Detent v0.5.0

Detent v0.5.0

Deny is the bound law's default alpha

An unbounded expensive read (content-mode Grep without head_limit; a large Read without limit/offset) is now refused by default, with the exact bounded call named in the refusal reason -- the caller learns to state bounds up front instead of being silently patched. This is a behavior change for existing users: the old silent-injection behavior (inject) is one env var away -- DETENT_BOUNDS_MODE=inject.

This default was chosen after a live in-session test: an unbounded Grep was denied through the real wired hook, the model restated the bound on its next call, and it passed -- the teaching loop working end to end.

The bound law, collapsed to one composition

The two near-duplicate bound functions (grep_bound_unbounded_content, read_bound_unbounded_content) are now one law (_bound_absent_key) driven by a declarative BOUNDS table -- covering a future unbounded tool is adding one row, not writing a new function. Guard totality is owed by the law itself; explicitness is key-presence (an explicit 0/null is always respected, never re-bounded).

Also in this release

• Three near-identical capture call sites (failure / subagent-reply / compaction-summary) collapsed onto one shared _record_capture primitive.
• A further internal consolidation certified by an automated, test-suite-gated consolidation pass (no behavior change).
• marketplace.json for one-command plugin install.

Full diff: v0.4.0...v0.5.0

Detent v0.4.0

Security fix

dispatch.main() previously failed open on any internal error inside a move — including
the outbound secret-leak gate (outbound_deny_secret_pattern). If Detent errored while
evaluating an outbound call to a mcp__*/WebFetch/WebSearch tool, the gate silently vanished
and the call proceeded unchecked, instead of blocking it.

As of this release, an internal error during (PreToolUse, →WORLD-class tool) now fails
closed: the call is denied with an explicit reason, not silently allowed. Every other
event (rewrites, capture) is unaffected and still fails open, which is correct there —
availability, not enforcement, is at stake.

Upgrade recommended if you rely on the outbound secret gate. There is no CVE filed for the
prior behavior; this is a hardening fix, not a report of exploitation.

New capability

• Edit pointer expansion, via the documented defer → PermissionRequest seam. This
  client validates Edit.old_string before PreToolUse rewrites apply, so a pointer-form
  Edit (detent://L<a>-<b> or detent://<addr>) now defers to PermissionRequest, where the
  expansion applies as a condition of approval — before validation runs.
• FileChanged capture. File states written by anything other than the model's own
  Edit/Write (Bash redirects, build output, external processes) now become addressable on
  occurrence, closing a gap native checkpointing doesn't cover.

Internal

• dispatch.route() is now one table — ENVELOPE[(event, result-type)] → shape — instead of
  branch logic. Adding a protocol capability is now a row, not a branch.
• The public test suite grows from 6 to 157: the falsifiability/law-verification battery
  (test_laws.py — guard totality, rewrite idempotence, store monotonicity) now ships in this
  repo instead of staying dev-only.

Full Changelog: v0.3.0...v0.4.0

Detent v0.3.0

Full Changelog: v0.2.0...v0.3.0

Detent v0.2.0

Full Changelog: v0.1.0...v0.2.0

Lever v0.1.0

Full Changelog: https://github.com/Clear-Sights/Lever/commits/v0.1.0