# Changelog

All notable changes to Amber Protocol will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.6.0] - 2026-08-14

### Added

- release: lockstep-publish dsh-amber-protocol on stable tags

### Fixed

- release: fail closed when release existence cannot be determined
- release: gate DSH publish on npm visibility and release idempotency
- web: drop at-rest shadows and blur from viewer surfaces
- governance: remediate v1.5.1 review findings
- web: share settings and tighten viewer a11y

### Changed

- clean up the MCP junction-fixture target directory
- web: keep settings persistence and query defaults pure
- align F020 feature paths with the actual change surface
- document target-local route reads in CLAUDE.md
- governance: reuse realPathForPotential in inspectRoutes
- test: share target-route fixtures across integration suites
- web: dedupe provider logic and split session-event hook
- release: skip GitHub Packages publish on prerelease tags
- dispatcher: extract shapeResult + requireSessionId, fix CI npm publish

## [1.5.1] - 2026-08-14

### Added

- `.gitattributes` enforces LF line endings cross-platform (`* text=auto eol=lf`) with a binary-file allowlist.
- `.github/CODEOWNERS` routes review by directory.
- CI runs `npm run lint` and `npm run format:check` before tests; the opt-in `pre-commit` hook runs the same two gates after identity validation.
- Add the installable `dsh-amber-protocol` bundle for native DeepSeek Harness profile setup. The bundle resolves `amber-protocol` from its own installed location, exposes `amberBundlePaths` to later rows, and inserts a stdio MCP client + dedicated skill-filesystem instance.
- Add `scripts/lib/subcommand-dispatcher.js` — a deep dispatch module that takes an action table + envelope shaper and returns a unified dispatcher, collapsing the duplicated if-chain pattern across adapters.
- Add `tests/integration/dsh-bundle.test.js` — manifest contract, pack dry-run, and runtime path-resolution tests.
- Add `tests/integration/capability-helpers.test.js` — unit tests for `deriveCapabilityFromAction` and `toCapability` parity.
- Add `dsh/LICENSE` (MIT) to the bundle artifact.

### Changed

- Ship the MCP Action and Function registries in the `amber-protocol` npm artifact so external adapters can start the governed stdio server.
- Centralize `ACTIVE_SESSION_STATUSES`, `loadAndValidateManifest`, `manifestProjection`, `readSessionSummary`, and `readSessionsForConcurrency` in `session-manifest.js` — eliminating duplicated manifest read/validate/project sequences across `mcp-action-runtime.js` and `mcp-functions.js`.
- Wire `deriveCapabilityFromAction` into `validateActionContract` so JSON→capability derivation has one shape, not inline per field.
- Add `toCapability` helper to `context/action-registry.js` — unifies the context capability shape with `COMMAND_CAPABILITIES` entries in `classifyCliInvocation`.
- Migrate `contextDispatch` from a 14-branch if-chain to a `HANDLERS` map; migrate `maintenanceDispatch` to `createSubcommandDispatcher` with an envelope shaper.
- Fix `resolveTargetOverride` TOCTOU: stat→realpath→re-verify in one try block, consistent with `canonicalizeDirectory`.
- Fix `handleWorkflow` `--output-dir` guard ordering: reject before dispatch, not after.
- Fix `handleIngest` payload guard: require `--payload` unconditionally, not only when `--json` is absent.
- Unify `failOnStartupError: true` across all dsh patch files (bundle + overlay).
- Rewrite `README.md`, `README.zh-CN.md`, `docs/README.md`, `dsh/README.md` to lead with `dsh plugin --profile web add dsh-amber-protocol`; overlay patches retained as unpublished-checkout fallback.
- Document the pnpm `overrides` workaround for unpublished local tarball installation in `dsh/README.md`.
- Apply Prettier across the repository against `.prettierrc.json` (tabs, double quotes, trailing commas, 100-col width, LF).

## [1.5.0] - 2026-08-10

### Added

- **Governed Context knowledge lifecycle (F017)**: classify knowledge by kind,
  validate forward supersession lineage, and assemble current-only Loadouts and
  derived projections without introducing a second writable source of truth.
- Add deterministic Context benchmarks, opt-in source adapters, report-only
  retention metrics, and dependency-boundary checks for external integrations.

### Changed

- Extend Context schemas, CLI help and output, verification errors, architecture
  guidance, and lifecycle documentation for the new assurance capabilities.
- Reconcile F016/F017 governance evidence: F016 remains accepted; F017 remains
  passing because its implementation predates a governed plan and Session.

## [1.4.1] - 2026-08-08

### Fixed

- Centralize CLI Command definitions, public order, help/output policy, and handler
  binding in `command-help.js`; dispatcher owns runtime dispatch only.
- Derive Context Page index status from page health at the store boundary (no
  blank `statusMap` defaulting every page to `ok`).
- Fail-closed session execution evidence for malformed JSON (including JSON
  `null`) and ledger/evidence coordinate mismatches; governance reports mark
  unavailable evidence explicitly instead of looking empty.
- Encoding validation skips tracked files deleted from the working tree.
- Align agent/wiki docs with the new registry and evidence paths.

### Changed

- Remove `command-handler-families.js`; assessment consumers degrade at their
  boundary when the shared evidence reader throws.

## [1.4.0] - 2026-08-08

### Added

- **Context layer — contract-driven distillation (ADR-0009)**: new `amber context`
  command family (`request` / `ingest` / `verify` / `list` / `show` / `refresh` /
  `stats` / `delete`) closes the write path between session evidence and project
  knowledge. Amber emits hash-bearing distillation contracts; a host agent executes
  them; Amber judges the result (schema, citation completeness, payload-to-request
  binding, source freshness) and persists provenance-backed pages under
  `.amber/context/pages/`, indexed by `docs/wiki/context-index.md`. Amber never
  calls a model — zero new runtime dependencies beyond `ajv`/`ajv-formats`.
  - Dual raw/normalized hashing absorbs cosmetic source changes silently;
    `{"outcome":"no-change"}` rebases hashes without touching page content.
  - Immutable sources (ledgers, ADRs, archived sessions) are excerpt-snapshotted
    into pages; tamper and page-corruption detection included (D5a).
  - Seven new `AMBER_E_CONTEXT_*` error codes; `doctor` gains an aggregate
    context-pages finding.
  - `stats` reports filter rate, pass rate, no-change rate, unknown-block share,
    and mean sources per block, with an optional `--window` for trend regression.
  - `amber-context` skill (mirrored to Claude Code, Codex/Cursor, Gemini) teaches
    host agents how to run the loop.
- **Context Loadouts (ADR-0010)**: deterministic, budgeted context selection now
  produces auditable Loadout artifacts with required, priority, and optional tiers.
  The Operating Manual, selected Route manifest, and Loadout Definition are pinned
  as target-local Required Artifacts and verified fail-closed.
- **Governance metadata and advisors (ADR-0011–0014)**: add explicit confidence
  bands, machine-readable dispatch approval requirements, protocol/schema version
  metadata, execution-routing taxonomy, artifact migration backfill, session-scoped
  no-progress findings, and objective-driven `amber next` route advice.

### Fixed

- Enforce lexical and real-path target confinement across Context sources, Pages,
  requests, payloads, and Loadouts; bind every ingest outcome to an existing request
  and reject stale or mismatched source snapshots.
- Verify the execution ledger hash chain before policy evaluation, require an
  explicit valid policy, preserve deny-wins behavior, and permit real execution
  only at high confidence after all governance gates pass.
- Require approval for every multi-worker dispatch and degrade low-confidence swarm
  requests to a single bounded loop instead of parallel execution.
- Make migration discover only recognized artifacts across `.amber/`, `routes/`,
  and `workflow-packs/`; scope routing and no-progress evidence to the target and
  active Session; retain fail-closed task/session/plan coordinate validation.

### Changed

- Split dispatch policy, validation, and persistence responsibilities into focused
  modules while preserving the public handoff and workflow-assessment facades.
- Align CLI, ADR, wiki, migration, and generated-agent guidance with the corrected
  governance contracts, including explicit `migrate state` legacy conversion.

## [1.3.12] - 2026-08-04

### Added

- **Loop no-progress reporting (F015)**: `loop status --ledger` now accepts a
  single ledger JSON file or a directory of recorded history. Directory reads
  retain valid records when individual files are corrupt, deterministically
  analyze at most the newest 100 files, and report conservative
  `insufficient-history`, `progressing`, or `stalled` outcomes with explicit
  repeated-observation, empty-evidence, stop-reason, and budget signals. Status
  remains read-only and reports execution, scheduling, and external-call flags
  as false.
- **Knowledge Plan deep module (F013)**: read-only (`inspect`/`report`/`validate`)
  and write-capable (`scaffold`/`build`/`plan`) use cases now cross a root facade
  (`scripts/lib/knowledge-plan`) and Governance Console command adapter
  (`scripts/lib/knowledge-plan/adapters/command`). Parsing, schema validation,
  lookup precedence, report mechanics, page materialization, and proposal
  inspection live behind an internal seam (`scripts/lib/knowledge-plan/internal`).
  An interface contract test prevents production modules and ordinary tests from
  importing internals directly.
- **Maintenance focused evidence outcome (F014-M1)**: a root facade
  (`scripts/lib/maintenance`) exposes a read-only `evidence` outcome for Amber
  Evolution findings and Regression Proposals. Workflow Effectiveness consumes
  it instead of raw Maintenance collectors, with no Team Distribution registry
  dependency. Corrupt or unreadable evidence records are skipped, retained valid
  records are preserved, the outcome is marked `partial`, and redacted warnings
  are emitted (warning-only; never a blocking error).
- **Maintenance partial-state propagation (F014-M2)**: full Maintenance
  inspection now composes the focused evidence outcome, and partial evidence
  warnings propagate as redacted non-blocking warnings through Governance Report
  and Adoption Report while retained valid data keeps both reports on their
  normal completion paths. Amber Evolution collectors move to
  `scripts/lib/core/evolution-findings.js` for shared use without circular
  requires.
- **Unified Maintenance command adapter (F014-M3)**: all ten Maintenance
  subcommands (inspect, propose, stale-docs, wiki-lint, pack-drift,
  upgrade-preview, evolution-rollup, regression-proposals, scaffold-drift,
  distill) route through one Governance Console command adapter
  (`scripts/lib/maintenance/adapters/command`); the outer handler no longer
  owns subcommand knowledge. Aliases, envelopes, registry-path closure, and
  unknown-action guidance are unchanged.
- **Maintenance interface seal (F014-M4)**: Governance Report, Adoption Report,
  and wiki drift consume the root facade (`inspect` / `evidence` / `staleDocs`
  outcomes); Workflow Effectiveness already used `evidence`; the Governance
  Console uses the command adapter. No production caller imports raw
  Maintenance helpers, delegation tests no longer monkey-patch exported
  bindings, and an interface contract prevents importing
  `maintenance/internal` directly. The legacy `core/maintenance.js` surface
  remains a documented forwarding compatibility adapter for one deprecation
  cycle, with removal deferred to a declared major release.
- **Pre-push pi-rewind checkpoint guard (F012)**: the repository pre-push hook
  refuses to push `refs/pi-checkpoints/*` refs, the local-only per-turn undo
  snapshots written by pi-rewind. A `git push --mirror` or explicit push of
  those refs would leak full working-tree snapshots (including captured
  untracked files) to the remote; normal branch and tag pushes are unaffected.
  Hook behavior is covered by unit tests.

### Fixed

- **Review standard labels**: `amber review` now gives JSON standards without an
  explicit `id` a deterministic filename-based identifier and labels the list
  as loaded standards. Human output no longer renders a blank standard between
  `amber-delivery` and `security-governance`.
- **Release documentation links**: correct two ADR-0003 links in the CLI
  reference and replace a stale `error-recovery.js` implementation link with
  the actual boundary: retry settings are governance metadata and never imply
  autonomous target-command retries.
- **Dependency security**: bump transitive `brace-expansion` 5.0.8 -> 5.0.9 in
  the lockfile, resolving HIGH advisory GHSA-rgw5-rvv9-x895 without changing
  the parent dependency graph.
- **Dependency security**: bump transitive `fast-uri` 3.1.4 -> 3.1.5 in the
  lockfile, resolving advisory GHSA-7p8r-x3mc-p8w7 without changing the parent
  dependency graph.

### Deprecated

- **Legacy Knowledge Plan CommonJS surface** (`scripts/lib/core/knowledge-plan.js`):
  retained helper exports (`loadKnowledgePlan`, `buildKnowledgeReport`, parser,
  serializer, and related helpers) are forwarded for one deprecation cycle.
  New code must use the root facade or command adapter. Removal is deferred to a
  declared major release; no runtime import warnings are emitted.

## [1.3.11] - 2026-07-31

### Changed

- workflow-assessment: single facade with internal seams

## [1.3.10] - 2026-07-31

### Fixed

- **workflow-assessment CI regression**: privacy assertion (`!json.includes(homedir())`) failed on Linux CI where checkout path lives under `/home/runner`. Now checks `~/.claude` root paths in both native and JSON-escaped forms, which catches real claude-home leaks while tolerating legitimate target paths under homedir
- **workflow-assessment M1**: `collectAgentAssets` dedupes by `realpathSync.native` (Windows case-insensitive filesystems no longer report phantom `AGENTS.md` + `Agents.md` duplicates of the same on-disk file)
- **workflow-assessment M2**: removed dead `vc-3` fail branch (check only observes capability; defect detection is `ld-4`'s job)
- **workflow-assessment M3**: `MAX_TRANSCRIPT_FILES=20` cap (mtime newest-first); `claudeHome` injection through `buildReport` → `listProviders`; two tests now use injected `claudeHome` instead of writing real `~/.claude`
- **workflow-assessment M4**: `summarizeTranscript` requires at least one positive cwd match (lossy directory name alone no longer binds; prevents transcript trust on lossy path encoding collisions)
- **workflow-assessment L1**: `collectMergedSessionObservations` comment updated to accurately describe no cross-provider dedup (amber-native and claude observe different planes)
- **workflow-assessment L2**: `foreignSessionUnsupported` noted as test-only (claude declared supported in P2b, codex/cursor unavailable until P3)
- **workflow-assessment L3**: `--target "\${target}"` quoted in draft templates (paths with spaces now render correctly)

### Performance

- **workflow-assessment suite**: 8.6s → 2.7s (MAX_TRANSCRIPT_FILES cap reduces unbounded transcript scans from 119MB to newest 20 files)
- **assess stdout**: 84.5KB → 18.3KB (108→17 observations; 105 claude transcripts capped to 14)

### Added

- **workflow-assessment tests**: cap regression (25 files → 20), no-cwd negative case, case-insensitive dedup regression

### Notes

- All 1295 tests pass; workflow-assessment coverage unchanged (cap only reduces historical noise, not signal)
- `realpathSync.native` required for case dedup — JS implementation preserves caller casing and misses Windows on-disk truth

## [1.3.9] - 2026-07-27

### Added

- **pi harness compatibility**: publish `skills/` in the npm package and declare a `pi` manifest (`{"skills": ["./skills"]}`) plus the `pi-package` keyword, so `pi install npm:amber-protocol` resolves all 10 Amber skills and the package is indexed by the [pi.dev package catalog](https://pi.dev/packages)

### Fixed

- **skill command prefix**: skill bodies now call `amber <cmd>` and carry an explicit prefix note — `node scripts/amber.js` in an Amber checkout, `npx -p amber-protocol amber` when Amber is installed as a package. Package-installed agents previously followed a checkout-only path that does not exist for them. Repo-local slash commands (`.claude/commands`, `.gemini/commands`) keep the checkout path via the unchanged `x-amber-json` frontmatter.

### Notes

- Repo-local pi support already worked without changes: pi reads `AGENTS.md`/`CLAUDE.md` as context files and discovers `.agents/skills/` (generated by `npm run gen:agents`) natively. The `x-amber-json` frontmatter key is ignored by pi's Agent Skills validator, so skills load unmodified.
- `npx amber-protocol` alone cannot resolve a bin (the package ships two: `amber` and `coding-harness`); `npx -p amber-protocol amber` is the working form.

## [1.3.8] - 2026-07-22

### Fixed

- **deps**: bump transitive `fast-uri` to 3.1.4 (via lockfile) clearing high advisories GHSA-4c8g-83qw-93j6 / GHSA-v2hh-gcrm-f6hx that failed the CI Security job after the 1.3.7 tag
- **docs boundary test**: allow `docs/architecture/session-lifecycle.md` to document refused autonomous session mode (refusal note, not product advertising)

### Notes

- Completes the interrupted `v1.3.7` ship path: tag CI failed before Publish / GitHub Release; do not retag `v1.3.7` — publish from `v1.3.8` instead.

## [1.3.7] - 2026-07-22

### Fixed

- **governance rules check**: dry-run uses `evaluateGovernedPolicy` (same built-in denies as governed-runner) so shell composites past a prefix allow no longer report false ALLOW
- **policy**: pure FD redirects (`2>&1`, `1>&2`) no longer trip shell-composition deny; default `allow-npm-checks` accepts optional trailing FD redirects (`npm test 2>&1`)
- **handoff**: free-text string evidence in `feature_list.json` renders correctly (no more `(none)` from string-spread); stamp `Last Updated`; reuse `getRepoSnapshot` for dirty labeling
- **governance audit / evidence / readiness**: count live `stage_completed` / `verification_failed` with `data.command` (phantom `command_executed`-only counting under-reported real dogfood sessions)
- **execution readiness**: stop requiring root-level `autonomous-policy.json` (wrong path + removed execution model); key off `.amber/governance/rules.json` with built-in defaults; strict mode requires on-disk rules.json
- **web EventStore**: compare SSE `since` against timestamps as epoch ms so ISO CLI timelines resume correctly
- **web gate-reader**: remove invalid `status !== 'all'` compare (not a `GateStatus`)
- **web lifecycle**: import `CompletionStatusResult` for completion helper typing
- **web timeline**: label `verification_failed` / `checkpoint_created`; show command/stage/exit details on stage and gate events
- **team registry**: reject malformed catalog entries; validate maintenance consumers; handle invalid registries
- **deps**: clear brace-expansion high advisory (GHSA-3jxr-9vmj-r5cp)

### Added

- **status**: `dirty (untracked only)` when the tree has only `??`/`!!` noise (e.g. local `.scratch/`)
- **ci**: guard commit identity; home visual e2e coverage
- **web**: realign home as data-first operator console

### Changed

- architecture docs: align governance model and session-lifecycle with live policy surfaces (`evaluateGovernedPolicy` / `session-timeline`) and removed autonomous executor
- readiness ACTION_LIBRARY: stop promoting “increase agent autonomy” for leftover policy findings
- BACKLOG: Phase C e2e is in CI; Phase D SSE auth + server-side error forwarding marked implemented for the local viewer boundary
- dogfood-weekly §7 candidates refreshed for empty `next-up` queues
- Phase B wiki task list: note `timeline-writer` superseded by `session-timeline.js`

## [1.3.6] - 2026-07-15

### Fixed

- session-lock: eliminate TOCTOU race in `acquireLock` via atomic `link(2)` (old `existsSync`+`writeFileSync` let concurrent acquirers all succeed; verified 10/10 → 1)
- web session-control: `resume` is pause-only (`paused → executing`); `routed → executing` stays `start`, not `resume`
- sync: artifact-unavailable note no longer falls through to misleading "none detected" (product-repo / non-git now report `n/a`)

### Changed

- remove unused nodemailer dependency
- remove 7.4M legacy `.harness` backup directory
- use `structuredClone` instead of hand-rolled `JSON.parse(JSON.stringify())` deep clone
- collapse `walkFiles` into `collectFilesBySuffix`
- command layer: dedupe `unknownAction`/`resolveTarget`; governance `requireTarget` SSOT
- architecture deepening (Batch A+B):
  - maintenance owns `runMaintenanceAction`; `registry` → `registryPath` at the seam
  - governance owns `governanceDispatch` + `runGuarded`
  - feature owns `runFeatureAction` presentation (structured fns stay exported)
  - extract `core/syncProject` for scaffold/artifact/refresh orchestration
  - web adapter seam (`scripts/lib/web-adapter.js` + `.d.ts`); ADR-0007 Consequences updated
  - session transition SSOT (`isLegalTransition` / `legalTargets` / `isFinal`); web drops `ALLOWED_TRANSITIONS`

## [1.3.5] - 2026-07-14

### Added

- wiki: add declarative Knowledge Plan capability with tests

### Fixed

- regenerate agent commands after amber-wiki SKILL change

### Changed

- clear lint warnings, sync README version, ignore local IDE dirs
- add lint/format tooling, leak guard, and dogfood feature_list

## [1.3.4] - 2026-07-14

### Fixed

- session: writeSessionManifest uses monotonic timestamp too (#58)
- session: monotonic createdAt + deterministic sort tiebreak (#58)

### Changed

- quality: mark G1/G2 post-adjudication closures (#59)

## [1.3.3] - 2026-07-14

### Added

- changelog: detect BREAKING CHANGE in commit body footer (#52)
- cli: add npm run orient for session-start orientation (dogfood amber status) (#48)
- release: add zero-dependency changelog generator + release process automation for #47

### Fixed

- changelog: breaking flag requires ! or body footer, not subject text
- changelog: use full history (empty range) on null getLatestStableTag; robust parser for first-release (#53)
- release: terminal release assertion — catch local-only tags and registry ghosts (#46)

### Changed

- add regression tests for complete-check --strict rejecting init-scaffold/template handoff (G2, #56)
- verify apps/web E2E succeeds on Windows local (127.0.0.1 + NO_PROXY; stale 'proxy trap' memory resolved)
- update e2e-governance-loop-verify.md with #54 target-repo dogfood results (G1/G2 closed on external target; outcome A)
- refresh dogfood-weekly.md §7 candidate list to point at live open next-up (G1/G2 target-repo verification from adjudication gaps)
- verify amber next last-mile closed at HEAD (STEPS + strict + inferNextStep); drop G1 weakness from dogfood-weekly.md (closes #50)
- correct G2 evidence honesty section after verifying complete-check rejects template handoff at code layer (closes #51)
- dogfood: define weekly self-dogfood ritual and first-round candidates

## [1.3.2] - 2026-07-13

### Added — Closed-loop governance lifecycle

The full 11-step lifecycle (audit→init→feature→plan→gate→session→verify→approve→complete→accept→handoff) now works end-to-end. Wayfinder maps #14/#27/#35.

- `session start --feature <id>` binds the feature into the manifest; `session complete` is the governance terminal state (all non-terminal states may transition).
- `session verify --execute` refluxes real execution evidence back to `feature_list.json` — claim-only verify does NOT reflux.
- `accept` evidence gate — refuses a plan whose feature has no evidence (`AMBER_E_FEATURE_NO_EVIDENCE`; `--force` bypasses with a ledger warning), and validates the plan's feature matches the session's feature (#37).
- **`governance standards init`** — scaffolds `standards/security-governance.json` so the missing-security-standard remediation actually clears the finding (#44).
- `handoff` regenerates from live repo state (not template); bundle distinguishes `structureValid` vs `deliveryReady` and surfaces bounded `failedVerifications` (legacy `.harness` repos included).
- **ADR-0007** — web console boundary: supervised action viewer with an explicit allow-list (session start/pause/resume/abort, runVerification) vs CLI-only (approve/complete/accept/handoff/feature management).
- Redesigned web session console: SessionCompletionWorkbench, lifecycleRouter endpoints (next/completionCheck/runVerification), i18n, runner ACK persistence.
- Web artifact-store — centralizes TS artifact path resolution and JSON reading, traversal-guarded, skip-corrupt (TS twin of `core/fs-utils`).
- `scripts/demo/acceptance-demo.sh` — idempotent full-lifecycle acceptance demo.

### Security — verify-surface hardening (#36, #40–#44)

- `evaluateVerifyPolicy`: un-removable built-in denies (destructive patterns + quote-aware shell-composition operators) applied before user rules — a custom `verify-rules.json` can no longer drop destructive protection, and an allow-listed head can no longer smuggle chained commands (`pytest && rm -rf`, `pytest | sh`).
- Closed case-sensitivity bypass (`RM -RF`, `DROP TABLE`, …) and variant bypass (`rm -fr`, `rm -r -f`, `git push … --force` at line end) on the built-in destructive check.
- Governed surface (`loop run --execute`) aligned with the same built-in denies.
- Target-safe lifecycle remedies: `shellQuote` on target/plan/command paths; session verify/approve/complete-check/complete carry `--target` (#41).
- Verify command is discovered from disk (package.json `scripts.test` → `npm test`, else toolchain candidate, else explicit placeholder) — never a silent `npm test` for an unknown toolchain (#42).
- `audit` is strictly read-only: no `.amber/last-audit.json` stamp written to the target (#43).

### Fixed

- `ledger verify-anchoring` surfaces its domain error instead of printing `undefined`.
- `next` last-mile: guides session terminal steps (handoff → complete-check → complete); strict completion rejects init-scaffold handoff; audit-before-init for existing repos.
- `buildContext` honors the strict flag instead of hardcoding strict evaluation.
- governed-runner captures the error tail and normalizes the timeout exit code.
- standards loader distinguishes a corrupt framework file from an unknown framework.
- Cross-language event parity: web event types aligned with the CLI state machine, guarded by parity tests (schema, SessionStatusSchema, command registry).
- `verification_failed` events carry stderr.

### Deprecated

- `profile`, `task`, `result`, `agent`, `team`, `adoption` commands now emit runtime deprecation warnings and are marked DEPRECATED in help and CLI reference (#26).

### Changed

- timeline-event and session-manifest deepened into single modules; session write concern extracted from session-reader; resume-reject ACK envelope and ledger verify outcome single-sourced; web session control unified behind a shared `runControlledTransition` pipeline; orphan loop-contract schema validator dropped.

Full suite 1134 passing (CLI) + web Vitest green; manifests/doctor/gen:agents green.

## [1.3.1] - 2026-07-05

### Added — Artifact-first evidence layer, Phase 1

Three boundary-safe, zero-new-dependency commands that make Amber's drift detection CI-deployable and its tamper-evident ledger SIEM-consumable and git-anchored. Design: `docs/superpowers/specs/2026-07-05-amber-artifact-first-evidence-layer-design.md`.

- **`amber drift`** — CI-native drift gate aggregating the artifact / wiki / scaffold detectors into one exit code (`0` clean / `1` any actionable drift). Supports `--scope`, `--format gh-annotations` (GitHub Actions `::warning` lines), and `--no-fail` for informational CI steps. Read-only, Verification-layer (same shape as `doctor`).
- **`amber ledger export`** — SIEM/compliance bridge. Walks every `ledger.jsonl` (loops / routes / sessions) via `walkLedgers`, verifies each chain, and emits `json` (default), `csv`, or `otlp-json` (valid OTLP JSON encoding — no protobuf, no dependency). A broken chain is exported as `intact:false` and counted in `brokenCount` rather than refused.
- **`amber ledger seal` + `amber ledger verify-anchoring`** — anchors each ledger's tail hash into an annotated git tag (`amber-ledger-seal-<head-sha>`), so forging a ledger then requires rewriting git tag history too. Closes the gap ADR-0003 and `loop-ledger.js` both self-admit ("hash chain detects tampering but does not prevent a full-file rewrite"). Human-triggered; no push, no scheduling. Ed25519 signing deliberately deferred until key management is real.
- New CLI flags (`--scope`, `--format`, `--home`, `--out`, `--no-fail`) registered in the `parseArgs` `FLAG_SPECS` table, with a regression guard in `tests/unit/parse-args.test.js`.
- CI dogfoods `amber drift` (non-blocking) on every build.

Adds 17 tests (5 drift, 5 ledger-export, 4 ledger-seal, 2 git-exec, 1 parse-args guard); full suite 1053 passing, zero regressions.

## [1.3.0] - 2026-07-04

### Changed — Direct core imports, facade removed (#4, PR2)

- All facade consumers (`command-dispatcher`, 8 entry scripts, 12 tests) now import directly from `scripts/lib/core/*`; `grep` once again equals the dependency graph.
- Removed `scripts/lib/amber-core.js` (322-line zero-logic re-export facade) and `scripts/lib/harness-core.js` (its alias).
- New permanent guard `tests/unit/no-facade-reintroduction.test.js` prevents the facade/backdoor from returning (the old `lint` echo-shell enforced nothing).
- `templates/feature_list.json` F001 verification now points to `node scripts/amber.js doctor`.

### Removed — Zombie execution platform & experimental scope (#4, PR1)

- Five execution-platform peripheral modules (`scripts/lib/{daemon,notifier,health-checker,budget-tracker,error-recovery}.js`) and their unit tests — zero production references, kept alive only by self-tests.
- `amber daemon <status|stop>` CLI command — hidden command with no help/docs/start path; removal is bug-equivalent (minor).
- `src/experimental/execution/` and `tests/experimental/` — the cold-stored execution engine was unreachable, broken-chained (5+ dangling requires incl. `checkpoint-manager`), `test:experimental` failed 3/5, yet shipped to every installer via `files:["src/"]`. See ADR-0005.
- `test:experimental` npm script.

### Fixed

- `session start --mode autonomous` now refuses at the gate (exit 1, no manifest written), matching ADR-0002's stated intent. Previously it accepted the mode and only `session continue` refused — leaving an unreachable autonomous manifest behind.

## [1.2.0] - 2026-07-04

### Added — State-aware drift detection (`amber status` + `amber sync`)

- **`amber status`** — a curated state front-door: repo? / initialised? / fresh?, plus three drift surfaces in one glance. Read-only; does not duplicate `doctor` (validity) or `maintenance inspect` (full dump).
- **Scaffold-version drift (SP1)** — `.amber/provenance.json` (per-file sha256 + ownership tier; hash strips YAML `updated:`) and a four-class classifier (fresh / stale / customized / ambiguous / missing). `amber sync --execute` and `init --refresh-amber-owned` overwrite only `controlled + stale` files (after a `.bak` backup); `customized`/`ambiguous` controlled files are cached as proposals, never clobbered.
- **Artifact-vs-reality drift (SP2)** — optional per-feature `paths` field (`feature add --paths`) and a git-anchored `detectArtifactDrift` with six classes (drifted / aligned + skipped: no-evidence / untracked / path-unknown / anchor-invalid). Comparison is timezone-homogeneous (`Date.parse` ms); an empty pathspec is surfaced as `path-unknown` rather than swallowed into `aligned`.
- **Wiki drift (SP3)** — `detectWikiDrift` aggregates stale docs (`Last Reviewed` marker), missing required wiki pages, and controlled-wiki template drift. Surfaced in `amber status`; non-git projects are NOT skipped (wiki drift is marker/file/provenance based, not git-anchored).
- **`amber sync`** — standalone scaffold-drift resolution (dry-run by default; `--execute` applies).

### Added — Evidence-grade sessions

- **`session verify --execute`** runs the verification command in the working copy behind the policy gate and records its real exit code to the session hash-chain ledger (`verification_passed/failed/denied`).
- **`session approve`** identity gate — records who approved (interactive TTY prompt or `--yes`); the agent must not self-approve.
- **Honest `completion-check`** — `hasWorkEvidence` excludes `.amber/`/`.harness/` bookkeeping and compares the latest commit to `createdAt` at ms precision; `--strict` requires executed verification.
- Evidence ledger records now persist `stdoutTail`/`stderrTail` (passed/failed; denied omits them).
- Verification uses a dedicated `governance/verify-rules.json` allow-list (absent → built-in defaults; unparseable → stderr warn) — widening the global `rules.json` can no longer relax verification.

### Changed

- `maintenance inspect` now includes artifact drift alongside scaffold drift.
- `loadPolicyRules` now stderr-warns on an unparseable/shape-invalid `rules.json` instead of silently falling back (was a diagnostic trap).

### Fixed

- GitHub Packages publish workflow is now idempotent — a re-pointed tag or a re-run skips an already-published version instead of failing with `E409 Cannot publish over existing version`.

Baseline tests 1038 → 1136 (+98), zero regressions.

## [1.1.0] - 2026-06-30

### Added — Governed Loop Execution (GLX)

- **Governed execution of loop contract commands** via `amber loop run --execute`. A command declared in a contract's `governed` block runs behind four gates: a declarative policy check (`.amber/governance/rules.json`, deny-wins / default-deny), an explicit `amber loop approve` (one approval authorises one run), an isolated git worktree, and a tamper-evident hash-chain ledger. Default `loop run` is still dry-run; `--execute` needs an approval. (#ADR-0003)
- **Extracted reusable governed runner** (`runGovernedCommand` primitive) — the four gates are one call site, shared by loops AND route command-stages.
- **Governed route-stage execution** via `amber route test <route> --execute --stage <name>`. A route `command`-type stage's `target` can be governed-executed with the same four gates, recorded in a route-scoped ledger. Non-`command` stages refuse `--execute`.
- **Session hash-chain ledger** — `amber session verify` and `amber session approve` mirror governance-critical events (verify result, gate approval) into `.amber/sessions/<id>/ledger.jsonl` alongside the timeline. `amber session verify-ledger` detects tampering.
- **Per-context rules** — a loop contract's `governed` block and a route `command` stage may declare additional fixed-predicate rules composed with the global `rules.json`. Deny-wins is absolute: a context `allow` can never override any `deny`.
- **Declarative command policy** (`.amber/governance/rules.json`) with `governance rules init` (scaffold safe defaults), `governance rules inspect`, and `governance rules check --command "..."` (trial verdict, read-only).
- **Honest OWASP ASI coverage report** via `amber governance standards`. Each ASI01–ASI10 risk is honestly labelled `governance` / `partial` / `out-of-scope` (runtime-only risks are never falsely claimed as covered). The `present` flag reflects actual deployed controls in the target repo, not cosmetic labels.
- **Governance readiness** now inspects GLX state: missing or unsafe `rules.json` triggers a warning / block; tampered hash-chain ledgers trigger a hard block.
- **New CLI subcommands**: `loop approve` / `loop verify-ledger`, `route approve` / `route verify-ledger`, `session verify-ledger`, `governance rules <init|inspect|check>`, `governance standards`.
- New error codes: `AMBER_E_POLICY_DENY`, `AMBER_E_LOOP_NOT_APPROVED`, `AMBER_E_LEDGER_TAMPERED`.
- 27 new tests; baseline 978→1038, zero regressions.

### Changed

- Refactored README.md and README.zh-CN.md for adopter-first clarity (388→134 lines, −65%)
- Amended `README.md` / `SPEC.md` / `CLAUDE.md` non-goal sections: the blanket "no execution" is replaced by the precise ADR-0003 statement (governance-gated, human-triggered, loop/route command-stages only).
- Added `docs/adr/0003-governance-gated-execution.md` (with Phase 3 addendum for route stages).
- Approvals in hash-chain ledgers unified under the `approvalKey` / `consumedApprovalKey` field pair (was `approvalId`).

### Fixed

- Corrected `docs/README.md` path reference: `guides/getting-started.md` → `user-guide/getting-started.md`

### Added

- Banner regeneration prompt at `assets/readme/BANNER_PROMPT.md`

## [1.0.0] - 2026-06-22

### Added

- Core Amber Protocol engine (init, audit, doctor, adoption)
- Route definitions for feature/bugfix/refactor workflows
- Session lifecycle management with checkpoints and timelines
- Web viewer (beta, local-only)
- Comprehensive test suite (900+ assertions, 281 web tests)
- CI/CD pipeline with quality gates (coverage, security, performance)

### Changed

- Rebranded from Coding Harness to Amber Protocol
- Reorganized documentation by functional topics (removed phase concept)

### Documentation

- Getting started guide
- Architecture documentation (route engine, session lifecycle, governance)
- Adoption workflow for existing projects
- API reference

### Security

- Path traversal protection in session/gate readers
- Secret redaction in client error reports
- Upgraded Nodemailer to 9.0.1 to resolve GHSA-p6gq-j5cr-w38f

## [1.0.0-rc.1] - 2026-06-21

### Added

- Release candidate for community testing
- Release checklist documentation for quality assurance
- Docker isolation testing for npm package
- GPG-signed release tags
- RC validation report template

---

[Unreleased]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.4.1...HEAD
[1.4.1]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.4.0...v1.4.1
[1.4.0]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.12...v1.4.0
[1.3.12]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.11...v1.3.12
[1.3.11]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.10...v1.3.11
[1.3.10]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.9...v1.3.10
[1.3.9]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.8...v1.3.9
[1.3.8]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.7...v1.3.8
[1.3.7]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.6...v1.3.7
[1.3.6]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.5...v1.3.6
[1.3.5]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.4...v1.3.5
[1.3.4]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.3...v1.3.4
[1.3.3]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.2...v1.3.3
[1.3.2]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.1...v1.3.2
[1.3.1]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.3.0...v1.3.1
[1.3.0]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.2.0...v1.3.0
[1.2.0]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.1.0...v1.2.0
[1.1.0]: https://github.com/Bandersnatch0x/amber-protocol/compare/v1.0.0...v1.1.0
[1.0.0]: https://github.com/Bandersnatch0x/amber-protocol/releases/tag/v1.0.0
[1.0.0-rc.1]: https://github.com/Bandersnatch0x/amber-protocol/releases/tag/v1.0.0-rc.1