Added
- Harness-agnostic hook contract (roadmap A1):
knowing hook <event> with a transport-neutral stdin/stdout contract (event + payload in, context out) for wiring knowing into any agentic harness (Hermes, OpenCode, Codex, custom loops) as a config task, not a code task. Events: session-start, pre-edit, pre-task, pre-files, pre-compact, post-task. The input parser also folds raw Claude Code keys (hook_event_name, tool_input.*, prompt), and --emit claude-code produces Claude Code's native hookSpecificOutput envelope, so Claude Code needs no wrapper script. The edit-symbol extraction from the benchmarked pre-edit shell hook is ported to Go. Adapter examples in hooks/adapters/.
- HTTP / streamable-http MCP transport (roadmap A2):
knowing mcp --http [--port <p> | --addr <a>] serves MCP over streamable-http alongside the default stdio transport, so subagents/harnesses can share one warm instance or reach it remotely.
- Git-native auto-sync (roadmap A3):
knowing sync reindexes a tracked repo after a git pull / branch switch with zero agent action, scoping LSP enrichment to files changed since the last indexed commit (distinguishing "no changes" from "couldn't resolve the range" and falling back to a full enrich in the latter case). knowing sync --roster syncs every tracked repo; knowing sync install writes non-destructive git post-merge + post-checkout (branch-switch only) hooks; knowing sync uninstall removes them.
- Multi-agent feedback semantics (roadmap A5): defined and enforced how the learned-feedback / noise-demotion layer behaves when multiple agents or harnesses share one graph (now real via
knowing mcp --http). The MCP server's ephemeral attribution state (lastTaskKeywords, lastPacks, session-recency boosts, implicit-feedback tracker, GCF dedup) is now per-connection, keyed by MCP session id and evicted on disconnect. This fixes a data race (concurrent map writes could panic the process) and silent cross-agent attribution corruption (one agent's edits were credited under another's task keywords). Durable feedback stays pooled across agents (collective learning) but now records provenance — the client/harness name from initialize instead of a hardcoded "implicit" — so a per-agent read policy is a future read-path change with no migration. Poison-resistance (confidence weighting + Merkle-root expiration) documented as an explicit threat model. See docs/architecture/multi-agent-feedback.md.
Changed
- npm publishing migrated to OIDC trusted publishing. npm permanently revoked classic tokens (2025-12-09) and caps granular tokens at 90 days, so the token-based npm release was broken/expiring. The npm job in
release.yml now publishes via OIDC (id-token: write, no NODE_AUTH_TOKEN) on Node 22 with npm upgraded to >= 11.5.1; provenance is generated automatically (all root + platform package.json files carry a repository field so provenance validates). The redundant manual npm-publish.yml was removed (one trusted-publisher entry per package). PyPI continues to publish via API token (PyPI has not revoked tokens); moving it to OIDC is a follow-up. Requires one-time setup: a Trusted Publisher on npmjs.com for each of the 5 packages, keyed on owner/repo/workflow filename.
- GitHub release notes are now assembled from the tag's
CHANGELOG.md section (was a static "see CHANGELOG" pointer).
- gcf-go v1.1.0 -> v1.7.1: no source changes required (knowing is a graph-profile consumer; all breaking changes in that range are in the generic profile). Graph-profile changes (mandatory
profile=graph on streaming/delta headers, canonical edge/symbol ordering, stricter decode) are decode-invariant and pack_root-invariant, so content addresses are unchanged. Measured GCF token savings 84.0% -> 83.6%.
- Relicense MIT -> Apache-2.0: added explicit patent grant, trademark carve-out,
LICENSE/NOTICE, and CLA.md/CONTRIBUTING.md. Updated license declarations across README, npm/pypi/glama manifests, goreleaser, and the release workflow.
Install
brew install blackwell-systems/tap/knowing
go install github.com/blackwell-systems/knowing/cmd/knowing@v0.16.0
