Skip to content

hSUM v0.1.0-alpha.4

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jul 06:53
Immutable release. Only release title and notes can be modified.
v0.1.0-alpha.4
This tag was signed with the committer’s verified signature.
burkan2 BurkanKale
GPG key ID: C963D2D0526C0B5B
Verified
Learn about vigilant mode.
a0b9da0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Zero-touch Codex onboarding

hSUM can now install itself as one user-wide, workspace-dynamic Codex MCP server. After the first repository is activated, future Codex tasks can call hSUM's four read-only evidence tools without copied TOML or a Codex restart.

Install and activate the current repository

version=0.1.0-alpha.4
base_url="https://github.com/burkan2/hSUM/releases/download/v$version"
curl -fsSLO "$base_url/install-hsum.sh"
curl -fsSLO "$base_url/SHA256SUMS"
grep ' install-hsum.sh$' SHA256SUMS | shasum -a 256 -c -
bash install-hsum.sh --activate . --confirm

On macOS arm64, this alpha is not Developer ID-signed or notarized. After verifying the checksum and reading the warning, add --allow-unnotarized-alpha to the final command.

The installer:

  • installs the pinned binary without sudo;
  • registers hSUM through Codex's supported mcp add/get CLI;
  • installs bounded, managed agent guidance in the effective user-global Codex instructions;
  • activates only the exact current Git repository;
  • verifies all four read-only tools and a search-to-citation round trip;
  • preserves existing user instructions and is idempotent.

Start a new Codex task after installation so the client discovers the new MCP registration.

Many repositories

Authorize a projects directory once:

hsum integration authorize-workspace codex --path ~/Projects --confirm

hSUM does not recursively scan or combine that directory. The first hSUM tool call in each child Git repository initializes only that exact repository. Every repository retains a separate trust binding, index, generation, and citation namespace.

Managed repositories attempt one bounded refresh before the first evidence search or citation read in each MCP task. Unsafe, busy, or deletion-refused refreshes keep the last good generation and report freshness state.

Boundaries

Retrieval remains local exact/quoted/BM25 lexical search. There is no embedding model, vector search, corpus upload, account, telemetry, daemon, or HTTP transport. A cloud-backed agent may forward returned passages to its own model provider under that client's policy.

Alpha.2 and alpha.3 indexes and citations remain compatible. Restart in-flight MCP pagination after upgrading because cursors and retrieval fingerprints are release-bound.

Verification

This prerelease was built from a GPG-signed annotated tag on protected main. Both supported targets passed release checks, reproducible builds, first-user and installer smokes, network-denied smokes, and published alpha.1 recovery. The archives, SPDX SBOMs, Cargo license inventory, and installer are covered by SHA256SUMS; each archive also has a GitHub SBOM attestation.

Assets 12
Loading