v2.7.0 — native links and verified context integrity

v2.7.0 release notes

Skill/CLI 2.7.0 maps to package/plugin 3.7.0. The tag follows the skill track.

Changes since v2.4.1

• Budgeted JSON task routing with explicit review signals, correct Unicode/spaces/rename paths and safe setup boundaries.
• Single-source agent resources and file ownership: canonical .agents bodies, pointer-only native metadata and preservation-first migration.
• Actual relative Git-compatible native symlinks, central Cursor views, Windows prerequisite guidance, immutable validation snapshots and non-destructive rollback recovery.
• Wave 0 substrate integrity: named frontmatter/glob contract errors; atomic wiki writes and live-owner-aware advisory locks; exact archive replay identity; validated staged SHIP-only installs with old-tree backups and local checksum manifest; setup CLI backup/config-schema migration; reserved roadmap/spec/tracker integrity; live router/related checks with fenced examples excluded.
• Always-green infrastructure: supported Node 22/24 on named Ubuntu/macOS/Windows runners, actual repository self-context gates, drift-negative probes, separate-track version/mapping/tag checks, read-only CI permissions, bounded jobs, concurrency cancellation and dependency update monitoring.
• The existing Vite/React website build is retained; this release does not claim its historical illustrative transcripts are a current benchmark.

Verification

Local candidate: Windows Node 24.21.0, node tests/run.mjs: 132 passed, 0 failed, 0 skipped. Strict wiki lint: 26 pages, 0 errors, 0 warnings; stale clean; doctor 13/13; copied CLI parity and baseline negative probes passed. Website npm run build passed.

The actual candidate passed all six Ubuntu/macOS/Windows jobs on Node 22/24, plus strict self-context and scaffold checks: https://github.com/AnshRoshan/project-context-system/actions/runs/39552815955. The verified commit was fast-forwarded to main and tagged v2.7.0. Main and actual tag CI are checked separately before final completion.

Limits

Hooks are best-effort bookkeeping, not verification of live host behavior. Advisory locks coordinate cooperating processes, not hostile filesystem writers. Install publishes with two sibling renames: caught failures restore an unoccupied target or report recovery backups, while a hard kill between renames may require recovery. A checksum manifest records local provenance; it is not remote authentication. Cold-start/eval claims remain unmeasured until their roadmap units run.