YHWH v0.15.0 — 运行时质量与宿主验收 / Runtime quality and host verification

YHWH v0.15.0 — Runtime quality and host verification / 运行时质量与宿主验收

中文

本版本将 v0.14.0 之后的工作流改进合入 main：真实宿主验收、T0/T1/T2 门控、官方 Claude CLI reviewer、原字节补丁策略、操作与任务审计结果、Git 构建来源、只读 fixtureScope、新文件父目录、hostEvidence 修复以及运行时预检警告。

完整双语说明：release-notes-0.15.0.md。

下载

• Windows 双击安装：YHWH-OneClick-0.15.0.zip。
• 单脚本安装：Install-YHWH-0.15.0.ps1。
• 完整便携源码包：pi-kether-portable-0.15.0.zip。
• SHA256SUMS.txt、SOURCE_COMMIT.txt 和 release-manifest.json 记录内容哈希、main 来源及打包插件版本。

包不含凭据、本机日志、node_modules 或第三方依赖二进制；安装仍需要网络准备固定依赖。已有服务升级前应结束任务并备份；不单独提供 GUI EXE。

验证与审查

运行时代码392c232在宿主510项测试中508通过、0失败、2既有跳过；原生WSL21/21、零跳过，内存40取消/40断连满足原阈值。此前独立审查记录保留在PR #4/#5；fixture pipeline独立审查通过并已修复意见。最终剩余部分按用户明确授权采用主代理本地审查，非独立审查。没有虚构模型全链路或后续效率统计。

本机运行时代码已升级为0.1.0+392c232a2e95，264托管文件零漂移，真实Luna/Claude CLI探针约9.0/7.3秒；这不代表发布元数据/合并提交已再次部署。最终发布来源与Windows CI见下方自动追加记录。

已知限制

• 自有代码Apache-2.0；第三方组件各自许可证保留。固定pi-lsp-extension1.3.0的完整上游通知适用性仍未确认，公开许可门禁仍拒绝。本次沿用用户此前已明确批准的、单独披露且不捆绑依赖的发布例外，不宣称完整许可审计通过。
• 上游Pi依赖审计尚未完成，现有安装报告的风险未通过自动升级掩盖。PowerShell7是Workflow Verify要求，5.1不支持。
• CLI reviewer在宿主运行，不受worker WSL隔离。通用疑似凭据只提示并要求主代理人工确认，不保证补丁无秘密或覆盖任意编码。
• yhwh_run_check仅为待用户决定的设计，未开放worker执行能力；72小时运行效果比较尚未完成，没有量化提速结论。
• 本机安装器创建新名称计划任务被拒绝；原任务保留、网关已恢复。宿主Codex缓存可能需重新连接。未验证全新Windows虚拟机联网安装。

English

This release merges the work since v0.14.0 into main: genuine host verification, T0/T1/T2 gates, official Claude CLI reviewers, raw-byte patch policy, operation/task audit outcomes, Git build provenance, read-only fixtureScope, scoped new-file parents, canonical hostEvidence resolution and advisory runtime checks.

Full bilingual notes: release-notes-0.15.0.md.

Downloads

• Windows double-click installer: YHWH-OneClick-0.15.0.zip.
• Standalone script: Install-YHWH-0.15.0.ps1.
• Complete portable source package: pi-kether-portable-0.15.0.zip.
• SHA256SUMS.txt, SOURCE_COMMIT.txt and release-manifest.json identify hashes, main source and packaged plugin version.

No credentials, local logs, node_modules or third-party dependency binaries are bundled. Installation still prepares pinned dependencies using the network. Finish existing tasks and back up before upgrading. No separate GUI EXE is supplied.

Verification and review

Runtime392c232: host510tests/508pass/0fail/2existing skips; nativeWSL21/21 with zero skips; memory40cancel/40disconnect with original thresholds passing. Earlier independent reviews are retained inPR #4/#5; the fixture pipeline was independently approved and findings fixed. The remaining final facets use explicitly authorized primary local review, not independent review. No live full model chain or efficiency measurements are fabricated.

The local runtime0.1.0+392c232a2e95 passed zero drift across264managed files and realLuna/Claude CLI probes at about9.0/7.3seconds. Release metadata and the merge commit are not claimed as redeployed locally. Final source identity and Windows CI are appended below.

Known limitations

• First-party code isApache-2.0; dependencies retain their own licenses. The complete upstream notice's applicability to pinnedpi-lsp-extension1.3.0 remains unconfirmed and the public license gate still rejects. This release retains the user's previously approved, explicitly disclosed exception with no bundled dependencies; full license-audit clearance is not claimed.
• UpstreamPi dependency auditing remains open; reported installation risks were not hidden through automatic upgrades. WorkflowVerify requiresPowerShell7;5.1 is unsupported.
• CLI reviewers run on the host outside workerWSL isolation. Generic secret-like patterns are advisory with primary human confirmation, not proof of secret-free patches or arbitrary-encoding coverage.
• yhwh_run_check is design-only, awaiting user decision; no worker executor is enabled. The72-hour measured outcome comparison is pending; no quantified speedup is claimed.
• The local installer was denied creation of a newly named startup task; the original task was preserved and the gateway restored. Codex cache reconnection may be needed. Full online installation in a fresh Windows VM has not been verified.

Build identity / 构建来源

Source main commit: 15e9d3e
Packaged plugin: 0.1.0+15e9d3e154d9; dirty=false.
PR #5 CI: SUCCESS — https://github.com/Yuzu482/YHWH/actions/runs/36858278408
Main CI: https://github.com/Yuzu482/YHWH/actions/runs/36859759682 (SUCCESS / 全部通过，11m57s).

YHWH v0.14.0 — Pi worker 治理与网关控制台 / Governed Pi workers and gateway console

YHWH v0.14.0

中文

YHWH v0.14.0 带来更严格的 Pi worker 执行策略、更清晰的任务交接与协作流程，以及 Windows 安装和网关控制台方面的更新。

主要更新

• 由 YHWH 管理普通 Pi worker 的 strict/off 策略。 支持原生 OpenAI gpt-6-luna；Sonnet reviewer 保留为明确的例外。
• 角色预设与确定性结果提交。 新增 role presets，以及面向 WSL 读取和 workspace 写入任务的 yhwh_submit_result 工具。该工具执行 fail-closed 验证；旧式无访问权限 envelope 仍受支持。
• 类型化交接与阶段连续性。 v2 handoffs 提供类型化任务交接并保留工作流阶段连续性。
• 协作任务包。 支持将工作拆成 2–4 个互不重叠的小型任务包，以便协作执行。
• Electron 网关控制台源码。 提供网关监控与配置控制台源码，并包含独立 Windows 打包支持；此项不代表已发布 GUI 二进制文件。
• Windows 安装与自检修复。 修正 ACL 处理，使其兼容 PowerShell 5.1 和 7.6；同时修复 WSL/LSP 自检问题。

本机验证

以下是本机观察到的检查结果，不等同于全新机器端到端安装验证或发布流水线验证：

• 完整 Node 测试套件：376/376 通过；npm ci 干净完成。
• 更新过时测试 fixture 以使用 gpt-6-luna 后，内存回归测试通过：400 ordinary、40 large、40 cancelled、40 disconnected。
• workflow 配置与 headless 检查通过。
• Electron 源码语法检查及 gateway-console-config 测试：5/5 通过。
• ACL 合成 fixture 和本机真实 Pi ACL helper，在 PowerShell 5.1 与 7.6 下均通过；已安装 Pi 的自检在两个版本下均通过。

尚未重新验证： 全新机器上的完整一键安装，以及 Electron GUI 的实际运行体验。准备源码时 GitHub CI 与新产物尚未核实；最终状态请参阅发布页面及对应 CI，本机检查不能替代这些验证。

分发与许可说明

计划提供带版本号的 YHWH-OneClick ZIP、独立 Install-YHWH PS1、便携 ZIP 及校验和文件。包含 Electron EXE 打包源码，但不承诺发布 GUI 二进制资产。第一方代码采用 Apache-2.0；上游依赖继续遵循各自的许可条款。

普通许可清单检查通过（358 项）。公开仓库许可门禁 node install/license-inventory.mjs --check --public 仍未通过，涉及固定版本 pi-lsp-extension 1.3.0：该版本虽声明 MIT，但缺少完整的许可与版权通知文本。上游于 2026-09-24 在 1.4.0 中新增 MIT LICENSE，但未明确确认其是否适用于已经发布的 1.3.0，因此不能据此认定 1.3.0 的问题已解决，也不应表述为上游从未提供许可。此次公开分发依据用户此前明确授权的例外，并附透明说明；这不构成完整许可合规认证。

English

YHWH v0.14.0 brings stricter execution policy for Pi workers, clearer task handoffs and collaboration workflows, and updates to Windows installation and the gateway console.

Highlights

• YHWH-managed strict/off policy for ordinary Pi workers. Supports native OpenAI gpt-6-luna; the Sonnet reviewer remains an explicit exception.
• Role presets and deterministic result submission. Adds role presets and the yhwh_submit_result tool for WSL read and workspace-write tasks. The tool validates fail-closed; the legacy no-access envelope remains supported.
• Typed handoffs and phase continuity. v2 handoffs provide typed task transfer while preserving workflow phase continuity.
• Cooperative task packs. Work can be divided into 2–4 small, disjoint task packs for cooperative execution.
• Electron gateway console source. Includes source for gateway monitoring and configuration, plus standalone Windows packaging support; this does not mean a GUI binary is released.
• Windows installation and self-test fixes. ACL handling is fixed for PowerShell 5.1 and 7.6, alongside WSL/LSP self-test fixes.

Local verification

These are checks observed locally; they are not equivalent to end-to-end installation on a fresh machine or verification of the release pipeline:

• Full Node test suite: 376/376 passed; npm ci completed cleanly.
• Memory regression passed after updating a stale test fixture to use gpt-6-luna: 400 ordinary, 40 large, 40 cancelled, and 40 disconnected.
• Workflow configuration and headless checks passed.
• Electron source syntax check and gateway-console-config tests: 5/5 passed.
• The ACL synthetic fixture and real local Pi ACL helper passed on PowerShell 5.1 and 7.6; the installed Pi self-test passed on both versions.

Not reverified: the complete one-click installation on a fresh machine and live use of the Electron GUI. At source preparation time, GitHub CI and the new artifacts were unverified; see the release page and corresponding CI for final status. Local checks do not substitute for those verifications.

Distribution and licensing

Planned downloads include a versioned YHWH-OneClick ZIP, standalone Install-YHWH PS1, portable ZIP, and checksum files. Electron EXE packaging source is included, but no GUI binary release asset is promised. First-party code is Apache-2.0; upstream dependencies retain their respective license terms.

The ordinary license inventory passes (358 entries). The public-repository license gate, node install/license-inventory.mjs --check --public, still fails for pinned pi-lsp-extension 1.3.0: the package itself lacked a license notice. Upstream added an MIT LICENSE in 1.4.0 on 2026-09-24, but did not explicitly confirm that it applies to the already published 1.3.0. This does not establish that the 1.3.0 issue is resolved, nor is it accurate to say upstream has never supplied a license. This public distribution uses the user's earlier explicitly authorized exception with transparent notice; it does not certify full license compliance.

发布确认：提交 4444f870b84b0cb229f4951c8d6f59edc33e4c1d 的 Windows CI 已通过；此页附有三个版本化资产、校验和、源码提交标识与便携包构建清单。固定版 LSP 的许可边界参见 上游 Issue #14。

Release verification: Windows CI passed for commit 4444f870b84b0cb229f4951c8d6f59edc33e4c1d. This page includes three versioned assets, checksums, the source commit, and the portable build manifest. See upstream Issue #14 for the pinned LSP licensing boundary.

YHWH v0.13.0 — Windows CI 修正版 / Windows CI corrected build

YHWH v0.13.0 — Windows CI 修正版 / Windows CI corrected build

简体中文 · English

简体中文

2026-09-22 替换发布：标签及附件统一对应提交 1e8cf4033bc92c67f2b65890dd026717b2f9842c。原 v0.13.0 指向 c960d3f8f188cdd2bc09b57c7afbd2c9c7554184；旧下载文件的校验值已失效，请重新下载并核对新 SHA-256。维护者已保留旧资产备份。

• 修复 Windows Get-Acl 调用超时造成的认证持久化失败，改为直接复制 .NET ACL 描述符，保留受保护 DACL、所有者和用户组；复制失败仍拒绝写入并清理临时文件。
• 修复 LF/CRLF 换行差异导致工作流目录被误判为过期的问题，真实内容差异仍会被拒绝。
• 保留 v0.13.0 的分级思考：原生 Luna 默认 medium，主代理按任务显式选择 low/medium/high/max；Sonnet/max reviewer 绑定不变。
• 保留交付与清理预算：从总时限内预留 min(15 秒, 总时限×10%)，并报告 executionBudget。思考、正文和工具活动分别计数，提前交付提示是软约束，不是隐藏推理 token 上限。
• 主代理负责规划、调度、整合与验收，Pi worker 负责源码和测试。双语文档及按需加载的工作流规则继续随包提供。

验证

对应提交 GitHub Windows CI 全部成功：329/329 测试，零失败、零跳过；内存回归、打包与解压验证、128 项一键安装检查及空目标安装计划通过。替换资产从该固定提交重新构建，并再次通过打包和 128 项安装检查。附带 SOURCE_COMMIT.txt 和 SHA256SUMS.txt。

维护者本地 Pi 已完成本次 ACL 修复的定向升级和重启，健康、就绪、Tunnel、已安装源码 ACL 夹具 2/2 以及一次 Luna/low 无工具心跳通过（约 12.9 秒）。本机保留原有适配；这不代表完整安装与所有宿主、语言服务器、机器重启持久性或复杂编码效果均已验收。没有实测证明降低思考档位一定节省 token 或保持同等质量。独立 Claude 复核仍因认证问题未完成。

下载与许可例外

通常下载 YHWH-OneClick-0.13.0.zip，单脚本使用 Install-YHWH-0.13.0.ps1，完整可检查包为 pi-kether-portable-0.13.0.zip。附件不捆绑第三方依赖源码或二进制、依赖目录、CLI、认证信息或本机运行配置；需要的依赖由安装流程下载。

仓库现为公开。自有代码为 Apache-2.0；第三方许可证不变。旧 pi-lsp-extension@1.3.0 的完整上游版权/许可通知仍未取得，上游 Issue #14 为跟进入口。项目的 --public 许可检查仍不通过。本次按维护者明确授权的“不捆绑依赖、单独说明 LSP”例外替换资产；这不是许可缺口已解决或公开再分发已获完整批准的声明。详细范围见包内 THIRD_PARTY.md、docs/lsp-component.md 和许可证证据文件。

English

Replacement published on 2026-09-22: both the tag and assets now identify commit 1e8cf4033bc92c67f2b65890dd026717b2f9842c. The original v0.13.0 pointed to c960d3f8f188cdd2bc09b57c7afbd2c9c7554184. Old download checksums no longer apply; download again and verify the new SHA-256 files. The maintainer retained backups of the original assets.

• Fixed Windows authentication persistence failures caused by a timed-out Get-Acl invocation. Direct .NET descriptor copying preserves protected DACL, owner and group; failures still reject writes and clean temporary files.
• Fixed false stale-workflow errors caused by LF/CRLF differences. Real content drift remains rejected.
• Retains v0.13.0 task-proportional effort: native Luna defaults to medium; the primary explicitly selects low/medium/high/max. Sonnet/max reviewer bindings are unchanged.
• Retains delivery and cleanup budgeting: min(15 seconds, total timeout×10%) is reserved within the original timeout and reported in executionBudget. Thinking, text and tool activity are counted separately. Early-delivery guidance is a soft constraint, not a hidden reasoning-token cap.
• The primary owns planning, scheduling, integration and acceptance; Pi workers author source and tests. Bilingual documentation and on-demand workflow policies remain included.

Verification

Exact-commit GitHub Windows CI passed completely: 329/329 tests, zero failures or skips; memory regression, package/extraction checks, 128 one-click checks and a clean-target installation plan passed. Replacement assets were rebuilt from that fixed commit and passed packaging and all 128 installer checks again. SOURCE_COMMIT.txt and SHA256SUMS.txt are attached.

The maintainer's local Pi received the targeted ACL update and restart. Health, readiness, Tunnel, 2/2 ACL fixture tests using installed source, and one tool-free Luna/low heartbeat passed (about 12.9 seconds). Host adaptations remain in place. This does not establish a complete clean installation, all hosts or language servers, reboot persistence, or complex coding quality. No benchmark establishes that lower effort always saves tokens or preserves equal quality. Independent Claude review remains unavailable because of authentication.

Downloads and licensing exception

Use YHWH-OneClick-0.13.0.zip normally, Install-YHWH-0.13.0.ps1 for a single script, or pi-kether-portable-0.13.0.zip for the inspectable package. Assets do not bundle third-party dependency source/binaries, dependency directories, CLIs, credentials or local runtime configuration. Required dependencies are downloaded during installation.

The repository is now public. First-party code is Apache-2.0; third-party licenses are unchanged. The complete upstream copyright/permission notice for legacy pi-lsp-extension@1.3.0 remains unavailable; follow upstream issue #14. The project's --public license check still fails. This asset replacement follows the maintainer's explicit exception to distribute without bundled dependencies and document LSP separately. It does not claim that the licensing gap or public redistribution review is resolved. See packaged THIRD_PARTY.en.md, docs/lsp-component.en.md and license evidence files for scope.

YHWH v0.12.0 — Coordination, sequential calls and heartbeats

YHWH v0.12.0 — 协调分工、连续调用与心跳 / Coordination, sequential calls and heartbeats

简体中文 · English

简体中文

本版汇总 v0.11.0 之后的两轮功能提交（bee3e54、3c65085），包含此前尚未进入 release 的优化。

• 主代理协调，Luna 编码：Astra 或宿主主模型负责意图、拆分、调度、补丁整合和验收；Pi Luna/max 编写代码、测试及修复。worker 失败不自动回退到主代理编码。保留任务范围、交付来源、结果结构和清理检查。该规则属于宿主指令与审计策略，不是禁用所有客户端编辑工具的技术屏障。
• 严格禁止反复轮询：禁止 Astra 重复查询进度，包括等待后查询、固定时间批次和脚本包装的查询循环。优先使用实际可用的完成等待接口；缺少接口时，等到真实事件、预定截止时间或用户询问再读取必要状态。独立监控界面与本地心跳继续运行；本版没有新增完成事件订阅或自动唤醒 Astra 的接口。
• 无模型监管心跳：异步任务运行后每 10 秒更新一次本地心跳，超过 30 秒未更新视为过期，执行进度单独计时。排队不启动计时器，状态读取不刷新心跳，取消及全部终态停止并冻结，重放不重复创建。现有状态/列表接口提供元数据；未添加界面心跳徽标。modelCalls:0 仅指监管心跳，不证明子进程或远端模型健康，也不触发自动重试、探测或放宽超时。
• 更透明的连续 CLI 调用：HeadlessBatchEvents 显示每项阶段、首次输出、等待、结果及整批汇总。先验证整批输入，再串行执行；失败或取消停止后续任务并保留已有结果。会话内帮助与文件摘要缓存减少重复读取，仍逐次验证完整版本和文件身份，提供缓存与分段耗时证据。不复用模型进程、会话或凭据，也不保证远端推理加速。
• CLI 验收与进程清理：增加显式实机回显和取消验收，以及可选 Windows Job Object 进程树管理。本机历史验收中 Claude 原生取消通过，Codex Job Object 通过、原生清理仍未确认；不自动切换模式。Antigravity 路径留空、默认禁用，实机验收待完成。
• 受管 Pi 升级与回滚：维护暂停、状态、恢复和停止入口；受管文件基线、升级锁、备份校验与日志、冲突拒绝、后台独立重启和失败回滚。WSL 副本、工具链、宿主规则与认证迁移不在定向升级范围；崩溃日志仍需人工核对。
• Git 变更影响候选：结合已暂存、未暂存、未跟踪文件及新鲜的反向相对导入关系，提示知识复核和测试候选。不会自动运行测试、刷新索引或确认知识，不代表完整语义调用图。
• WSL 模型工具隔离：普通模型任务停止自动加载旧 LSP 扩展工具及其生命周期钩子，保留受控 yhwh_lsp_*、读写范围和授权编辑器桥接。直接确定性探针及宿主兼容路径仍保留；不代表旧依赖已彻底移除。

继续保留：项目长期知识、持久化代码关系、多语言确定性 LSP、18 个宿主配置入口、三个可选官方 CLI 主代理入口、受控 API 平台配置和 Windows DPAPI 密钥加密。这些来自此前版本，不重复计为本版新增。

验证与限制

既有专项证据包含协调/路由 45/45、任务拆分组合 51/51、心跳/网关 55/55、实际安装副本 10/10、策略 5/5；这些套件有重叠，不能累加为独立测试数量。版本元数据由 Pi Luna/max 交付，发布前后审查由主代理本地完成，不宣称独立 reviewer 或完整运行时阶段链。最终构建与测试结果见本次 GitHub release 的验证补充和仓库 VERIFICATION.md。

基线提交 3c65085 的 Windows CI 存在 7 项失败：2 项涉及 CI 缺少已安装的 Pi/LSP 入口，5 项涉及认证续期持久化/跨进程夹具。未据此宣称 CI 通过或无凭据环境可完整复现。全新机器安装、重启持久性、所有宿主实机体验与完整治理链不属于本版已完成证据。

维护者本机此前已定向部署心跳和 WSL 工具隔离；这不表示发布包与含本机认证适配的全部运行文件完全相同。创建 release 不会自动升级任何本地服务。

下载与许可

一般安装选择 YHWH-OneClick-0.12.0.zip；单脚本分发选择 Install-YHWH-0.12.0.ps1；检查完整内容选择 pi-kether-portable-0.12.0.zip。核对附带 .sha256、SHA256SUMS.txt 和版本清单。已有安装先备份，按 docs/workflow-operations.md 核查受管升级条件。

本 release 保持在现有私有仓库。自有代码采用 Apache-2.0；第三方许可证不变，旧 pi-lsp-extension 完整上游通知仍待补齐，公开再分发检查仍受限。附件不包含 CLI 二进制、认证文件、主机私有配置、运行日志或 node_modules。

English

This release collects both feature commits since v0.11.0 (bee3e54 and 3c65085), including improvements not previously shipped in a release.

• Primary coordination, Luna implementation: Astra or the host-selected primary owns intent, decomposition, scheduling, patch integration and acceptance. Pi Luna/max authors code, tests and repairs. Worker failure does not silently fall back to primary coding. Scope, provenance, result structure and cleanup checks remain required. This is a host instruction and audit policy, not a technical barrier disabling every client's editing tools.
• Strict no-polling policy: Astra must not repeatedly query progress through sleep/query loops, fixed-interval batches or script-wrapped loops. Prefer an actually available completion wait; otherwise wait until a genuine event, a predeclared deadline or a user request before reading necessary status. Independent monitoring and local heartbeats continue. No completion-event subscription or automatic Astra wakeup interface was added.
• Model-free supervision heartbeats: Running asynchronous tasks receive a local heartbeat every 10 seconds; more than 30 seconds without a beat is stale. Execution progress is tracked separately. Queued tasks have no timer, reads do not refresh beats, cancellation and every terminal path stop/freeze the timer, and replay does not duplicate it. Existing status/list APIs expose metadata; no UI heartbeat badge was added. modelCalls:0 refers only to supervision, not child-process or remote-model health. No automatic retry, probing or relaxed timeout is introduced.
• More transparent sequential CLI calls: HeadlessBatchEvents reports each request's phases, first output, waiting, result and batch summary. Validate all inputs before serial execution; stop later work on failure/cancellation while retaining prior results. Session-local help/digest caches reduce repeated reads while preserving exact version and file-identity checks, with cache and phase timings. Model processes, conversations and credentials are not reused; remote inference acceleration is not guaranteed.
• CLI acceptance and process cleanup: Explicit live echo/cancellation acceptance and optional Windows Job Object process-tree management. Historical local acceptance passed Claude native cancellation and Codex Job Object cleanup; Codex native cleanup remains unverified, with no automatic mode switching. Antigravity stays disabled with an empty path and pending live acceptance.
• Managed Pi upgrades and rollback: Maintenance pause/status/resume/stop, managed-file baselines, upgrade locks, verified backups/journals, conflict rejection, detached restart and rollback on failure. Targeted upgrades exclude WSL copies, toolchains, host policies and authentication migration; crash journals still require manual reconciliation.
• Git change-impact candidates: Combine staged, unstaged and untracked paths with fresh reverse relative-import relationships to suggest knowledge-review and test candidates. This runs no tests, refreshes no index, accepts no knowledge and is not a complete semantic call graph.
• WSL model-tool isolation: Ordinary model tasks no longer automatically load legacy LSP tools and their lifecycle hooks. Controlled yhwh_lsp_*, read/write scopes and authorized editor bridges remain. Direct deterministic probes and host compatibility paths remain; this does not mean the legacy dependency was fully removed.

Retained capabilities include project knowledge, persistent code relationships, multilingual deterministic LSP, 18 host configuration entries, three optional official CLI primary hosts, controlled API-platform configuration and Windows DPAPI key encryption. These shipped earlier and are not counted again as new features.

Validation and limitations

Existing focused evidence includes coordination/routing 45/45, decomposition integration 51/51, heartbeat/gateway 55/55, installed-copy 10/10 and policy 5/5. These suites overlap and must not be added as unique tests. Pi Luna/max delivers version metadata; release pre/post review is local primary review, not an independent reviewer verdict or a complete runtime-attested stage chain. Final build/test results are recorded in this GitHub release's validation addendum and repository VERIFICATION.md.

The baseline 3c65085 Windows CI run has 7 failures: 2 involve missing installed Pi/LSP entries and 5 involve authentication-renewal persistence/cross-process fixtures. Neither passing CI nor complete reproduction on a credential-free host is claimed. Fresh-machine installation, reboot persistence, every host's live experience and a complete governance chain remain outside this release's completed evidence.

The maintainer previously deployed heartbeats and WSL tool isolation locally. That does not establish whole-runtime parity with host-specific authentication adaptations. Publishing a release does not upgrade local services.

Downloads and licensing

Use YHWH-OneClick-0.12.0.zip for normal installation, Install-YHWH-0.12.0.ps1 for single-script distribution, or pi-kether-portable-0.12.0.zip to inspect the full payload. Verify accompanying .sha256, SHA256SUMS.txt and the release manifest. Back up existing installations and check managed-upgrade conditions in docs/workflow-operations.md.

This release remains in the existing private repository. First-party code is Apache-2.0; third-party licenses are unchanged. The complete upstream legacy pi-lsp-extension notice remains pending and public redistribution remains gated. Assets exclude CLI binaries, authentication files, private host configuration, runtime logs and node_modules.

---

最终发布验证 / Final release validation

• 发布提交 / Release commit: 5721495c215c3def1db62edbadad4a5b7e10bd77.
• 本机全量 Node 回归 / Local full Node regression: 320/320, zero failures or skips; heap regression passed.
• 发布构建、安装/配置、DPAPI、许可证清单与插件校验通过；生成安装器 128 项检查通过。Release packaging, installation/configuration, DPAPI, license-inventory and plugin validation passed; generated installer: 128 checks passed.
• 便携 ZIP 内 339/339 文件与本地发布源码逐字节一致；排除路径检查通过。Portable archive: 339/339 files byte-match local release sources; excluded-path checks passed.
• SHA-256 (portable ZIP): 3ed979e7e8ab26acd0541d6306b355a2656b11b1af99ce8ebded29c71f9e7159.
• 8 个附件含三种安装/检查制品、各自校验文件、版本清单及 SHA256SUMS.txt。Eight assets provide three installation/inspection artifacts, their checksums, a version manifest and SHA256SUMS.txt.
• 远端 CI 不是通过状态：基线有 7 项失败；本次仅版本和文档更新，不包含这些失败的修复。Remote CI is not green: the baseline has 7 failures, and this preparation changes only version metadata/documentation, not those failures.

完整版本差异 / Full comparison

YHWH v0.11.0 — Code relationships and headless CLI

YHWH v0.11.0 — 关系记忆与 CLI 无头入口 / Code relationships and headless CLI

简体中文 · English

简体中文

本版新增持久化代码关系记忆，以及 Codex、Claude Code、Antigravity 官方 CLI 的可选无头主代理入口。

• 代码关系记忆：JS/TS/JSX/TSX/Python 文件与符号索引，支持检索、邻接关系及导入影响查询。按源文件哈希增量刷新；过期索引默认拒绝。MCP 查询只读，刷新和限时 watch 由宿主显式执行。语法提及不等于已解析调用。
• 统一 CLI 入口：HeadlessDoctor、HeadlessRun、HeadlessCompare；明确模型与权限策略、精确版本校验、标准输入任务、统一终态、超时/取消/进程树清理。默认全部禁用，认证由各官方 CLI 管理，不改变 Pi 下层角色绑定。
• 一致性与安装检查：比对适配模块、示例配置和治理目录；发布构建增加隔离复制与漂移拒绝测试。不同账号、原生配置和系统环境仍需分别验证。
• 文档与许可材料：完整中英文 README 与语言切换按钮，补充 Tree-sitter/WASM 固定依赖的来源及原始通知。

验证基线：Node 回归 270/270，CLI 专项 11/11，隔离复制/漂移检查、安装与配置检查、许可证清单和内存回归通过；单文件安装器另有 35 项源码检查，发布生成的安装器执行附加解包验证。

证据边界：本机仅核实 Codex 0.153.0、Claude Code 2.1.250 的版本及帮助参数。Antigravity 只有官方协议与本地夹具证据，三个 CLI 均未执行带认证的真实模型测试。全新机器安装、本地服务升级和完整模型治理链不是本次发布证据。关系记忆仅覆盖受支持且已纳入 Git 的普通源文件。

下载：一般用户选择 YHWH-OneClick-0.11.0.zip；单脚本分发使用 Install-YHWH-0.11.0.ps1；检查完整文件使用 pi-kether-portable-0.11.0.zip。核对附带 SHA-256 文件。先备份并停止已有服务，再按安装器升级说明执行；发布不会自动更新本机服务。CLI 设置参考包内 docs/headless-cli.md，关系记忆参考 docs/code-graph.md。

该 release 位于现有私有仓库。自有代码使用 Apache-2.0，第三方许可证不变；旧 pi-lsp-extension 完整上游通知仍按现有记录标为待补齐，公开再分发检查仍保留限制。无 CLI 二进制、凭据、主机私有配置或依赖目录随附件分发。

English

This release adds persistent code relationships and optional official Codex, Claude Code and Antigravity headless primary-host entries.

• Code relationships: file/symbol indexes for JS/TS/JSX/TSX/Python with search, neighbors and import-impact queries. Hash-based incremental refresh and stale-index rejection. MCP queries are read-only; the host explicitly runs refresh or bounded watch. Syntax mentions are not resolved calls.
• Unified CLI entry: HeadlessDoctor, HeadlessRun and HeadlessCompare, explicit models/permission policies, exact version checks, stdin tasks, normalized terminal results, timeout/cancellation and process-tree cleanup. All clients default to disabled; official CLIs retain authentication ownership and Pi lower-role bindings are unchanged.
• Consistency and installation checks: compare adapter modules, example configuration and workflow catalog. Release builds validate an isolated copy and reject drift. Account, native-configuration and OS differences still need separate validation.
• Documentation and notices: complete Chinese/English READMEs with language buttons, plus provenance and original notices for the pinned Tree-sitter/WASM dependency.

Validation baseline: 270/270 Node tests and 11/11 headless-specific tests; isolated-copy/drift, installation/configuration, licensing inventory and heap checks passed. The one-click source has 35 checks; generated release installers receive additional extraction validation.

Evidence limits: only version/help flags were checked on local Codex 0.153.0 and Claude Code 2.1.250. Antigravity has official-protocol and local-fixture evidence only. No authenticated live model test was performed through these three CLI adapters. Clean-machine installation, local-service upgrades and a complete model governance chain are outside this release's evidence. Code indexing covers supported ordinary Git-tracked sources only.

Downloads: use YHWH-OneClick-0.11.0.zip for the normal installer bundle, Install-YHWH-0.11.0.ps1 for single-script distribution, or pi-kether-portable-0.11.0.zip to inspect the complete payload. Verify the accompanying SHA-256 files. Back up and stop existing services before following the installer's upgrade instructions; publishing does not upgrade local services. See packaged docs/headless-cli.md and docs/code-graph.md for configuration.

This release remains in the existing private repository. First-party code is Apache-2.0; third-party licenses are unchanged. The legacy pi-lsp-extension complete upstream notice remains pending in the existing evidence, and the public-redistribution gate remains intact. Attachments exclude CLI binaries, credentials, private host configuration and dependency directories.

Release artifact verification / 发布附件验证

Fresh release build: 270/270 Node tests; 128 generated-installer checks; 314 archive files matched the working sources byte-for-byte. All eight attached assets have local SHA-256 evidence. / 本次完整构建通过 270 项 Node 测试与 128 项生成安装器检查；314 个归档文件与工作源码逐字节一致，8 个附件均有本地 SHA-256 记录。

YHWH v0.10.0 — Project knowledge and Git review

简体中文

YHWH v0.10.0 是现有私有仓库的正式 Release。对应源码提交：ebe7a3a168f3c1af543b4aff2b1edf5d8b4df219。

本次更新

• 增加项目长期知识 .yhwh/memory/<id>.md，保存来源文件、SHA-256、审查日期及草稿/确认/废弃状态。
• 新增只读 project_memory MCP 工具及同实现 CLI，支持中英文检索、单条读取、来源指纹和过期检测。默认检索只返回已确认且来源未变化的知识。
• Git 差异管理分别显示已暂存、未暂存和未跟踪新增内容；支持完整提交 SHA 基准对比。不会自动写知识、确认旧结论、提交或推送。
• 同步按需治理规则、主代理接入提示及完整双语文档。源码包含五条 YHWH 项目知识；安装器分发工具和规则，不将这些项目专属知识复制到其他工作区。
• 保留 v0.9.0 的 multilspy 与 yhwh-pi-lsp 1.6.0，未改变 LSP 后端、模型路由或凭据机制。

下载与安装

推荐下载 YHWH-OneClick-0.10.0.zip，解压并运行 Install-YHWH.cmd。也可使用独立的 Install-YHWH-0.10.0.ps1；完整便携目录为 pi-kether-portable-0.10.0.zip。使用 SHA256SUMS-0.10.0.txt 验证附件。

首次安装仍需 Windows 11 x64、WSL2/虚拟化及网络。知识工具额外要求运行机器已安装 Git，并能从 PATH 找到；安装器不安装 Git。 cwd 须为允许访问的 Git 工作树根目录。已有实例需显式升级；常驻服务应先完成任务再停止升级。纯聊天宿主可以查询或生成提案，落盘仍需有权限的文件编辑工具。

验证与边界

• 完整构建通过 247 项 Node 测试（含 13 项知识专项）、内存回归、凭据设置/DPAPI、插件/规则目录/许可清单检查和 128 项一键安装检查。
• 便携包全部 297 个文件与构建源码逐字节一致；自包含脚本内嵌的 ZIP、双击安装包及 SHA-256 校验文件已核对。
• 维护者本机此前已完成窄范围升级。实际认证 MCP 连接通过五条知识的复核、读取、检索、来源快照、越界拒绝和写操作拒绝；认证、路由及 LSP 配置保持不变。知识操作没有模型调用。
• 源文件指纹一致不证明知识语义正确，也不覆盖未声明的依赖变化。没有后台自动记忆或向量数据库。全新机器完整联网安装、重启持久性及付费模型访问未在本次发布验证；不声称独立模型审查通过。

详见知识管理指南及验证记录。历史文档中的“未发布/未部署”描述属于对应实施阶段，本次是后续单独授权的发布。

许可状态

YHWH 自有代码采用 Apache-2.0；第三方组件保留各自许可证与通知。仍保留的 pi-lsp-extension 1.3.0 上游 MIT 通知缺口在仓库记录中尚未解除，公开发布检查保持阻断；本次仅发布到原私有仓库。见LSP 许可说明。

English

YHWH v0.10.0 is a stable Release in the existing private repository. Source commit: ebe7a3a168f3c1af543b4aff2b1edf5d8b4df219.

Changes

• Adds persistent project knowledge in .yhwh/memory/<id>.md, with source paths, SHA-256 fingerprints, review dates and draft/accepted/deprecated states.
• Adds the read-only project_memory MCP tool and matching CLI for Chinese/English keyword search, individual reads, source snapshots and freshness checks. Default search includes only accepted knowledge with matching sources.
• Separates staged, unstaged and untracked additions during Git review, with optional full-commit-SHA baseline comparison. It never automatically writes knowledge, accepts stale claims, commits or pushes.
• Updates on-demand governance policy, primary-agent integration guidance and complete bilingual documentation. Source control includes five YHWH knowledge entries; installers distribute tooling and policy without copying project-specific knowledge into other workspaces.
• Retains v0.9.0's multilspy and yhwh-pi-lsp 1.6.0 without changing LSP backends, model routes or credential mechanisms.

Download and installation

Download YHWH-OneClick-0.10.0.zip, extract it and run Install-YHWH.cmd. Alternatively use Install-YHWH-0.10.0.ps1; pi-kether-portable-0.10.0.zip contains the full portable directory. Verify assets using SHA256SUMS-0.10.0.txt.

Initial installation still requires Windows 11 x64, WSL2/virtualization and network access. Knowledge operations additionally require Git installed on the runtime machine and available on PATH; the installer does not install Git. cwd must be an allowed Git worktree root. Existing installations need an explicit upgrade; finish active tasks before stopping a persistent service. Chat-only hosts can query or produce proposals, while writing requires an authorized file-capable operator.

Validation and boundaries

• The complete build passed 247 Node tests (including 13 knowledge tests), heap regression, credential setup/DPAPI, plugin/workflow catalog/license inventory validation and 128 one-click installer checks.
• All 297 portable archive files match build sources byte-for-byte. The embedded ZIP in the self-contained script, double-click bundle and SHA-256 sidecars were verified.
• The maintainer previously completed a narrow local deployment. Actual authenticated MCP calls verified five fresh entries, reads, search, source snapshots, out-of-root denial and write-action denial; authentication, routing and LSP settings were preserved. Knowledge operations use no model calls.
• Matching source fingerprints do not prove semantic correctness or unchanged undeclared dependencies. There is no automatic background memory or vector database. Full online installation on a clean machine, reboot persistence and paid model access were not verified in this release; independent model-review approval is not claimed.

See the knowledge guide and verification history. Historical statements that publication/deployment had not occurred describe their implementation stages; this is the separately authorized subsequent release.

Licensing status

YHWH-owned code uses Apache-2.0; third-party components retain their licenses and notices. The retained pi-lsp-extension 1.3.0 MIT notice gap remains unresolved in the repository's evidence record, and the public-release check remains blocked. This release stays in the original private repository. See the LSP licensing record.

YHWH v0.9.0 — 多语言确定性探针 / Multilanguage deterministic probes

简体中文

YHWH v0.9.0 是当前私有仓库的正式 Release，包含 yhwh-pi-lsp 1.6.0。对应提交：57a12b63ff0c0ba849af0a663ac70daf706d00f7。

本次更新

• 接入 multilspy 0.0.15 和自有 Pi 适配插件，提供诊断、悬停、定义、引用、符号、补全及代码操作预览，均可在无模型、无凭据的只读沙箱中执行。
• 增加任务内服务器复用、编辑后失效和自动回收；完善 Python 双后端以及 C/C++、C#、Java 的连续调用与清理性能。
• 新增 Go 1.27.1 / gopls 0.23.0，以及 Rust/rust-analyzer 1.98.1。Go 等待完整拉取诊断；Rust 结合有界 rustc 单文件元数据检查，避免初始空诊断误判。
• 修复 HTTP 测试夹具、输出处理和相关回归问题；同步固定依赖安装脚本、第三方材料、完整双语 README 和语言切换入口。

下载与安装

推荐下载 YHWH-OneClick-0.9.0.zip，解压后运行 Install-YHWH.cmd。也可使用独立的 Install-YHWH-0.9.0.ps1；pi-kether-portable-0.9.0.zip 提供完整便携目录。

使用 SHA256SUMS-0.9.0.txt 核对附件。首次安装需要 Windows 11 x64、WSL2/虚拟化和网络；模型提供商登录仍需用户自行完成。工具链在安装时下载，不包含在附件内。

验证与范围

• 234 项 Node 测试、42 项 Python 协议测试、内存回归和 128 项一键安装检查通过。
• 源码及安装态真实 Pi SDK 检查通过，覆盖七项工具、会话复用、编辑刷新、Go 标准库及 Rust 所有权错误；正式网关 Go/Rust 诊断和两层清理均验证成功，测试未调用模型。
• 便携包全部 293 个文件与构建源码逐字节一致；本机服务已验证适配器 1.6.0。当前发布步骤不会再次升级服务。
• 当前探针范围是单文件快照及可用标准库，不证明完整 Go 模块、Cargo/Maven/Gradle 或多文件工程构建正确。Rust 构建脚本、过程宏和用户程序不执行。完整新机安装、重启持久性及模型自动选择工具未在本次验证。

详见适配器说明及验证记录。包内关于“未提交/未发布”的描述为实施阶段记录，本 Release 是后续单独授权的发布步骤。

许可状态

YHWH 自有代码采用 Apache-2.0，依赖保留各自许可证和通知。兼容/结构工具仍使用 pi-lsp-extension 1.3.0；仓库证据记录的完整上游 MIT 版权通知仍待补齐。私有正式 Release 不替代许可义务，公开发布检查继续阻断。见独立 LSP 说明和许可补齐记录。

English

YHWH v0.9.0 is a stable Release within the existing private repository and includes yhwh-pi-lsp 1.6.0. Source commit: 57a12b63ff0c0ba849af0a663ac70daf706d00f7.

Changes

• Integrates multilspy 0.0.15 and the first-party Pi adapter for diagnostics, hover, definitions, references, symbols, completion and code-action previews, running in credential-free, model-free, read-only sandboxes.
• Adds task-local server reuse, edit invalidation and automatic cleanup, with Python dual backends and improved repeated-call/cleanup behavior for C/C++, C# and Java.
• Adds Go 1.27.1 / gopls 0.23.0 and Rust/rust-analyzer 1.98.1. Go waits for completed pull diagnostics; Rust adds bounded single-file rustc metadata checks so initial empty notifications cannot masquerade as clean results.
• Repairs HTTP test fixtures, output handling and related regressions; updates pinned provisioning, third-party materials, complete bilingual READMEs and language navigation.

Download and installation

Download YHWH-OneClick-0.9.0.zip, extract it and run Install-YHWH.cmd. Alternatively, use Install-YHWH-0.9.0.ps1; pi-kether-portable-0.9.0.zip contains the full portable directory.

Verify assets with SHA256SUMS-0.9.0.txt. Initial installation requires Windows 11 x64, WSL2/virtualization and network access. Provider login remains manual. Toolchains are downloaded during installation rather than bundled in these assets.

Validation and boundaries

• Passed 234 Node tests, 42 Python protocol tests, memory regression checks and 128 one-click installer checks.
• Passed real source and installed Pi SDK checks for all seven tools, reuse, edit refresh, Go standard-library imports and Rust ownership errors. Direct deployed Go/Rust diagnostics and both cleanup layers were verified without model calls.
• All 293 portable archive files match build sources byte-for-byte. The local service was verified with adapter 1.6.0; creating this Release does not upgrade it again.
• Scope remains single-file snapshots and available standard libraries, not complete Go modules, Cargo/Maven/Gradle or multi-file project builds. Rust build scripts, procedural macros and user programs are not executed. Clean-machine installation, reboot persistence and autonomous model tool selection were not verified in this round.

See the adapter guide and verification history. Packaged statements that no commit or release was made describe the implementation stage; this Release is the subsequently authorized publication step.

Licensing status

YHWH-owned code uses Apache-2.0; dependencies retain their own licenses and notices. Compatibility/structural tools still use pi-lsp-extension 1.3.0, whose complete upstream MIT copyright notice remains pending in the repository's evidence record. A stable private Release does not replace licensing obligations; the public-release check remains blocked. See the LSP component disclosure and remediation record.

YHWH v0.8.1 — 正式版 / Release

简体中文

v0.8.1 已由预发布转为私有仓库的正式 Release，并设为 Latest。运行时代码和依赖版本沿用 v0.8.0。

此次仅更新 GitHub 发布状态及说明，标签、源码和 7 个附件保持不变；包内文档的“预发布”措辞保留为构建时记录。仓库仍为私有，公开发布许可检查仍未通过。

本次更新

• 增加独立的 LSP 组件说明，说明功能、安装关系、执行边界及许可证状态。
• 同步中英文 README、第三方通知、上游核查证据和补齐步骤；说明材料包含在便携包和一键安装器内。
• 已提交 上游 Issue #14，请求完整 MIT 通知及 1.3.0 的版本覆盖确认。

LSP 单独说明

现有实现仍依赖 pi-lsp-extension@1.3.0；本次没有重写、移除或禁用该依赖。安装时仍会下载并打补丁。上游声明 MIT，但完整版权与许可通知仍待确认。独立说明和私有正式 Release 不替代许可义务；公开发布检查继续阻断。

下载与验证

下载 YHWH-OneClick-0.8.1.zip 后解压运行 Install-YHWH.cmd，或使用 Install-YHWH-0.8.1.ps1。pi-kether-portable-0.8.1.zip 提供完整便携目录；使用 SHA256SUMS-0.8.1.txt 核对附件。

本次安装包检查 98 项通过；文档本地链接 76 项有效。许可材料一致性、公开发布阻断、配置与安装辅助检查通过，便携包所有文件与源文件逐字节一致。构建使用 -SkipTests：未重新执行网关测试，沿用 v0.8.0 的 202/202 运行时基线。

未进行完整新机安装、语言服务器功能复测、付费模型心跳或线上服务升级。本次发布不修改当前服务或真实密钥，旧版 v0.8.0 资产保持不变。

English

v0.8.1 has been promoted from a prerelease to a regular Release in the private repository and marked Latest. Runtime code and dependency versions remain at the v0.8.0 baseline.

Only GitHub release status and these notes were updated. The tag, source and all 7 assets are unchanged; prerelease wording inside the packaged documentation remains a record of the original build. Repository visibility remains private, and the public-release licensing check has not passed.

Changes

• Added separate LSP component notes covering functionality, installation relationships, execution boundaries and license status.
• Updated both READMEs, third-party notices, upstream audit evidence and remediation steps. The notes are included in the portable archive and one-click installer.
• Submitted upstream issue #14 requesting the complete MIT notice and confirmation of coverage for 1.3.0.

Separate LSP disclosure

The implementation still depends on pi-lsp-extension@1.3.0. This update does not rewrite, remove or disable it; installation still downloads and patches the dependency. Upstream declares MIT, but the complete copyright and permission notice remains pending. Separate documentation and a regular private Release do not replace licensing obligations. The public-release check continues to block.

Download and verification

Extract YHWH-OneClick-0.8.1.zip and run Install-YHWH.cmd, or use Install-YHWH-0.8.1.ps1. pi-kether-portable-0.8.1.zip contains the complete portable directory. Verify assets with SHA256SUMS-0.8.1.txt.

This update passed 98 installer-package checks and 76 local documentation links. Licensing consistency, the public-release hold, configuration and installer-helper checks passed; every portable archive file matches the source byte-for-byte. The build used -SkipTests: gateway tests were not rerun, and the v0.8.0 result of 202/202 remains the earlier runtime baseline.

No full clean-machine installation, language-server feature retest, paid model heartbeat or live upgrade was performed. Publication does not change the current service or real credentials. Existing v0.8.0 assets are preserved.

YHWH v0.8.0 — 首次私有预发布 / First private preview

简体中文

YHWH 的首次私有预发布，版本 v0.8.0。基于 Pi 的治理工作流，主 Agent 保留意图、授权、整合与最终验收职责。

本次内容

• Windows 11 + WSL2 一键安装；18 个主客户端配置，包含 Codex、OpenCode、Claude Code、Cherry Studio 等。
• Worker Luna/max 与 Reviewer Sonnet 5/max；审查者无工具权限，支持异步任务、范围控制、资源限制、结果校验和确定性 LSP。
• OpenCode Go、CommandCode、OpenRouter、自定义 HTTPS API 的可选受控配置，默认路由不变，无自动切换或推理降级。
• Anthropic / 聚合平台 API key 使用 Windows DPAPI CurrentUser 加密，运行时通过私有管道 / FD3 传递；提供旧格式迁移入口。
• YHWH 自有代码采用 Apache-2.0；双语 README、语言切换、开发历史与第三方通知随源码提供。

下载与升级

建议下载 YHWH-OneClick-0.8.0.zip，解压后运行 Install-YHWH.cmd。也可以下载独立 Install-YHWH-0.8.0.ps1。使用 SHA256SUMS-0.8.0.txt 核对附件完整性。pi-kether-portable-0.8.0.zip 为完整便携目录。

升级前停止旧任务并更新配套网关/WSL 文件，再运行安装目录的 Migrate-API-Keys.cmd。迁移不生成明文备份；跨 Windows 用户或机器通常需要重新配置密钥。不要把真实凭据上传到仓库。

验证与已知限制

• 网关回归 202/202，安装包检查 93 项通过。
• 已验证实际 DPAPI 假密钥加解密/迁移与 WSL/Bubblewrap 无网络 FD3 管道；实际 Pi SDK 请求格式经过离线校验。
• 未完成真实平台付费心跳、跨账号 DPAPI、完整干净机器安装和完整线上升级验证。
• 上游 pi-lsp-extension@1.3.0 完整版权通知仍待补齐。私有预发布不表示公共分发门禁已通过；公共发布检查仍保留阻断。完整记录见仓库 THIRD_PARTY.md 和 VERIFICATION.md。
• 本次发布不自动更新当前机器的服务，也不迁移真实密钥。

English

YHWH's first private prerelease, v0.8.0. This Pi-based governed workflow keeps intent, authorization, integration and final acceptance with the primary agent.

Included

• Windows 11 + WSL2 one-click installation and 18 primary-client profiles, including Codex, OpenCode, Claude Code and Cherry Studio.
• Luna/max workers and Sonnet 5/max reviewers; reviewers have no tools. Includes asynchronous tasks, scope/resource controls, result validation and deterministic LSP.
• Optional controlled OpenCode Go, CommandCode, OpenRouter and custom HTTPS API transports; defaults remain unchanged, without automatic switching or reasoning downgrade.
• Windows DPAPI CurrentUser encryption for Anthropic/aggregator API keys, private pipe/FD3 runtime transport and legacy-key migration.
• Apache-2.0 for YHWH-owned code, bilingual READMEs with language navigation, development history and third-party notices.

Download and upgrade

Download YHWH-OneClick-0.8.0.zip, extract and run Install-YHWH.cmd, or use the standalone Install-YHWH-0.8.0.ps1. Verify assets against SHA256SUMS-0.8.0.txt. pi-kether-portable-0.8.0.zip contains the complete portable directory.

Stop old tasks and upgrade matching gateway/WSL files before running Migrate-API-Keys.cmd in the installation directory. Migration creates no plaintext backup. Moving Windows users/machines usually requires re-entering keys. Never upload real credentials.

Verification and known limits

• 202/202 gateway tests and 93 installation-package checks passed.
• Real DPAPI fixture encryption/migration and a no-network WSL/Bubblewrap FD3 probe passed; actual Pi SDK request formats were checked offline.
• Paid platform heartbeats, cross-account DPAPI, a complete clean-machine installation and a full live upgrade remain unverified.
• The complete upstream copyright notice for pi-lsp-extension@1.3.0 remains pending. This private prerelease does not clear public distribution: the public-release gate still blocks. See THIRD_PARTY.en.md and VERIFICATION.md.
• Publishing does not update the current machine's service or migrate real keys.