v0.60.3

Fixed

• Accept Kiro CLI 2.35+/2.36.0 additions: the documented app.warnOnElevatedPrivileges boolean setting joins the KR-SET-005 known-key list, and the Kiro-written approve-for-me policy preset joins KR-PM-006's valid presets.
• Accept OpenCode 2 v2.2.5's percentage form of compaction.buffer (a string such as "20%", from 1% up to but not including 100%) when the file targets OpenCode 2; OpenCode 1 keeps the integer-only contract.

Changed

• Review Antigravity CLI 1.4.12 (via agy changelog and the published schemas, both byte-identical), Kiro 2.35.2 superseded by 2.36.0, OpenCode 2 v2.2.5 and the five changed spec sources from the drift sentinel; refresh all five spec baseline hashes and CC-SK-028's reworded vendor quote. No Claude Code or MCP rule-bearing change was needed.

Fixed

• Correct the package and editor READMEs: the agnix-core validate_project_rules example now compiles, the Zed .agnix.toml example uses valid keys, npm and Homebrew are no longer listed as agnix-lsp installs, the Zed rule count and the npm and CLI command lists match the binary, and the Neovim link points at editors/neovim.

Changed

• Show the sponsor note as a centered badge in the README.
• Update similar to 3.2.1, rmcp to 3.8.0, tokio to 1.54.1, notify to 8.2.1 and ignore to 0.4.34.
• Refresh CodeQL, Python, Java, Claude Code and installer actions, keeping the workflow pin reference in sync.

Security

• Clear new npm advisories in the website and VS Code extension dependencies: follow-redirects 1.16.2 (GHSA-mrwp-f3q8-3g9p), joi 17.13.9 (GHSA-4528-x5fx-h6hg), minimatch 11.0.3 (GHSA-g3hv-75wg-m249) and glob 14.0.3 (GHSA-3g3m-2fjr-6pw4).