v0.2.1 — README proof and a pruned research skill

ResearchForge v0.2.1

Patch release after v0.2.0. Documentation and skills only; no engine behavior or project-format change.

Highlights

• README shows the tracked run. The existing hero and workflow SVGs are now embedded (they were tracked but unused), the duplicated tagline is gone, and a five-sentence text version of the workflow keeps the page readable without images.
• research-forge skill pruned, 544 → 532 lines. Removed one identity line, merged the two rforge search stats homes, deleted the third statement of the screening-before-fetch order and its duplicate command, and replaced the coverage bullet in the verification gate with a pointer to the reporting rule in "Search depth and stopping". Packaged copies stay byte-identical to the canonical skill.
• Compatibility metadata moves to 0.2.1. The five plugin manifests, install.sh and the skill min_rforge_version now require engine 0.2.1. An 0.2.0 engine is rejected by the skill compatibility check and by the installer.

TDD receipt

• make check — pass (Go 1.26.10)
• make vuln — No vulnerabilities found for this code (Go 1.26.10)
• GitHub CI (make ci) — pass on 9b4c74b; Playwright e2e — pass
• RFORGE_RELEASE_VERSION=v0.2.1 go test ./internal/docs -run '^TestPassivePluginConformance$' — pass
• python3 -B -m unittest discover -s adapters -p test_hermes.py — pass
• node --test adapters/test — 15 pass, 0 fail
• README audit script — pass (2 images)
• go vet ./..., git diff --check — pass

License approval receipt

• make license-decision-live-audit
• make license-decision-approval-gate reports approved:true
• License SPDX identifier: MIT
• Copyright holder: Trebuchet Dynamics
• Approved by: XelHaku (repository owner)
• Approval date: 2026-06-13

Compatibility

• Project schema: 1 (unchanged)
• Lockfile schema: 1 (unchanged)
• Plugin manifests and install.sh require engine 0.2.1.

Known limitations

• Live source smoke tests stay opt-in (RFORGE_RUN_LIVE_SOURCE_SMOKE=1).
• The R/metafor integration test stays opt-in (RFORGE_RUN_R_METAFOR_INTEGRATION=1).
• make ci reports Go standard-library advisories on the pinned toolchain go1.26.6; the gates above ran on Go 1.26.10, which CI also resolves to.
• install-script-smoke needs each host CLI to answer. A broken local host wrapper fails that step on the release machine; CI runs it clean.

Install

curl -fsSL https://raw.githubusercontent.com/TrebuchetDynamics/research-forge/main/install.sh | sh
# or
go install github.com/TrebuchetDynamics/research-forge/cmd/rforge@v0.2.1

v0.2.0 — installer, plugins, provenance levels and resumable jobs

ResearchForge v0.2.0

First minor release after v0.1.21. 365 commits. No project-format change.

Highlights

• Installer and plugins: one user-scope installer for the engine, skills and hosts; passive cross-host plugin packaging (Claude, Codex, Pi, Hermes); explicit per-host research workflow commands; compatibility-checked MCP tools per host; rforge capabilities reports engine contracts so a host can check compatibility before work starts.
• Search and jobs: depth budgets with structured stop reasons; persisted, resumable search jobs; screening queue export/import improvements; single decode path for search stats.
• Provenance and claims: provenance levels computed from checksummed engine runs; deterministic evidence-facet checks and citation scoring; claim exports guarded by facets.
• Sources and parsing: optional OpenAlex API key; date-capped Europe PMC, Crossref and Semantic Scholar recording for benchmarks; parser adapters with arbitration, comparison and quality reports.
• Meta-analysis: meta-regression, subgroup, publication-bias, sensitivity and estimator-comparison runs.
• Benchmarks: blinded paired agent-tier protocol; locked engine replay with opt-in recording; keyless pool A plans on Europe PMC and Crossref.
• Citations: explicitly unscreened local bibliography builds.
• Internal: the sources, parsing and analysis packages are split by responsibility behind compatibility facades. No caller import path changed.
• Fixes: neutral batch-resume summary; malformed report JSONL is rejected; briefs fail on unreadable results; overlap counts only real overlap; short brief timestamps render safely; duplicate comparison labels are rejected before I/O; BOM'd CSV headers import; checkpoint read races retry.

TDD receipt

• make check — pass (Go 1.26.10, tree 058c7f2)
• make vuln — No vulnerabilities found for this code (Go 1.26.10)
• GitHub CI (make ci) — pass on 41be472
• RFORGE_RELEASE_VERSION=v0.2.0 go test ./internal/docs -run '^TestPassivePluginConformance$' — pass
• python3 -B -m unittest discover -s adapters -p test_hermes.py — pass
• go vet ./..., git diff --check — pass

License approval receipt

• make license-decision-live-audit
• make license-decision-approval-gate reports approved:true
• License SPDX identifier: MIT
• Copyright holder: Trebuchet Dynamics
• Approved by: XelHaku (repository owner)
• Approval date: 2026-06-13

Compatibility

• Project schema: 1 (unchanged)
• Lockfile schema: 1 (unchanged)
• Plugin manifests and install.sh now require engine 0.2.0. An older engine is rejected by the skill compatibility check and by the installer.

Known limitations

• Live source smoke tests stay opt-in (RFORGE_RUN_LIVE_SOURCE_SMOKE=1) and are not part of CI.
• The R/metafor integration test stays opt-in (RFORGE_RUN_R_METAFOR_INTEGRATION=1); FakeRunner coverage is the default.
• make ci reports Go standard-library advisories on Go 1.26.6. CI uses the latest 1.26 patch; the gates above ran on Go 1.26.10.
• install-script-smoke needs each host CLI to answer. A broken local host wrapper fails that step on the release machine; CI runs it clean.

Install

curl -fsSL https://raw.githubusercontent.com/TrebuchetDynamics/research-forge/main/install.sh | sh
# or
go install github.com/TrebuchetDynamics/research-forge/cmd/rforge@v0.2.0

v0.1.21 — Unified paper library workspaces

What's new in v0.1.21

Patch release focused on making ResearchForge's local library useful as a daily reading workspace.

Unified paper library workspaces

• Adds stable, deterministic opaque record IDs with backward-compatible migration for existing project libraries.
• Expands /library rows with authors, year, venue, collections, tags, and PDF/parsed-text status.
• Adds canonical read-only /library/{id} workspaces that join metadata, notes, parsed passages, and available local PDFs.
• Adds /library/{id}/pdf and redirects matched legacy /papers/{id} links while preserving unmatched parsed-paper views.

Documentation and release health

• Refreshes the README around the evidence-first workflow and restores decision-gate/license references required by release validation.
• Keeps the CLI and project-local files authoritative; the web workspace remains a read-only navigation layer.

Validation receipts

• Clean committed-tree make ci passed on Go 1.26.6.
• GitHub CI and Playwright end-to-end workflows passed for release commit a9f939c.
• make license-decision-live-audit and make license-decision-approval-gate reported approved:true.
• Cross-platform artifacts were built from tag v0.1.21; SHA-256 verification passed.

License approval receipt

• License SPDX identifier: MIT
• Copyright holder: Trebuchet Dynamics
• Approved by: XelHaku (repository owner)
• Approval date: 2026-06-13

Compatibility

• Project schema: backward compatible; legacy library records receive deterministic persisted IDs when opened through the library store.
• Lockfile schema: unchanged.

Known limitations

• Paper workspaces are read-only in this release; collection/tag editing and passage-linked user annotations remain future work.

v0.1.20 — CI toolchain fixes and DeepSeek Harness skill install

What's new in v0.1.20

Patch release focused on CI/toolchain health and skill distribution.

CI & developer workflow

• Bump Go toolchain to 1.26.6 — clears govulncheck reporting 7 Go standard-library CVEs (GO-2026-6218/6091/6090/6089/6088/5972/5026) on go1.26.5. Restores a green make ci / CI gate on main.
• Pre-commit hook now runs the lighter make check locally; the heavy vuln + install/inventory targets move to CI. Faster local commits, same safety net.
• make vuln prints verbose traces (govulncheck -show verbose) for clearer failure output.

Skill distribution

• The research-forge skill is now installable for DeepSeek Harness via the shared ~/.agents/skills/research-forge/ root, alongside the existing Claude/Codex install — one harness-agnostic skill body, no fork.

v0.1.19 — More reliable batch search and source connectors

• Redesign the README around the evidence workflow.
• Fix batch search DOI counting, raw TSV output, source validation, credential skips, and failure accounting.
• Tolerate source API schema drift across CORE, eLife, OpenAIRE, and OSTI.
• Treat PubChem and zbMATH not-found responses as empty results.

v0.1.18 — safer research persistence and resumable search

• Fix Playwright e2e installer after upstream driver CDN retirement
• Adopt provenance schema v1 in the research skill
• Add rforge provenance validate for versioned research provenance
• Distinguish expected no-OA-copy results from download failures
• Add rforge search refresh with DOI new/unchanged/gone deltas
• Add rforge search resume --dry-run
• Add an evidence-backed rforge usage improvement study
• Surface the Semantic Scholar API key gap in rforge doctor
• Harden CLI and web UI commands against unsafe writes and store errors
• Harden domain outputs and provenance events
• Harden persistence with transactional, symlink-safe writes
• Add path-traversal and shareability-leak validation
• Add the filetxn transactional file-write package
• Consolidate the local and GitHub CI gate behind make ci

v0.1.17 — Research robustness and Playwright CI

• Pin Playwright e2e to available driver
• Tune research skill source defaults
• Skip malformed source records during normalization

v0.1.16 — Playwright CI and research defaults

• Fix Playwright e2e browser install
• Default rforge research to comprehensive

v0.1.15 — Validation and reliability fixes

• Fix Obsidian CLI launch tests
• Strengthen local validation gate
• Fix ApplyIdentityDecision silently deleting unrelated library records
• Fix screening stopping criteria always reporting recall target reached
• Fix search batch/resume silently swallowing results file Close errors
• Fix Append() silently swallowing provenance log Close errors
• Fix copyIfExists silently swallowing package file Close errors
• Fix backupBeforeMigrations silently swallowing backup Close errors
• Fix Archive() silently swallowing tar/file Close errors
• Remove dead code flagged by staticcheck unused checker

v0.1.14 — Ignore generated Obsidian vault output

What's new

• Added /research/vault/ to .gitignore — the directory generated by rforge vault build is now excluded from version control as it is a local generated artifact.

Commits

• bfec454 Ignore research/vault/ — generated Obsidian vault output