v0.99.5

Documentation

• The public-face slice of the README — hero, value proposition, feature wall,
  at-a-glance, layer map, install, first 60 seconds, trial path, and releases —
  now ships in eight translations under docs/readme/ (simplified Chinese,
  Spanish, Brazilian Portuguese, Japanese, Korean, German, French, and Slovak),
  linked from a language-switcher line at the top of the main README. The
  English README stays canonical: generated blocks (capability snapshot,
  citation) exist only there, each translation ends with a pointer to the full
  English reference, and technical terms plus code identifiers stay in their
  original form. The documentation site build excludes the translated files,
  which live as GitHub-rendered pages only.

Added

• Signed capability cards now ship as an advisory Ed25519 runtime. Separate
  owner-only card keys and explicitly agent/project-scoped trust bundles feed
  strict canonical capability-card keygen|sign|verify verbs plus opt-in worker
  signing and hub verification. Manifests, directories, dashboards, MCP resources,
  and Agent Cards expose explicit valid, unsigned, key/signature/expiry, replay,
  downgrade, binding, digest, and bounded-history results. Unsigned wire behaviour
  stays compatible and verification grants no authority. The bounded in-memory
  history remains the default; an opt-in owner-only SQLite store now preserves
  replay and downgrade floors across hub restarts, rejects corrupt state at startup,
  and projects runtime persistence failure as history_unavailable. Recovery and
  safe-reset instructions ship with it; enforced admission remains separate.

• Grok is now a fully enabled Participant Fabric provider and the fifth
  provider-native file-claim guard. Its parser is pinned to a real stable
  grok 0.2.93 capture of native thought / text / end events, so
  GROK_SCHEMA_VERIFIED is true and participant ask grok no longer carries
  the stale unverified-schema refusal. The small Grok hook adapter feeds
  camelCase PreToolUse events through the shared provider-neutral claim
  engine and emits Grok's top-level deny JSON on exit zero for every handled
  parse, Git, state, transport, timeout, or runtime failure. The printed
  grok-claim-hook recipe covers search_replace and compatibility aliases
  without embedding tokens; public docs retain Grok's host-level fail-open and
  alternate-tool limits. adapters install grok writes the separate
  kebab-case ~/.grok/skills/synapse/SKILL.md contract required by the
  installed CLI, without changing Kimi's distinct skill schema.

• The generic tmux waker's default pane detection now recognises every
  first-class provider binary out of the box: grok and gemini join
  codex/kimi/claude/node in DEFAULT_AGENT_PANE_COMMANDS, so an
  interactive Grok or Gemini pane is detected as a live agent without an
  explicit agent_command override (which continues to union any custom
  binary into the set).

• Gemini CLI becomes the seventh registered participant provider and the fourth
  file-edit claim guard. The guard speaks Gemini's native hook contract —
  BeforeTool event, replace/write_file tool names, tool_input.file_path,
  and a top-level {"decision": "deny", "reason": …} blocking response on exit
  zero — verified against the installed 0.47.0 bundle source, with an anchored
  ^(replace|write_file)$ matcher and a millisecond hook timeout in the printed
  settings.json fragment (synapse adapters gemini-claim-hook). The headless
  driver (gemini -p … -o stream-json --approval-mode plan) parses the CLI's
  init/message/error/result events, and GEMINI_SCHEMA_VERIFIED is true:
  the envelope was behaviourally captured from the installed binary's real
  emitter via the CLI's own --fake-responses-non-strict harness (only the
  model API client is substituted; no account required), with the fixture
  SHA-256-pinned. The schema gate stays wired so turns are refused again should
  a future release change the wire shape. Account-side, OAuth-personal setup
  still fails with IneligibleTierError; live model turns need an API key or
  an eligible account.

• Codex and Kimi now join Claude Code on provider-native, live-claim file-edit
  guards. A shared resolver canonicalises every target against its Git worktree
  and requires exact worktree, branch, path, task-state, and owner coverage;
  Codex extracts all add/update/delete/move paths from one apply_patch, while
  Kimi validates its Edit|Write path shape. New read-only recipe commands emit
  token-file-safe Codex hooks.json and Kimi config.toml fragments, and every
  handled parse, Git, state, transport, timeout, or runtime failure returns
  structured denial on exit zero. Public docs keep Codex alternate-tool and Kimi
  host-level fail-open limitations explicit rather than claiming filesystem
  isolation. The reversible adapter installer also emits valid Kimi Agent Skills
  at user scope (kimi, respecting $KIMI_CODE_HOME) or explicit project scope
  (kimi-project), preserving Kimi's Project-over-User precedence. Skill install
  does not touch config.toml; the opt-in --with-hook / --install-config
  path manages one marked hook block with bounded reads, owner and symlink checks,
  mode-preserving atomic replacement, and compare-before-write refusal.

• Studio now serves pinned, self-hosted Space Grotesk, Inter, and JetBrains
  Mono variable WOFF2 subsets from the package itself. The six Latin and Latin
  Extended files total 217,608 bytes, retain system fallbacks for other scripts,
  carry exact source hashes and OFL-1.1 provenance, and are included in the
  wheel; no browser font request leaves the dashboard origin.

• Dashboard Studio can now authenticate distinct viewer, operator, and
  admin browser principals from a strict owner-only
  --dashboard-access-file. The token-free /dashboard-access.json
  descriptor drives capability-filtered rendering, while every write request
  independently re-resolves its bearer and exact route capability before the
  existing rate-limit, relay, hub ACL, and audit chain. Viewer DOM and command
  search contain no write controls; operator/admin expose only the three
  shipped writes under distinct relay identities, and a live downgrade closes
  write UI, restores command-trigger focus, and announces the change. The
  dependency-free Studio shows a fail-visible role pill and remains read-only.

• Participant ask, exchange, and convene can now opt into bounded,
  token-file-authenticated REMANENTIA recall. The stdlib HTTP adapter binds an
  operator-supplied origin to the fixed /recall path, refuses redirects,
  requires HTTPS outside literal loopback IPs, caps requests, responses,
  tokens, hits, rendering, and elapsed time, and treats every current HTTP hit
  as boundary data because the response omits honesty axes. Recall stays off by
  default; the operator prompt is unchanged, recalled text is fenced as data,
  and unavailable or empty memory remains visible without failing the provider
  turn.

Changed

• The compact relay codec, NDJSON log, byte cursor, and command normaliser now
  live inside synapse_channel.core, removing the kernel's sole upward import.
  The existing synapse_channel.relay path remains a small compatibility
  facade that re-exports the identical objects, so public imports and wire/log
  behaviour do not change.

Fixed

• SECURITY.md now describes signed-capability-card history truthfully: the
  bounded in-memory default, opt-in owner-only SQLite replay/downgrade floors,
  fail-visible history_unavailable result, and advisory no-enforcement boundary
  match the shipped runtime. A documentation-accuracy regression pins the contract.