AOCI-CODE v0.1.0-rc5

AOCI-CODE v0.1.0-rc5 is built from 1bf1d28f32226298f72a351a8f6fa4e3d0242889.

• Stop treating a line-ending rewrite as a reason to stop governing a
  repository. internal/volumegovernance compared formal Volumes by raw
  SHA-256, making it the one consumer in the repository that bypassed
  baseline.EquivalentFingerprints — the function whose own contract declares
  it the single entry point for that judgement — and therefore the one place
  that ignored line_ending_tolerance, which defaults to true. core.autocrlf
  is the Git for Windows default, so an ordinary Windows checkout rewrote every
  Volume and hard-blocked the Guide over a difference the team policy already
  calls equivalent, while identical rewrites of business sources stayed
  authorable. Such a difference is now reported as
  code_volume_line_ending_only (with root_, meta_, and database_
  siblings) carrying the repair, and does not block.
• Refuse a scan that would publish a Baseline without the Volumes it governs.
  Scan takes its inventory from Git, so a formal cognition asset covered by
  .gitignore, .git/info/exclude, or core.excludesFile was silently absent
  from the Baseline; the repository then failed far away on a blocked Guide that
  named neither the rule nor the file. The refusal names both, and --dry-run
  reports it rather than promising a scan that would fail.
• Report Root and Meta drift. Nothing checked them, so a repository was aligned
  according to Verify and Guide while every Scope Change refused over the same
  bytes, and only one of those authorities named a file. Both now use the
  vocabulary the Code and Database Volumes already use, under the same condition
  a Scope Change refuses on.
• Give new repositories the line-ending protection AOCI applies to itself.
  init writes a .gitattributes normalizing text to LF, and never rewrites an
  existing one.
• Say when the base Go toolchain is older than go.mod requires, instead of
  reporting it as a supply-chain fault. The licenses and
  opengauss-connector gates pin GOTOOLCHAIN=local so the audit reports one
  Go identity, and under that pin an older base install stops them — but
  check-opengauss-connector.sh wraps every go mod download failure into
  "could not download the pinned upstream module", so a base install one patch
  behind read as a compromised or unreachable upstream. make full now
  compares the base toolchain against the go directive first and, when it is
  older, names both versions, explains why a plain go version can disagree,
  and offers either installing the newer Go or pointing GO_BIN at one already
  on the machine. The comparison is >=, so a newer base install is never
  blocked.
• Show the confirmation prompt before the phrase is read, not after the command
  has exited. The library entry point buffers both writers into memory and
  flushes them once Execute returns, so every TTY digest confirmation wrote its
  prompt into a buffer and then blocked on stdin with nothing on screen. The
  prompt carries the exact phrase the operator has to type, so the one thing
  they needed was the one thing they could not see: they typed blind or gave up,
  and the phrase appeared only alongside the failure. The prompt now goes
  straight to the process stderr the confirmed branch has already proven is a
  terminal. Every scope approve, scope safety approve, baseline scope approve, cognition bootstrap, and cognition migration confirmation is
  affected.
• Let an approval land in a file instead of being carried by hand. scope approve, scope safety approve, and baseline scope approve take
  --out-file, so the artifact scope apply --approval-file needs is written
  where it is wanted rather than printed to stdout for the operator to
  redirect. Forgetting that redirect silently discarded a confirmation that
  cannot be reused. The path is checked before the human is asked, so a bad
  path never costs a confirmation; the file is created only when nothing is
  already there, and is readable by its owner alone, because until the change is
  applied anything that can read it can stand in for the human who typed the
  phrase.
• Give a Managed Scope posture relaxation the reviewer it always needed. Auto
  authorization correctly refuses to let a posture ratify its own weakening, but
  refusing was only half the contract: interaction_required was derived from
  the weaker desired mode, so desiring auto also decided that no reviewer was
  needed and the blocked change had no approver at all. Once left, auto could
  not be re-entered by any governed path. A relaxation now reports
  interaction_required and is authorized under the posture the current
  Baseline receipt proves, so exactly one scope approve ratifies it while
  policy_bound_auto still refuses it and ordinary auto plans stay fully
  automatic.
• Stop counting a deleted file's stale Baseline record as a cognition coverage
  reduction. A path the current Safe Inventory no longer sees has neither an
  Entry nor source bytes left to lose, so retiring its record is bookkeeping;
  excluded paths remain in the evaluation, so an existing source that still owes
  an Entry is unaffected and keeps raising P1. Previously one such record — a
  file deleted three weeks earlier — forced a pure policy change to high risk and
  demanded a human approval that protected nothing.
• Say what a Managed Scope confirmation actually approves. The prompt now leads
  with the effects that matter — cognition Entries removed, files losing Index
  coverage, a weakened posture, a relaxed budget, high-risk content admitted —
  and states plainly when a change carries none of them. A confirmation phrase
  binds the approval to one exact plan; it was never meant to be the only thing
  the approver could read.
• Index the three MCP black-box harnesses. They are executable contracts run by
  name with their own preconditions, which is exactly what the admission rule
  admits, and each Entry now carries the precondition a reader needs: conformance
  expects an established repository and zero formal writes, scenarios writes only
  disposable fixtures, and lifecycle needs Docker for the database suite while
  repo-c reaches aligned without drift. The earlier exclusion rested on a wrong
  cost model — an Entry is about 110 tokens of FRAS, never the Python body — so
  its recorded reason is corrected rather than deleted. Three Entries cost about
  700 tokens against a 120k target.
• Managed Scope approval mode is now review: applying the harness change
  required independent human review, because any Scope Change re-evaluates every
  role and a Baseline record for a file deleted in 82120db therefore appears as
  a coverage reduction. Policy-bound auto authorization correctly refused it.
• State the repository's verification obligations and its Whole-Index admission
  rule in AGENTS.md, where every Agent session reads them. The gate table maps
  a kind of change to the gate that actually covers it, and it records the fact
  no gate output carries: clean-room-smoke, licenses, race, vuln, and
  database-integration run only under make full, so a green make fast
  proves nothing about them. The admission rule states that a test earns an
  Entry only when it is an executable contract run by name with its own
  preconditions; ordinary package tests stay observe, and a test that locks a
  fact is recorded in the locked object's S. A cross-layer test now fails when
  any *_test.go acquires an Entry and when either rule is dropped from
  AGENTS.md.
• Have aoci init add the agent host configuration it just wrote to the
  repository's .gitignore. Those files carry machine-bound absolute paths, and
  a committed copy silently no-ops another machine's init because every
  installer detects an existing entry by key presence. The timing is what made
  this worth fixing in init rather than in prose: Managed Scope roles are fixed
  by the first scan, scan --force cannot advance them, and removing a path
  afterwards is a coverage reduction that needs an approved Scope Change — so a
  default init then scan used to leave a machine-bound file as a permanent
  authoring target. init appends under its own marked block, never rewrites
  maintainer content, skips any path Git already tracks, and does nothing when no
  host configuration was written.
• Split the one-step setup instruction in both public READMEs into the two turns
  it always was. The index is authored through AOCI's MCP tools, and the server
  init writes is not loaded in the session that wrote it, so the old single
  prompt asked the Agent to finish work it could not reach. The first
  instruction now runs init and scan, asks for any configuration a host does
  not write itself, and stops with an explicit restart hand-off; the second
  confirms the MCP server and builds the index. scan, which establishes the
  Baseline every later step needs, was missing from the one-step path entirely.
• Say in both READMEs how to tell which AOCI a host is actually connected to:
  cognition_receipt.mcp_service_version and runtime_repository_root from any
  Overview check_only response or any Maintain response, and the command in
  the project's .mcp.json or the equivalent host configuration for the binary
  path. Replacing bytes on disk does not change a running MCP process.
• Carry the aoci scope acknowledge remediation in a blocked Volumes Guide whose
  Observe evidence is pending review. observe_change_policy defaults to
  review_required, so an ordinary edit to any Observe-role file blocks
  authoring; the Legacy Plan already routed that state to acknowledgement, while
  the Volumes Guide reported a bare observed_pending finding with no command.
  The response now adds the scope status and acknowledge commands, an
  observed_pending stop with cause and safe next action, and the instruction to
  review the reported evidence before acknowledging.
• Show the index header both public READMEs previously only described: the Root
  manifest that declares each participating Volume with its kind, path, format,
  dependency, and activation state, and the Meta header that carries the object
  protocol, the FRAS discipline, the machine limits authority, S admission, and
  the S quota. Each locale quotes what its own aoci init writes, and a
  cross-layer test binds every quoted line to the rendered template and the
  machine S quota, so a template or limits change cannot leave the published
  example describing a header the binary no longer produces.
• Correct published facts in the release-facing READMEs: the status badge named
  the superseded v0.1.0-rc3, the black-box suites were advertised as 44
  conformance checks, 22 fault-injection scenarios, and two lifecycle fixtures
  when they are 46, 30, and three, the English documentation map linked the
  Chinese Windows host-agent original instead of its English rendering, and the
  one worked FRAS example separated A items with semicolons where the public
  contract and every shipped Entry use commas.
• Make the conformance check count a property of the suite rather than of the
  repository it is pointed at. The Overview chain is tallied as two aggregate
  checks instead of two per chunk, and the probe pair is graded unconditionally,
  so the published number no longer moves when an index crosses a chunk boundary
  or a probe is not issued, and AOCI_REPO runs against a foreign target no
  longer look for this repository's documents.
• Carry the issue #8 aoci cognition bootstrap correction into the Chinese
  README, which had kept the pre-fix wording: bootstrap never targets an
  initialized Volumes v1 repository, and a Volumes skeleton with zero Entries is
  established through aoci scan, then Guide and no-argument aoci_maintain.
• Make the black-box suites enforce their own published numbers. Conformance and
  scenarios now fail when the count printed by the run disagrees with any
  document that advertises it, and the lifecycle suite fails when a committed
  fixture is not named where the suites are advertised, so these counts cannot
  drift silently again.

The first public availability date for v0.1.0-rc5 is 2026-08-17.

See docs/install.md and docs/supply-chain.md for asset verification.