v0.8.0

Linmas 0.8.0

Security and reliability

Linmas 0.8.0 hardens the boundaries around the review and release workflow:

• filesystem containment, uninstall planning, and cleanup preserve ownership
  and fail closed instead of falling back to unsafe lexical path mutation;
• Proof Chain bundles bind every recorded finding to the validated source and
  decision receipt;
• human-review decisions bind to the process-local review reference and exact
  capsule digest, so a caller cannot substitute an unrelated result;
• credentials, review input, raw provider output, and stderr remain redacted
  at the public error boundary;
• provider failures use an explicit taxonomy with transmission state and
  retryability;
• CLI argument, package-entrypoint, and package-surface validation are strict;
  and
• the Codex isolated launch and filesystem checks preserve their
  platform-specific security contract.

These controls improve reliability and evidence integrity without turning a
policy result or model response into automatic approval.

Breaking MCP request contract

The human-review decision flow no longer accepts a caller-supplied
review_result. In 0.8.0, linmas_review_execute returns a bound
reviewReference containing a process-local handle and the SHA-256
capsuleDigest. Pass those values to linmas_review_decide as
review_handle and capsule_digest. The reference must be used by the same
MCP server process and the digest must match exactly.

Before 0.8.0 (caller-supplied result):

{
  "workspace_root": "/work/linmas-demo",
  "review_result": { "schemaVersion": 1, "findings": [] },
  "decision": { "disposition": "manual_review_required" }
}

After 0.8.0 (bound reference returned by execute, then supplied to decide):

{
  "reviewReference": {
    "handle": "demo-review-handle",
    "capsuleDigest": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
  }
}

{
  "workspace_root": "/work/linmas-demo",
  "review_handle": "demo-review-handle",
  "capsule_digest": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "decision": { "disposition": "manual_review_required" }
}

The handle and digest above are safe synthetic values only. A real caller must
use the values returned by its own linmas_review_execute call. Human review,
transmission consent, and write consent remain separate gates.

Windows contract

• The deterministic/offline workflow and CLI remain supported on Windows.
• Codex isolated launch preparation is supported on Windows with the same
  authenticated-source safeguards.
• Destructive uninstall and cleanup intentionally fail closed on Windows.
• The repository-defined diagnostic is
  SAFE_FILESYSTEM_OPERATION_UNAVAILABLE because Node.js does not provide the
  handle-relative mutation primitive needed to preserve Linmas's
  anti-substitution invariant there.
• Dry-run uninstall remains available and does not mutate data.

0.8.0 does not claim native destructive Windows parity. Use a supported POSIX
environment for destructive cleanup or wait for a separately reviewed native
implementation; do not replace the guard with a path-based fallback.

Upgrade: 0.7.0 → 0.8.0

For the npm CLI:

npm install --global linmas@0.8.0
npx --yes linmas@0.8.0 list

Codex stores a marketplace source and its ref separately. A moving ref such as
main can be refreshed; an immutable ref such as v0.7.0 does not move when
refreshed. marketplace upgrade never repins an existing source, and a second
marketplace add with a different ref is rejected until the old source is
removed. Verify both the configured ref and the installed plugin version before
starting a new task.

A. Existing moving-ref marketplace

If the configured marketplace follows main (or another moving branch), refresh
that same source and then install or re-enable the plugin:

codex plugin marketplace upgrade linmas
codex plugin add linmas@linmas
codex plugin marketplace list --json
codex plugin list --json

The marketplace entry in the configured Codex config.toml should still show
the intended moving ref, and the plugin list should report the installed
release version. marketplace upgrade alone does not update an already cached
plugin. Restart the Codex desktop/app-server and start a fresh task afterward.

B. Existing marketplace pinned to v0.7.0

When codex plugin list --json shows the installed 0.7.0 plugin and the
marketplace is pinned to v0.7.0, remove the installed plugin first, remove the
old marketplace source, and then add the source again with the new immutable
ref:

codex plugin remove linmas@linmas
codex plugin marketplace remove linmas
codex plugin marketplace add TanKimGwan/linmas --ref v0.8.0
codex plugin add linmas@linmas
codex plugin marketplace list --json
codex plugin list --json

Confirm that the [marketplaces.linmas] section in the configured Codex
config.toml contains ref = "v0.8.0" and that the installed
linmas@linmas entry reports version 0.8.0. Do not treat a successful
marketplace upgrade linmas as proof that a pinned ref changed. Restart the
Codex desktop/app-server and start a fresh task after the verification.

Update MCP callers to the bound review_handle/capsule_digest contract before
using linmas_review_decide with 0.8.0.

Rollback

If a release rollback is required, use a reviewed Git revert or pin the npm
package and Codex marketplace to 0.7.0 / v0.7.0, then restart the
Codex desktop/app-server and verify the tools from a fresh task. Do not use a
destructive reset, mix the 0.7.0 caller contract with a 0.8.0 server, or npm
unpublish a release.

v0.7.0

Linmas 0.7.0

Interactive human-review gate

Linmas kini menyediakan linmas_review_decide untuk meminta disposition manusia setelah findings tersedia melalui MCP form elicitation. Host yang mendukung capability tersebut menerima empat pilihan:

• Minta agent memperbaiki findings dan mengulang review.
• Lanjutkan dengan catatan khusus; Critical/High memerlukan risk acknowledgement dan rationale.
• Hentikan task untuk review manual.
• Berikan instruksi custom tanpa melewati consent transmisi, consent write, atau safety gate.

Jika host tidak mendukung MCP elicitation, Linmas mengembalikan pilihan terstruktur untuk ditanyakan melalui chat. Tidak ada pilihan default, auto-approval, provider transmission, atau workspace write dari gate ini.

Kontrak dan upgrade

Tool MCP baru bersifat additive; tools lama tetap tersedia. Hasil tetap membawa humanReviewRequired=true dan reviewState=needs_human_review.

npm install --global linmas@0.7.0
codex plugin marketplace add TanKimGwan/linmas --ref v0.7.0
codex plugin add linmas@linmas
codex plugin list

Setelah upgrade native MCP, restart Codex desktop/app-server dan mulai task baru. Task lama dapat mempertahankan child process atau metadata plugin dari versi sebelumnya.

Verifikasi dan batas keamanan

• Node.js 24 atau lebih baru diperlukan.
• Offline tools tetap read-only dan tidak mengirim data.
• Provider execution tetap memerlukan confirm_transmission=true.
• Critical/High continuation memerlukan risk acknowledgement dan rationale eksplisit.
• Full Access atau --dangerously-skip-permissions tidak dianggap sebagai human disposition.
• Live-provider, native Windows, dan deployment production bukan klaim release ini tanpa verifikasi terpisah.

Rollback

Kembalikan source dengan Git revert dan pin instalasi ke linmas@0.6.0 / --ref v0.6.0, restart app-server, lalu verifikasi tools MCP dari task baru. Jangan gunakan destructive reset atau npm unpublish.

v0.6.0

Linmas 0.6.0

Diagnostik MCP dan provider granular

MCP kini menerima canonical specialist ID dan legacy alias yang sudah didukung resolver Linmas, lalu menormalisasinya sebelum review disiapkan. Error input menampilkan kode dan field yang aman sehingga caller dapat memperbaiki payload tanpa melihat isi review.

Provider-backed review kini menjalankan preflight konfigurasi sebelum payload diproses, membedakan configuration, authentication, rate limit, timeout, transport, upstream, response, dan contract failure, serta mengembalikan state transmisi terakhir secara eksplisit. Credential, source diff, raw provider response, stderr, dan request ID tetap tidak pernah dikembalikan melalui MCP.

Kontrak dan upgrade

Perubahan top-level error code adalah breaking change. Client yang sebelumnya hanya mengenali INVALID_INPUT, PROVIDER_FAILURE, atau TIMEOUT harus diperbarui untuk menggunakan kode granular dan schemaVersion pada envelope error.

npm install --global linmas@0.6.0
codex plugin marketplace add TanKimGwan/linmas --ref v0.6.0
codex plugin add linmas@linmas
codex plugin list

Setelah upgrade native MCP, restart Codex desktop/app-server dan mulai task baru. Task lama dapat mempertahankan child process atau metadata plugin dari versi sebelumnya.

Verifikasi dan batas keamanan

• Node.js 24 atau lebih baru diperlukan.
• Offline tools tetap read-only dan tidak mengirim data.
• Provider execution tetap memerlukan confirm_transmission=true.
• Tidak ada automatic retry; caller menggunakan retryable dan transmissionState untuk menentukan tindakan.
• Live-provider, native Windows, dan deployment production bukan klaim release ini tanpa verifikasi terpisah.

Rollback

Kembalikan source dengan Git revert dan pin instalasi ke linmas@0.5.2 / --ref v0.5.2, restart app-server, lalu verifikasi keenam MCP tools dari task baru. Jangan gunakan destructive reset atau npm unpublish.

v0.5.3

Linmas 0.5.3

Structured provider diagnostics

Provider-backed reviews now preserve a bounded, allowlisted diagnostic envelope through the MCP boundary. When execution fails, callers can identify the failure class, stage, reason code, retryability, provider, and transmission state without receiving raw stderr, causes, credentials, request IDs, or other sensitive provider output.

The diagnostic contract covers Codex and Claude execution, capability discovery, model selection, response reading, normalization, and MCP timeout handling. Successful reviews and the existing consent gates are unchanged; human review remains mandatory.

Upgrade

npm install --global linmas@0.5.3
codex plugin marketplace add TanKimGwan/linmas --ref v0.5.3
codex plugin add linmas@linmas
codex plugin list

After upgrading a native MCP plugin, restart the Codex desktop/app-server and start a fresh task. An existing task may retain a stale child process or cached plugin metadata from an earlier version.

Verification and safety

• Node.js 24 or newer is required.
• Offline tools remain read-only and do not transmit data.
• Provider execution still requires explicit confirm_transmission=true.
• No raw provider diagnostic or credential is exposed through MCP.
• Native Windows and live-provider certification remain outside this release's claim unless separately verified.

Rollback

Pin npm or the Codex marketplace to linmas@0.5.2 / --ref v0.5.2, reinstall, restart the Codex desktop/app-server, and verify the six MCP tools from a fresh task. Source rollback should use a Git revert; do not use a destructive reset. No npm unpublish is required.

v0.5.2

Linmas 0.5.2

Branded Codex plugin experience

Linmas now displays its own logo in the Codex plugin catalog and ships matching icons for all eleven Linmas skills. The public marketplace artifact includes both light and dark plugin branding plus per-skill Codex metadata, so users can identify Linmas consistently in the plugin page and skill list.

Install the stable release from the public marketplace:

codex plugin marketplace add TanKimGwan/linmas --ref v0.5.2
codex plugin add linmas@linmas
codex plugin list

Users already following main can refresh the marketplace and reinstall the plugin:

codex plugin marketplace upgrade linmas
codex plugin add linmas@linmas

After installation or upgrade, restart the Codex desktop/app-server and start a fresh task. An existing task can retain stale MCP child processes or cached plugin metadata from the previous version.

Reproducibility

• package.json remains the canonical version source for the npm package, MCP server, builder output, and marketplace artifact.
• npm run sync:codex-marketplace regenerates the tracked plugin and checks every generated file byte-for-byte in tests.
• Plugin validation covers the manifest, canonical branding assets, all eleven skill icons, and each generated agents/openai.yaml file.
• Windows CI verifies that generated metadata uses repository-canonical line endings.

Safety boundary

This patch changes presentation and distribution metadata only. Linmas remains defensive-only: offline tools do not transmit data, provider execution still requires confirm_transmission=true, proof creation still requires confirm_write=true, and human review remains mandatory.

Rollback

Remove the plugin with codex plugin remove linmas@linmas. To restore the previous stable release, add the marketplace at --ref v0.5.1, reinstall linmas@linmas, restart the Codex desktop/app-server, and verify discovery from a fresh task. Source rollback should use a Git revert rather than a destructive reset.

v0.5.1

Linmas 0.5.1

Public Codex plugin installation

Linmas can now be installed from the public Git repository as a Codex marketplace plugin. The repository tracks a generated plugins/linmas artifact and a marketplace manifest at .agents/plugins/marketplace.json, so Codex does not need to run a build step during installation.

codex plugin marketplace add TanKimGwan/linmas --ref main
codex plugin add linmas@linmas

The installed plugin exposes eleven Linmas skills and six native MCP tools. After installation or upgrade, restart the Codex desktop/app-server and start a fresh task so stale MCP child processes cannot retain an older plugin cache.

Reproducibility

• npm run sync:codex-marketplace rebuilds the tracked public plugin from canonical package, manifest, MCP, runtime, policy, and skill sources.
• Tests compare every tracked plugin file byte-for-byte against a fresh temporary build.
• The plugin validator checks the tracked artifact before release.
• The npm package remains focused on canonical sources and excludes .agents/ and plugins/; npm users can still build a local plugin with npm run build:codex-plugin.

Safety boundary

The marketplace changes distribution only. Offline tools remain local and advisory. linmas_proof_create still requires explicit write confirmation, and linmas_review_execute still requires explicit transmission confirmation. Human review remains mandatory.

Rollback

Remove the marketplace installation with codex plugin remove linmas@linmas. If the marketplace itself is no longer needed, remove it with codex plugin marketplace remove linmas, restart the Codex desktop/app-server, and start a fresh task. Users who need the previous local plugin can rebuild 0.5.0 from the immutable npm or Git release using the documented local builder flow.

v0.5.0

Linmas 0.5.0

Release candidate scope

Linmas 0.5.0 packages the native MCP server and Codex plugin as one bounded release surface. package.json is the canonical version source; the lockfile, generated plugin manifest, MCP serverInfo.version, provider client metadata, builder, tests, and documentation are checked against it. Development cachebusters remain host-artifact metadata and are not part of the canonical version.

Native MCP

• Adds six bounded MCP tools: review preparation, capsule comparison, policy evaluation, proof verification, proof creation, and provider-backed review execution.
• Offline tools do not transmit data. linmas_review_execute requires confirm_transmission=true; linmas_proof_create requires confirm_write=true.
• Every result remains advisory and reports that human review is required.
• Stdio input uses a byte-bounded newline JSON reader that handles fragmented UTF-8, LF/CRLF, multiple messages per chunk, malformed JSON, and deterministic oversized-line rejection.

Packaging and security boundary

• npm pack includes the builder's manifest template and all runtime inputs it needs, including plugin/manifest.template.json and package metadata.
• The packed-artifact test builds a plugin with exactly eleven skills, .mcp.json, mcp/server.mjs, and validates it with validate_plugin.py.
• Provider cancellation uses an abort/deadline signal. Late provider responses are rejected before normalization, policy evaluation, temporary output creation, and atomic final writes. Temporary files and staged proof bundles are cleaned on cancellation.
• Credentials, raw provider responses, request IDs, and sensitive provider diagnostics remain excluded from result output.

Migration

1. Build a fresh plugin directory with npm run build:codex-plugin -- --target /absolute/path/to/plugins/linmas.
2. Run validate_plugin.py against the generated directory.
3. Use the official Codex plugin reinstall/cachebuster flow for development hosts when authorized.
4. Restart the Codex desktop/app-server so any MCP child process using an older or deleted cache is terminated.
5. Start a fresh Codex task before treating plugin discovery as verified. Starting a new task without restarting a stale app-server may continue to reuse the old MCP child process.

Direct stdio verification, plugin-cache verification, and Codex fresh-task discovery are separate claims. The latter requires invocation evidence tied to this exact 0.5.0 artifact.

Known limitations

• Node.js 24 or newer is required.
• Native MCP and direct stdio are verified on Linux. Native Windows MCP is not claimed.
• Live-provider verification is not claimed by this release candidate; offline and injected-fixture paths remain the deterministic verification surface.
• Human review remains mandatory. A policy pass, empty comparison, verified bundle, or successful tool status is not approval, certification, remediation proof, or proof that software is secure.

Rollback

The validated rollback artifact is linmas-0.4.0-reconstructed-rollback.tar.gz, reconstructed from the official linmas@0.4.0 npm package. It contains exactly the eleven skills and an Interactive/Read Codex plugin manifest, with no MCP declaration, apps, or hooks. It is not claimed to be byte-identical to a historical Codex plugin bundle.

Provenance:

• npm package: linmas@0.4.0
• npm registry tarball: https://registry.npmjs.org/linmas/-/linmas-0.4.0.tgz
• npm gitHead: 09d982a484daa121aff238fb575b7af67f6b0ccb
• npm dist.integrity: sha512-wOHw3LEyPmGzA+UtAfYitr8xPcmIoXCaI7ycpOuhv9+C7Gy2+ivy+TCa8UP81xLDyrUbeUQ/F/X6mGYa7AEakw==
• reconstructed archive SHA-256: 13abcd3d8011d9547f7a171a09a04e6e3ab9068f2a6c025ade0a15bbe5e4adca

The binary archive and plugin backup are release assets, not source files, and must remain excluded from the source commit and npm package. Before relying on the archive, obtain the release asset and verify its SHA-256 against the value above.

Rollback procedure:

1. Move the current plugin target to a recoverable backup.
2. Verify the reconstructed archive SHA-256, then restore it as the complete plugin directory so no native-MCP files remain alongside the skills-only tree.
3. Run validate_plugin.py against the restored plugin.
4. Reinstall through the official Codex plugin flow for the configured local marketplace.
5. Restart the Codex desktop/app-server to terminate stale MCP child processes.
6. Start a fresh Codex task and verify discovery of all eleven skills. The rollback artifact intentionally exposes no MCP tools.

Source rollback is performed with a revert commit after the release commit exists; git reset --hard is not part of the rollback procedure.

v0.4.0

Linmas 0.4.0

Proof Chain

• Adds human decision receipts with per-finding dispositions and a derived overall disposition.
• Creates portable offline proof bundles with hashed source evidence, Markdown and HTML reports, and fail-closed verification.
• Adds optional SSH signatures with explicit distinction between cryptographic validity and trusted signer identity.
• Adds a sealed Codex Security adapter that accepts only a completed scan directory with verified manifest, findings, coverage, and artifact hashes.
• Adds an offline npm run demo:proof path for reproducible Build Week judging.

Linmas remains defensive-only. Proof bundles are evidence records, not approvals, certifications, or proof that software is secure. Human review remains required.

v0.3.2

Linmas 0.3.2

Codex compatibility and live evaluation

• Selects the account-visible Codex default model without pinning automatic execution to one GPT generation.
• Adds explicit --model support to the judge demo for reproducible evidence.
• Makes Codex the default live evaluator while retaining explicitly selected Claude compatibility.
• Keeps CI credentials step-scoped and removes request identifiers and raw responses from live reports.

Verification and repository operations

• Adds enforced Node 24 source coverage thresholds: 96% lines, 85% branches, and 94% functions.
• Adds deterministic Windows CI while preserving the required Linux verify check.
• Updates maintained checkout, setup-node, and upload-artifact actions to major v7.
• Creates a protected main-to-dev ancestry sync pull request after promotions when required.

Documentation and branding

• Aligns npm and GitHub positioning around proof-carrying defensive security reviews.
• Replaces the public Linmas logo and preserves the name story, independent-project disclaimer, and Build Week evidence.
• Documents CI-only API-key use separately from subscription-first local Codex authentication.
• Adds a truthful trusted-machine gate for future native Windows live evidence.

Linmas remains defensive-only. Policy output is not approval or proof of security, and human review remains required.

v0.3.1

Linmas 0.3.1

Project identity and npm documentation

• Restores the story behind the Linmas name and its connection to Perlindungan Masyarakat.
• Explains Linmas as a first layer of defense close to everyday builders, while keeping human review authoritative.
• Makes the project's independence and non-government affiliation explicit.
• Preserves the OpenAI Build Week judge demo, live Codex path, Review Capsule contract, and privacy boundaries in the npm README.

This patch updates the documentation shipped with the npm package. It does not change review runtime behavior, weaken safety boundaries, or imply government or OpenAI endorsement. Human review remains required.