T-1-2 release --held # released T-1-2 (exit 0) git ls-remote origin 'refs/agent-sync/leases/*' # .../refs/agent-sync/leases/T-1.2 <- still there ``` **Root cause: the key was stored under two different lossy slugs, and the local one was reported.** `_ref` kept dots (`re.sub(r"[^A-Za-z0-9._-]+", "-", key).strip("-")`), `_local_lock` did not (`re.sub(r"[^A-Za-z0-9_-]", "-", key)`), and `held()` returned the lock file's stem. `release --held` then released `T-1-2`: `_git_release` found no ref of that name, returned without a word, and `release` printed "released". The same slugs broke more than dots: every path key (`docs/x.md` → note `docs-x-md`, ref `docs-x.md`) was stranded the same way; `a/b` and `a-b` were one ref; a key with a leading dot (`.claude-plugin/marketplace.json`) produced an invalid ref, and the rejected push was reported as "held by another run". - **One key, one name.** `lease_name` percent-escapes every byte outside `[A-Za-z0-9._-]`, and a `.` wherever git forbids one in a ref component; `lease_key` reverses it. The ref and the note carry that same name, and both payloads carry the key verbatim, which is what `held()`, `whoami`, `residue` and the board now report. A key made only of safe characters is its own name, so every ref 1.21.2 pushed for one is already under the right name. - **A key that cannot travel unchanged is refused at `acquire`**, before anything is written: empty, whitespace or a control character, a backtick, `|`, or a stored name over 200 bytes. Two spellings that land on one note file (`T-1`/`t-1` on a case-insensitive disk) are refused instead of the second overwriting the first. - **`released` is said only after the remote is read again.** `release` asks the remote first, deletes with `--force-with-lease`, re-reads the ref with a strict `ls-remote`, and only then clears the board claim and the note. A refused delete or an unreachable remote is `NOT released`, exit 1, with the claim and the note kept — they are the only trace of a lease that is still out there. `release --held` and `merge` report the same way; `merge` printed `✓ released` unconditionally. - **What 1.21.2 left behind stays exclusive and releasable.** A 1.21.2 ref with a slugged name is still that key's lease (`acquire docs/x.md` loses to its holder; `release docs/x.md` deletes it); a 1.21.2 note is re-noted under the key its ref was taken as by `whoami`, `status`, `release` and `release --held`; the slug 1.21.2 printed (`release T-1-2`) resolves to this run's ref — only refs 1.21.2 wrote, so a lease taken under 1.21.3 is released by its own key only; and in local mode a 1.21.2 lock held by another run still blocks the dotted key. The PreToolUse guard does none of this: it stays local. - **Checked for the same defect:** `reserve` built `refs/agent-sync/ids/` from the same slug, so `A B` and `A-B` shared one counter; a register name the ref cannot carry verbatim is now refused (every name the slug left unchanged keeps its ref). `release-id` writes a log receipt keyed by the exact register name and touches no ref — unaffected. Resource claims (`res----`) are built from `[A-Za-z0-9_-]` only and round-trip unchanged; kept byte-identical so two versions cannot claim one register under two names. `residue`/`reap` now report a git-plane ref by its key and delete the ref that exists; `reap --i-own-this` still accepts the slugs 1.21.2 printed. - **Left open, stated:** a run still on 1.21.2 and one on 1.21.3 taking the same PATH key at the same moment, with no ref yet under either name, push two different refs. Task ids made of safe characters never had two names. Update every machine. - Eight new `check_*` in `test/validate.py`, all against a real bare origin and confirmed by `git ls-remote`: the issue's round trip, a ten-key bijection in both modes, refusals, legacy release (`--held`, by key, by the printed slug), legacy exclusion on both planes, the false "released" (a pre-receive hook refusing deletes, and a vanished remote), case variants, and register names. Run against the 1.21.2 script, seven of the eight fail with 37 problems (case variants only on a case-insensitive disk, the macOS default); the legacy-exclusion guard passes there and must keep passing. Eight self-test plants put back the slugged ref, the slugged stem, `held()` reporting the stem, the unverified delete, the missing migration, the unread legacy ref, the accepted unrepresentable key and the slugged register; all eight are caught. - Docs: `references/lease-protocol.md` (one key, one name; what 1.21.2 left behind; the release proof; register names), README command table and troubleshooting, SKILL.md. ## v1.21.2 — the guard that asked the session instead of the repository it guarded The `PreToolUse` guard decided whether coordination was on from `${CLAUDE_PROJECT_DIR:-$PWD}/.claude/agent-sync.json` — the SESSION's project (`hooks/_lib.sh` `agent_sync_configured`, called at the top of `guard.sh`) — and then ran the check somewhere else. Reproduced 2026-10-01 against 1.21.1, three ways: - **A commit into a repository with no config was blocked.** For `git -C commit` or `cd && git commit` the guard ran `agent_sync.py guard` per staged path inside ``, which exits 2 for *no .claude/agent-sync.json in this project*; the guard read that as "no lease" and refused a commit in a repository where coordination is off. - **An edit in another repository was judged by the session's rules.** `agent_sync.py guard ` ran from the session's cwd, so the path was made relative to the wrong root (`../other/docs/ROADMAP.md`): the other repository's own `guardedFiles` never applied, and a session glob such as `**/HANDOFF.md` matched files it was never written for. - **A session rooted in an unconfigured project guarded nothing**, so it could write a guarded register in a configured repository with no lease at all. Now **the repository that owns the write decides**. `agent_sync_owner` (`hooks/_lib.sh`) resolves `git -C rev-parse --show-toplevel` — the file's nearest existing directory for `Edit`/`Write`/`MultiEdit`/`NotebookEdit`, the repository named by `-C`/`cd` for a commit — and prints it only when that toplevel carries its own config. None → exit 0, silently; a path inside no git repository → exit 0; otherwise `agent_sync.py guard` runs from that toplevel, against its `guardedFiles` and its leases. The guard no longer exits early on the session's config. - **Failing closed is unchanged where it was promised.** A parser that cannot run (no python3) — and now also a missing git — still exits 2 in a session whose project is configured. In an unconfigured session the owning repository cannot be named without them, so the guard exits 0 and says so in its capability matrix rather than refusing every call on a machine that never opted in. - **The common Bash call stays cheap** now that the guard runs in every session: a payload without the substring `commit` exits before the commit tokeniser starts an interpreter. - A commit refusal now names the repository to take the lease in and carries the coordinator's own reason. - `check_guard_asks_the_repository_that_owns_the_file` drives fifteen cases through the real hook (configured / unconfigured session × repository with / without a config, a path in no repository, a subdirectory commit, a `Write` into a directory that does not exist yet, and the same writes with the owning repository's lease). Seven failed on 1.21.1. Two self-test plants put back the session lookup and the early exit; both are caught. - **Unchanged, checked:** `session-start.sh`, `renew.sh` and `session-end.sh` still act on the session's project. They register, renew and release this session's run there, which is the right scope for them; a lease taken in a second repository is still neither renewed nor released by them (backlog AS-07, open). - Docs: `references/hooks.md` (which repository decides, debugging rows), README hook table and troubleshooting, SKILL.md, SECURITY.md, the `hooks.json` description. ## v1.21.1 — the check that asked the wrong plane who hands out ids `check` refused every `idRegisters` entry on `backend: "fs"` + `leaseBackend: "git"`, while `reserve DEC` in that same repository allocated race-free. Found 2026-10-01 while installing agent-sync across an organisation's repositories: each one with a local record plane had to drop its DEC/OQ registers and take numbers by hand — the collision this tool exists to prevent, recommended by the tool's own health check. The two commands asked different questions. `reserve` allocates when the record plane orders writes OR the lease is git — in git mode the allocator is a compare-and-swap on `refs/agent-sync/ids/` at the remote, independent of the record plane, exactly like the lease. `check` asked only the record plane. - **One predicate, `id_allocator(cfg, adapter)`**, now answers for `reserve`, `release_id`, `check` and the generated snapshot, which also names the allocator under *Id registers*. `check` accepts registers under `leaseBackend: "git"` whatever the record plane, and still refuses the two configurations that genuinely cannot allocate: a non-ordering plane (`fs`, or a cloud plane degraded to `fs`) with `leaseBackend: "local"`, and `leaseBackend: "git"` pointed at a remote that does not exist. - **A missing lease remote is refused by name** in `acquire` and `reserve`. It used to surface as "held by another run" and "another allocator is racing" — a holder and a contention that did not exist. - `check_check_and_reserve_agree_on_who_allocates_ids` drives all three configurations through both commands against a real bare remote; two self-test plants put back the record-plane-only condition and the phantom-contention path, and each is caught. - Docs: `lease-protocol.md` → *Id reservation* carries the configuration table; `backend-fs.md`, the schema description, the README and SKILL.md say that registers follow the lease, not the record plane. ## v1.21.0 — the SessionEnd budget no host gave, and the watchdog that held the pipe Codex 0.157 prints `clamping SessionEnd hook timeout to 3s in …/agent-sync/…/hooks.json` at every session start. The hook declared 20 s; Codex clamps a SessionEnd handler to 3 s, and Claude Code sizes its own SessionEnd wait from the largest handler timeout. So the number was never honoured, and the loop behind it did not fit the budget it really had. - **`hooks.json` declares `timeout: 3`** for SessionEnd, and `check_hooks_manifest` refuses anything larger, with a self-test plant of the exact 20 that shipped 0.1.0 → 1.20.2. - **`release --held`** gives back everything this run holds in ONE process. `session-end.sh` used to run `whoami` plus one `release` per key, each with its own 10 s limit, so the host killed it part-way and the tail of the list stayed out until its TTL. It now runs `release --held` under a 2 s limit. The re-read of `held()` after each release is kept, because a run's last task key takes its resource claims with it. - **`run_limited`'s fallback watchdog held the caller's pipe.** Stock macOS has neither `timeout` nor `gtimeout`; the bash fallback was `( sleep N; kill ) &` with the caller's stdout inherited, and `kill "$watchdog"` ended the subshell but not its `sleep`. The orphan kept the pipe open, so `$(run_limited 10 …)` and `… | sed` waited the full limit after the command had finished. That covered session-end, and SessionStart's `status` output too. Measured 2026-09-27: session-end took 10.4 s to release three leases. It is a race, so a trap-based stop still lost it now and then. The watchdog now polls `kill -0` in 0.1 s steps with its stdio on `/dev/null`. Seven cases in `test/hooks_session_test.py` (13 total). The watchdog cases force the fallback with a PATH that carries no timeout binary, so a Linux runner exercises it too. They repeat the shape forty times, because a single draw of a race proves nothing. ## v1.20.2 — the override that could not reach the plane the state was on **161 expired lease refs on one remote, from two runs that ended five days earlier, and no command in this tool could clear any of them.** Measured on the operator's machine 2026-09-14: `residue` listed every one, `reap` left them alone (correctly — a ref in a dead run's name is `foreign`), and `reap --i-own-this`, the one path a person has for exactly this, answered *there is no lock by that name in this checkout*. True, and useless: in git mode the authority is `refs/agent-sync/leases/*` on the REMOTE, and the override walked the local lock directory only. This is AS-01b returning on the other plane. That row closed *"expired locks accumulate with no path out for anybody"* for the filesystem; the same sentence was true of the git plane the whole time, and the tool that reports it could not act on it. - `_reap_by_operator_decision` now reads **both planes** and collects entries per key as a LIST — a key can be a lock file here AND a ref there, and clearing one while calling the key done is how the ref survived every sweep that ran. A git entry is deleted through `git_reap`'s existing `--force-with-lease` compare-and-swap and proved gone by a second `ls-remote`, never by the push's exit code. - **Every refusal the override had, it keeps**, now per plane: a LIVE lease is refused and named, a key nobody holds is reported rather than guessed at, the destroyed payload is printed with its plane so the decision stays auditable, and the journal line carries it. - **A remote that cannot be read says so** instead of answering "no such lock" — that answer reads as *there is nothing to clear* over state that may well be there. Three cases in `test/claim_cell_test.py` (27 total): the override clears a dead run's ref and proves it gone, a live ref is still refused, and an unreachable remote does not read as a missing key. ## v1.20.1 — the filter that was never read, and the check that would have said so Claude Code 2.1.270 prints `agent-sync: hooks.json: unknown key "if" in hooks.PreToolUse[1] ignored` at every session start. The key was there since 0.1.0. - **`"if": "Bash(git commit *)"` sat beside `matcher`, and a matcher group is only `matcher` + `hooks`** — read out of the 2.1.270 binary's schema, where `if` exists on a command HANDLER only. So the filter was declared and never evaluated: `guard.sh` has run on every Bash call in a coordinated project for its whole life, narrowing to a commit with its own parser. Nothing in behaviour changes with the key gone; the warning does. - **Removed rather than moved.** A handler-level `if` would be real, and a real `Bash(git commit *)` skips `git -C commit`, `env X=1 git commit` and `cd d && git commit` — the three forms the parser covers and the 2026-08-07 measurement was about. hooks.json's description, `guard.sh`'s header, `references/hooks.md`, the README hook table and the live AS-09 row now say the same thing. `CHANGELOG` v1.18.6 and the 2026-07-29 spec keep their wording: dated records. - **`check_hooks_manifest` now refuses any key Claude Code does not know** — at group level `{matcher, hooks}`, on a handler `{type, command, args, if, shell, timeout, statusMessage, once, async, asyncRewake}` — with a self-test plant that puts the old `if` back and watches the check fire. `claude plugin validate --strict` passes the defective file, so a repo gate is the only place this fails before a session start. - `test/audit_regressions/fix-sy-07.01.py` derived "git commit is covered" from the group's `if` — a declaration that never filtered. It now asserts the matchers, the description and the absence of `if` at both levels. ## v1.20.0 — the two-sources duty stops carrying its own elaboration Sherlock external-v3 (14 findings) plus the House audit gap they introduced. - The audit's doctrine grew SKILL.md past the house working limit, and the rule for that is a SPLIT, not a trim. The `Two documentation sources` section keeps what a reader needs before opening anything — the two questions, the gap IS the finding, the duty at both ends, and that `reconcile` is mechanical so its green is not agreement — and hands the rest to `references/two-sources.md`, which already held every one of those points in full. - `references/adapter-contract.md` passed 100 lines and gained a `## Contents`. - CI now MEASURES the token budget with a real tokenizer instead of estimating it. ## v1.19.3 — the boundary ships with the skill, and two descriptions stop looking like drift Close-out of the 2026-09-06 family audit (wave AUDIT-WAVE-0906). One bullet enters the skill body, one decision gets a written home; no behaviour changes. - **The refusal the operator's routing block promises now travels with the skill.** The routing doctrine names this router's boundary — a file in a project where coordination is on — and a waiver, **"no coordination" / «без координации»**, and neither phrase appeared anywhere in the shipped `SKILL.md`: a standalone install advertised no refusal at all. One bullet in Non-negotiables now carries both. The body had **3 tokens of headroom** (~4747/4750 against the house working limit), so the line displaced prose rather than joining it — standing instruction 7 — and the auditor was watched refusing both oversteps on the way: a first draft measured 4753 (`GAP BODY_HEADROOM`), the second exactly 4750 and still refused, the shipped text ~4746/4750 after trimming one motivational sentence from the `status` section and three words from the `$SKILL_DIR` paragraph. `audit_skill.py --house`: **0 GAP, 15 PASS**. - **`plugin.json` and `marketplace.json` describe this plugin in two entirely different texts — now recorded as deliberate, which is what makes it distinguishable from drift.** The audit's finding was not that the texts differ but that nothing RECORDED whether they should, and a sibling shipped accidental manifest drift this same week. They should: the marketplace entry is the storefront read before install and carries the lease doctrine in full — that surface is where the 1.5.2 audit caught this repo selling the refuted no-CAS design, and `check_doctrine_is_current` still watches it — while `plugin.json` is the installed listing's one-line layer summary. JSON takes no comment, so the decision lives where this board's decisions live (`docs/evidence/backlog.md`, beside B-002 and B-004), naming both texts and which surface reads which. ## [1.19.2] - 2026-09-04 ### Fixed - **An expired foreign lease printed at every SessionStart for ever, and the block it sat in stopped being read.** Measured on the machine that filed the issue: sixteen expired leases, none newer than two days, the oldest **thirteen days old** — six printed in full plus *"… and 11 more"*, identically, every session for a fortnight. None of it was actionable: a foreign lease is reported and deliberately never touched, so the operator could not clear a single line of it. A block reprinted verbatim is a block an operator learns to skim, **including the lines that would have mattered**. Age splits the list now. A lease expired inside `STALE_DETAIL_SECONDS` (24h) may still mean a run is in trouble and keeps its own line; anything older collapses into **one** summary — which still **names the keys**, because a summary that hides which leases are stuck replaces noise with a different uselessness. Sixteen lines became one. Watched failing before it shipped: with the split removed the new check reports *"6 ancient lease(s) still print a line each"* and *"nine ancient leases produced no summary line at all, so they vanished"* — the second assertion exists because collapsing and hiding are one edit apart. ## v1.19.1 — re-acquiring your own lease now refreshes it **`renew` was fixed for exactly this and `acquire` was not, in the same file.** `_refresh_lease`'s docstring records the bug it exists to have fixed: *"`renew` appended `op=renew` to the RECORD plane — which has not decided a lease since 1.0.0 — and touched a throttle file. The lock's own `ts` was written once, by `acquire`. So a run holding a lease lost it at TTL while still working."* The repair landed in `renew`. The own-lock branch of `acquire` kept doing precisely what that paragraph describes. **Two harms, and the second is the one that bites.** The lock stayed expired, so `classify_lock` read it as spent and another run's `acquire` took it over while this one believed it held — measured 2026-09-01: a foreign expired lock IS taken over, timestamp and host rewritten. And `_touch_renew` resets the marker `renew()` throttles on, so a re-acquire **actively suppressed the next real refresh** while refreshing nothing itself. That is the mechanism behind a lease expiring three times in one run against a 450-step CI job. Measured before and after, on a lock aged past its own TTL: ``` old: won mykey (…) ts after re-acquire: 2026-08-29T20:59:04Z still expired new: won mykey (…) ts after re-acquire: 2026-09-01T12:38:48Z ``` `check_acquire_refreshes_its_own_lease` is beside `check_renew_extends_the_lease`, watched failing against the previous commit with both of its assertions. **One finding retracted in the same run, and it belongs here.** `reap` refuses to clear a lock three days past a forty-five-minute TTL when this run's identity is the shared fallback, and that reads like a deadlock. It is not: `acquire` takes over an expired lock regardless of who wrote it — measured, timestamp and host rewritten — so the expired lock blocks nothing, and `reap`'s stricter bar for a *tidying* operation is correct as designed. The claim that expiry alone should license a delete was wrong about which operation matters. ## v1.19.0 — the skill now promises the finish it has always performed Wave-4 close-out of the 2026-08-29 family audit (ASY-10), filed by this repository's own first eval run. One front-matter line changes; no behaviour does. - **ASY-10 — the submodule-finish request reached nothing, and now reaches this skill on every sample.** `finish` exists for exactly one silent failure — a submodule pushed while the parent still points at the commit before it — and the description advertised none of its words, so "Finish a submodule change so the parent points at the pushed commit" (eval q06) routed past the skill on every probe of the v1.18.7 run. The *Use when* clause now names it, in the words `finish` itself prints (`finishing work across a parent repo and its submodules - clean, pushed, and pointed at`), and the trigger list carries the symptom in both languages: `'the submodule is pushed, the parent points at the old commit' / 'сабмодуль запушен, родитель на старом коммите'`. The description is **951 characters — against the 970 house working limit, not the 1024 spec cap**: a first draft at 1017 passed `test/validate.py` and was refused by the family's pinned auditor (`GAP DESC_HEADROOM`, exit 1, a CI failure), so it was rewritten rather than shipped. `yaml.safe_load` reads the front matter — the two things this family has shipped broken before. - **The fix is measured, not asserted, and both arms ran in this session.** Two corpus files differing in exactly one line (`- agent-sync: …`, old vs new), one enforced protocol, fresh context-free subagents: **q06 went 0/3 → 3/3 on haiku and 0/3 → 3/3 on sonnet**, and every number in the results file comes from the text that ships — the discarded 1017-char draft was re-measured from scratch after the rewrite rather than having its numbers carried over. The pilot probes are reported too, because they changed the protocol: offered the corpus rather than required to read it, all three sonnet probes answered with no tool call at all, from the machine's own installed listing — so the read was made mandatory and provable, and both arms re-run under it. - **Every other query was re-probed, because a widened trigger steals a neighbour's.** All twelve queries × two models: **12/12 on both, train 6/6 and validation 6/6**, up from 11/12. Nothing moved except q06 — including q07 (solo git branching) and q08 (the full delivery cycle), the two negatives with the most to lose from submodule and finish vocabulary. Tables, the 68-probe accounting across three arms and the limits are in `test/evals/RESULTS.md`; the v1.18.7 rows are left standing beside the new ones rather than rewritten. - Ten routed triggers still advertised — the umbrella's own `advertised_check.js` was run against this checkout (`ok: agent-sync advertises all 10 routed trigger(s)`), not a copy of its table. - **Filed, not fixed: AS-10.** `npm test` accepts a description up to 1024 characters and CI's pinned auditor refuses one past 970, so a description in that band goes green locally and red on the runner. That is AS-06's shape a second time — the same auditor, the other half of the same budget — and the fix belongs in `test/validate.py` with a planted self-test, not inside a release whose subject is one description line. The retro entry records what the divergence cost here. ## v1.18.7 — the evals stop being a claim, and the manifests say what shapes them Wave-3 close-out of the 2026-08-29 family audit (ASY-03, ASY-09). No behavior changes; a measurement that did not exist now does, and two manifests declare their schemas. - **ASY-03 — the behavioral evals were executed, dated, and the numbers are worse than silence pretended.** `test/evals/RESULTS.md` had one row: "no run yet". It now carries two dated rows (2026-08-31, haiku and sonnet): 24 blind fresh-context trigger probes — one per query per model, the query verbatim plus the installed family list, nothing else — and all six scenario lines driven as real agent sessions against scratch repositories, end states verified on disk. Both models score 11/12 on triggers (train 6/6, validation 5/6) and fail the SAME query: **q06, the submodule-finish positive, 0/3 samples on each model** — the description has no submodule vocabulary to catch it. That gap is filed as ASY-10 (a description change is a minor release, not this patch). The Method section states the harness limits out loud: n=1 sampling except the failing query, the operator's routing doctrine present in probe context, fs-backend `reserve` refusing by design in s02, model aliases rather than pinned snapshot ids. SKILL-CARD.md's "never executed" line now points at the dated rows. - **ASY-09 — both plugin manifests declare `$schema`.** `.claude-plugin/marketplace.json` names `https://json.schemastore.org/claude-code-marketplace.json` and `plugins/agent-sync/.claude-plugin/plugin.json` names `https://json.schemastore.org/claude-code-plugin-manifest.json`; both files validate against the schemas those addresses serve (fetched and checked at edit time), and `claude plugin validate --strict` stays green on both. The repo's own no-host-address rule refused the plugin manifest — correctly, by its letter — so `json.schemastore.org` joined `ALLOWED_HOSTS` beside `json-schema.org`: a vendor-neutral public schema registry, not an instance address. The planted `leaked host` self-test still proves the check can fail. ## v1.18.6 — the guard keeps its own header's promise, and /clear gets its own identity Wave-2 hardening from the 2026-08-29 family audit (ASY-07, ASY-08, ASY-06, ASY-01). Same shape as v1.18.5: text that claimed more than the code did. - **ASY-07 — a machine without python3 had no guard, and said nothing.** `guard.sh`'s header promises that every internal failure exits 2, because any other outcome is non-blocking in Claude Code — and the python3-absent path broke it: both parser substitutions failed under `2>/dev/null`, `path` came back empty, `is_commit` defaulted to 0 and the hook exited 0. Fail OPEN, exactly where the header says it must not, and nothing upstream compensates — hooks.json's `if` filter is best-effort by doctrine, so the parser IS the guard. Both substitutions now report through `parser_or_die`, which exits 2 and names the remedy (install python3 / fix PATH, or remove `.claude/agent-sync.json` to switch coordination off). `check_guard_fails_closed_without_python3` drives the real hook through a shim PATH holding bash and cat but no interpreter — watched failing against the shipped guard (`the guard exited 0`) — and the self-test plants the fail-open back (`an absent interpreter fails open`). - **ASY-08 — a post-/clear session inherited the ended run's identity.** The SessionStart matcher read `startup|resume`, and `/clear` ends the run while keeping the CLI process — so the stamp keyed by that process survived into the next session: "two sessions, one identity", the case SKILL.md itself names, and `release` then takes a lease the caller never had. The matcher now carries `clear`; `compact` stays excluded deliberately, because a compaction continues the SAME session. `hooks_session_test.py` gained the case (matcher parts asserted both directions, and the hook re-stamps on a clear payload) — watched failing against the shipped matcher. - **ASY-06 — the guard's internal-failure refusal named no next step.** A refusal with no remedy is how an operator learns to switch a hook off. The message now says: diagnose with `python3