v0.25.0

[0.25.0] - 2026-08-25

Changed

• Rule #137 amended: Read is necessary but not sufficient (#210). The
  no-filtered-bash rule told @sec/@rev/@dev to read file content with
  Read/Grep only. That is not sufficient: on files with very long single
  lines (raw gh --json output, dense prose) the compression layer mangles
  Read output too — fragments rather than honest truncation, invisible to a
  "looks fine" check. (Provenance: an operator-memory field note, not
  reconstructible from any issue thread; the rule stands on the mechanism, not
  on that note.) All three rule sites
  (core/skills/tech-lead/SKILL.md, core/agents/security.md,
  core/agents/review.md) now name the detection (compare wc -l against the
  highest line number that was displayed, and treat text breaking mid-token as
  mangled) and the recovery (re-fetch to a file, reformat to short lines,
  re-read in small line-limited chunks — never pipe the content through Bash),
  and say plainly that a verdict must never be issued over input the reviewer
  cannot confirm it read whole: after two failed recovery attempts the input is
  reported unreviewable and escalated.
• A merged product change with no version bump means a bump PR is needed
  (#210). A merge+release pass once concluded "no release needed" because the
  merged PR carried no bump — backwards, since a merge is not Done until a
  released tag covers it. The skill carried only the converse rule ("a bump
  isn't released until its tag is pushed"); the missing direction is now stated.
• @techlead stops volunteering compaction advice (#184, PR #196). The
  operator no longer offers unprompted compaction or session-restart suggestions
  — that call belongs to the harness, and the only thing that may trigger the
  advice is an explicit [mARC token-guard] warning. The obsolete task-boundary
  context-hygiene advisory from #81 came out at the same time, and
  references/invariants-card.md now records unprompted/volume-based compaction
  as a rejected pattern so it doesn't get re-proposed.

Added

• Memory conventions: size-capped writes, pinned vs decay, and a two-tier
  recall index (#176, PR #201). core/skills/tech-lead/SKILL.md and the
  invariants card carry rules for keeping memory recall bounded, and record an
  external memory daemon as a rejected pattern. AGENTS.md gets the matching
  tiered, size-capped operating principle.
• Concurrent-operator coordination protocol in @techlead (#208). Two
  operators — different harnesses, or two sessions — may run against the same
  clone with no supervisor between them (#202 decided harnesses are
  board-mediated peers). core/skills/tech-lead/SKILL.md now carries four
  rules under step 3: claim with the assignee field before dispatching (only
  the assignee carries operator identity — Status is a shared enum with no
  author, so it cannot tell you who claimed an item); the claim is racy and
  knowingly accepted; stale claims are reclaimed by a human, never by a timer,
  and an unclearing claim from a peer you don't control is escalated rather than
  raced; and writer isolation extends to the operators themselves, not just to
  dispatched specialists.
  There is deliberately no locking layer. GitHub's GraphQL exposes no
  optimistic-concurrency field on UpdateIssueInput or
  UpdateProjectV2ItemFieldValueInput (verified against the live schema in
  #205), so board.py set-status's last-write-wins window cannot be closed by
  adopting an API feature — it is accepted explicitly, and the skill says so.
  The prior art behind that stance lives in this repo's AGENTS.md and the #205
  brief under docs/marc/, not in the shipped skill: GitHub's own coding agent
  claims work by assignment, and Renovate — which has no claim field at all —
  serializes with external CI locks plus a per-instance work directory. Neither
  builds compare-and-swap into the tracker (#204, #205, #206).

Fixed

• Antigravity hooks.json now lands at the plugin root (#197, PR #198). It
  was being emitted under hooks/, where Antigravity doesn't look for it, so the
  hooks shipped in 0.24.0 never resolved for that harness.
  scripts/compile_prompts.py gained get_hooks_json_path plus cleanup of a
  stale hooks/hooks.json or root hooks.json, the path is declared as
  hooks_path in harnesses/antigravity/marc/compile.json, and both
  test_hooks_parity.py and the Tier 2 CI assertion check the installed root
  location and the absence of the stale one.

Security

• CI's Antigravity CLI installer is pinned and checksum-verified (#169, PR
  #199). The workflow no longer pipes install.sh straight into a shell: it
  downloads, verifies against a pinned SHA256, and only then executes.
  ANTIGRAVITY_API_KEY is out of the unprivileged bootstrap and package-install
  steps entirely, scoped now to plugin install and the registration assertion.
  Repo-internal (.github/workflows/ci.yml); nothing consumer-facing changes.

Documentation

• Decision record for cross-harness dispatch — harnesses are board-mediated
  peers, with no nested dispatch bridge (#202, PR #203).
• Research brief on Antigravity context compaction (#186, PR #200).
• Research brief on concurrent-operator coordination, plus this repo's own
  AGENTS.md convention that #208 later promoted into the plugin (#206, PR
  #207).