agent-session-kit 0.7.0

Swift and Rust become peer implementation lanes. The repository now says out
loud what it had already become when the Rust crate landed: one set of
session-reading semantics with two implementations, neither generated from
the other, and a contracts/ directory holding the facts both must honour.

Changed

• Layout: implementations/swift/ and implementations/rust/. The Swift
  sources and tests moved out of the repository root, and the Rust crates
  moved out of crates/. Both manifests stay at the root and reach in with
  explicit paths, so no consumer changes anything: the git URL, the
  exact: pin, import AgentSessionKit, and both product names are
  unaffected. crates/ at the root became implementations/rust/crates/,
  which does move the Cargo path for anyone depending on the crate by path
  rather than by git.
• ci.yml is now ci-swift.yml, and both lane workflows are scoped to their
  own paths plus contracts/.

Added

• contracts/storage/session-index-v5.sql — the canonical index DDL and
  user_version, extracted from the Swift writer that had been its only
  definition. Both lanes are now tested against it: SessionIndexContractTests
  checks that Swift creates exactly the objects the contract names, and
  index::contract_tests builds a database from the file and opens it with the
  Rust reader. A schema change in either lane alone now fails CI.

Fixed

• AgentSessionKitInfoTests resolved the repository root by walking three
  directories up from #filePath, which the new layout broke. It is five now,
  and the failure was real: the test could not find CHANGELOG.md.

Fixed

• Rust discovery/search/transcript parity. The first Rust session-core
  slice now mirrors Swift's default title/user/assistant search scopes,
  explicit system/tool opt-in, project include/exclude filtering, and title
  metadata branch. Codex and Claude transcript shapes are flattened more
  tolerantly, and discovery validates bounded head/tail JSON, regular files,
  tail metadata, stable ordering, and normalized 80-character titles.
  Intentional first-slice limitation: filesystem discovery still exposes
  only file modified_at; it does not yet expose parsed createdAt or
  lastActiveAt, and must not be presented as full timestamp parity. Index
  rows retain their stored created_at / last_active_at fields.
• Rust session core hardening. Transcript pages now stream into a bounded
  result, report an explicit truncated state instead of a partial total, and
  cap scan bytes/messages, page size, and rendered message text. Index list,
  search, and excerpt queries clamp untrusted page arguments before SQLite
  binding; short LIKE searches use the Swift store's 200-row cap.
• Rust session core parity and IPC safety. Index search now includes
  title/session-id metadata and deduplicates body and metadata results.
  Unknown providers are reported through an explicit compatibility status;
  opaque row references can resolve a transcript without treating a raw path
  supplied by a UI as authority. Direct readers reject symlink and
  non-regular leaves (while documenting the remaining same-user TOCTOU
  limitation).
• Rust reproducibility. The workspace now commits Cargo.lock, pins the
  toolchain to Rust 1.98.0, and runs CI with --locked.

Added

• crates/agent-session-core — the Rust implementation lane. A new
  Cargo workspace rooted at Cargo.toml carries agent-session-core
  (v0.1.0), a dependency-light Rust crate mirroring the session-reading
  semantics cross-platform hosts need without the Swift runtime: read-only
  session_index.sqlite3 access (schema v5; any other version is refused,
  never rebuilt), lightweight Codex/Claude Code filesystem discovery,
  tolerant JSONL transcript paging, and a byte-compatible mirror of
  SessionResumeCommandBuilder. The Swift package is untouched; the two
  lanes are peer implementations and this repository is the shared source
  of truth. First consumer: vibe-bar-desktop.