v0.9.1 — Review lenses and dissent preservation

vibe-council v0.9.1 — Describe the personas (documentation only)

Ready for the v0.9.1 tag — not yet tagged. The version bump (backend/__init__.py,
pyproject.toml, uv.lock self-version) and the dated CHANGELOG.md section are done
(chore: prepare v0.9.1 release); the repo now reports 0.9.1. The git tag and the GitHub
Release are still a separate, manual step — see §"Final release checklist" below and
docs/release-checklist.md.

The second release of the v0.9.x line, closing its theme — "Apply the proven; describe the
personas; defer their behavior." v0.9.0 applied the four proven preference keys; v0.9.1
describes the council review lenses as pure documentation and designs the safety framework any
future persona behavior would have to satisfy — it adds no runtime, no schema, and no behavior of
any kind. Based on and crediting karpathy/llm-council.

No commercial-clearance claim. License/provenance remains an unresolved "Question 0"
commercial gate; no LICENSE is added.

Theme

Review lenses are now documented as a shared human/agent review vocabulary. Persona/lens
behavior — prompt influence, ranking/synthesis influence, a --persona flag, a preset schema —
remains deferred to v0.10.x or later, and only behind the dissent-preservation framework this
release also designs (docs only, no implementation).

What this release adds

PR 6 — Council review lenses (documentation only)

docs/fable/council-review-lenses.md documents review
lenses as a shared human/agent review vocabulary:

• Three primary, elaborated lenses: Security Guardian, Cost Skeptic, Local-first
  Guardian — each a short purpose plus emphasis/questions a reviewer can hold in mind.
• Four future stubs (named for vocabulary only, not elaborated): Product Strategist, UX/User
  Advocate, Risk Officer, Commercialization Lens.
• Documentation only. A pinned header and a binding envelope state a lens is "a human
  reviewer's mental lens, not a command" — not applied, not schema, not validated. A lens
  never changes prompt construction, peer ranking, chairman synthesis, model/provider selection, the
  preference reader/validator or PREFERENCES.md machine-block semantics, the guide/context-export
  output, or the Workbench/executor/guard/trust boundary. It may only add scrutiny (tighten-only);
  it can never suppress or outrank another lens's dissent, or loosen a safety rule; it creates
  or reads no .council/profile.* store; it implies no UI.

PR 7 — v0.10.x dissent-preservation framework design sketch (documentation only)

docs/fable/v0.10.x-dissent-preservation-sketch.md
specifies — design only, no implementation — the safety framework any future council
persona/lens behavior must satisfy before it could ship:

• Threat model for future lens/persona behavior: reframing bias, emphasis-as-suppression, seat
  crowd-out, cumulative bias across stages, and persona-text-as-injection.
• How a lens can accidentally suppress dissent (an emergent failure, not an explicit one) and
  why "more scrutiny" is not automatically "more safety" — attention is finite, and narrowing a
  frame can reduce total coverage even when every word reads as "be more careful."
• Structural rules: additive collect-stage-only, own-seat-only, ranking/synthesis
  persona-blind, no hidden prompt mutation, default-off/feature-flagged, trust boundary untouched.
• Content rules: no suppression/override language, no reference to other seats/ranking/
  synthesis, additive-only framing, length-bounded, curated (not free-form).
• Dissent-canary test ideas: a seeded objection must still surface verbatim with every persona
  enabled; injection-shaped persona text is rejected; ranking/synthesis inputs stay byte-identical
  with/without a persona; an off-state golden matches the pre-persona baseline.
• Observability/audit requirements (persona use labeled in stage output and usage reporting),
  override + rollback rules (explicit CLI/user choice always wins, per-invocation override,
  feature-flag default-off, a reversible kill-switch), and acceptance criteria that gate any
  future persona-behavior PR (a merge gate, not polish).
• An honest feasibility verdict: partly feasible (the structural/content rules and most of the
  canary suite are ordinary engineering), partly a research problem (reframing bias is not
  fully catchable by output-diff tests — there is no deleted artifact to detect). Cancellation is
  on the table, not just deferral, if dissent-preservation proves infeasible; a persona-free
  fallback (concurrent councils with different preference sets, compared by the user) is recorded
  as an alternative design, not implemented.
• Stop conditions that force a full council review (persona text reaching ranking/
  synthesis, silent prompt mutation, suppression of a minority opinion, a schema: 2 without its
  own reviewed spec, an on-by-default persona, a new local store/UI/network surface).

council-review-lenses.md links the sketch.

PR 8 — v0.9.1 release prep (this release)

Version bump (backend/__init__.py/pyproject.toml/uv.lock self-version, one line, no
dependency-graph change), a dated CHANGELOG.md [0.9.1] section, this release note, and README/
vault (STATUS.md/PROGRESS.md/ROADMAP.md/RELEASES.md) + docs/context/agent-brief.md
pointers. Release metadata + docs only.

Safety posture

• No persona/council behavior. No lens is parsed, selected, or applied to any command; nothing
  reads a persona into prompt construction, ranking, or synthesis.
• No prompt mutation, no ranking/synthesis change. Both files are pure documentation/design —
  no code path in backend/ was touched by either.
• No schema change. No schema: 2, no new preference key, no change to backend/preferences.py
  (reader or validator) — the v0.8.2 schema v1 stays frozen, exactly as v0.9.0 left it.
• No .council/profile.* local store, no UI/dashboard, no network/LAN/mobile/hosted surface.
• No Workbench/executor/guard/trust change. The deterministic trust boundary, the guarded
  executor, the command allowlist, and approval-separate-from-execution are untouched.
• No dependency change (stdlib-only; the only uv.lock change across PR 6–8 is the
  vibe-council self-version line).
• Redaction lint stays 0 critical (30 warnings, pre-existing); context check and MCP health
  stay 21/21.

Explicit non-goals (deferred, not started in this release)

No active review-lens/persona runtime of any kind · no persona schema objects or persona
validator · no prompt emphasis · no ranking/synthesis influence · no UI/dashboard · no hosted /
network / LAN / mobile mode · no .council/profile.* local store · no Workbench trust-boundary or
executor change · no command-allowlist growth · no vector DB / database stack · no /council real
command. v0.9.1 documents the lenses and designs the future safety framework, and nothing more —
persona behavior stays a v0.10.x-or-later decision, gated behind the dissent-preservation
framework's acceptance criteria.

Release checklist (must be clean before tagging)

• uv run python -m unittest discover -s tests -t . is green (1020 tests).
• uv run python -m backend.cli --version prints vibe-council 0.9.1.
• vibe lint --redaction reports 0 critical (30 warnings, expected).
• vibe decisions lint passes.
• vibe project doctor reports READY.
• vibe context check scores 21/21.
• vibe mcp inspect --context --health scores 21/21.
• uv sync produces no uv.lock diff beyond the intentional self-version sync in this PR.
• No .council/ artifact (incl. .council/runtime/payloads/ and .council/profile.*)
  staged/committed; no root CLAUDE.md/AGENTS.md/FABLE.md; no private/local plan file
  staged.

Final release checklist (manual steps, after this PR merges)

These are not automated by this PR — a maintainer performs them once the checklist above is
clean on master:

• Merge this PR (chore: prepare v0.9.1 release) into master.
• On the merged master, re-confirm: tests green, vibe --version reports vibe-council 0.9.1, redaction lint 0 critical (30 warnings), decisions lint passes, vibe project doctor
  READY, context check 21/21, MCP health 21/21, and uv sync shows no drift.
• Verify git status --short and the merged diff carry no private/local artifacts
  (.council/, .council/profile.*, the two untracked private plan files, .env/.venv//
  data/, secrets, generated packs/exports, root CLAUDE.md/AGENTS.md/FABLE.md).
• Create an annotated git tag: git tag -a v0.9.1 -m "vibe-council v0.9.1" on the merge
  commit, then git push origin v0.9.1.
• Create the GitHub Release for v0.9.1 manually, using this document
  (docs/releases/v0.9.1.md) as the release-notes body.

Known limitations

• Documentation only, by design. Neither the lenses nor the dissent-preservation sketch change
  any runtime behavior; there is nothing to dogfood beyond reading the docs.
• The feasibility verdict is honest, not reassuring. Reframing bias — a persona narrowing a
  seat's attention so a dissenting thought never forms — is flagged as a research problem, not
  solved by this release. v0.10.x may find persona behavior infeasible and cancel it rather than
  ship it.
• No hosted/team/mobile/voice — deferred to later ph...

v0.9.0 — Apply the proven preferences

vibe-council v0.9.0 — Apply the proven preferences (tighten-only, advisory)

Ready for the v0.9.0 tag — not yet tagged. The version bump (backend/__init__.py,
pyproject.toml, uv.lock self-version) and the dated CHANGELOG.md section are done
(chore: prepare v0.9.0 release); the repo now reports 0.9.0. The git tag and the GitHub
Release are still a separate, manual step — see §"Final release checklist" below and
docs/release-checklist.md.

The first release of the v0.9.x line. Its theme — "Apply the proven; describe the personas; defer
their behavior" — is the "later" that the whole v0.8.x line was built toward: v0.8.2 defined and
validated the tighten-only preference schema; v0.9.0 finally applies it, but only the four
mechanically-proven, add-friction-only keys, and only in bounded, advisory, tighten-only ways. The
deterministic trust boundary, the executor, the Workbench, and the council prompt/ranking/synthesis
paths remain completely preference-blind — locked by tests. No named-persona behavior, no prompt
emphasis, no new command, no new dependency. Based on and crediting
karpathy/llm-council.

No commercial-clearance claim. License/provenance remains an unresolved "Question 0"
commercial gate; no LICENSE is added.

How v0.9.x was planned (council-backed + Fable architecture)

• Council-backed planning (docs-only, two vibe review --preset balanced passes):
  v0.9.x-council-debate.md,
  v0.9.x-phase-brief.md, and
  v0.9.x-fable-input.md. The council rejected shipping persona
  behavior as premature — the dissent-suppression / viewpoint-bias failure mode is a new risk
  class the tighten-only proof machinery does not cover.
• Fable architecture plan (docs-only, version-line):
  v0.9.x-architecture-plan.md resolved the theme into a two-
  release line — v0.9.0 apply-the-keys (PRs 1–5) and v0.9.1 persona lenses + v0.10.x
  dissent-preservation sketch — and a spec/CLI resolution (schema v1's full is a council mode,
  not a --preset value → notice-only; schema v1 stays frozen).

What this release adds — the four proven keys, applied

The clamped reader (PR 1)

• New effective_suggestions(project_root) → Suggestions in
  backend/preferences.py: pure, read-only, fail-closed. It reuses
  the v0.8.2 validator internals and returns clamped tighten-only values only — raw parsed JSON never
  escapes: review_preset_floor is emitted only for a preset strictly above the project baseline
  (so "lower" is inexpressible and premium is unrepresentable), the path fields are re-validated,
  de-duplicated relative-path tuples, and require_usage is a plain bool. Any anomaly (missing /
  invalid / oversized / multiple-block / out-of-root / undecodable block, or any validation error) →
  NEUTRAL. It reads exactly one file (PREFERENCES.md, realpath-inside-root), writes nothing, and
  never reads a .council/profile.* store.

Review/diff preset floor + --no-preferences (PR 2)

• vibe review and vibe diff resolve their preset through the reader — tighten-only and
  CLI-first. Precedence (highest wins): an explicit --preset (CLI always wins) → the new
  --no-preferences escape hatch (baseline; byte-identical to pre-v0.9.0) → a validated preference
  floor (can only raise toward more review, never lower, never premium) → the project
  baseline (DEFAULT_PRESET).
• Because the baseline is already balanced (the strongest non-premium preset), the observable effect
  is that a default_review_preset: "full" block prints one pinned stderr notice recommending
  vibe full and leaves the preset at the baseline — full is a council mode, not a --preset
  value; nothing is silently reinterpreted. A genuine raise (a future lower baseline) is likewise
  announced.
• extract / mini / full modes never consult preferences.

Usage-flag warning (PR 3)

• On vibe review / vibe diff only, when the block sets require_usage_flag: true and --usage is
  absent, a single pinned stderr warning ("pass --usage to see token usage (advisory)"). It
  never adds --usage, never fails, never changes cost/model behavior, and is suppressed by
  --usage, --no-preferences, or an explicit choice.

Doctor staged-path advisories (PR 3)

• vibe project doctor emits advisory [warn] lines in its staged-file section when a staged path
  equals/prefixes a declared never_stage_extra / extra_sensitive_paths entry — naming the preference
  key (never its configured value / raw JSON), volume-capped at 10 lines plus a roll-up.
  Advisory only: READY/NOT-READY, exit code, and the [FAIL] dangerous-staged set are byte-stable;
  a missing/invalid block leaves doctor behavior unchanged. It does not change staging, git, or the
  no-stage guard.

Isolation lock-in (PR 4)

• tests/test_preferences_isolation.py locks the boundary:
  an allowlist-first static scan (the backend.preferences importer set is exactly {cli.py};
  effective_suggestions is referenced only in {preferences.py, cli.py}; an explicit forbidden-
  surface list — all workbench_*, council.py, openrouter.py/providers.py, guards.py, mcp_*,
  context_pack.py — imports none of it), a behavioral byte-identity check (the deterministic trust
  evaluation and the dry-run executor are identical with and without a maximal valid block), pointer-
  only guide/context-export tripwires, doctor READY stability, and a pack-21/21-with-block check.

Safety posture

• Advisory / tighten-only only. Every preference effect can only add friction/warnings — never
  enforce, never block, never fail a command, never lower a preset, never select premium, never
  auto-add --usage, never change staging/git. An explicit --preset/--usage (or --no-preferences)
  always wins.
• Preference-blind trust surface. The guard, executor, Workbench, proposal/importer/panel, and the
  council prompt / ranking / synthesis paths never read preferences (proven by static scan +
  byte-identity tests). Guide / context-export stay pointer-only. No .council/profile.* store.
• Raw JSON never escapes the reader; all preference-driven text is stderr-only and pinned.
• No new dependency (stdlib-only; the only uv.lock change is the vibe-council self-version
  line). Redaction lint stays 0 critical (30 warnings); context check and MCP health stay
  21/21.

Explicit non-goals (deferred, not started in this release)

No named-persona behavior · no prompt emphasis · no ranking/synthesis influence · no persona schema
objects or persona validator (v0.9.1 documents the review lenses as prose; v0.10.x is the persona-
behavior line behind a dissent-preservation framework) · no UI/dashboard · no .council/profile.*
local store · no Workbench trust-boundary/executor change · no command-allowlist growth · no hosted /
network / LAN / mobile mode · no vector DB / database stack · no /council real command. v0.9.0 applies
the four proven keys, advisory/tighten-only, and nothing more.

Release checklist (must be clean before tagging)

• uv run python -m unittest discover -s tests -t . is green (990 tests).
• uv run python -m backend.cli --version prints vibe-council 0.9.0.
• vibe lint --redaction reports 0 critical (30 warnings, expected).
• vibe decisions lint passes.
• vibe project doctor reports READY and shows the Preferences (machine-readable, advisory):
  section.
• vibe context check scores 21/21.
• vibe mcp inspect --context --health scores 21/21.
• uv sync produces no uv.lock diff beyond the intentional self-version sync in this PR.
• No .council/ artifact (incl. .council/runtime/payloads/ and .council/profile.*)
  staged/committed; no root CLAUDE.md/AGENTS.md/FABLE.md; no private/local plan file staged.

Final release checklist (manual steps, after this PR merges)

These are not automated by this PR — a maintainer performs them once the checklist above is clean
on master:

• Merge this PR (chore: prepare v0.9.0 release) into master.
• On the merged master, re-confirm: tests green, vibe --version reports vibe-council 0.9.0,
  redaction lint 0 critical (30 warnings), decisions lint passes, vibe project doctor READY (with
  the preferences advisory section), context check 21/21, MCP health 21/21, and uv sync shows no
  drift.
• Verify git status --short and the merged diff carry no private/local artifacts
  (.council/, .council/profile.*, the two untracked private plan files, .env/.venv//data/,
  secrets, generated packs/exports, root CLAUDE.md/AGENTS.md/FABLE.md).
• Create an annotated git tag: git tag -a v0.9.0 -m "vibe-council v0.9.0" on the merge
  commit, then git push origin v0.9.0.
• Create the GitHub Release for v0.9.0 manually, using this document
  (docs/releases/v0.9.0.md) as the release-notes body.

Known limitations

• Small observable delta by design. With the balanced baseline, the preset floor is notice-only
  (no preset actually changes); v0.9.0's deeper value is the application pattern (single clamped
  consumption point, fixed precedence, byte-identity guarantees) that later work reuses.
• Preferences are advisory. Nothing here enforce...

v0.8.2 — Preference schema and validator

vibe-council v0.8.2 — Preference schema v1 + read-only doctor validator

Ready for the v0.8.2 tag — not yet tagged. The version bump (backend/__init__.py,
pyproject.toml, uv.lock self-version) and the dated CHANGELOG.md section are done
(chore: prepare v0.8.2 release); the repo now reports 0.8.2. The git tag and the GitHub
Release are still a separate, manual step — see §"Final release checklist" below and
docs/release-checklist.md.

The preference-control slice of the v0.8.x "Solidify the core, local-first" line: a normative,
tighten-only preference schema v1 plus a read-only validator folded into vibe project doctor.
This is the "auditable before executable" gate — the schema is defined and validated but never
applied. No preference influences any behavior, no council/persona behavior changes, no new
command, no new dependency. Based on and crediting
karpathy/llm-council.

No commercial-clearance claim. License/provenance remains an unresolved "Question 0"
commercial gate; no LICENSE is added.

How v0.8.x was planned (council-backed + Fable architecture)

• Council-backed planning (docs-only): v0.8.x-council-debate.md
  weighed candidate directions; v0.8.x-phase-brief.md captured the
  resolved theme; v0.8.x-fable-input.md was the curated handoff.
• Fable architecture plan (docs-only, version-line — architecture-only, no implementation):
  v0.8.x-architecture-plan.md resolved the open questions into
  a 9-PR sequence. v0.8.2 is PR 7 (the schema) + PR 8 (the validator, at full review) plus
  this release prep (PR 9).

What this release adds

Preference schema v1 (PR 7)

• A normative spec — docs/fable/preference-schema-v1.md — and a
  single bounded (≤ 4096-byte) fenced json block in
  docs/context/project/PREFERENCES.md (Markdown stays the source
  of truth; the block is the machine-checkable region).
• Exactly four tighten-only keys plus the required schema: 1:
  • default_review_preset — enum cheap | balanced | full (a review floor; premium is not in
    the enum and can never be named).
  • extra_sensitive_paths — array of relative path prefixes (additive extra-guarding).
  • never_stage_extra — array of relative paths (additive no-stage extension).
  • require_usage_flag — boolean; only true is meaningful (warn when --usage is absent).
• Tighten-only by construction: every legal value can only add friction/checks; the schema has
  no vocabulary to loosen a safety/security/no-stage/trust rule, change the Workbench executor/trust
  boundary, add shell/auto-execution/network/hosted behavior, override the review policy, or
  hide/suppress dissenting council opinions.
• Council personas (Cost Skeptic, Security Guardian, Product Strategist, Local-first Guardian,
  UX/User Advocate, Risk Officer, Commercialization Lens) are documented as an illustrative, future
  v0.9.x direction — curated presets of these tighten-only values, never a policy override. They are
  not v1 fields and are not applied.

Read-only preference validator in vibe project doctor (PR 8, full review)

• New pure module backend/preferences.py validates the schema v1 block
  and returns findings only (Finding(level, message) — never parsed settings; parse helpers are
  private). It is read-only (reads exactly one file), writes nothing, creates no .council/, and
  never reads a .council/profile.* store.
• vibe project doctor gains an advisory Preferences (machine-readable, advisory): section:
  a valid block → [ok ], a missing block → informational [note] (prose-only is fine), an
  invalid block → [warn] with the reason and "ignored (not applied to anything)".
• READY/NOT-READY and exit code are unchanged — a missing or invalid block is never a doctor
  failure (failure stays reserved for missing required docs + dangerous staged files).
• Hardening (fail-closed on any anomaly): first/only fenced ```json block, 4096-byte cap,
  stdlib json.loads only (no jsonschema/pydantic/YAML/TOML), key allowlist, strict per-key
  types, relative-path checks (reject absolute / drive-letter / .. / backslash / non-string;
  traversal detected across both separators), empty-array + duplicate warnings, missing/unknown
  schema version rejected (a JSON true rejected as non-integer), realpath-inside-project-root
  symlink defense (generic warn, no content/target leak), UTF-8-only (UnicodeDecodeError → clean
  warn).
• The module exposes findings, not settings: a test asserts no module outside the doctor path
  imports backend.preferences, so a parsed value can never be wired into behavior.

Safety posture — unchanged from v0.8.1

• No preference application and no council/persona behavior application — the schema is
  validated into a report, never routed into any command's logic. Application is deferred to v0.9.x.
• No local .council/profile.* store, no preference applier, no named-persona runtime.
• No guide/context-export behavior change — those stay pointer-only (never inline the block).
• No Workbench trust-boundary/executor/proposal/importer/panel change, no command-allowlist growth.
• No model/provider/API call, no vector DB / database / hosted stack, no network/LAN/mobile
  surface, no new dependency (stdlib-only; the only uv.lock change is the vibe-council
  self-version line). Redaction lint stays 0 critical (30 warnings); context check and MCP health
  stay 21/21.

Explicit non-goals (deferred, not started in this release)

No named persona runtime · no UI/dashboard persona controls · no local .council/profile.* store · no
preference applier · no Workbench/executor/trust changes · no hosted / network / LAN / mobile mode · no
vector DB / database stack · no /council real command. v0.8.2 is the schema + read-only validator
infrastructure only.

Release checklist (must be clean before tagging)

• uv run python -m unittest discover -s tests -t . is green (919 tests).
• uv run python -m backend.cli --version prints vibe-council 0.8.2.
• vibe lint --redaction reports 0 critical (30 warnings, expected).
• vibe decisions lint passes.
• vibe project doctor reports READY and shows the Preferences (machine-readable, advisory):
  section.
• vibe context check scores 21/21.
• vibe mcp inspect --context --health scores 21/21.
• uv sync produces no uv.lock diff beyond the intentional self-version sync in this PR.
• No .council/ artifact (incl. .council/runtime/payloads/ and .council/profile.*)
  staged/committed; no root CLAUDE.md/AGENTS.md/FABLE.md; no private/local plan file staged.

Final release checklist (manual steps, after this PR merges)

These are not automated by this PR — a maintainer performs them once the checklist above is clean
on master:

• Merge this PR (chore: prepare v0.8.2 release) into master.
• On the merged master, re-confirm: tests green, vibe --version reports vibe-council 0.8.2,
  redaction lint 0 critical (30 warnings), decisions lint passes, vibe project doctor READY,
  context check 21/21, MCP health 21/21, and uv sync shows no drift.
• Verify git status --short and the merged diff carry no private/local artifacts
  (.council/, .council/profile.*, the two untracked private plan files, .env/.venv//data/,
  secrets, generated packs/exports, root CLAUDE.md/AGENTS.md/FABLE.md).
• Create an annotated git tag: git tag -a v0.8.2 -m "vibe-council v0.8.2" on the merge
  commit, then git push origin v0.8.2.
• Create the GitHub Release for v0.8.2 manually, using this document
  (docs/releases/v0.8.2.md) as the release-notes body.

Known limitations

• Validate-only. The validator reports on the block; nothing applies it. A valid block
  changes no behavior — that is deliberate (application is v0.9.x behind its own reviewed design).
• Personas are documentation. The named council personas are an illustrative future direction, not
  defined, selected, or applied here.
• No hosted/team/mobile/voice — deferred to later phases.

Next after v0.8.2

Cut the v0.8.2 tag/GitHub Release, closing the v0.8.x "Solidify the core, local-first" line
(v0.8.0 launcher, v0.8.1 vault polish, v0.8.2 preference schema + validator). The next version-line
architecture moment is v0.9.x — preference application (letting validated preferences influence a
command, and the council-persona model): a Fable architecture pass over council-produced planning, then
Opus/Sonnet implementation. Preference application, a .council/profile.* store, named
personas/persona UX, mobile/LAN/voice, and hosted/team all stay deferred behind their own gated designs.

v0.8.1 — Vault polish

vibe-council v0.8.1 — Vault polish (capped release-history index)

Ready for the v0.8.1 tag — not yet tagged. The version bump (backend/__init__.py,
pyproject.toml, uv.lock self-version) and the dated CHANGELOG.md section are done
(chore: prepare v0.8.1 release); the repo now reports 0.8.1. The git tag and the GitHub
Release are still a separate, manual step — see §"Final release checklist" below and
docs/release-checklist.md.

The vault-polish patch of the v0.8.x "Solidify the core, local-first" line. It keeps the
project vault (and its context pack) lean by adding a capped, newest-first release-history index
— docs/context/project/RELEASES.md — and a documented
STATUS-trimming workflow, so STATUS.md can stay focused on the current state instead of a
growing release log. Docs + tests only: no code behavior change, no new command, no dependency
change. Based on and crediting
karpathy/llm-council.

No commercial-clearance claim. License/provenance remains an unresolved "Question 0"
commercial gate; no LICENSE is added.

How v0.8.x was planned (council-backed + Fable architecture)

• Council-backed planning (docs-only): v0.8.x-council-debate.md
  weighed candidate directions; v0.8.x-phase-brief.md captured the
  resolved theme; v0.8.x-fable-input.md was the curated handoff.
• Fable architecture plan (docs-only, version-line — architecture-only, no implementation):
  v0.8.x-architecture-plan.md resolved the open questions into
  a 9-PR sequence. v0.8.1 is PR 5 (the vault index/workflow) plus this release prep (PR 6).
  Per the balanced review, the vibe summarize-history command was deferred — a documented
  workflow delivers the same lean-STATUS outcome with zero new command surface.

What this release adds (PR 5)

docs/context/project/RELEASES.md — a capped release-history index

• A newest-first index of shipped releases (v0.8.0 → v0.1.0), one line per release, each
  pointing at its canonical docs/releases/<version>.md note.
• It is an index / working-memory aid, not canonical detailed release notes: it does not inline
  full release-note bodies. The detailed notes remain in docs/releases/*.md,
  and CHANGELOG.md remains the canonical chronological change list.
• Cap / collapse policy: a hard cap of 30 visible release/history entries; on overflow the
  oldest entries collapse into a single roll-up line (history is summarized, never endlessly
  appended). The rule is documented inline in the file.
• Not ingested into the context pack. vibe context build still builds only from STATUS.md +
  decisions; a test asserts a phrase distinctive to RELEASES.md never reaches the pack. Context
  health stays 21/21 and the pack size is unchanged.

STATUS-trimming workflow (in WORKFLOWS.md)

• A short "Trimming STATUS history" workflow: move aged "Current state" bullets into the release
  notes, keep a one-line pointer plus a RELEASES.md entry, and use a git log recipe to reconstruct
  what shipped when. Human curation — deterministic, local, and there is no command (no
  summarize-history).
• STATUS.md is kept focused on current state / the latest release, with a pointer to
  RELEASES.md for the full history.

Tests

• tests/test_project_vault.py gains checks: RELEASES.md present + in the deterministic vault set,
  ≤ 30 entries, documents its cap/collapse policy, links the canonical release notes, is framed as
  an index (not a replacement/duplicate), does not inline note bodies, the README/STATUS/WORKFLOWS
  pointers exist, no private-plan names appear, and the context pack does not ingest it.

Safety posture — unchanged from v0.8.0

• No code behavior change. No new CLI command; no summarize-history command / no RELEASES.md
  automation; no context-builder rewrite or budget change; no vibe project doctor, vibe guide,
  vibe context export, or vibe init-agent behavior change; no redaction-semantics change.
• No Workbench / proposal / importer / executor / trust change, no command-allowlist expansion.
  Approval stays separate from execution; the deterministic trust boundary remains authoritative.
• No preference schema/validator yet, no .council/profile.* store, no preference application —
  personalization stays advisory/pointer-only and tighten-only.
• No vector DB / database / hosted stack, no network / LAN / mobile mode, no new dependency
  (the only uv.lock change is the vibe-council self-version line). Redaction lint stays 0
  critical (30 warnings); context check and MCP health stay 21/21.

Explicit non-goals (deferred, not started in this release)

No v0.8.2 preference schema/validator yet · no summarize-history command / RELEASES.md automation ·
no local .council/profile.* store · no preference applier · no named profiles · no Workbench-UX
changes · no /council real command · no hosted / network / LAN / mobile mode. v0.8.1 is the vault
release-history index + STATUS-trimming workflow only.

Release checklist (must be clean before tagging)

• uv run python -m unittest discover -s tests -t . is green (861 tests).
• uv run python -m backend.cli --version prints vibe-council 0.8.1.
• vibe lint --redaction reports 0 critical (30 warnings, expected).
• vibe decisions lint passes.
• vibe project doctor reports READY.
• vibe context check scores 21/21.
• vibe mcp inspect --context --health scores 21/21.
• uv sync produces no uv.lock diff beyond the intentional self-version sync in this PR.
• No .council/ artifact (incl. .council/runtime/payloads/ and .council/profile.*)
  staged/committed; no root CLAUDE.md/AGENTS.md/FABLE.md; no private/local plan file staged.

Final release checklist (manual steps, after this PR merges)

These are not automated by this PR — a maintainer performs them once the checklist above is clean
on master:

• Merge this PR (chore: prepare v0.8.1 release) into master.
• On the merged master, re-confirm: tests green, vibe --version reports vibe-council 0.8.1,
  redaction lint 0 critical (30 warnings), decisions lint passes, vibe project doctor READY,
  context check 21/21, MCP health 21/21, and uv sync shows no drift.
• Verify git status --short and the merged diff carry no private/local artifacts
  (.council/, .council/profile.*, the two untracked private plan files, .env/.venv//data/,
  secrets, generated packs/exports, root CLAUDE.md/AGENTS.md/FABLE.md).
• Create an annotated git tag: git tag -a v0.8.1 -m "vibe-council v0.8.1" on the merge
  commit, then git push origin v0.8.1.
• Create the GitHub Release for v0.8.1 manually, using this document
  (docs/releases/v0.8.1.md) as the release-notes body.

Known limitations

• RELEASES.md curation is human. There is no digest/summarize command; keeping it capped and
  rolling up old entries is a documented manual workflow, by design (the summarize-history command
  was deferred pending a concrete, reviewable extraction spec).
• Index only. RELEASES.md intentionally holds no detailed notes — follow its pointers into
  docs/releases/.
• Personalization is still advisory/documentation — no preference is read or applied yet.
• No hosted/team/mobile/voice — deferred to later phases.

Next after v0.8.1

Cut the v0.8.1 tag/GitHub Release, then continue the v0.8.x line per
docs/fable/v0.8.x-architecture-plan.md: v0.8.2 (the
tighten-only JSON preference schema + a read-only validator in vibe project doctor, full review;
no application). Preference application, a .council/profile.* store, mobile/LAN/voice, and
hosted/team stay deferred to v0.9.x behind their own gated designs.

v0.8.0 — Agent onboarding launcher

vibe-council v0.8.0 — Agent onboarding launcher (vibe init-agent)

Ready for the v0.8.0 tag — not yet tagged. The version bump (backend/__init__.py,
pyproject.toml, uv.lock) and the dated CHANGELOG.md section are done
(chore: prepare v0.8.0 release); the repo now reports 0.8.0. The git tag and the GitHub
Release are still a separate, manual step — see §"Final release checklist" below and
docs/release-checklist.md.

The agent onboarding launcher release, opening the v0.8.x "Solidify the core, local-first"
line. It adds a single onboarding entry point — vibe init-agent — that composes the existing
vibe project doctor / vibe guide machinery into a report + guarded write, plus a mandatory
localhost-only test guard. Everything is local-first, read-only-by-default, and append-only when
writing: no preference behavior, no .council/profile.* store, no network/LAN/hosted surface, no
new dependency. Based on and crediting
karpathy/llm-council.

No commercial-clearance claim. License/provenance remains an unresolved "Question 0"
commercial gate; no LICENSE is added.

How v0.8.x was planned (council-backed + Fable architecture)

• Council-backed planning (docs-only): v0.8.x-council-debate.md
  weighed candidate directions and the council (two vibe review --preset balanced passes)
  rejected "preference behavior as the headline" as premature;
  v0.8.x-phase-brief.md captured the resolved theme; and
  v0.8.x-fable-input.md was the curated handoff.
• Fable architecture plan (docs-only, version-line — not patch-by-patch, architecture-only, no
  implementation): v0.8.x-architecture-plan.md preserved the
  council's "Solidify the core, local-first" pivot and resolved the open questions into a 9-PR
  sequence. v0.8.0 is the first three implementation PRs below.

What this release adds

vibe init-agent report mode (PR 1)

• A deterministic, read-only onboarding report: a vibe project doctor readiness summary,
  then per agent (claude/codex/fable) exactly what vibe guide … --write would do to the
  fixed files (would create / would append / already-present-would-skip), plus the recommended next
  commands (vibe project doctor, vibe guide …, vibe context export …).
• States that vibe is the real CLI and /council is not (a future host-command idea only), that
  the profile/preferences are documentation/advice only, and that personalization may tighten
  but never loosen a safety/security/no-stage/trust rule.
• Writes nothing, creates no .council/, runs no commands, makes no model/provider/network call.
  No path argument; operates only on the current working directory.

vibe init-agent --write guarded append mode (PR 2)

• vibe init-agent --write --agent {claude|codex|fable}... [--role <role>] --yes appends the
  selected agents' guide sections to the fixed per-topic files — Claude → CLAUDE.md, Codex →
  AGENTS.md, Fable → FABLE.md — via the existing _guide_append machinery.
• Append-only, marker-skip idempotent (re-runs byte-identical; existing content preserved; an
  already-present section is skipped, not duplicated); the appended section is byte-identical to
  vibe guide <agent> --role <role> --write (shared helper — no divergence; no guide subprocess).
• Safety: --write requires --yes (a deterministic confirmation) and an explicit --agent
  (a bare --write never writes three files); no path/target argument (the fixed defaults are the
  whole write surface — no traversal/injection); a target that exists as a non-regular file fails
  cleanly; creates no .council/.

Localhost-only guard (PR 3)

• A tests-only guardrail (tests/test_localhost_guard.py) that locks the local-first
  invariant — no production change (the Workbench panel already enforces it): the panel binds
  loopback only, non-local hosts (0.0.0.0, ::, representative LAN/external IPs, empty) are
  rejected, a runtime check confirms every observed socket.bind is loopback,
  host_header_is_local accepts only loopback Host headers, and a static "no second listener"
  scan asserts no module outside backend/workbench_panel.py constructs a listening socket/server.
• No LAN/hosted mode, no host-header/state-token change.

Safety posture — unchanged from v0.7.1

• No arbitrary shell, no auto-execution, no Workbench trust-boundary loosening, no command
  allowlist expansion. Approval stays separate from execution; the deterministic trust boundary
  remains authoritative.
• No preference parsing/application, no .council/profile.* local store, no preference applier —
  personalization stays advisory/pointer-only and tighten-only.
• No vector DB / database / hosted stack, no model/provider/network call from the new commands,
  no new dependency (the only uv.lock change is the vibe-council self-version line). Redaction
  lint stays 0 critical (30 warnings); context check and MCP health stay 21/21.

Explicit non-goals (deferred, not started in this release)

No v0.8.1 RELEASES.md / vault-polish work yet · no v0.8.2 preference schema/validator yet · no local
.council/profile.* store · no preference applier · no named profiles · no Workbench-UX changes · no
/council real command · no hosted / network / LAN / mobile mode. v0.8.0 is the launcher + localhost
guard only.

Release checklist (must be clean before tagging)

• uv run python -m unittest discover -s tests -t . is green (849 tests).
• uv run python -m backend.cli --version prints vibe-council 0.8.0.
• vibe lint --redaction reports 0 critical (30 warnings, expected).
• vibe decisions lint passes.
• vibe project doctor reports READY.
• vibe context check scores 21/21.
• vibe mcp inspect --context --health scores 21/21.
• uv sync produces no uv.lock diff beyond the intentional self-version sync in this PR.
• No .council/ artifact (incl. .council/runtime/payloads/ and .council/profile.*)
  staged/committed; no root CLAUDE.md/AGENTS.md/FABLE.md; no private/local plan file staged.

Final release checklist (manual steps, after this PR merges)

These are not automated by this PR — a maintainer performs them once the checklist above is clean
on master:

• Merge this PR (chore: prepare v0.8.0 release) into master.
• On the merged master, re-confirm: tests green, vibe --version reports vibe-council 0.8.0,
  redaction lint 0 critical (30 warnings), decisions lint passes, vibe project doctor READY,
  context check 21/21, MCP health 21/21, and uv sync shows no drift.
• Verify git status --short and the merged diff carry no private/local artifacts
  (.council/, .council/profile.*, the two untracked private plan files, .env/.venv//data/,
  secrets, generated packs/exports, root CLAUDE.md/AGENTS.md/FABLE.md).
• Create an annotated git tag: git tag -a v0.8.0 -m "vibe-council v0.8.0" on the merge
  commit, then git push origin v0.8.0.
• Create the GitHub Release for v0.8.0 manually, using this document
  (docs/releases/v0.8.0.md) as the release-notes body.

Known limitations

• vibe init-agent composes existing generators — it does not seed the vault, run a model, or
  initialize a project beyond appending guide blocks to the fixed files.
• Intentionally local-only — the Workbench binds 127.0.0.1; agent intake is file/CLI only; the
  localhost guard is a code-drift tripwire, not a runtime sandbox.
• Personalization is still advisory/documentation — no preference is read or applied yet.
• No hosted/team/mobile/voice — deferred to later phases.

Next after v0.8.0

Cut the v0.8.0 tag/GitHub Release, then continue the v0.8.x line per
docs/fable/v0.8.x-architecture-plan.md: v0.8.1 (capped
RELEASES.md + a documented STATUS-trimming workflow) and v0.8.2 (the tighten-only preference
schema + a read-only validator in vibe project doctor, full review; no application). Preference
application, a .council/profile.* store, mobile/LAN/voice, and hosted/team stay deferred to v0.9.x
behind their own gated designs.

v0.7.1 — Personalization hardening

vibe-council v0.7.1 — Personalization hardening

Ready for the v0.7.1 tag — not yet tagged. The version bump (backend/__init__.py,
pyproject.toml, uv.lock) and the dated CHANGELOG.md section are done
(chore: prepare v0.7.1 release); the repo now reports 0.7.1. The git tag and the GitHub
Release are still a separate, manual step — see §"Final release checklist" below and
docs/release-checklist.md.

The personalization hardening release. It hardens the v0.7.0 safe-personalization scaffold —
it does not expand it. Everything added is advisory, read-only, local, and tighten-only;
personalization still can never loosen a security/safety/no-stage/trust rule, and there is still no
preference store, no preference parser/application, no vector DB/database, and no hosted stack. No
model/provider/network call, no Workbench trust-boundary change, no /council command (vibe is the
real CLI), no new dependency. Based on and crediting
karpathy/llm-council.

No commercial-clearance claim. License/provenance remains an unresolved "Question 0"
commercial gate; no LICENSE is added.

What this release adds

v0.7.1 hardening architecture plan (Fable planning-only pass)

• docs/fable/v0.7.1-hardening-architecture-plan.md
  — a docs-only Fable architecture pass (planning only; Fable implemented nothing) that scoped the
  phase as hardening, not feature expansion. It was balanced-council-reviewed ("this plan
  should be executed"), grounded against the real code, and broke the work into a small 4-PR sequence
  with explicit non-goals, a risk analysis, copy-paste Opus/Sonnet prompts, and a Fable stop rule.

Local-profile redaction hardening (PR 1)

• vibe lint --redaction gains a local-profile-path WARNING rule that flags a concrete
  local/private profile filename — .council/profile.(json|md|toml|yaml|yml) — when it appears in a
  tracked public doc. The glob form .council/profile.* is intentionally not matched (operational/
  policy text uses the glob; the rule targets concrete leaks only).
• Public committed scaffold files (docs/context/project/PROFILE.md / PREFERENCES.md /
  AGENT-ROLES.md) are allowed — they are never flagged for existing.
• It is advisory (WARNING, blocks only under --strict), following the private-plan-filename
  precedent, with a documented WARNING → CRITICAL promotion path for when a real local profile
  store ships. Expected redaction result: 0 critical, 30 warnings (the extra warnings are the
  enumerated design/plan-doc references, pinned by tests).

Project doctor profile consistency polish (PR 2)

• vibe project doctor's advisory "Personalization scaffold" section now differentiates the
  all-present / none-present / partial states: all present → an OK summary; none → a "scaffold is
  missing" warn; partial → a "scaffold is incomplete" warn that lists the missing file(s).
• A missing/partial scaffold WARNs — it does not fail. READY/NOT-READY still depends solely on
  required vault/core docs + the dangerous-staged check.
• The root-AGENTS.md advisory is state-aware and reiterates that root AGENTS.md is not the
  canonical preference source (never advises removing it — it is legitimate guide output).
• A staged .council/profile.* still FAILs through the existing dangerous .council/ staged-file
  check (now pinned by a test).

Export / guide invariant tests (PR 3)

• The context-export and guide "Project profile & preferences" sections are locked by tests as:
  size-bounded (no full profile/vault content inlined), never reading .council/profile.*,
  gracefully degrading if the scaffold is missing (the export section is byte-identical
  with/without it; the guide reads no filesystem at all), and deterministic (no timestamp).
• A wording invariant pins that the guide keeps "advice to read, not commands" and "never
  loosen" and never implies a preference can override/relax/bypass a safety rule.
• A vault-consistency check pins that the scaffold/vault files agree on the shared invariants, and
  a context-pack no-ingest check pins that the pack still does not ingest the full vault and
  stays 21/21.

Safety posture — hardening only, unchanged trust boundary

• No profile storage implementation and no preference parsing/application — personalization is
  still advisory documentation + pointers.
• No Workbench trust-boundary change, no auto-execution, no command-allowlist expansion.
• No model/provider/API/network call from anything in this release.
• /council is not a real command — vibe remains the real CLI.
• No dependency changes (the only uv.lock change is the vibe-council self-version line).
  Redaction lint stays 0 critical (30 warnings, explained); context check and MCP health stay
  21/21.

Explicit non-goals (deferred, not started in this release)

No local .council/profile.* store yet · no preference parser / application engine · no
guide/context-export preference application · no vector DB · no database stack · no hosted / SaaS · no
project init / interactive launcher / vibe council start. v0.7.1 hardens the existing advisory
surface; it adds no runtime.

Release checklist (must be clean before tagging)

• uv run python -m unittest discover -s tests -t . is green (811 tests).
• uv run python -m backend.cli --version prints vibe-council 0.7.1.
• vibe lint --redaction reports 0 critical (30 warnings, expected).
• vibe decisions lint passes.
• vibe project doctor reports READY.
• vibe context check scores 21/21.
• vibe mcp inspect --context --health scores 21/21.
• uv sync produces no uv.lock diff beyond the intentional self-version sync in this PR.
• No .council/ artifact (including .council/runtime/payloads/ and .council/profile.*)
  staged/committed; no root AGENTS.md; no private/local plan file staged.

Final release checklist (manual steps, after this PR merges)

These are not automated by this PR — a maintainer performs them once the checklist above is clean
on master:

• Merge this PR (chore: prepare v0.7.1 release) into master.
• On the merged master, re-confirm: tests green, vibe --version reports vibe-council 0.7.1,
  redaction lint 0 critical (30 warnings), decisions lint passes, vibe project doctor READY,
  context check 21/21, MCP health 21/21, and uv sync shows no drift.
• Verify git status --short and the merged diff carry no private/local artifacts
  (.council/, .council/profile.*, the two untracked private plan files, .env/.venv//data/,
  secrets, generated packs/exports, root AGENTS.md).
• Create an annotated git tag: git tag -a v0.7.1 -m "vibe-council v0.7.1" on the merge
  commit, then git push origin v0.7.1.
• Create the GitHub Release for v0.7.1 manually, using this document
  (docs/releases/v0.7.1.md) as the release-notes body.

Known limitations

• Personalization is still advisory/documentation — nothing reads, parses, or enforces the
  profile/preferences; v0.7.1 only hardens the guardrails around them.
• No local .council/profile.* store yet — the redaction rule's CRITICAL promotion is staged for
  when such a store ships.
• Intentionally local-only — the Workbench binds 127.0.0.1; agent intake is file/CLI only.
• No hosted/team/mobile/voice yet — deferred to later phases.

Next after v0.7.1

Cut the v0.7.1 tag/GitHub Release, then scope the next slice per
docs/fable/v0.7-personalization-and-project-profile-plan.md
and docs/fable/04-roadmap.md: remaining personalization work (a local
.council/profile.* store and a preference reader/applier — all still tighten-only), with
mobile/LAN/voice (v0.8) and hosted/team (v0.9+) deferred behind the local core.

v0.7.0 — Safe personalization scaffold

vibe-council v0.7.0 — Safe personalization / project-profile scaffold

Ready for the v0.7.0 tag — not yet tagged. The version bump (backend/__init__.py,
pyproject.toml, uv.lock) and the dated CHANGELOG.md section are done
(chore: prepare v0.7.0 release); the repo now reports 0.7.0. The git tag and the GitHub
Release are still a separate, manual step — see §"Final release checklist" below and
docs/release-checklist.md.

The safe personalization / project-profile release. On top of the v0.6.x cross-project onboarding
arc, this bundles the v0.7 A–D personalization slice: a council-in-the-loop planning brief, a
public-safe project profile/preferences scaffold, and advisory pointers to that scaffold from
vibe project doctor, vibe context export, and vibe guide. Everything here is advisory,
read-only, and local, and tighten-only: personalization can never loosen a security/safety/
no-stage/trust rule. No model/provider/network call, no Workbench trust-boundary change, no
/council command (vibe is the real CLI), no new dependency. Based on and crediting
karpathy/llm-council.

No commercial-clearance claim. License/provenance remains an unresolved "Question 0"
commercial gate; no LICENSE is added.

What this release adds

v0.7 personalization / project-profile planning brief

• docs/fable/v0.7-personalization-and-project-profile-plan.md
  — the council-in-the-loop source brief for the phase: purpose, non-goals, the Markdown-first
  memory model, the tighten-only principle (personalization may tighten but never loosen a
  guardrail), the layered data model, the council-in-the-loop production workflow, an A–E PR breakdown,
  open questions, and a copy-paste future-Fable architecture prompt.
• A balanced council review was performed on the brief; its highest-value, in-scope refinements
  were folded in (profile-never-sent-to-model, a concrete "tighten-only" definition, schema-stability
  and public-safe open questions). The brief explicitly rules out a vector DB / database / hosted
  stack for v0.7.

Project profile/preferences scaffold (PR A)

• Public-safe, committed, Markdown vault files under docs/context/project/:
  PROFILE.md (project identity/shape, local-first stance,
  release state), PREFERENCES.md (review-preset policy,
  Fable-usage policy, implementation style, no-stage policy, tighten-only principle), and
  AGENT-ROLES.md (per-agent role expectations, the
  MODEL: OPUS/SONNET CODE / MODEL: FABLE CODE header convention, the council-in-the-loop workflow).
• Each file carries a safe-to-commit boundary, a never-store list, and the tighten-only
  principle. Root AGENTS.md is deliberately not used as the canonical preference source (the
  balanced review flagged a write-target/read-source corruption risk); role preferences live in the
  vault AGENT-ROLES.md. Public-safe committed files only — no secrets, raw outputs, runtime
  payloads, or private data.

Project doctor awareness (PR B)

• vibe project doctor gains an advisory "Personalization scaffold" section for
  PROFILE.md / PREFERENCES.md / AGENT-ROLES.md: present → [ok ], missing → [warn] with a
  next step (never a doctor failure). Root AGENTS.md is not required; if present, an advisory
  [warn] points to the vault convention. Dangerous staged files still fail as before, and
  READY/NOT-READY still depends solely on the required vault/core docs + the dangerous-staged check.
  Still read-only: writes no files, creates no .council/, makes no model/provider/network call.

Context-export profile pointers (PR C)

• vibe context export --for {claude|codex|fable} [--role <role>] gains a "Project profile &
  preferences" section with pointers to the three scaffold files — pointers only, no full
  scaffold dump. It notes tighten-only, that root AGENTS.md is not the canonical preference source,
  and recommends vibe project doctor. The export never reads .council/profile.*, inlines no
  distinctive file content, degrades gracefully if the scaffold is absent, stays deterministic (no
  timestamp), and remains read-only (stdout by default; --output FILE still never overwrites).

Guide profile pointers (PR D)

• vibe guide {claude|codex|fable} [--role <role>] [--write [FILE]] output now carries the same
  "Project profile & preferences" pointer section in base, role, and --write guides. It is
  static/deterministic — it parses/applies no preferences and reads no local/private
  profile — and the existing --write append + marker-skip behavior is unchanged (no duplication on
  re-run).

Safety posture — advisory, tighten-only, unchanged trust boundary

• Personalization is advisory and tighten-only — a project preference may make a rule stricter
  but can never loosen a security / safety / no-stage / trust rule. Preferences are advice to
  read, not commands to execute; the deterministic trust boundary ignores them entirely.
• No model / provider / API / network call from any of the new/changed commands.
• No Workbench trust-boundary change — approval stays separate from execution, the deterministic
  trust boundary remains authoritative, the auditor stays advisory, and there is no auto-execution.
  The Workbench / importer / panel / executor are untouched.
• /council is not a real command — it stays a documented future host-command idea; vibe
  remains the real CLI.
• No dependency changes (the only uv.lock change is the vibe-council self-version line);
  redaction lint remains 0 critical; context check and MCP health remain 21/21.

Explicit non-goals (deferred, not started in this release)

No vector DB · no PostgreSQL / Redis / Docker / Next.js / LangGraph adoption · no hosted / SaaS · no
cloud sync · no secret storage · no local .council/profile.* implementation yet · no preference
parser / application engine yet · no redaction rule implementation yet · no root AGENTS.md
preference source · no project init / interactive launcher / vibe council start. The v0.7 surface is
a set of advisory pointers + a documented scaffold, not a personalization runtime.

Release checklist (must be clean before tagging)

• uv run python -m unittest discover -s tests -t . is green (784 tests).
• uv run python -m backend.cli --version prints vibe-council 0.7.0.
• vibe lint --redaction reports 0 critical findings.
• vibe decisions lint passes.
• vibe project doctor reports READY.
• vibe context check scores 21/21.
• vibe mcp inspect --context --health scores 21/21.
• uv sync produces no uv.lock diff beyond the intentional self-version sync in this PR.
• No .council/ artifact (including .council/runtime/payloads/ and .council/profile.*)
  staged/committed; no root AGENTS.md; no private/local plan file staged.

Final release checklist (manual steps, after this PR merges)

These are not automated by this PR — a maintainer performs them once the checklist above is clean
on master:

• Merge this PR (chore: prepare v0.7.0 release) into master.
• On the merged master, re-confirm: tests green, vibe --version reports vibe-council 0.7.0,
  redaction lint 0 critical, decisions lint passes, vibe project doctor READY, context check
  21/21, MCP health 21/21, and uv sync shows no drift.
• Verify git status --short and the merged diff carry no private/local artifacts
  (.council/, .council/profile.*, the two untracked private plan files, .env/.venv//data/,
  secrets, generated packs/exports, root AGENTS.md).
• Create an annotated git tag: git tag -a v0.7.0 -m "vibe-council v0.7.0" on the merge
  commit, then git push origin v0.7.0.
• Create the GitHub Release for v0.7.0 manually, using this document
  (docs/releases/v0.7.0.md) as the release-notes body.

Known limitations

• Personalization is advisory/documentation — vibe project doctor / context export / guide
  only point to the scaffold; nothing reads, parses, or enforces the profile/preferences yet.
• The scaffold is curated, committed Markdown — not a database, not an Obsidian dependency, and
  there is no local .council/profile.* store yet.
• Intentionally local-only — the Workbench binds 127.0.0.1; agent intake is file/CLI only.
• No hosted/team/mobile/voice yet — deferred to later phases.

Next after v0.7.0

Cut the v0.7.0 tag/GitHub Release, then scope the next slice per
docs/fable/v0.7-personalization-and-project-profile-plan.md
and docs/fable/04-roadmap.md: remaining personalization work (e.g. a local
.council/profile.* store and a preference reader/applier — all still tighten-only), with
mobile/LAN/voice (v0.8) and hosted/team (v0.9+) deferred behind the local core.

v0.6.3 — Cross-project agent onboarding

vibe-council v0.6.3 — Cross-project agent onboarding

Ready for the v0.6.3 tag — not yet tagged. The version bump (backend/__init__.py,
pyproject.toml, uv.lock) and the dated CHANGELOG.md section are done
(chore: prepare v0.6.3 release); the repo now reports 0.6.3. The git tag and the GitHub
Release are still a separate, manual step — see §"Final release checklist" below and
docs/release-checklist.md.

The cross-project agent onboarding release. On top of the v0.6.0 agent-to-Workbench proposal
bridge, this bundles the v0.6.1–v0.6.3 onboarding arc: a role-aware vibe guide layer, a local-first
Markdown project vault, a read-only vibe project doctor, and a read-only vibe context export --for <agent> handoff. Everything here is read-only and local: no model/provider/network call, no
Workbench trust-boundary change, no /council command (vibe is the real CLI), no new dependency.
Based on and crediting karpathy/llm-council.

No commercial-clearance claim. License/provenance remains an unresolved "Question 0"
commercial gate; no LICENSE is added.

What this release adds

Role-aware guide layer (v0.6.1)

• vibe guide claude --role <role> — a read-only stdout generator printing a role-tailored
  instruction block. Roles: task-shaper, planner, coder, reviewer, release-manager. Each
  pairs a role-specific workflow with the common rules (this project's CLI is vibe not /council;
  council is a reviewer/context/memory layer, not an implementer; the cheap/balanced/full preset
  policy; before/after-coding workflow; the Workbench proposal-bridge basics; the never-stage list).
• Opt-in --write — vibe guide claude --role <role> --write [FILE] appends the role's
  section to a CLAUDE.md-style file (default CLAUDE.md) and reports the path. Append-only with a
  per-role marker: never overwrites/truncates, re-runs are skipped, and roles coexist in one file.
• Claude / Codex / Fable topics — vibe guide {claude|codex|fable} [--role <role>] [--write [FILE]], reusing the same machinery. Default --write targets: CLAUDE.md, AGENTS.md,
  FABLE.md. Codex emphasizes using vibe as a reviewer/guardrail and proposing (not bypassing)
  Workbench actions; Fable documents its cost/technical-lead policy — plan-first, curated
  docs/context//docs/fable/ packs (not broad scans), Opus/Sonnet implement routine PRs, and Fable
  reserved for major phase planning / critical architecture-security blockers / high-leverage reviews.

Project vault (v0.6.2)

• A local-first, Markdown, human- and agent-readable project-memory vault under
  docs/context/project/: README.md, STATUS.md, ROADMAP.md, DECISIONS.md (an index/pointer
  into docs/decisions/, never a competing canonical store), PROGRESS.md, RISKS.md,
  WORKFLOWS.md, NOTES.md. Each file states what belongs there and what must never go there
  (secrets, API keys, private paths, runtime payloads, raw outputs, private plans).
• The context builder is unchanged — the pack stays a budgeted projection (STATUS.md + decision
  index; context check 21/21 preserved). The vault is read directly and discovered via pointers,
  not injected into the budgeted pack.

Project doctor (v0.6.2)

• vibe project doctor — a read-only onboarding-readiness diagnostic (new project subcommand,
  distinct from the provider vibe doctor). Checks the vault + core onboarding docs are present; that
  no dangerous file is staged (.env / .council/ / .council/runtime/ / private plans → fail;
  a staged uv.lock → advisory warning); a context-health summary (in-memory
  build_pack/check_pack); and lists the vibe guide commands. Exit 0 when ready; non-zero with
  next steps otherwise; git-unavailable degrades to a warning. Read-only: writes no files, creates
  no .council/, makes no model/provider/network call.

Agent context export (v0.6.3)

• vibe context export --for {claude|codex|fable} [--role <role>] [--output FILE] — a read-only
  onboarding context handoff. Prints Markdown to stdout by default; --output FILE writes it and
  never overwrites an existing file. It bundles a header (vibe real / /council future), a
  vibe project doctor recommendation, project-vault pointers (not a full vault dump), a
  context-health summary built in-memory (no .council/ written), the Workbench proposal flow
  (propose → human approves → guarded execute; no auto-execution; raw payload never rendered), and the
  operating rules + agent guidance + never-stage list. The existing vibe context export claude-code
  behavior is unchanged.

Safety posture — unchanged from v0.6.0

Nothing in this release changes the security model; everything added is read-only/local:

• No model/provider/API/network call from any of the new onboarding commands.
• No Workbench trust-boundary change — approval stays separate from execution, the deterministic
  trust boundary remains authoritative, the auditor stays advisory, and there is no
  auto-execution. The Workbench/importer/panel/executor are untouched.
• /council is not a real command — it stays a documented future host-command idea; vibe
  remains the real CLI (the onboarding docs say so explicitly).
• No command-allowlist change, no new dependency, no new network surface.
• Redaction lint remains 0 critical; context check and MCP health remain 21/21.

Explicit non-goals (deferred, not started in this release)

No project init · no interactive launcher / vibe council start · no Obsidian plugin · no vector DB ·
no hosted / SaaS stack · no Next.js / Postgres / Redis / Docker / LangGraph adoption · no
personalization implementation (v0.7) · no mobile/LAN/voice (v0.8) · no hosted/team (v0.9+). The
onboarding surface is a set of read-only generators/diagnostics, not a runtime.

Release checklist (must be clean before tagging)

• python -m unittest discover -s tests -t . is green (749 tests).
• uv run python -m backend.cli --version prints vibe-council 0.6.3.
• vibe lint --redaction reports 0 critical findings.
• vibe decisions lint passes.
• vibe context check scores 21/21.
• vibe mcp inspect --context --health scores 21/21.
• uv sync produces no uv.lock diff beyond the intentional self-version sync in this PR.
• No .council/ artifact (including .council/runtime/payloads/) staged/committed.
• No private/local plan file staged/committed.

Final release checklist (manual steps, after this PR merges)

These are not automated by this PR — a maintainer performs them once the checklist above is clean
on master:

• Merge this PR (chore: prepare v0.6.3 release) into master.
• On the merged master, re-confirm: tests green, redaction lint 0 critical, decisions lint
  passes, context check 21/21, MCP health 21/21.
• Verify git status --short and the merged diff carry no private/local artifacts
  (.council/, the two untracked private plan files, .env/.venv//data/, secrets,
  generated packs/exports).
• vibe --version on master prints vibe-council 0.6.3.
• Create an annotated git tag: git tag -a v0.6.3 -m "vibe-council v0.6.3" on the merge
  commit, then git push origin v0.6.3.
• Create the GitHub Release for v0.6.3 manually, using this document
  (docs/releases/v0.6.3.md) as the release-notes body.

Known limitations

• Onboarding is read-only generators/diagnostics — vibe guide/project doctor/context export
  print (or, for guide --write/export --output, append/write a user-chosen file); none are
  interactive launchers and none run a model.
• The project vault is curated, committed Markdown — not a database, not an Obsidian dependency.
• Intentionally local-only — the Workbench binds 127.0.0.1; agent intake is file/CLI only.
• No hosted/team/mobile/voice yet — deferred to later phases.

Next after v0.6.3

Cut the v0.6.3 tag/GitHub Release, then scope the next phase per
docs/fable/04-roadmap.md: personalization (v0.7) is the next candidate,
with mobile/LAN/voice (v0.8) and hosted/team (v0.9+) deferred behind the local core.

v0.6.0 — Agent proposal bridge

vibe-council v0.6.0 — Agent-to-Workbench proposal bridge

Ready for the v0.6.0 tag — not yet tagged. The version bump (backend/__init__.py,
pyproject.toml, uv.lock) and the dated CHANGELOG.md section are done
(chore: prepare v0.6.0 release); the repo now reports 0.6.0. The git tag and the GitHub
Release are still a separate, manual step — see §"Final release checklist" below and
docs/release-checklist.md.

The agent-to-Workbench proposal bridge release. AI agents (Claude Code, Codex, Fable, or custom
workers) can now propose a bounded code action into the local Workbench instead of acting
directly — a human still inspects, approves, and executes. It is local file/CLI intake only (no
network endpoint): an agent writes a schema-v1 proposal JSON, vibe workbench propose validates it
and mints ids + payload hash server-side, the panel shows a proposed-by-agent card, and nothing
runs until a human approves it and explicitly executes it through the existing, unchanged
guarded executor. Still local-first and stdlib-only: no new runtime dependency, no new network
surface, no command-allowlist growth. Based on and crediting
karpathy/llm-council.

No commercial-clearance claim. License/provenance remains an unresolved "Question 0"
commercial gate; no LICENSE is added.

What this release adds

Built across four PRs (#95–#98), designed in
docs/fable/05-v0.6-agent-bridge.md /
docs/fable/06-proposal-schema.md.

Proposal schema + validation (PR #95)

• A pure, stdlib-only validation module (backend/workbench_proposals.py) defining proposal envelope
  schema v1 — strict: unknown keys are rejected at every level (envelope/agent/action/
  payload/scope), never silently dropped.
• Allowed kinds: write_file, edit_file, and run_command by exact command_label only.
• Rejected outright (fail-closed): freeform/mutated commands; argv/env/cwd/timeout/
  shell; payload_hash; action_id/approval_id/task_id/status/risk/verdict/blocked/
  findings; cloud_call (and read_file/unknown kinds); and absolute, ..-traversal, or
  denylisted paths (.env, .git, .council, private plans, key files). File payloads have exact
  per-kind shapes, reject NUL bytes, and honor early size caps mirroring the executor bounds (the
  executor remains the final authority at execution time).
• proposal_id is strictly charset-validated ([A-Za-z0-9._-], 1–120) — rejected, never
  sanitized — because it is the importer's dedup key.

Proposal importer + CLI intake (PR #96)

• backend/workbench_proposal_importer.py turns a validated proposal into a runtime Task + pending
  ApprovalRequest + pending Action that flows into the existing, unchanged trust/auditor/panel/
  executor path.
• Server mints everything: task/approval/action ids come from the runtime store; the payload
  hash is computed server-side from the submitted content; the internal kind:target convention is
  constructed server-side (agents never author it).
• File payloads are stored in a local, gitignored, write-once payload artifact — never in the
  task/approval/action JSON and never in the dedup record.
• Dedup by proposal_id (global, never agent-scoped): an identical re-import returns the original
  ids and creates nothing; the same id with materially different content is a conflict and
  fails closed (a corrupt dedup record also fails closed). No auto-execution.
• CLI: vibe workbench propose <proposal.json | -> (stdin supported). A JSON result is printed to
  stdout (machine-readable, never raw payload); a human summary + panel next-step goes to stderr;
  failure exits non-zero and creates no runtime files.

Panel proposed-by-agent visibility (PR #97)

• Imported agent-proposed tasks show a "proposed by agent: <name>" badge with the agent role and
  proposal_id (all HTML-escaped), so they are visually distinct from demo/manual tasks.
• Display-only — derived from the task's existing agent:<name> source plus a read-only
  importer lookup. No raw payload content appears in the panel HTML or the /api/state JSON, and
  no tokens are exposed. XSS-safe (agent name / title are escaped).

Documentation (PR #98)

• docs/workbench-agent-bridge.md — the end-to-end guide: overview
  and flow, safety model, CLI usage/output, safe write_file/edit_file/run_command examples,
  rejected-example/common-mistake cases, and the agent + human operator workflows.
• docs/agent-quickstart.md gained a §10 pointer; the README gained a short
  pointer + minimal usage example.

Security posture — unchanged from v0.5.2 (only extended upstream of approval)

The bridge sits entirely upstream of the approval, so none of the v0.5 guarantees move:

• No network endpoint — file/CLI intake only; no new HTTP API, no CORS, no LAN/mobile/remote.
• Approval is separate from execution — importing a proposal only records a pending approval; it
  never writes a file or runs a command. Approval records a decision; execution is a further,
  separate, explicit step.
• The existing guarded executor is the only execution path, and it re-validates the
  deterministic trust boundary at execution time — a stored audit or a cached preview cannot
  authorize anything.
• The trust boundary remains the deterministic authority; the Approval Auditor remains
  advisory and can never relax a block.
• Commands are exact allowlisted labels only (no command-allowlist expansion in this release), no
  arbitrary shell, no dynamic argv/env/cwd/timeout.
• Server mints ids + hash; agents never submit them. Raw payload content stays in the local
  write-once artifact and is never rendered anywhere.
• The v0.5.2 hardening remains in force — the panel binds 127.0.0.1, POSTs and GET /api/state
  are token-gated, and every request's Host header is validated (DNS-rebinding defense).
• Redaction lint remains 0 critical; context check and MCP health remain 21/21.

Explicit non-goals (deferred, not started in this release)

No autonomous execution · no LAN/mobile/hosted/voice · no personalization · no project-vault
implementation · no onboarding/session-launcher implementation · no website · no new provider/model/
network call from the executor · no dependency changes. The docs/fable/ pack plans these; this
release implements none of them.

Release checklist (must be clean before tagging)

• python -m unittest discover -s tests -t . is green (672 tests).
• uv run python -m backend.cli --version prints vibe-council 0.6.0.
• vibe lint --redaction reports 0 critical findings.
• vibe decisions lint passes.
• vibe context check scores 21/21.
• vibe mcp inspect --context --health scores 21/21.
• uv sync produces no uv.lock diff beyond the intentional self-version sync in this PR.
• No .council/ artifact (including .council/runtime/payloads/) staged/committed.
• No private/local plan file staged/committed.

Final release checklist (manual steps, after this PR merges)

These are not automated by this PR — a maintainer performs them once the checklist above is clean
on master:

• Merge this PR (chore: prepare v0.6.0 release) into master.
• On the merged master, re-confirm: tests green, redaction lint 0 critical, decisions lint
  passes, context check 21/21, MCP health 21/21.
• Verify git status --short and the merged diff carry no private/local artifacts
  (.council/, the two untracked private plan files, .env/.venv//data/, secrets,
  generated packs/exports).
• vibe --version on master prints vibe-council 0.6.0.
• Create an annotated git tag: git tag -a v0.6.0 -m "vibe-council v0.6.0" on the merge
  commit, then git push origin v0.6.0.
• Create the GitHub Release for v0.6.0 manually, using this document
  (docs/releases/v0.6.0.md) as the release-notes body.

Known limitations

• Intentionally local-only — no LAN/mobile/remote access; the panel binds 127.0.0.1 only, and
  proposal intake is local file/CLI only (no network endpoint).
• Intentionally tiny command allowlist — run_command proposals accept only the fixed
  verification/status labels; the allowlist did not grow for the bridge.
• The demo still seeds no executable Action (a deliberate v0.5.0/PR #77 safety choice) — real
  execution dogfood requires an imported or manually-seeded action in a temp/safe project.
• No hosted/team/mobile/voice yet — deferred to a later phase.

Next after v0.6.0

Cut the v0.6.0 tag/GitHub Release, then scope the next roadmap phase per
docs/fable/04-roadmap.md: v0.6.1 (agent session launcher / onboarding),
v0.6.2 (Obsidian-like project vault), v0.6.3 (cross-project onboarding). Personalization (v0.7),
mobile/LAN/voice (v0.8), and hosted/team (v0.9+) stay deferred behind the local core.

v0.5.2 — Workbench security hardening and Fable implementation pack

vibe-council v0.5.2 — Workbench security-hardening patch (+ implementation-pack docs)

Ready for the v0.5.2 tag — not yet tagged. The version bump (backend/__init__.py,
pyproject.toml, uv.lock) and the dated CHANGELOG.md section are done
(chore: prepare v0.5.2 release); the repo now reports 0.5.2. The git tag and the GitHub
Release are still a separate, manual step — see §"Final release checklist" below and
docs/release-checklist.md.

A small patch release on top of the v0.5.0/v0.5.1 AI Council Workbench: one DNS-rebinding-class
security hardening on the localhost panel (PR #92) plus a docs-only implementation pack for planning
v0.6+ (PR #93). No executor/trust/payload/allowlist behavior change, no new product surface, no new
dependency. Based on and crediting
karpathy/llm-council.

No commercial-clearance claim. License/provenance remains an unresolved "Question 0"
commercial gate; no LICENSE is added.

What this release covers

Workbench Host-header validation + /api/state token gate (PR #92)

A Fable architecture review flagged a DNS-rebinding class gap ahead of the v0.6 agent-proposal
bridge. The panel already binds 127.0.0.1, but localhost binding alone does not stop a malicious
page whose domain re-resolves to 127.0.0.1 — the browser still sends that page's original Host
header. This release closes that gap:

• Host-header validation on every request. A request's Host header must name a literal loopback
  host — 127.0.0.1, localhost, or ::1 (any port). A missing, malformed, or multiple/ambiguous
  Host header fails closed (a >1 Host count is rejected outright). Enforced before routing on
  GET /, GET /api/state, and all POST endpoints via a pure, unit-tested host_header_is_local()
  helper.
• GET /api/state is now token-gated. It exposes runtime tasks/approvals/actions and was
  previously unauthenticated; it now requires the same startup token as the POST endpoints,
  accepted via the X-Workbench-Token header or the ?token= query the panel URL already carries.
  The token is never echoed into the /api/state JSON body.
• GET / behavior is unchanged — it stays tokenless so the panel URL loads normally; Host
  validation is its guard. (The token remains embedded in the returned HTML for the panel's own
  POSTs, exactly as before.)

The panel JS never fetched /api/state (state is server-rendered into GET /), so nothing in the
panel UI changed. Added tests cover loopback/non-loopback Host acceptance, invalid-Host rejection on
/, /api/state, and POST (even with a valid token), the /api/state token gate, multiple Host
headers rejected (raw-socket test), and the token never leaking into the state JSON.

Fable implementation pack docs (PR #93)

A docs-only, phase-by-phase implementation pack under docs/fable/ for driving
future work with a long-running model (Fable 5 / Opus / Claude Code) without losing the product or
security direction: current-state baseline, operating rules, product vision, the non-negotiable
security invariants, the v0.5.2→v0.9+ roadmap, the v0.6 agent-to-Workbench bridge design + a
concrete proposal schema, onboarding/session launcher, the Obsidian-like project vault (extend
docs/context/, not a new .vibe/), cross-project onboarding, the tighten-only personalization
layer, website positioning, the open-core commercial path, an implementation playbook, and copy-paste
prompt templates. No code, tests, dependencies, or behavior change — the v0.6 bridge is designed
here, not built.

Security posture — unchanged from v0.5.1 (only strengthened)

Nothing in this patch relaxes or expands the security model; the panel is strictly more locked down:

• Approval is separate from execution — approving only records a decision; it never writes a
  file, edits a file, or runs a command.
• The panel is localhost-only (127.0.0.1), POSTs are token-gated, and now /api/state is
  token-gated and all requests are Host-header validated — no LAN/mobile/remote surface, no
  CORS widening.
• Payload artifacts stay local and gitignored, write-once, hash/scope-verified before every real
  execution.
• Command execution is fixed argv + shell=False, always — no dynamic arguments, no shell.
• The deterministic trust boundary re-runs at execution time; the advisory Approval Auditor still
  cannot relax a block.
• No new command allowlist entries — still the same verification/status-only allowlist as v0.5.0.
• No executor/trust/payload behavior changed — this patch only tightens the panel's request
  admission (Host + /api/state token).

Explicit non-goals (deferred, not started in this release)

No v0.6 implementation · no proposal importer · no new network endpoint · no LAN/mobile/hosted/voice ·
no command-allowlist expansion · no arbitrary shell · no new provider/model/network call from the
executor · no dependency changes. The docs/fable/ pack plans v0.6+ but implements none of it.

Release checklist (must be clean before tagging)

• python -m unittest discover -s tests -t . is green (587 tests).
• uv run python -m backend.cli --version prints vibe-council 0.5.2.
• vibe lint --redaction reports 0 critical findings.
• vibe decisions lint passes.
• vibe context check scores 21/21.
• vibe mcp inspect --context --health scores 21/21.
• uv sync produces no uv.lock diff beyond the intentional self-version sync in this PR.
• No .council/ artifact (including .council/runtime/payloads/) staged/committed.
• No private/local plan file staged/committed.

Final release checklist (manual steps, after this PR merges)

These are not automated by this PR — a maintainer performs them once the checklist above is clean
on master:

• Merge this PR (chore: prepare v0.5.2 release) into master.
• On the merged master, re-confirm: tests green, redaction lint 0 critical, decisions lint
  passes, context check 21/21, MCP health 21/21.
• Verify git status --short and the merged diff carry no private/local artifacts
  (.council/, the two untracked private plan files, .env/.venv//data/, secrets,
  generated packs/exports).
• vibe --version on master prints vibe-council 0.5.2.
• Create an annotated git tag: git tag -a v0.5.2 -m "vibe-council v0.5.2" on the merge
  commit, then git push origin v0.5.2.
• Create the GitHub Release for v0.5.2 manually, using this document
  (docs/releases/v0.5.2.md) as the release-notes body.

Known limitations (unchanged from v0.5.1)

• Intentionally local-only — no LAN/mobile/remote access; the panel binds 127.0.0.1 only.
• Intentionally tiny command allowlist (verification/status commands only); not meant to grow
  casually.
• No hosted/team/mobile/voice yet — deferred to v0.6+ at the earliest.
• The panel is intentionally simple — no framework, no rich UI, no persistence beyond the runtime
  JSON store.
• The demo still seeds no executable Action (a deliberate v0.5.0/PR #77 safety choice) — real
  execution dogfood requires manual seeding in a temp/safe project.

Next after v0.5.2

Cut the v0.5.2 tag/GitHub Release, then begin v0.6.0 — the agent-to-Workbench bridge (file/CLI
proposal intake, no new network endpoint) per
docs/fable/05-v0.6-agent-bridge.md and
docs/fable/06-proposal-schema.md. Mobile/LAN/voice (v0.8) and
hosted/team (v0.9+) stay deferred behind the local core.