Release ceulen 0.8.0 — todo + rules modules, 15 fixes · ceulen-dev/ceulen

New modules (OMP ports)

Phased task tracking: one todo tool (init/start/done/rm/block/unblock/append/view) over an ordered phase list.

Blocked is derived from unmet blockedBy edges — finishing a blocker auto-unblocks dependents
The earliest pending unblocked phase auto-starts after every mutation
Persistence across sessions (ceulen-todo entries) + a ▸ n/m done · in_progress: … status segment
/todo prints the board, /todo clear resets

Sticky RULES.md + rulebook. Drop a RULES.md in <repo>/.pi/ or ~/.pi/agent/:

One rule per ## name section
No description: line → sticky (body injected into every request, 4000-char cap)
description: first line → rulebook (listed by name; body served on demand via rule_get)
@path imports, nearest-first precedence (project beats user), mtime cache (edits apply without /reload)
/rules = status, /rules reload = drop the cache. Zero footprint when no file exists.

subagent: idleTimeoutMins reached the resolver (was dead config); typo'd @alias fails loud instead of silently using the parent model; tier gating uses the chosen label's own probability
router: /config saves re-register from the effective (trust-aware) snapshot — trusted-project endpoints no longer clobbered, API key no longer sent to shadowed URLs; combo/* thinking off omits reasoning_effort (upstream 422s on the literal — caught live)
steering: registry reorder — steering is genuinely the last before_agent_start rewriter (serena/web previously appended after the ds-anchor bootstrap, breaking byte-identity)
advisor: 3-strike pause notice actually delivered; cursor reseed fires on enable+chain saved together
usage: session cost/tok-s reset per session
zai: panel trust baseline; 401-ladder state leak fixed
web: garbage number input skipped, nested project shadows disclosed
munin: panel trust baseline
registry: isProjectTrusted cursor leak across agent dirs

Full changelog: CHANGELOG.md · Modules: 20 · Tests: 1920 passing