ATape v0.5.10

ATape v0.5.10: Source clocks and recorded activity

This coordinated release contains the CLI and all seven official Adapters at
0.5.10, with matching Web, Server and container metadata. The Authentication
epoch remains auth-v1, including the 180 days absolute Web Session lifetime.
Unified release and minimum CLI metadata are 0.5.10. Package publication,
Server rollout and Web deployment are separate operations.

Codex source clocks and record order

The Codex paged Adapter now explicitly selects nullable Canonical v3. Supported
records with missing, null or invalid source timestamps remain captured with an
unknown occurrence time. Session recency uses the maximum admitted source clock
in the selected metadata/title/record snapshot, or remains unknown. Filesystem
modification time supports discovery, revision and stable legacy observation/Raw
capture metadata; it does not fill a missing Session or Event clock. Repeating
an unacknowledged Raw chunk reconstructs the same receipt metadata.

Each supported projected source record has a stable order coordinate. A persisted,
bounded source-object/generation registry gives file generations separate
namespaces, preserving existing coordinates through append, discovery reorder
and source deletion. Missing or reversed clocks do not reorder records or fold
distinct user inputs together. Ordering separate files in one Thread is derived.

Projection v5 replays supported older Canonical cursors once with stable Event
IDs and a higher revision floor, retaining Raw acknowledgements. Available
source history can therefore acquire corrected clocks. Unavailable history
remains unrepaired; the Server does not guess away a stored epoch. The updated
cursor cannot be read by an older Codex Adapter. This remains the legacy paged
collection path, with its existing source-dependent retry and redaction-policy
limits; it does not gain sourceCapture frozen recovery or complete publication.

The new Host must affirm the Adapter's explicit v3 capability. Collection and
managed admission require affirmative Server support before source access or
progress changes. The CLI-authenticated Canonical capabilities endpoint reports
modern profiles independently of Publication; an explicitly absent endpoint
can use the existing affirmative publication-target-v3 capability on an older
Server. Negative, invalid, authentication or transient responses are not proof
of support.

See Codex source clocks,
Canonical ingestion, and
ADR-0122.

Recorded activity and original records

Session Analytics v3 adds record span, an activity timeline and interval
evidence. Select all captured Threads or one Thread. Summary, tools,
capabilities and usage still describe the full Session. Counts describe
Canonical records, including fragments and tool updates, rather than inferred
turns. Span is the difference between the first and last eligible recorded
clock; it is unknown with none and zero for one instant. It does not establish
work time, active coding time, tool duration or time to first token.

Non-null clocks under explicit nullable Canonical v3/v4 are categorized as
recorded, rather than independently verified. Explicit null clocks are unknown.
Older non-null clocks retain their stored dates and a legacy category, outside
the dated timeline and span. This conservative rule can exclude legitimate
legacy dates; source replay under a nullable profile is required for inclusion.
Unknown and legacy records remain available in a separate unplaced selection.
Existing summary known/unknown counts keep their earlier non-null/null meaning.

The Server produces at most 60 uniform dated intervals, including empty ones.
Select an interval or the unplaced group to page through its records, then open
an Event in the existing conditional Reader. Browser Back restores the selected
Thread, interval and page. Ranges and cursors bind the Session, snapshot,
analytics version and filters. Changed content requires a full refresh, which
clears those selections. Authorization is checked on each read.

New Web opts into v3 using the standard safelisted Accept header. New Server
keeps analytics v2 for callers without that opt-in. Older Servers can return
v1/v2; Web keeps their supported report and explicitly marks activity
unavailable. Missing activity is not a zero report. The Module reads authorized
Canonical metadata without Raw or Search data, new persistence or background
workers. Existing deadline and capacity bounds remain enforced. Arbitrary
client time bounds, timeline granularity, cost estimates and generated analysis
remain outside this release.

See Session Analytics and
ADR-0123.

Upgrade and recovery boundaries

The actual SQLite journal, atape.client.v3-capture.v2 state contract,
update-control v1 and compiled journal-v7-to-v8 plan remain unchanged. A common
state contract does not prove that an older parent understands a new Adapter
manifest or can resume a newer Codex cursor.

The genuine published 0.5.9 parent rejects a first managed update involving
active Codex collection during read-only preflight, before pause. Stop sync
before updating the CLI and matching official Adapter bundle. Preserve
ATAPE_HOME, credentials, project/tool choices, checkpoints, Raw receipts and
Stop intent. The required POSIX installed transition gate executes the genuine
old console's stopped complete-bundle update, followed by the exact candidate
Collector's replay, no-op and append cycles. It verifies preserved checkpoint
and credential bytes, Raw receipts, stable Event IDs and higher revisions,
including an Instance advertising minimum CLI 0.5.10 during upgrade. Its Server
and distribution HTTP are owned external Test Adapters; constructed source
records do not establish live Provider acceptance or a personal installation
upgrade. Do not install the new Codex Adapter into the old Host, or resume with
an older Adapter after the new cursor is written. Consult
the stopped Codex upgrade
and the Codex guide.

Other historical boundaries still apply. In particular, active official-Claude
0.5.8 installations require the stopped external CLI refresh described in
v0.5.9. Pinned, local, custom or
nonselected integrations are not silently replaced. Normalized MCP/Skill
identity remains Claude-specific; no identity is inferred for other Providers
from text or display labels.

No database migration is added. Preserve the current Server image and a fresh
paired PostgreSQL/Raw recovery point before rollout. Restoring that point
withdraws writes made afterwards; a backup is not evidence that production
restore or rollback was exercised.

Candidate validation and manual acceptance disclosure

The exact frozen candidate must pass fresh repository, installed CLI/Adapter,
historical compatibility, PostgreSQL, dependency/container security, race/fuzz,
self-host configuration and paired restore gates. Feature PR results and
0.5.9 evidence do not attest this release candidate. Published npm bytes,
GitHub assets, update catalogs and deployed image identities require their own
verification; this release note alone does not claim that those actions passed.

Staging evidence remains pending. The following
manual checks are unverified and waived for package publication only:

• candidate-artifacts: manual candidate artifact acceptance.
• official-topology: official deployment topology acceptance.
• github-provider-staging-smoke: live GitHub Provider staging smoke.
• official-domain-egress-deny-smoke: official-domain egress isolation.
• two-user-two-team: two-user/two-Team acceptance.
• waf-tls-callback: WAF, TLS and callback configuration.
• backup-restore: operational backup and restore exercise.
• observability-secret-sample: observability secret sampling.
• rollback: operational rollback exercise.
• release-signoff: manual release signoff.

Authenticated native Cursor capture remains unverified; its installed contract
uses controlled native-format samples. A fresh live MCP/Skill recording also
remains unverified. Constructed source records, synthetic API checks and
published-byte verification do not establish either native acceptance.

On 2026-10-12 Asia/Singapore, the user explicitly requested
“可以，那你继续发布新版 npm 包，再升级 Server，把这次改动上线。” This authorizes
coordinated package publication and the matching Server upgrade. Under
ADR-0048, the
publication request also authorizes the candidate-bound manual-only waiver in
the authorization record; automated gates
remain mandatory. This increment requires no new schema migration and does not
authorize unrelated production data or schema changes.

{
"protocol": "atape.release-bundle.v1",
"version": "0.5.10",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-VDtK5uXgp2vSyhfqKNedpDxFa91R4nfJgrOXH2Hs0O16LhT7RS1dKxiFPhao1q3UReD31xHPnXQcmC8v4oUWYw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.10.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-OXfOmrROG/CFBySHWAp3B2fOoJ03wgR3JeQk+A2xjh3/ZS+Eef9BCCorTPgrnMotfkmcjMmjSTyELK84D9zc9A==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.10.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-tgiD29qMmiH+3DlXtm94XOYBZlVT/N8uXTgX739r9FruGG0Xi4T4M705xbNmhpnrigH9KtzLmyEinEaVHMvfKA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.10.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-hBlLia4FM+4PPiS+Gm+eTTHR3mxSEnkzAC/4RqzMZbe+ub56Wv1JCbOiK5J7EFoiry/KOIkxg/8nuMeBWKy/YQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.10.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-h7H2OcMsO2luQdjEeXxGdxC9qEu/lvd5WwMtWLXWzBtv+APlC0Tk3hBpDg9OJSlBOK8pCKT/v6GeyvLdnfHYeQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.10.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-aA9Mf6Hk0ftxT921nmOsVG6w19WGKjGXqGO+PK1DgqRgFSz4Rc07pF2b+Yyn+8b76HNSSrhDXGA86YynORMNnw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.10.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-O3C5GfCigNmLk5y4JF9LvKSEaJuVeOHfDA59jyR2/Dzgy3C9ZtMbSKQZPNCgyzYMdq6+3N1+IHQnjDhwBsFb0g==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.10.tgz"
},
{
"name": "@atape/cli",
"integrity": "sha512-edQJ66nr0VMaKgxYaRDOCiSwJeueEVRTRtBQFk815skIPt7sBOR8ZCfFNhMhOHQ+nU/iY8BEsUxQHoO/LPSCJQ==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.10.tgz"
}
]
}

{
"protocol": "atape.release-bundle.v2",
"version": "0.5.10",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-VDtK5uXgp2vSyhfqKNedpDxFa91R4nfJgrOXH2Hs0O16LhT7RS1dKxiFPhao1q3UReD31xHPnXQcmC8v4oUWYw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.10.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-OXfOmrROG/CFBySHWAp3B2fOoJ03wgR3JeQk+A2xjh3/ZS+Eef9BCCorTPgrnMotfkmcjMmjSTyELK84D9zc9A==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.10.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-tgiD29qMmiH+3DlXtm94XOYBZlVT/N8uXTgX739r9FruGG0Xi4T4M705xbNmhpnrigH9KtzLmyEinEaVHMvfKA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.10.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-hBlLia4FM+4PPiS+Gm+eTTHR3mxSEnkzAC/4RqzMZbe+ub56Wv1JCbOiK5J7EFoiry/KOIkxg/8nuMeBWKy/YQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.10.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-h7H2OcMsO2luQdjEeXxGdxC9qEu/lvd5WwMtWLXWzBtv+APlC0Tk3hBpDg9OJSlBOK8pCKT/v6GeyvLdnfHYeQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.10.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-aA9Mf6Hk0ftxT921nmOsVG6w19WGKjGXqGO+PK1DgqRgFSz4Rc07pF2b+Yyn+8b76HNSSrhDXGA86YynORMNnw==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.10.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-O3C5GfCigNmLk5y4JF9LvKSEaJuVeOHfDA59jyR2/Dzgy3C9ZtMbSKQZPNCgyzYMdq6+3N1+IHQnjDhwBsFb0g==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.10.tgz"
},
{
"name": "@atape/cli",
"integrity": "sha512-edQJ66nr0VMaKgxYaRDOCiSwJeueEVRTRtBQFk815skIPt7sBOR8ZCfFNhMhOHQ+nU/iY8BEsUxQHoO/LPSCJQ==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.10.tgz"
}
],
"migration": {
"protocol": "atape.capture-migration.v1",
"id": "journal-v7-to-v8",
"fromCaptureStateContracts": [
"atape.client.v3-capture.v1",
"atape.client.v3-capture.v2"
]
}
}