ATape v0.5.12

ATape v0.5.12: Recorded file activity

This coordinated target-owned implementation contains the CLI and seven official
Adapters at 0.5.12, with matching Web, Server and container metadata.
Authentication remains auth-v1, including the 180 days absolute Web Session
lifetime. Release and minimum CLI metadata are 0.5.12. Implementation,
integration, npm publication and Server deployment are separate actions.

Recorded tool and file activity

Codex and Claude emit Canonical/publication v5 facts for explicit native
tool identities and read, edit and search paths. Analytics v4 groups tools by
stable identity and reports exact recorded paths, distinct calls, operation
counts and coverage. File and operation filters open the final original tool
update through a conditional Reader link; browser Back restores the selection.

Paths retain their recorded spelling. Search paths describe scope, rather than
matching files. An edit invocation does not prove a successful filesystem
change. Unknown, invalid, oversized and redacted facts remain unavailable;
commands, output lists and patch bodies do not supply guessed paths. Upload
preparation clears copied path facts when their original sensitive fields are
masked. No Raw or Search data enters the analysis report.

Available source history replays with stable Event IDs and higher revisions.
Codex uses projection/cursor v7; Claude uses source profile active-path.4 and
projection v7. Frozen pending publications and Raw acknowledgements retain
their original bytes. Unavailable history remains unrepaired. Other official
Adapters retain their existing capture scope and do not infer these new facts.

Automatic delivery and recovery

Publication policy keeps the genuine 0.5.11 bridge on npm/GitHub Latest and
retains legacy catalog v1/v2 routes. The 0.5.12 release is assigned npm
atape-managed and catalog v3 only. A long-offline 0.5.10 client can first
receive that real bridge, then hand target
preparation, migration and recovery to this verified runtime. Normal updates
preserve the global npm entry and do not require prefix write permission.

The 0.5.12 manual CLI operation also preserves the global entry for catalog v3,
including before tool initialization. It still performs complete-bundle target
preparation and activation. A current managed runtime does not repeatedly offer
an update solely because its global entry is older. Historical v1/v2 entry
replacement remains available for their compatibility transitions.

The already published 0.5.11 manual menu can report an entry-refresh failure
after selecting the new runtime on a read-only npm prefix. Its immutable bytes
retain this limitation. Installed unattended acceptance therefore executes the
genuine 0.5.11 automatic worker; the new manual policy is implemented in 0.5.12.

The target-owned Interface retains writer exclusion, bounded durable receipts,
Stop intent and updates-off preference. Interrupted handoffs recover forward
through the exact recorded target before reading its private state. Historical
0.5.9 cannot cross the clock transition unattended. It still requires the
documented stopped entry replacement into the compatible 0.5.11 bridge before
the target-owned feature update. This release cannot change that published
old decoder. Native Windows update lifecycle and live Claude/Cursor acceptance
are outside POSIX installed acceptance.

The bridge delivery record confirms genuine
0.5.11 publication and independent anonymous public-byte verification. It does
not claim publication or deployment of this feature release.

See Session Analytics,
target-owned updates and
ADR-0126.

Server and durable-data boundary

Deploy a v5-capable Server before advertising this feature release. The SQL
schema remains version 24; accepting v5 data still creates a durable format
boundary. A pre-v5 Server must not be restored through an image switch after
v5 writes. Retain the matched PostgreSQL/Raw backup and use compatible forward
repair. A deliberate paired restore withdraws later writes and needs a separate
operator decision.

Acceptance and remaining limits

Local implementation verification passed repository checks, production builds,
release-policy checks, dependency checks at the configured security threshold,
Go race/fuzz tests, PostgreSQL integration, self-hosting configuration and a
paired PostgreSQL/Raw restore rehearsal. The installed HTTP/provider corpus
passed in 655.429 seconds; the separate authentication maintenance contract
passed in 7.65 seconds. Local candidate container builds and Web rollout unit
tests also passed.

The final checksummed packages passed required installed compatibility through
the genuine published 0.5.10 → 0.5.11 → 0.5.12 automatic chain and four interruption
cases: control synced, first private ledger, before readiness and orphan apply.
Each case verifies an actual registered Claude journal, its complete target-bound
receipt and owner. The observed journal format is 8 before and after this update;
the separate installed candidate contract verifies controlled SQL7 → SQL8
migration. The historical 0.5.9 stopped transition reaches the genuine bridge,
then its automatic worker reaches 0.5.12 while retaining Stop intent. The test
explicitly enables automatic updates for that second leg and disables them at
the end. Manual v3 policy also passed 39 application caller tests.

The candidate acceptance record retains
artifact hashes, completed checks and the earlier failed attempts with their
repairs. These remain local candidate checks. Exact-head CI and image Security
are mandatory before integration and publication. Package publication, public
byte verification, Server deployment and client uptake are separate delivery
actions; their records establish when they have completed.

The user's explicit package publication request includes the incomplete manual
staging waiver under ADR-0048. Automated CI, integration, installed
compatibility and security gates remain mandatory. The following manual checks
remain unverified:

• candidate-artifacts
• official-topology
• github-provider-staging-smoke
• official-domain-egress-deny-smoke
• two-user-two-team
• waf-tls-callback
• backup-restore
• observability-secret-sample
• rollback
• release-signoff

Constructed native source and synthetic authenticated API acceptance do not
establish a fresh live Provider session, real GitHub OAuth, native login/wake
registration or complete manual staging. Public byte identity and decoded
provenance content do not establish independent cryptographic signature
verification. Publication does not prove immediate client uptake: existing
discovery cache and automatic-check scheduling still apply.

{
"protocol": "atape.release-bundle.v3",
"version": "0.5.12",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-lPviL9eCfRhWhHLmRy2oJOgxAe/tMVQ3Bkz6UcJK8ucStmxAT9Hw3TDdlPs7HI/tX3EbGmm4qGRL5tRMSt2o4Q==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.12.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-b8woaxKsz9fqok8tqntCiHi3FaKugV7oW99zOSItXLO5uncAoN9vGAy/NWuotJH2kAmvZ30W7DZtKAptiEOREg==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.12.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-s9lJPBMZMMyojIhg0wkGDoICarfMLwrxugdQV/r0qzCz4Zy9lyYVKMiUL939TaB0lij9OX8Zr49DuDDyxVO9WQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.12.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-uizSGMwP4DaNTMqZYAarVXNi6FVy+Sjn9vl75+6KLItXLUCdcr2awBRhqlx256SiIOYPcKAs+RSmdsMsqZDPTQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.12.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-adVnbre65Ed6IdWNk3riiVeIMx9B9WaHjT4tNcpv0Owah5/3zHuWbcN73wNqAf+fX6wMq0bbQY3+4hDKuVhcjA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.12.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-sysne93OUKTvMpWkcXaVdyfZoTK6GqHHFwFAb5jjFjXtUQ1sH0qoVJZBZxZjf2ZLIKEuz7GZSTOxqJ1Vg+DG/w==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.12.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-g6ZbiMuzR/4tmuhGfP+w6420+u57K/k6Sap99OPdS1M9wjWhTEQVuQ9f05UnSwqxqazY9xqaQMycWumuNesxRQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.12.tgz"
},
{
"name": "@atape/cli",
"integrity": "sha512-jAn1iUKbt+eUOgiYN41fEyrFBlLroaWytsJG2+BAguvBUuU+t/En/jqfaYq3CIuz4lAeib1+ht7Zpom586weCQ==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.12.tgz"
}
],
"updateTargetProtocol": "atape.update-target.v1",
"fromCaptureStateContracts": [
"atape.client.v3-capture.v1",
"atape.client.v3-capture.v2"
]
}

ATape v0.5.11

ATape v0.5.11: Automatic update bridge

This coordinated bridge contains the CLI and seven official Adapters at 0.5.11,
with matching Web, Server and container metadata. Authentication remains
auth-v1, including the 180 days absolute Web Session lifetime. Release and
minimum CLI metadata are 0.5.11. Implementation, integration, npm publication
and Server deployment are separate actions.

Target-owned automatic updates

The new atape.update-target.v1 Interface hands preparation, Adapter decoding,
server admission, capture migration and recovery to the verified target CLI.
The parent verifies immutable executable identity and exchanges bounded durable
requests/receipts. An interrupted handoff delegates to its exact recorded
target before the parent reads any target-specific capture state. Existing
maintenance, forward-only fences, Stop intent and automatic-update preferences
remain part of activation and recovery.

Target-owned execution handoff completes through the stable public control
Interface before private migration begins. Collector readiness waits for the
durable handoff to settle. Existing private scheduled launchers are refreshed
without changing their OS registration. The global npm entry remains unchanged;
normal updates do not require write permission to its installation prefix.

The published 0.5.10 parent cannot decode v5 Adapter manifests before target
handoff. This release therefore retains genuine Codex Canonical v3/projection 5
and Claude publication v4/source active-path.2 behavior. Those implementations
match their capability declarations; they do not emit the later file-activity
facts. New Host, Server and reader support for richer data remains available.

The explicit publication channel is legacy-bridge. The release advertises
v1/v2/v3 metadata and remains the legacy npm/GitHub Latest target. Subsequent
v5 feature packages use the target-owned channel and catalog v3. Legacy routes
remain on this bridge so a long-offline 0.5.10 client can automatically traverse
both stages. This is independent of private journal migration plans.

This automatic bridge starts at genuine 0.5.10. The historical 0.5.9 Codex
clock transition still requires its documented stopped entry replacement;
this release cannot change that already-published parent's decoder. Installed
automatic-transition acceptance uses POSIX process and PTY contracts and does
not establish the same lifecycle on Windows.

See target-owned updates,
publication policy and
ADR-0126.

Session Analytics and compatibility

The Server and Web include stable tool identity and Analytics v4 file-activity
support from the integrated feature increment. Exact paths, read/edit/search
counts and conditional original-record jumps require explicitly captured
file-activity facts. The bridge's official providers do not produce those
facts. Missing coverage is reported as unavailable/unknown, not inferred from
text, shell commands or search results. Cursor's controlled capture scope is
unchanged; live account acceptance remains outstanding.

The SQL schema remains version 24. Accepting Canonical/publication v5 creates a
durable format boundary even without a new SQL migration: a pre-v5 Server must
not be restored using only an image switch after v5 writes. Keep paired database
and Raw backups and use compatible forward recovery.

Acceptance and remaining limits

Installed acceptance passed with authentic npm-published 0.5.10, the actual
0.5.11 bridge artifacts and actual-source 0.5.12 feature artifacts. The unchanged
global 0.5.10 entry automatically traversed both stages with a read-only npm
prefix, then replayed native-format file-activity facts and continued capture.
Conversation/event identity, acknowledged progress, Raw receipts, credentials,
Projects, tools, Stop intent and updates-off preference were checked.

Four installed SIGKILL scenarios also passed: after public control sync, after
the first private authorization ledger write, before Collector readiness, and
while an orphan retained the migration apply lock. Recovery through the unchanged
old public entry selected the exact recorded target. A genuine queued old worker
could not cross the orphan's apply lock or resume stopped collection. Native
service-manager probes were rejected by the external Test Adapter; no OS job was
registered. These tests use constructed Codex native source and an authenticated
HTTP Test Adapter. They do not establish live Claude/Cursor, native login or
production acceptance. A stopped manual npm replacement is separate evidence.

The candidate acceptance record binds
the exact tested artifacts, source identities, completed checks, recovered
verification failures and remaining limits. Local verification and exact-head
CI evidence remain distinct.

The local full PostgreSQL run failed one authentication maintenance expiry
assertion; its complete installed HTTP/provider corpus passed. An unchanged
isolated rerun passed after diagnostics observed Docker database wall-clock
reversals. The initial full-run cause remains unproven. Complete exact-head
Linux integration and Security CI must pass before publication; no automated
gate is waived.

The user's explicit request to publish npm authorizes the incomplete manual
staging waiver under ADR-0048. Automated CI, integration and security gates
remain mandatory. The following manual checks remain unverified:

• candidate-artifacts
• official-topology
• github-provider-staging-smoke
• official-domain-egress-deny-smoke
• two-user-two-team
• waf-tls-callback
• backup-restore
• observability-secret-sample
• rollback
• release-signoff

The staging record deliberately remains pending.
Candidate-bound publication and deployment evidence is recorded only after the
corresponding actions occur.

{
"protocol": "atape.release-bundle.v1",
"version": "0.5.11",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-fgkgFrNltDa6+Vq/0+SE4xmqvCyPL1SdYgP0KIDu/uas2Oz5OyLly/562zzMkfKfymuFCZUGALqzMMbQ8BLw9Q==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.11.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-3BbggtxinR210yLzqk1GKaRxbT1aWnnv9Xe6/NWDvzkBh5lWnawva6azCGeF9gKjr7UjZgEUKxihzRgQ9eBqKA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.11.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-b3h4/RBl8GbNUN/M2IxkjnV/IujJqOLl1z99C9w6mzP499fENSU08SQbjXRmEephe05J92JmcfkPZEcd6wlLDw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.11.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-Ggc3vy7laTb2imRSjK6YvbLqKkSbF1Yl7I5v+yI5BxuwzBe4t8DnQg3Yqn9zs2oQi7X9SsxH7HhyrBqy2UAfSA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.11.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-sKY39aSPOt55XWtHZ6jrLZvcukIMdtfdfjqv+c0p3G1L6EqMZD6ai9mHigy1xcms17Xp/tB5BShPWrvw/PNICw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.11.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-y8iAqWqBT+I2E22ofgjVgATIFE9GrMGkCbpSpNw8UwtDx13GyUkijb0YmktcB0sQ7TWr8gmThL9wWeuLlKXacA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.11.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-WD05HLDZyZg+24SAm9MAjk0Ob+tMoyuzI5Kk/teESNzWNX5aN7X8sCLAcls7NyaQg4uOmRfWAkclvKAR5CW4YQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.11.tgz"
},
{
"name": "@atape/cli",
"integrity": "sha512-SYZQnSmI9QSKnzEWumIIE22saB919cA2ebGJzCGfnaI4lDLiGLA4rW9c605464B7SBhNfY8zUV0C6Gvsj2rCZA==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.11.tgz"
}
]
}

{
"protocol": "atape.release-bundle.v2",
"version": "0.5.11",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-fgkgFrNltDa6+Vq/0+SE4xmqvCyPL1SdYgP0KIDu/uas2Oz5OyLly/562zzMkfKfymuFCZUGALqzMMbQ8BLw9Q==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.11.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-3BbggtxinR210yLzqk1GKaRxbT1aWnnv9Xe6/NWDvzkBh5lWnawva6azCGeF9gKjr7UjZgEUKxihzRgQ9eBqKA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.11.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-b3h4/RBl8GbNUN/M2IxkjnV/IujJqOLl1z99C9w6mzP499fENSU08SQbjXRmEephe05J92JmcfkPZEcd6wlLDw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.11.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-Ggc3vy7laTb2imRSjK6YvbLqKkSbF1Yl7I5v+yI5BxuwzBe4t8DnQg3Yqn9zs2oQi7X9SsxH7HhyrBqy2UAfSA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.11.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-sKY39aSPOt55XWtHZ6jrLZvcukIMdtfdfjqv+c0p3G1L6EqMZD6ai9mHigy1xcms17Xp/tB5BShPWrvw/PNICw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.11.tgz"
},
{
"name": "@atape/adapter...

ATape v0.5.10

ATape v0.5.10: Source clocks and recorded activity

This coordinated release contains the CLI and all seven official Adapters at
0.5.10, with matching Web, Server and container metadata. The Authentication
epoch remains auth-v1, including the 180 days absolute Web Session lifetime.
Unified release and minimum CLI metadata are 0.5.10. Package publication,
Server rollout and Web deployment are separate operations.

Codex source clocks and record order

The Codex paged Adapter now explicitly selects nullable Canonical v3. Supported
records with missing, null or invalid source timestamps remain captured with an
unknown occurrence time. Session recency uses the maximum admitted source clock
in the selected metadata/title/record snapshot, or remains unknown. Filesystem
modification time supports discovery, revision and stable legacy observation/Raw
capture metadata; it does not fill a missing Session or Event clock. Repeating
an unacknowledged Raw chunk reconstructs the same receipt metadata.

Each supported projected source record has a stable order coordinate. A persisted,
bounded source-object/generation registry gives file generations separate
namespaces, preserving existing coordinates through append, discovery reorder
and source deletion. Missing or reversed clocks do not reorder records or fold
distinct user inputs together. Ordering separate files in one Thread is derived.

Projection v5 replays supported older Canonical cursors once with stable Event
IDs and a higher revision floor, retaining Raw acknowledgements. Available
source history can therefore acquire corrected clocks. Unavailable history
remains unrepaired; the Server does not guess away a stored epoch. The updated
cursor cannot be read by an older Codex Adapter. This remains the legacy paged
collection path, with its existing source-dependent retry and redaction-policy
limits; it does not gain sourceCapture frozen recovery or complete publication.

The new Host must affirm the Adapter's explicit v3 capability. Collection and
managed admission require affirmative Server support before source access or
progress changes. The CLI-authenticated Canonical capabilities endpoint reports
modern profiles independently of Publication; an explicitly absent endpoint
can use the existing affirmative publication-target-v3 capability on an older
Server. Negative, invalid, authentication or transient responses are not proof
of support.

See Codex source clocks,
Canonical ingestion, and
ADR-0122.

Recorded activity and original records

Session Analytics v3 adds record span, an activity timeline and interval
evidence. Select all captured Threads or one Thread. Summary, tools,
capabilities and usage still describe the full Session. Counts describe
Canonical records, including fragments and tool updates, rather than inferred
turns. Span is the difference between the first and last eligible recorded
clock; it is unknown with none and zero for one instant. It does not establish
work time, active coding time, tool duration or time to first token.

Non-null clocks under explicit nullable Canonical v3/v4 are categorized as
recorded, rather than independently verified. Explicit null clocks are unknown.
Older non-null clocks retain their stored dates and a legacy category, outside
the dated timeline and span. This conservative rule can exclude legitimate
legacy dates; source replay under a nullable profile is required for inclusion.
Unknown and legacy records remain available in a separate unplaced selection.
Existing summary known/unknown counts keep their earlier non-null/null meaning.

The Server produces at most 60 uniform dated intervals, including empty ones.
Select an interval or the unplaced group to page through its records, then open
an Event in the existing conditional Reader. Browser Back restores the selected
Thread, interval and page. Ranges and cursors bind the Session, snapshot,
analytics version and filters. Changed content requires a full refresh, which
clears those selections. Authorization is checked on each read.

New Web opts into v3 using the standard safelisted Accept header. New Server
keeps analytics v2 for callers without that opt-in. Older Servers can return
v1/v2; Web keeps their supported report and explicitly marks activity
unavailable. Missing activity is not a zero report. The Module reads authorized
Canonical metadata without Raw or Search data, new persistence or background
workers. Existing deadline and capacity bounds remain enforced. Arbitrary
client time bounds, timeline granularity, cost estimates and generated analysis
remain outside this release.

See Session Analytics and
ADR-0123.

Upgrade and recovery boundaries

The actual SQLite journal, atape.client.v3-capture.v2 state contract,
update-control v1 and compiled journal-v7-to-v8 plan remain unchanged. A common
state contract does not prove that an older parent understands a new Adapter
manifest or can resume a newer Codex cursor.

The genuine published 0.5.9 parent rejects a first managed update involving
active Codex collection during read-only preflight, before pause. Stop sync
before updating the CLI and matching official Adapter bundle. Preserve
ATAPE_HOME, credentials, project/tool choices, checkpoints, Raw receipts and
Stop intent. The required POSIX installed transition gate executes the genuine
old console's stopped complete-bundle update, followed by the exact candidate
Collector's replay, no-op and append cycles. It verifies preserved checkpoint
and credential bytes, Raw receipts, stable Event IDs and higher revisions,
including an Instance advertising minimum CLI 0.5.10 during upgrade. Its Server
and distribution HTTP are owned external Test Adapters; constructed source
records do not establish live Provider acceptance or a personal installation
upgrade. Do not install the new Codex Adapter into the old Host, or resume with
an older Adapter after the new cursor is written. Consult
the stopped Codex upgrade
and the Codex guide.

Other historical boundaries still apply. In particular, active official-Claude
0.5.8 installations require the stopped external CLI refresh described in
v0.5.9. Pinned, local, custom or
nonselected integrations are not silently replaced. Normalized MCP/Skill
identity remains Claude-specific; no identity is inferred for other Providers
from text or display labels.

No database migration is added. Preserve the current Server image and a fresh
paired PostgreSQL/Raw recovery point before rollout. Restoring that point
withdraws writes made afterwards; a backup is not evidence that production
restore or rollback was exercised.

Candidate validation and manual acceptance disclosure

The exact frozen candidate must pass fresh repository, installed CLI/Adapter,
historical compatibility, PostgreSQL, dependency/container security, race/fuzz,
self-host configuration and paired restore gates. Feature PR results and
0.5.9 evidence do not attest this release candidate. Published npm bytes,
GitHub assets, update catalogs and deployed image identities require their own
verification; this release note alone does not claim that those actions passed.

Staging evidence remains pending. The following
manual checks are unverified and waived for package publication only:

• candidate-artifacts: manual candidate artifact acceptance.
• official-topology: official deployment topology acceptance.
• github-provider-staging-smoke: live GitHub Provider staging smoke.
• official-domain-egress-deny-smoke: official-domain egress isolation.
• two-user-two-team: two-user/two-Team acceptance.
• waf-tls-callback: WAF, TLS and callback configuration.
• backup-restore: operational backup and restore exercise.
• observability-secret-sample: observability secret sampling.
• rollback: operational rollback exercise.
• release-signoff: manual release signoff.

Authenticated native Cursor capture remains unverified; its installed contract
uses controlled native-format samples. A fresh live MCP/Skill recording also
remains unverified. Constructed source records, synthetic API checks and
published-byte verification do not establish either native acceptance.

On 2026-10-12 Asia/Singapore, the user explicitly requested
“可以，那你继续发布新版 npm 包，再升级 Server，把这次改动上线。” This authorizes
coordinated package publication and the matching Server upgrade. Under
ADR-0048, the
publication request also authorizes the candidate-bound manual-only waiver in
the authorization record; automated gates
remain mandatory. This increment requires no new schema migration and does not
authorize unrelated production data or schema changes.

{
"protocol": "atape.release-bundle.v1",
"version": "0.5.10",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-VDtK5uXgp2vSyhfqKNedpDxFa91R4nfJgrOXH2Hs0O16LhT7RS1dKxiFPhao1q3UReD31xHPnXQcmC8v4oUWYw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.10.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-OXfOmrROG/CFBySHWAp3B2fOoJ03wgR3JeQk+A2xjh3/ZS+Eef9BCCorTPgrnMotfkmcjMmjSTyELK84D9zc9A==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.10.tgz"
},
{
"name": "@atape/adapter-codex",
"integri...

ATape target-owned update catalog

{
"protocol": "atape.update-catalog.v3",
"revision": 2,
"bundles": [
{
"protocol": "atape.release-bundle.v3",
"version": "0.5.12",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"updateTargetProtocol": "atape.update-target.v1",
"fromCaptureStateContracts": [
"atape.client.v3-capture.v1",
"atape.client.v3-capture.v2"
],
"packages": [
{
"name": "@atape/cli",
"integrity": "sha512-jAn1iUKbt+eUOgiYN41fEyrFBlLroaWytsJG2+BAguvBUuU+t/En/jqfaYq3CIuz4lAeib1+ht7Zpom586weCQ==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.12.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-s9lJPBMZMMyojIhg0wkGDoICarfMLwrxugdQV/r0qzCz4Zy9lyYVKMiUL939TaB0lij9OX8Zr49DuDDyxVO9WQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.12.tgz"
},
{
"name": "@atape/adapter-claude",
"integrity": "sha512-lPviL9eCfRhWhHLmRy2oJOgxAe/tMVQ3Bkz6UcJK8ucStmxAT9Hw3TDdlPs7HI/tX3EbGmm4qGRL5tRMSt2o4Q==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.12.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-b8woaxKsz9fqok8tqntCiHi3FaKugV7oW99zOSItXLO5uncAoN9vGAy/NWuotJH2kAmvZ30W7DZtKAptiEOREg==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.12.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-sysne93OUKTvMpWkcXaVdyfZoTK6GqHHFwFAb5jjFjXtUQ1sH0qoVJZBZxZjf2ZLIKEuz7GZSTOxqJ1Vg+DG/w==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.12.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-g6ZbiMuzR/4tmuhGfP+w6420+u57K/k6Sap99OPdS1M9wjWhTEQVuQ9f05UnSwqxqazY9xqaQMycWumuNesxRQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.12.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-adVnbre65Ed6IdWNk3riiVeIMx9B9WaHjT4tNcpv0Owah5/3zHuWbcN73wNqAf+fX6wMq0bbQY3+4hDKuVhcjA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.12.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-uizSGMwP4DaNTMqZYAarVXNi6FVy+Sjn9vl75+6KLItXLUCdcr2awBRhqlx256SiIOYPcKAs+RSmdsMsqZDPTQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.12.tgz"
}
]
}
],
"routes": [
{
"fromCaptureStateContract": "atape.client.v3-capture.v1",
"updateControlProtocol": "atape.update-control.v1",
"updateTargetProtocol": "atape.update-target.v1",
"version": "0.5.12"
},
{
"fromCaptureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"updateTargetProtocol": "atape.update-target.v1",
"version": "0.5.12"
}
]
}

ATape v0.5.9

ATape v0.5.9: Session analysis and normalized tool identity

This coordinated release contains the CLI and all seven official Adapters at
0.5.9, with matching Web, Server and container metadata. The Authentication epoch
remains auth-v1, including the 180 days absolute Web Session lifetime. Unified
release and minimum CLI metadata are 0.5.9. Publication and Server deployment
are separate operations; a v4-capable Server must be deployed before the new
Claude capture packages are advertised.

Session analysis

Session Analytics derives current authorized Canonical counts, explicit tool
outcomes, child Threads, models and recorded Tokens without Raw access, cost or
productivity inference. Filtered evidence opens the original Event through the
same conditional snapshot. Changed source content requires refresh; pagination
does not combine different publications or legacy inputs.

Analytics v2 adds MCP server/tool and Skill-name reports. The first normalized
source is Claude's explicit MCP namespace and Skill tool invocation. Source
Adapters provide bounded identities in the closed ACP extension under Canonical
and publication v4. Missing identities remain unclassified; a completed Skill
tool does not establish successful completion of its requested task. New Web
also accepts older analytics-v1 responses without inventing a missing report.

Identity redaction uses the existing upload policy. Masked names or copied source
values explicitly clear identity, preventing a field-rule bypass or grouping
different secret values under one replacement. Unrelated masked arguments keep
public identities. Malformed Unicode identities are rejected consistently
between TypeScript and Go. Oversized Claude Skill inputs do not create new
identity copies outside the admitted content boundary.

See Session Analytics,
v4 ingestion,
ADR-0120 and
ADR-0121.

Opening a Project while its background status refresh is running now shares
the existing process inspection. Concurrent callers no longer block each other
with a process-lock recovery screen; completed results are reread on the next
inspection. Capture timing, Stop intent and exclusion of other commands retain
their existing behavior.

Upgrade and recovery boundaries

The journal's actual SQLite format, atape.client.v3-capture.v2 contract,
update-control v1 and compiled journal-v7-to-v8 plan remain unchanged. V4 source
recovery metadata uses a v3-compatible closed field plus an independent v4 fact;
new readers restore its effective profile. Actual target parts remain v4 and
frozen bytes are not rewritten during receipt recovery.

Published 0.5.8 active official-Claude upgrade parents cannot decode the candidate
Adapter's v4 declaration. Their automatic and existing in-console update paths
reject it before pause; this release does not claim universal unattended
0.5.8 → 0.5.9 delivery. Such installations require the stopped external CLI
refresh described in explicit maintenance,
then complete bundle selection through the updated CLI. Preserve ATAPE_HOME,
credentials, project/tool choices and Stop intent. Resume only after every
configured Instance meets the declared capture prerequisites. Other eligible
installations retain the existing managed discovery path.

If the CLI is already current while eligible official integrations remain older,
Tools and updates exposes Update matching official integrations for ATape
0.5.9. This invokes the existing complete-bundle upgrade and preserves stopped
intent. Pinned, local, custom or ahead installations do not trigger a blanket
replacement action.

Pinned, custom, local or nonselected old Adapters are not silently replaced.
Historical sessions acquire identities only after a supported updated Adapter
successfully replays their source. Codex Skill message markers and Claude command
expansion remain outside this tool-invocation report. MCP/Skill-specific source
acceptance currently uses constructed native-format records; a fresh live
execution recording remains unverified.

No database migration is added. Once v4 data is accepted, an older pre-v4 Server
image cannot guarantee Reader compatibility. Preserve the current image and a
fresh paired PostgreSQL/Raw recovery point before rollout; restoring that point
withdraws writes made afterwards.

Candidate validation and manual acceptance disclosure

The exact frozen candidate must pass fresh repository, installed CLI/Adapter,
genuine historical-reader and upgrade-path, PostgreSQL, dependency/container
security, race/fuzz, self-host configuration and paired restore gates. Existing
0.5.8 or feature-PR results do not attest this release candidate. Preparing these
notes claims no successful candidate CI, package publication, deployment or
unattended upgrade.

Focused candidate evidence
binds the exact local archives, genuine 0.5.8 source-free recovery and installed
stopped upgrade path, mandatory POSIX release gate and scanned ARM64 images.
It preserves the initial repository-check failure, unchanged-limit focused
reruns and the PR's Node/Vitest suite-discovery correction. Fresh complete gates
are required on the corrected candidate. It does not attest candidate CI,
public npm visibility, deployment or manual staging.

Staging evidence remains pending. The following
manual checks are unverified and waived for package publication only:

• candidate-artifacts: manual candidate artifact acceptance.
• official-topology: official deployment topology acceptance.
• github-provider-staging-smoke: live GitHub Provider staging smoke.
• official-domain-egress-deny-smoke: official-domain egress isolation.
• two-user-two-team: two-user/two-Team acceptance.
• waf-tls-callback: WAF, TLS and callback configuration.
• backup-restore: operational backup and restore exercise.
• observability-secret-sample: observability secret sampling.
• rollback: operational rollback exercise.
• release-signoff: manual release signoff.

On 2026-10-11 Asia/Singapore, the user replied “继续推进” to the specific proposed
next step “升级 Server，再发布配套 CLI/Adapter”. This accepts that deployment and
coordinated package-publication sequence. Under
ADR-0048, the
publication request also authorizes the candidate-bound manual-only waiver;
automated gates remain mandatory. This increment requires no new database schema
migration and does not authorize unrelated data or schema changes.

{
"protocol": "atape.release-bundle.v1",
"version": "0.5.9",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-UvbgYL796RzxA7gP2XdrBn9Zfkn2HrIZonj591SY9Z6dsfnLS7tK/0w9JNq5/08nv0ufO8HxAsBQtlDc47TOoQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.9.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-DeMBhUg61bJ687IZIsiY/3cePTnlQSvMYGPW9nk5jiGGE3nQGiNDUDDRKDQbgHXSZMuFNPjklohc2/W7AnTUmw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.9.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-caOzjllMYtbhyM4dU99AodrNrl48X63f3NedW09otADLyCiR5IpkpLMnNp6DOpLqiXvYVgOBs7Zha0O61RGlEw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.9.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-b56jltp7o0cFBbu6Qy+gpcnQe1hz160vgxkQDotPsHT5rb1u70I0C8RDCnqfvOYtMu14IcGc1AOn2UMFeRQSdA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.9.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-PiMD2OBaFcAtbF8zTIoIbE5BicfMNGwT+z6/3UyQrAhCQwdPnnp7AKkW234uq7uX2NDjsqtk3vToFru7Q7JEFA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.9.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-oOHmn69TfDbxK5rAVTbU0oqsgiHYp/M/GOagAmJGlXltuWhDebWjbOd8FdE0F24e4Kav/lgS6jlpmT7/qELBog==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.9.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-1n7RIjNmv9lTBYQJWISAxYl1Z5LFh3zp7VezannzzJdXrjOjsCxJ3dkb2cU2/DKJ2ksFh1tdIfCN89CqDH/Z7w==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.9.tgz"
},
{
"name": "@atape/cli",
"integrity": "sha512-w47H6TUqDg9bWLLKvYQ8J6jgMz0zT3MLs/wzKy9ZFCkkoM+2iReNUneYEeDM/YNHb3xzKP2pbrD1jdRcCQeehw==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.9.tgz"
}
]
}

{
"protocol": "atape.release-bundle.v2",
"version": "0.5.9",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-UvbgYL796RzxA7gP2XdrBn9Zfkn2HrIZonj591SY9Z6dsfnLS7tK/0w9JNq5/08nv0ufO8HxAsBQtlDc47TOoQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.9.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-DeMBhUg61bJ687IZIsiY/3cePTnlQSvMYGPW9nk5jiGGE3nQGiNDUDDRKDQbgHXSZMuFNPjklohc2/W7AnTUmw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.9.tgz"
},
{
"name": "@at...

ATape v0.5.8

ATape v0.5.8: Static update discovery and bounded Collector handoff

This coordinated patch contains @atape/cli and all seven official Adapters
at 0.5.8. It includes the static discovery work from
PR #223 and the Collector stop-probe
fix from PR #222.

The Authentication epoch remains auth-v1, including the 180 days absolute Web
Session lifetime. Unified artifact release and minimum CLI metadata are 0.5.8.
Package publication does not deploy a Server or change an existing Instance's
minimum CLI version.

Changes and delivery

New clients discover complete release bundles from https://updates.atape.net
through Cloudflare Workers Static Assets. The v1/v2 catalogs and immutable exact
descriptors use the existing domain protocols; npm still serves package archives.
The serialized publisher validates every advertised public package byte, retains
historical exact descriptors and refuses catalog regression or immutable changes
before deploying one complete static snapshot.

Discovery reuses a validated catalog for 12 hours and reuses immutable exact
bundle receipts. Expired verified catalogs can serve a compatible target during
transport failure; malformed metadata, damaged local state and integrity failures
remain errors. Transient metadata requests can retry at most three times within
one ten-second request budget, with cancellation and short Retry-After support.
Using stale discovery retains the durable retry schedule even when that cached
target successfully upgrades; it does not reset to a daily success schedule.

Collector stop probes now reject cancelled, late, empty or partial timeout output
as proof of exit. A live PID remains distinct from confirmed exit, and force
termination requires a fresh ownership check. Closing timed-out probe readers
prevents an inherited pipe from extending the bounded handoff. These changes do
not authorize signals to a process whose ownership cannot be confirmed.

Capture contract atape.client.v3-capture.v2, update control
atape.update-control.v1 and the compiled
atape.capture-migration.v1 / journal-v7-to-v8 plan are unchanged. Existing
0.5.7 clients discover this complete release through the retained GitHub bridge;
the new selected generation then uses the CDN. That initial old-client discovery
can still be delayed by GitHub availability or its existing due schedule. Deploying
static files alone does not replace installed binaries or make immutable 0.5.3
cross its unsupported initial state boundary.

See the automatic update guide,
explicit migration guide
and static publication contract.
Existing provider and Server prerequisites, including experimental
Cursor requirements, remain unchanged.

Candidate validation and manual acceptance disclosure

The frozen 0.5.8 candidate must pass repository, installed CLI/Adapter, historical
client and migration, PostgreSQL, dependency/container security, Go race/fuzz,
self-host configuration and paired restore gates before publication. Preparing
these notes claims no 0.5.8 CI, npm publication or native unattended upgrade result.
The 0.5.6 → 0.5.7 acceptance
and static distribution evidence
retain their recorded scope; they are not a 0.5.7 → 0.5.8 delivery attestation.

Staging evidence remains pending. All ten manual
checks are unverified and waived for publication only:

• candidate-artifacts: manual candidate artifact acceptance.
• official-topology: the official deployment topology.
• github-provider-staging-smoke: live GitHub Provider staging smoke.
• official-domain-egress-deny-smoke: official-domain egress isolation.
• two-user-two-team: two-user/two-Team acceptance.
• waf-tls-callback: WAF, TLS and callback configuration.
• backup-restore: operational backup and restore.
• observability-secret-sample: observability secret sampling.
• rollback: operational rollback exercise.
• release-signoff: manual release signoff.

On 2026-10-11 in Asia/Singapore, the user explicitly requested:
“那你发布下新版 CLI 和官方 Adapter 吧，让现有用户自动升级接入 CDN。”
The next coordinated patch selected for that request is 0.5.8. Under
ADR-0048, this
authorizes the candidate-bound manual-only waiver; automated gates remain
mandatory. It does not authorize Server deployment or production database migration.

{
"protocol": "atape.release-bundle.v1",
"version": "0.5.8",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-oepXN4VV+WtoXd7MonxUIO0+JJbFpwgcVU0okPzjTfEnFWj5QiR5EkMJIoGSoFKpjA4UXWxVPq/N/OYVdzVvjQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.8.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-Tdp88bsSufXtwib09/3u+NEFSLPKW15oL1fTYa9rZYmkSo9w26GhaEgOJAPwFi51YVpjW1BLJ2k530DEP0YI9A==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.8.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-itVpG1/0kNnTTgyVdCdtZcVZH9icpNXfE1OT4aFMC2dIXOrhT0+5iq2uryQqwleQH7+5dFrUCTzPImd/5MbHGw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.8.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-mV72aHdmauN3XxrawgLMJYgxuIdHQ3OGT9k2fYXkFMpKaL+gWYK1i74csJiTpFXfMtj/mHVEUSjaNz4KDbnXaA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.8.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-212KBdkSETy31mZi2UMStxESElyepkF14PElIn/Wg5lnbvHmYKHkpRbDNqD8ZPzURShIIHFSl88uojnpJ5cPJw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.8.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-Eu9tfLEqpekKhOJfYeNFQJKwkEgKlOwHgjcyt0yeBySEggv7/6CHMtzlsXImEDtLFWHKNuS0uNQSqeNsRIE0Fg==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.8.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-KmYjZyxWphHbA8LfeP/12gmLjn2UbTyqWUdSIl6QTP0cnoV9Y9TNNn9mNeDqQ9QWnNcbrDE5FCGGFnxJUPt5Fg==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.8.tgz"
},
{
"name": "@atape/cli",
"integrity": "sha512-zSoXd95XwgXVy6ulGbFrtH5uDAPHossC5MU6Sxl3IG85MvxGgFA+Shae9bVMRI7bfX+/AhuCde67Gv9N6sIzlw==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.8.tgz"
}
]
}

{
"protocol": "atape.release-bundle.v2",
"version": "0.5.8",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-oepXN4VV+WtoXd7MonxUIO0+JJbFpwgcVU0okPzjTfEnFWj5QiR5EkMJIoGSoFKpjA4UXWxVPq/N/OYVdzVvjQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.8.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-Tdp88bsSufXtwib09/3u+NEFSLPKW15oL1fTYa9rZYmkSo9w26GhaEgOJAPwFi51YVpjW1BLJ2k530DEP0YI9A==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.8.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-itVpG1/0kNnTTgyVdCdtZcVZH9icpNXfE1OT4aFMC2dIXOrhT0+5iq2uryQqwleQH7+5dFrUCTzPImd/5MbHGw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.8.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-mV72aHdmauN3XxrawgLMJYgxuIdHQ3OGT9k2fYXkFMpKaL+gWYK1i74csJiTpFXfMtj/mHVEUSjaNz4KDbnXaA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.8.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-212KBdkSETy31mZi2UMStxESElyepkF14PElIn/Wg5lnbvHmYKHkpRbDNqD8ZPzURShIIHFSl88uojnpJ5cPJw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.8.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-Eu9tfLEqpekKhOJfYeNFQJKwkEgKlOwHgjcyt0yeBySEggv7/6CHMtzlsXImEDtLFWHKNuS0uNQSqeNsRIE0Fg==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.8.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-KmYjZyxWphHbA8LfeP/12gmLjn2UbTyqWUdSIl6QTP0cnoV9Y9TNNn9mNeDqQ9QWnNcbrDE5FCGGFnxJUPt5Fg==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.8.tgz"
},
{
"name": "@atape/cli",
"integrity": "sha512-zSoXd95XwgXVy6ulGbFrtH5uDAPHossC5MU6Sxl3IG85MvxGgFA+Shae9bVMRI7bfX+/AhuCde67Gv9N6sIzlw==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.8.tgz"
}
],
"migration": {
"protocol": "atape.capture-migration.v1",
"id": "journal-v7-to-v8",
"fromCaptureStateContracts": [
"atape.client.v3-capture.v1",
"atape.client.v3-capture.v2"
]
}
}

ATape v0.5.7

ATape v0.5.7: Explicit capture migration and unattended update recovery

This release adds an explicit, recoverable local capture migration to the managed
update path. The coordinated npm bundle contains @atape/cli and the seven
official Adapters, all at 0.5.7. Publication and unattended delivery are separate
results: this candidate must pass its automated gates before publication, and
public packages alone do not establish a successful production-registry upgrade.

The Authentication epoch remains auth-v1, including the 180 days absolute Web
Session lifetime. Artifact release and minimum CLI metadata are 0.5.7. Publishing
npm packages does not deploy a Server or change an existing Instance's minimum
CLI version.

To refresh the actual command entry with Node.js 24 or newer:

npm install --global @atape/cli@0.5.7

Explicit local migration and continued compatibility

The first compiled plan is atape.capture-migration.v1 / journal-v7-to-v8. A
migration-capable capture-v1 or capture-v2 runtime can move registered journals
at format 7 or 8 to actual capture contract atape.client.v3-capture.v2.
Transactional v7-to-v8 SQL preserves bindings, Canonical and Raw obligations,
receipts and checkpoints; verified v8 is an idempotent no-op. Projects, tool
selection, credentials, privacy settings and Stop intent are retained. Manual
upgrades use the same migration path for retained journals even when tools have
been disconnected. This does not import history or migrate Server storage.

The verified target performs read-only preflight before the bounded collection
pause. For enabled SourceCapture v2 sources that are intended to run, it checks
the Server's publication and legacy-adoption capabilities using existing
credentials. An Adapter's declared publication profile determines its minimum;
Cursor requires Profile3. Stopped collection permits local migration without
remote prerequisites. Scope and inventory are checked again under ownership so
a concurrent Start or configuration change cannot reuse an obsolete preflight.

Before the durable forward boundary, a confirmed failure can restore the exact
previous selection. After that boundary, recovery must continue with the recorded
target and plan. A strict requirement, progress ledger and completion receipt
gate ordinary capture writes. Recovery checks each attempt's authority under the
same barrier as the reader floor; a revoked apply process cannot commit further
progress. Missing metadata can be repaired only from matching surviving evidence;
unknown or inconsistent state fails closed. Do not delete recovery metadata as
a repair.

A completed receipt permits later compatible runtimes at or above its target,
subject to the current reader floor. It does not pin an obsolete executable,
bootstrap identity or Adapter slot. An active controlled-session creation proof
defers a floor advance until confirmation or abandonment, without killing the
interactive native session or allowing stale writers past the floor.

Migration-capable clients prefer the fixed v2 catalog, whose routes bind source
contract, control protocol and known migration plan to a complete immutable
bundle. The original v1 catalog and descriptor remain compatible; their readers
require the original seven packages and accept bounded additive packages. The
current publisher verifies all eight packages, including Cursor. New Adapters
are not installed or enabled merely because a bundle contains them. Old plan
routes and a real capture-v2 bridge on legacy GitHub/npm latest must remain
available for indefinitely offline clients. Future state formats and plans need
their own implementation, recovery bridge and verification; this release does
not authorize arbitrary migrations from remote metadata.

See explicit migration behavior
and ADR-0115.

Independent wakeup and older installations

Automatic updates are enabled by default after tool initialization and can be
disabled in Settings. Supported npm-global macOS/Linux installations register an
independent hourly user-level wakeup. It checks the existing due schedule while
the console is closed, login startup is off or collection is stopped, without
issuing Start. Disabling updates stops future new work; scheduling needed by an
in-flight update remains available for recovery and is removed when safe.
Recovery after the forward boundary still runs with automatic updates off and
preserves the latest Stop intent.

Immutable 0.5.3 does not acquire migration, discovery or wakeup support from this
release. Its incompatible initial boundary needs the
documented manual transition.
Existing capture-v2 clients can receive a compatible bridge, but a 0.5.4
installation enrolls independent scheduling only after a capable actual entry
runs. A newer managed selection does not prove the npm command entry was
refreshed; new command grammar may require that refresh. Reopen old consoles
after upgrading. External npm replacement is not crash-atomic.

The wake requires a running user manager and an available Node/npm installation.
It does not update a powered-off machine or supervise collection. Controlled
process, SQLite, orphan-process and physical-disk tests exercise recovery
boundaries; native helper tests exercise repeated OS activation. They do not
establish real capture after logout/reboot, calendar sleep, recovery from an
actual machine power cut, or a migration delivered through the production
registry. Those remain unverified operational acceptance limits.

Cursor and Server prerequisites

Cursor remains experimental. Existing acceptance uses constructed Confab-derived
rows and a synthetic native executable, not authenticated Cursor CLI or IDE
conversations. The selected static profile is Cursor CLI 2026.10.01-e373342;
other versions, real streaming/compaction and platform equivalence remain
unverified. Controlled creation requires a fresh session through
atape start --tool cursor, an updated actual bootstrap, a connected Project,
an enabled Cursor Adapter, an interactive macOS/Linux terminal and an explicit
absolute ATAPE_CURSOR_EXECUTABLE path. Unconfirmed history is skipped. A
nonprefix rewrite or truncation conservatively stops that source while keeping
its published head. See the Cursor guide.

Cursor upload still requires a Server supporting
atape.publication-target.v3, storage migration
000024_unknown_conversation_time.sql, and matching Reader/Search/Web behavior.
An older Server fails capability negotiation; source clocks are not fabricated.
Other providers retain their existing publication profile unless they explicitly
declare Profile3. Server deployment and the production storage migration are
separate operator actions and are not authorized or performed by this release.

Candidate validation and manual acceptance disclosure

The exact frozen 0.5.7 candidate must pass repository checks, production builds,
checksummed installed CLI/Adapter acceptance, terminal and historical-client
contracts, real local migration/recovery contracts, authenticated PostgreSQL
provider contracts, dependency/container security, Go race/fuzz, self-host
configuration and paired restore gates. Prior PR results and older package
hashes are not this candidate's completed acceptance. No candidate CI or
publication outcome is claimed by preparing these notes.

All eight packages use the ordinary GitHub Actions Trusted Publisher route.
Cursor's one-version local bootstrap in 0.5.6 remains a historical record;
neither its skipped 0.5.6 workflow step nor its trust configuration proves a
successful Cursor OIDC publication. The workflow must verify all eight exact
public manifests and tarball bytes before advertising the version Release,
compatible v1 catalog and migration v2 catalog. Publication evidence must cover
the actual frozen 0.5.7 candidate.

Staging evidence remains pending. These manual
checks are unverified and waived for publication only, never recorded as passed:

• candidate-artifacts: manual acceptance of the candidate artifacts.
• official-topology: operation in the official deployment topology.
• github-provider-staging-smoke: live GitHub Provider staging smoke.
• official-domain-egress-deny-smoke: official-domain egress isolation.
• two-user-two-team: two-user/two-Team acceptance.
• waf-tls-callback: WAF, TLS and callback configuration.
• backup-restore: operational backup and restore.
• observability-secret-sample: observability secret sampling.
• rollback: operational rollback exercise.
• release-signoff: manual release signoff.

On 2026-10-10 in Asia/Singapore, the user explicitly requested publication with
“那你触发下发布吧”. Under
ADR-0048, that
request authorizes the manual-only waiver for this coordinated release. The
separate waiver will bind the exact frozen candidate after preparation; automated
gates remain mandatory. This request does not authorize Server deployment or
a production database migration.

{
"protocol": "atape.release-bundle.v1",
"version": "0.5.7",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-OmEHG2NVdgiR1WqysaCX8ss2CpnYrB1v/hQi3cvBZJ5W0YXL2AovaZXzXgmx7SO4uNNamCupkeuhSgOnb36l+Q==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.7.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-NEwKrO7eZa3NANJ4wXI+ueKsnWEmYQIxYECv3kKfqHQpBLP91Q6pWVi8atGjt7gHIsb8tQG5nmKGuj6GI8dMbA==",
"tarball": "https://registry.npmjs.org/@ata...

ATape v0.5.6

ATape v0.5.6: Controlled Cursor capture and independent update control

This release adds an experimental Cursor Adapter, explicit unknown conversation
times, background privacy observations and a stronger compatible-update path.
The coordinated npm bundle contains the CLI and seven official Adapters,
including the new @atape/adapter-cursor package. Publication requires this
candidate's automated gates; repository integration and earlier PR checks do not
establish that these packages have been published or deployed.

The Authentication epoch remains auth-v1, including the 180 days absolute Web
Session lifetime. The coordinated artifact metadata records release and minimum
CLI version 0.5.6; an existing Instance changes its minimum only when an operator
deploys that Server artifact.

Install or refresh the actual command entry using Node.js 24 or newer:

npm install --global @atape/cli@0.5.6

Cursor scope and Server prerequisites

Cursor capture is experimental. Its acceptance uses constructed Confab-derived
rows and an external synthetic native executable through the real installed
CLI, authenticated HTTP and PostgreSQL. No authenticated Cursor conversation was
available. This is compatibility evidence, not verified general Cursor CLI or
IDE support. The selected static native profile is Cursor CLI
2026.10.01-e373342; other versions and platform equivalence remain unverified.

Controlled creation uses atape start --tool cursor, with optional --project
and literal --prompt. It requires an updated npm bootstrap, an installed and
enabled Cursor Adapter, a connected Project, an interactive macOS/Linux terminal
and an explicitly configured absolute ATAPE_CURSOR_EXECUTABLE path. An older
bootstrap rejects the new command grammar before managed-runtime delegation;
selecting a newer runtime alone does not add the command to it. See the
Cursor guide for setup and supported native roots.

Only a fresh conversation started through this controlled path can acquire an
immutable local creation receipt. History without that evidence is skipped;
mutable metadata, current workspace and lossy directory slugs never establish
original Project ownership. Config/data roots must be absolute and resolve to
the same directory. Split roots, native resume/continue and arbitrary native
arguments are unsupported.

Cursor emits explicit null source clocks, stable IDs derived from physical rows
and content parts, one partial root Thread and no invented Usage. Text and tool
inputs are retained; absent tool results, model information, native IDs and child
relationships are not fabricated. Turn-end rows are Raw facts rather than proof
that a Session ended. Raw contains complete parsed native row objects through
shared upload-time redaction, not a byte-identical original-file archive.

Cursor upload requires a Server with atape.publication-target.v3, nullable
source-clock storage migration 000024_unknown_conversation_time.sql, and the
matching Reader/Search/Web behavior. Deploying those components and applying
the production migration are separate operator actions. npm publication does
neither. An older Server fails capability negotiation before publication instead
of receiving fabricated occurrence dates. Existing providers continue their
default canonical v2 path when they do not explicitly select v3; Server minimum
CLI admission still follows the deployed Server's release policy.

The new v3 contract represents unknown Session updatedAt and Event occurredAt
as required explicit JSON null. v1/v2 continue requiring known clocks. Usage and
observation clocks retain their existing separate meanings. Reader/Search show
unknown time, Search pages known dates before unknown dates, and Overview omits
unknown source clocks from dated activity. Migration 000024 also normalizes exact
historical Go-zero source clocks to null; other recorded sentinel dates and
frozen publication bytes remain unchanged. The migration rebuilds the message
paging index. See unknown-time semantics.

Continuation checks the confirmed creation prefix and last acknowledged prefix
against the same stable bytes. Repeated appends, touches and byte-identical
rewrites preserve IDs. Nonprefix rewriting, truncation or compaction stops that
source while preserving its published head. Real Cursor may rewrite a complete
assistant row during streaming; constructed fixtures cannot establish otherwise,
and the conservative check will refuse such a change. Real native streaming,
compaction, authenticated CLI/IDE behavior and child relationships remain
outstanding acceptance work. Creation evidence assumes cooperating local
processes and does not authenticate against a deliberate local UUID/file race.
Cancellation joins the immediate child and restores terminal state; cleanup of
arbitrary native tool grandchildren after parent-only cancellation remains
unverified. Proof reads are bounded without a total human first-message deadline.

Compatible updates and older clients

The local capture contract remains atape.client.v3-capture.v2; this release does
not add automatic cross-contract migration. New update control separates durable
runtime selection/recovery from capture admission, verifies complete immutable
CLI/Adapter bundles and uses a version-aware compatible catalog. Current
production bundles contain eight packages, while the catalog Reader retains its
original seven-package minimum and accepts bounded additive packages. New tools
are not installed or enabled merely because a bundle includes them.

Supported npm-global macOS/Linux installations can register an independent
hourly user-level update wakeup, including while collection is stopped, login
startup is off or the console is closed. The wake checks the existing due
schedule and preserves Stop intent. It is not a collection supervisor or a
machine-off updater. Native service availability, Node/npm removal, real
logout/reboot, power loss and Linux lifecycle behavior remain operational limits.

A failed candidate enters a finite 24-hour, 72-hour or seven-day cooldown only
after narrowly classified startup/readiness failure and confirmed restoration of
the previous runtime. Explicit manual updates can retry it. Reader-floor guards
reject stale capable writers after a forward recovery boundary; malformed or
uncertain recovery state fails closed. Already published old workers and open
consoles do not acquire these protections retroactively.

The published 0.5.4/0.5.5 capture-v2 cohort can receive a compatible bridge within
the existing same-contract update path; first adoption and subsequent capable
updates have different guarantees. Refresh the actual npm command entry before
using new bootstrap commands, and reopen old consoles after upgrading. A managed
selection is not proof that the global command entry was refreshed. External npm
replacement is not crash-atomic and may require owned forward recovery. The
historical 0.5.3 capture-v1 boundary still requires the documented manual
transition; this release does not make an old v1 worker migrate v2 state.

Automatic/manual managed updates preserve configured custom/local sources and
align only eligible installed official Adapters. Incomplete public propagation
must not advertise a partial bundle: local artifact identities are validated
before npm writes, every public manifest and tarball must match the verified
bytes, and only then can the version Release and compatible catalog advertise
it. Publication does not prove an unattended upgrade against the production
registry. See upgrade behavior and limits
and release procedure.

Background privacy observations and fixes

Privacy rules now offers a local Background privacy status page. It compares the
saved editor file with each observed job's loaded path/revision and safe rule
counts, bound to the current managed process generation. It exposes no literal
values, regular expressions or policy identity. Jobs may use different immutable
snapshots across a file edit; an observation is not a heartbeat or proof that all
sources uploaded. An unavailable report is unknown, and a stopped process's
snapshots are historical. These local descriptors are excluded from remote
device reports. The underlying rules and local test command were already shipped
in 0.5.5. See client redaction.

This release also repairs reading atomically replaced Collector status snapshots
under concurrent writes and updates the Server's Go networking dependencies,
including golang.org/x/net to 0.60.0. Server security fixes affect a built and
deployed Server artifact; publishing npm packages does not update an existing
Server process.

Candidate validation and manual acceptance disclosure

All automated release gates must pass for the exact frozen 0.5.6 candidate:
repository checks, production builds, checksummed installed CLI/Adapter packages,
updater/login/terminal checks, authenticated PostgreSQL/provider contracts
including controlled Cursor start/capture, dependency and container security,
Go race/fuzz, supported self-host configurations and paired restore. Previous
PR results and older release evidence are not this candidate's acceptance.
Cursor's controlled synthetic contract does not replace authenticated native
Cursor acceptance. Under
ADR-0117, Cursor
0.5.6 alone uses local account/MFA first publication of the exact verified
tarball, so it has no GitHub build provenance attestation. The other seven
packages use the normal GitHub Actions route. The workflow checks the existing
Cursor integrity, all eight public manifests and tarball bytes before advertising
the complete Release/catalog. Configuring Cursor's future Trusted Publisher is
separate from proving a ...

ATape migration update catalog

{
"protocol": "atape.update-catalog.v2",
"revision": 5,
"bundles": [
{
"protocol": "atape.release-bundle.v2",
"version": "0.5.11",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/cli",
"integrity": "sha512-SYZQnSmI9QSKnzEWumIIE22saB919cA2ebGJzCGfnaI4lDLiGLA4rW9c605464B7SBhNfY8zUV0C6Gvsj2rCZA==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.11.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-b3h4/RBl8GbNUN/M2IxkjnV/IujJqOLl1z99C9w6mzP499fENSU08SQbjXRmEephe05J92JmcfkPZEcd6wlLDw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.11.tgz"
},
{
"name": "@atape/adapter-claude",
"integrity": "sha512-fgkgFrNltDa6+Vq/0+SE4xmqvCyPL1SdYgP0KIDu/uas2Oz5OyLly/562zzMkfKfymuFCZUGALqzMMbQ8BLw9Q==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.11.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-3BbggtxinR210yLzqk1GKaRxbT1aWnnv9Xe6/NWDvzkBh5lWnawva6azCGeF9gKjr7UjZgEUKxihzRgQ9eBqKA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.11.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-y8iAqWqBT+I2E22ofgjVgATIFE9GrMGkCbpSpNw8UwtDx13GyUkijb0YmktcB0sQ7TWr8gmThL9wWeuLlKXacA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.11.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-WD05HLDZyZg+24SAm9MAjk0Ob+tMoyuzI5Kk/teESNzWNX5aN7X8sCLAcls7NyaQg4uOmRfWAkclvKAR5CW4YQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.11.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-sKY39aSPOt55XWtHZ6jrLZvcukIMdtfdfjqv+c0p3G1L6EqMZD6ai9mHigy1xcms17Xp/tB5BShPWrvw/PNICw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.11.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-Ggc3vy7laTb2imRSjK6YvbLqKkSbF1Yl7I5v+yI5BxuwzBe4t8DnQg3Yqn9zs2oQi7X9SsxH7HhyrBqy2UAfSA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.11.tgz"
}
],
"migration": {
"protocol": "atape.capture-migration.v1",
"id": "journal-v7-to-v8",
"fromCaptureStateContracts": [
"atape.client.v3-capture.v1",
"atape.client.v3-capture.v2"
]
}
}
],
"routes": [
{
"fromCaptureStateContract": "atape.client.v3-capture.v1",
"updateControlProtocol": "atape.update-control.v1",
"migrationProtocol": "atape.capture-migration.v1",
"migrationId": "journal-v7-to-v8",
"version": "0.5.11"
},
{
"fromCaptureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"migrationProtocol": "atape.capture-migration.v1",
"migrationId": "journal-v7-to-v8",
"version": "0.5.11"
}
]
}

ATape compatible update catalog

{
"protocol": "atape.update-catalog.v1",
"revision": 6,
"bundles": [
{
"protocol": "atape.release-bundle.v1",
"version": "0.5.11",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/cli",
"integrity": "sha512-SYZQnSmI9QSKnzEWumIIE22saB919cA2ebGJzCGfnaI4lDLiGLA4rW9c605464B7SBhNfY8zUV0C6Gvsj2rCZA==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.11.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-b3h4/RBl8GbNUN/M2IxkjnV/IujJqOLl1z99C9w6mzP499fENSU08SQbjXRmEephe05J92JmcfkPZEcd6wlLDw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.11.tgz"
},
{
"name": "@atape/adapter-claude",
"integrity": "sha512-fgkgFrNltDa6+Vq/0+SE4xmqvCyPL1SdYgP0KIDu/uas2Oz5OyLly/562zzMkfKfymuFCZUGALqzMMbQ8BLw9Q==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.11.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-3BbggtxinR210yLzqk1GKaRxbT1aWnnv9Xe6/NWDvzkBh5lWnawva6azCGeF9gKjr7UjZgEUKxihzRgQ9eBqKA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.11.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-y8iAqWqBT+I2E22ofgjVgATIFE9GrMGkCbpSpNw8UwtDx13GyUkijb0YmktcB0sQ7TWr8gmThL9wWeuLlKXacA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.11.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-WD05HLDZyZg+24SAm9MAjk0Ob+tMoyuzI5Kk/teESNzWNX5aN7X8sCLAcls7NyaQg4uOmRfWAkclvKAR5CW4YQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.11.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-sKY39aSPOt55XWtHZ6jrLZvcukIMdtfdfjqv+c0p3G1L6EqMZD6ai9mHigy1xcms17Xp/tB5BShPWrvw/PNICw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.11.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-Ggc3vy7laTb2imRSjK6YvbLqKkSbF1Yl7I5v+yI5BxuwzBe4t8DnQg3Yqn9zs2oQi7X9SsxH7HhyrBqy2UAfSA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.11.tgz"
}
]
}
]
}