ATape v0.5.12

ATape v0.5.12: Recorded file activity

This coordinated target-owned implementation contains the CLI and seven official
Adapters at 0.5.12, with matching Web, Server and container metadata.
Authentication remains auth-v1, including the 180 days absolute Web Session
lifetime. Release and minimum CLI metadata are 0.5.12. Implementation,
integration, npm publication and Server deployment are separate actions.

Recorded tool and file activity

Codex and Claude emit Canonical/publication v5 facts for explicit native
tool identities and read, edit and search paths. Analytics v4 groups tools by
stable identity and reports exact recorded paths, distinct calls, operation
counts and coverage. File and operation filters open the final original tool
update through a conditional Reader link; browser Back restores the selection.

Paths retain their recorded spelling. Search paths describe scope, rather than
matching files. An edit invocation does not prove a successful filesystem
change. Unknown, invalid, oversized and redacted facts remain unavailable;
commands, output lists and patch bodies do not supply guessed paths. Upload
preparation clears copied path facts when their original sensitive fields are
masked. No Raw or Search data enters the analysis report.

Available source history replays with stable Event IDs and higher revisions.
Codex uses projection/cursor v7; Claude uses source profile active-path.4 and
projection v7. Frozen pending publications and Raw acknowledgements retain
their original bytes. Unavailable history remains unrepaired. Other official
Adapters retain their existing capture scope and do not infer these new facts.

Automatic delivery and recovery

Publication policy keeps the genuine 0.5.11 bridge on npm/GitHub Latest and
retains legacy catalog v1/v2 routes. The 0.5.12 release is assigned npm
atape-managed and catalog v3 only. A long-offline 0.5.10 client can first
receive that real bridge, then hand target
preparation, migration and recovery to this verified runtime. Normal updates
preserve the global npm entry and do not require prefix write permission.

The 0.5.12 manual CLI operation also preserves the global entry for catalog v3,
including before tool initialization. It still performs complete-bundle target
preparation and activation. A current managed runtime does not repeatedly offer
an update solely because its global entry is older. Historical v1/v2 entry
replacement remains available for their compatibility transitions.

The already published 0.5.11 manual menu can report an entry-refresh failure
after selecting the new runtime on a read-only npm prefix. Its immutable bytes
retain this limitation. Installed unattended acceptance therefore executes the
genuine 0.5.11 automatic worker; the new manual policy is implemented in 0.5.12.

The target-owned Interface retains writer exclusion, bounded durable receipts,
Stop intent and updates-off preference. Interrupted handoffs recover forward
through the exact recorded target before reading its private state. Historical
0.5.9 cannot cross the clock transition unattended. It still requires the
documented stopped entry replacement into the compatible 0.5.11 bridge before
the target-owned feature update. This release cannot change that published
old decoder. Native Windows update lifecycle and live Claude/Cursor acceptance
are outside POSIX installed acceptance.

The bridge delivery record confirms genuine
0.5.11 publication and independent anonymous public-byte verification. It does
not claim publication or deployment of this feature release.

See Session Analytics,
target-owned updates and
ADR-0126.

Server and durable-data boundary

Deploy a v5-capable Server before advertising this feature release. The SQL
schema remains version 24; accepting v5 data still creates a durable format
boundary. A pre-v5 Server must not be restored through an image switch after
v5 writes. Retain the matched PostgreSQL/Raw backup and use compatible forward
repair. A deliberate paired restore withdraws later writes and needs a separate
operator decision.

Acceptance and remaining limits

Local implementation verification passed repository checks, production builds,
release-policy checks, dependency checks at the configured security threshold,
Go race/fuzz tests, PostgreSQL integration, self-hosting configuration and a
paired PostgreSQL/Raw restore rehearsal. The installed HTTP/provider corpus
passed in 655.429 seconds; the separate authentication maintenance contract
passed in 7.65 seconds. Local candidate container builds and Web rollout unit
tests also passed.

The final checksummed packages passed required installed compatibility through
the genuine published 0.5.10 → 0.5.11 → 0.5.12 automatic chain and four interruption
cases: control synced, first private ledger, before readiness and orphan apply.
Each case verifies an actual registered Claude journal, its complete target-bound
receipt and owner. The observed journal format is 8 before and after this update;
the separate installed candidate contract verifies controlled SQL7 → SQL8
migration. The historical 0.5.9 stopped transition reaches the genuine bridge,
then its automatic worker reaches 0.5.12 while retaining Stop intent. The test
explicitly enables automatic updates for that second leg and disables them at
the end. Manual v3 policy also passed 39 application caller tests.

The candidate acceptance record retains
artifact hashes, completed checks and the earlier failed attempts with their
repairs. These remain local candidate checks. Exact-head CI and image Security
are mandatory before integration and publication. Package publication, public
byte verification, Server deployment and client uptake are separate delivery
actions; their records establish when they have completed.

The user's explicit package publication request includes the incomplete manual
staging waiver under ADR-0048. Automated CI, integration, installed
compatibility and security gates remain mandatory. The following manual checks
remain unverified:

• candidate-artifacts
• official-topology
• github-provider-staging-smoke
• official-domain-egress-deny-smoke
• two-user-two-team
• waf-tls-callback
• backup-restore
• observability-secret-sample
• rollback
• release-signoff

Constructed native source and synthetic authenticated API acceptance do not
establish a fresh live Provider session, real GitHub OAuth, native login/wake
registration or complete manual staging. Public byte identity and decoded
provenance content do not establish independent cryptographic signature
verification. Publication does not prove immediate client uptake: existing
discovery cache and automatic-check scheduling still apply.

{
"protocol": "atape.release-bundle.v3",
"version": "0.5.12",
"captureStateContract": "atape.client.v3-capture.v2",
"updateControlProtocol": "atape.update-control.v1",
"packages": [
{
"name": "@atape/adapter-claude",
"integrity": "sha512-lPviL9eCfRhWhHLmRy2oJOgxAe/tMVQ3Bkz6UcJK8ucStmxAT9Hw3TDdlPs7HI/tX3EbGmm4qGRL5tRMSt2o4Q==",
"tarball": "https://registry.npmjs.org/@atape/adapter-claude/-/adapter-claude-0.5.12.tgz"
},
{
"name": "@atape/adapter-codebuddy",
"integrity": "sha512-b8woaxKsz9fqok8tqntCiHi3FaKugV7oW99zOSItXLO5uncAoN9vGAy/NWuotJH2kAmvZ30W7DZtKAptiEOREg==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codebuddy/-/adapter-codebuddy-0.5.12.tgz"
},
{
"name": "@atape/adapter-codex",
"integrity": "sha512-s9lJPBMZMMyojIhg0wkGDoICarfMLwrxugdQV/r0qzCz4Zy9lyYVKMiUL939TaB0lij9OX8Zr49DuDDyxVO9WQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-codex/-/adapter-codex-0.5.12.tgz"
},
{
"name": "@atape/adapter-cursor",
"integrity": "sha512-uizSGMwP4DaNTMqZYAarVXNi6FVy+Sjn9vl75+6KLItXLUCdcr2awBRhqlx256SiIOYPcKAs+RSmdsMsqZDPTQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-cursor/-/adapter-cursor-0.5.12.tgz"
},
{
"name": "@atape/adapter-grok",
"integrity": "sha512-adVnbre65Ed6IdWNk3riiVeIMx9B9WaHjT4tNcpv0Owah5/3zHuWbcN73wNqAf+fX6wMq0bbQY3+4hDKuVhcjA==",
"tarball": "https://registry.npmjs.org/@atape/adapter-grok/-/adapter-grok-0.5.12.tgz"
},
{
"name": "@atape/adapter-kimi",
"integrity": "sha512-sysne93OUKTvMpWkcXaVdyfZoTK6GqHHFwFAb5jjFjXtUQ1sH0qoVJZBZxZjf2ZLIKEuz7GZSTOxqJ1Vg+DG/w==",
"tarball": "https://registry.npmjs.org/@atape/adapter-kimi/-/adapter-kimi-0.5.12.tgz"
},
{
"name": "@atape/adapter-opencode",
"integrity": "sha512-g6ZbiMuzR/4tmuhGfP+w6420+u57K/k6Sap99OPdS1M9wjWhTEQVuQ9f05UnSwqxqazY9xqaQMycWumuNesxRQ==",
"tarball": "https://registry.npmjs.org/@atape/adapter-opencode/-/adapter-opencode-0.5.12.tgz"
},
{
"name": "@atape/cli",
"integrity": "sha512-jAn1iUKbt+eUOgiYN41fEyrFBlLroaWytsJG2+BAguvBUuU+t/En/jqfaYq3CIuz4lAeib1+ht7Zpom586weCQ==",
"tarball": "https://registry.npmjs.org/@atape/cli/-/cli-0.5.12.tgz"
}
],
"updateTargetProtocol": "atape.update-target.v1",
"fromCaptureStateContracts": [
"atape.client.v3-capture.v1",
"atape.client.v3-capture.v2"
]
}