v0.2.0

Added

• cline, goose, and windsurf adapters — each ships an AGENTS.md mapped
  to the tool's native model controls (Cline Plan/Act, Goose /plan planner
  model, Windsurf per-message model picker) — plus their install.sh cases.
  Built by dogfooding TierDecay on itself; the real routing ledger from that
  session is in examples/self-build/.

• cursor adapter — ships an AGENTS.md Cursor reads natively at the repo root
  and in nested subdirectories (or a Project Rule at .cursor/rules/tierdecay.mdc
  with alwaysApply: true), mapping tiers onto Cursor's per-conversation /
  per-surface model picker (Agent/Ask/Plan modes). Adds an install.sh case,
  .cursor/ auto-detection, and CI matrix + conformance coverage.

• install.sh flags: --help, --version, --dry-run (preview every write),
  --uninstall (removes context files, never touches learned state).

• Non-native installs now ship the full spec as .tierdecay/PROTOCOL.md, so
  class-signature discipline and the §5 invariants travel with every adapter.

• CI: an install-matrix job (ubuntu + macos × 8 targets) asserting install
  and idempotent re-install (learned state must survive); a conformance
  job (120-line caps, adapter↔installer parity, normative-token presence in
  every non-native adapter); an offline docs job (mermaid fence balance,
  internal link resolution); a release.yml workflow guarding
  tag↔CHANGELOG↔CITATION coherence; dependabot.yml for actions updates.

• Claude Code adapter: a PreToolUse guard hook
  (.claude/hooks/tierdecay-guard.sh) wired into both executors' frontmatter
  blocks executor calls referencing .claude/ or .tierdecay/ at the tool
  layer (Write/Edit/MultiEdit/NotebookEdit/Bash).

• core/MODELS.md — the single source of truth for tier→model bindings, and the
  only file in the tree allowed to name a model version. Installed to every
  target as .tierdecay/MODELS.md. A new model release is now a one-row edit
  here instead of a sweep across adapters, skills, and agent descriptions.

• CI conformance: a guard that fails the build if a versioned model string
  (claude-opus-5, Sonnet 4.6, …) appears anywhere outside core/MODELS.md,
  the changelog, or a historical ledger. This is the mechanism that keeps the
  tree from going stale at the next release; it caught a stale placeholder in
  the bug-report template on its first run.

• CI is now reusable by the release workflow, runs the installer, routing, and
  guard regression suites, and Shellchecks every shell script in the tree.

Changed

• Model bindings are now expressed as tiers + provider aliases, never version
  numbers. Adapters, skills, and agent descriptions name roles (frontier /
  strong workhorse / fast / cheapest) and bind through the opus, sonnet,
  and haiku aliases, which resolve to the latest model in each family at
  session start — so a new release is picked up with no edit. Current bindings:
  Claude Opus 5 (T3 and T2), Claude Sonnet 5 (T1), and Claude Haiku 4.5 (T0).
  examples/self-build/ keeps the model names that session actually ran on —
  it is a historical record, not a live binding.
• install.sh rewritten around non-destructive copy_safe/copy_tree
  helpers: one collision policy everywhere (sidecar *.tierdecay, pending
  sidecars preserved), no reliance on cp -n semantics.
• detect() now reads project signals (.claude/, .cursor/, .clinerules/,
  .windsurf/, .goosehints, GEMINI.md, CONVENTIONS.md, AGENTS.md)
  before machine-global binaries, and can resolve cursor/cline/goose/windsurf.
• SPEC: PROBE now explicitly outranks PRIORS while a live entry exists, and a
  downgrade rewrites the entry's provenance — the T3→T2→T1 iteration has an
  operational path; escalation trigger (2 failed acceptance runs = 1
  escalation) defined; ≤400 words recon cap and keep last 50 ledger
  retention lifted into the spec.
• All 6 non-native adapters now carry invariant §5.2 (quarantine on ANY
  acceptance failure), the escalation trigger, class-signature discipline, the
  any axis maxed → T3 clause, and the full APPROVE / APPROVE-WITH-NITS /
  BLOCK verdict vocabulary.
• Cline adapter: T0 recon explicitly assigned to Plan mode (read-only safety
  over model cost), resolving the tier-map contradiction.
• Release publication now requires the tagged commit to pass the full CI,
  validates strict SemVer and ancestry from main, and remains a draft until
  its archive and SHA256SUMS assets have both been attached and verified.
• All actions/checkout uses are pinned to an immutable commit SHA.

Deprecated

Removed

Security

• Claude Code adapter: SPEC §5 invariant 1 ("only the orchestrator writes
  state") is now enforced at the tool layer, not just in the prompt —
  executor and heavy-executor carry a PreToolUse guard hook
  (.claude/hooks/tierdecay-guard.sh) that blocks their calls referencing
  .claude/ or .tierdecay/, and settings.json ask-gates all remaining
  state writes behind human approval. CI verifies the guard's behaviour.
• README/SECURITY.md: the anti-poisoning FAQ no longer claims impossibility
  ("it can't write") — defenses are documented as explicit layers (protocol,
  tool-layer enforcement, human review) with the residual risk stated.
• SECURITY.md: new "Distribution and shared-repo surface" section — install
  from tagged releases verified against the SHA256SUMS asset (shipped from
  v0.1.0), and an explicit commit-vs-ignore policy choice for shared
  .tierdecay/ state (a committed playbook is a shared attack surface;
  review its diffs like code).

Fixed

• Guard hook false positives: the PreToolUse guard judged the entire
  tool payload, so any legitimate write whose content merely mentioned
  .claude/ or .tierdecay/ was blocked — including adding .tierdecay/ to
  .gitignore, the exact choice SECURITY.md recommends. File tools are now
  judged by their target path only; Bash is still judged by its command
  string. CI carries the false-positive regressions.
• release.yml now builds the release archive and its SHA256SUMS
  (sha256sum -c compatible, same format as the v0.1.0 assets) so future
  releases keep the verification contract documented in SECURITY.md, and
  guards that install.sh's VERSION constant matches the tag.
• Adapter READMEs showed a copy-pasteable install command
  (../../install.sh <target>) that fails from the repo being equipped;
  aligned on /path/to/tierdecay/install.sh <target>.
• install.sh could destroy learned state: the claude target's
  cp -rn … || cp -r … fallback silently overwrote an existing .claude/
  (routing ledger and playbook included) on GNU coreutils ≥ 9.2, where cp -n
  exits non-zero when skipping. Replaced with a guarded per-file walk through
  copy_safe — existing files are always preserved and a differing incoming
  version lands as a .tierdecay sidecar; regression-tested in CI (idempotence
  test + full install matrix).
• Quick-start commands no longer cd into the checkout (which guaranteed the
  installer's self-install guard would abort) and now list all 8 targets.
• CI "Every adapter is complete" check was vacuous (the *.md glob matched
  README.md itself); it now excludes the README and actually fails on a
  missing context file.
• adapter_request.yml: unquoted - Yes parsed as a YAML boolean, breaking
  the dropdown; quoted. Bug-report dropdown now lists all adapters.
• examples/self-build/playbook.md made SPEC-conformant (provenance rewritten
  to T1, hit counter reset after downgrade).
• Docs no longer call the Bash installer "POSIX".