v2.18.5

release(2.18.5): router face-conflict guards, claim heartbeat session…

v2.18.4 — Full heartbeat identity & canonical face resolver

[2.18.4] - 2026-10-16

Fixed — Full heartbeat identity and canonical face resolver

• Full heartbeat identity: writeHeartbeat accepts optional full HeartbeatIdentity (owner, sessionId, pid, claimToken) with strict ownership checks (session equality, both-null for transferred ownership, claim_token match); refusals carry the owner's name. HeartbeatRecord persists session_id/pid. wolf claim heartbeat gains --session/--pid/--claim-token (legacy writer-only default preserved).
• Canonical face resolver: new resolveFace use-case — strict query (type=face, status=active, owner_skill === agentId), deterministic refusal on 0/multiple with sorted candidate diagnostics, content hash. New wolf face resolve CLI (JSON, exit 1 on miss/conflict).
• wolf-router plugin: canonical face resolve first, legacy text search + owner guard as fallback (2.13 howto delivery preserved).

2.18.3 — Per-token heartbeat isolation, council analytics naming, docs and demo sync

Fixed — Per-token claim heartbeat isolation, council analytics naming, docs & demo sync

• Per-token claim heartbeat isolation: ClaimRecord now issues a unique claim_token on acquisition (${epoch}.${randomTag}) with fallback to acquired_at for legacy records. Heartbeats are saved as <slug>.<claim_token>.heartbeat, eliminating race conditions where delayed writes from a previous holder could overwrite the heartbeat of a new claim holder. releaseClaim and takeover clean up their per-token files alongside legacy paths.
• Council analytics naming: CouncilsView introduces opinions_with_claims_count to unambiguously represent opinions with non-empty claims. audited_count is preserved as a deprecated alias pointing to opinions_with_claims_count for backwards compatibility.
• Documentation & demo scenarios sync: docs/guide/user-guide.md updates the 8 core memory types to the canonical list (rule, lesson, decision, thread, complaint, tool, note, face). docs/guide/architecture.md synchronizes active use cases in src/app/use-cases/, removing obsolete draft/learn files. README.md and README.ru.md update demo scenario 8 description to reflect routing model and session wrap-up. scripts/demo/lib.sh ensures non-zero exit code (exit 1) in summary() upon scenario failures.

2.18.2 — Claim heartbeat lifecycle fix, docs/scripts cleanup, evidence validation

Fixed — Claim heartbeat lifecycle, evidence validation, docs hygiene & coordinator face

• Claim heartbeat lifecycle binding (F-01): HeartbeatRecord now records claim_acquired_at tying the heartbeat to the specific ownership session. isStale ignores orphaned heartbeats whose claim_acquired_at does not match the active claim, preventing subsequent claim holders from being spuriously flagged as stale after 10 minutes. readHeartbeat returns { corrupt: true } on damaged JSON files so that corruption triggers fail-closed staleness. writeHeartbeat validates that the claim exists, is active, and is owned by writer. releaseClaim and acquireClaim takeover now cleanly remove stale .heartbeat files alongside the claim JSON.
• EvidenceRef schema validation & council metrics (F-02): EvidenceRef now enforces that at least one of memory_id or path is present and non-empty via Zod refinement. Analytics exposes structured_claims_count alongside audited_count and filters whitespace-only claim entries.
• Documentation & demo scripts hygiene (F-04): Demo scenarios scenario-6.sh, scenario-7.sh, scenario-8.sh and scenario-4.sh in scripts/demo/ no longer invoke removed wolf run or wolf learn commands, switching to canonical wolf propose, wolf doctor, wolf validate and wolf session wrap-up. scripts/bench/ comments cleaned of wolf run. Stale references to "25 активных типов" in docs/guide/architecture.md and docs/guide/user-guide.md updated to "8 core-типов + расширения". Stale wolf thread create invocations updated to wolf thread add. E2E audit tests/e2e/docs-audit.test.ts now enforces token cleanliness across scripts/ as well.
• Coordinator L0 role contract (F-03): In templates/base/agents/mr-wolf.md and .opencode/agents/mr-wolf.md, replaced "безликий: отсутствие playbook — данные" with the coordinator face contract (procedural coordination & complaint loop protocol).

2.18.1 — Mobile scroll horizontal overflow fix (390px) + roadmap sync

[2.18.1] - 2026-10-15

Fixed — Mobile scroll horizontal overflow on docs site (390px)

• Docs site HomeModes horizontal overflow fixed: .wolf-mode cards now declare min-width: 0, matching the .wolf-install-step pattern. Previously, the lack of min-width: 0 on the CSS Grid item caused a grid blowout on mobile viewports (e.g. 390px screen width), resulting in horizontal overflow and failing mobile layout acceptance. Tested and verified on headless Chrome at 390px viewport (scrollWidth === 390). Resolves blocker mem_20260901_sayt_gorizontalnyy_overflow_390px_ot_sek_e443fd.
• Roadmap files synchronized: docs/dev/roadmap/wave-2.18.md is updated to reflect the completed 2.18.0 wave (Council opinions v2, Claim heartbeats, Base sets polish, Docs audit); docs/dev/roadmap/wave-2.19.md is updated to capture Wave 2.19.0 (Async learning); docs/dev/roadmap/wave-2.20.md tracks the candidate Wave 2.20.0 (Archival brief).

2.18.0 — Council opinions v2, claim heartbeats, base sets, docs audit

[2.18.0] - 2026-10-14

Added — Council opinions v2, claim heartbeats, base-set finalization, public docs audit

• Council opinions and syntheses get a v2 schema (REQ-01, A9): council-opinion and synthesis carry a richer structure with auditable claims, evidence, assumptions, risks, failure conditions, counterexamples and a confidence level (low | medium | high). Legacy notes read as claims: [] and confidence: 'medium' so nothing old breaks. Analytics surfaces audited_count and unresolved_dissent_total. A new procedural rule — “isolation of opinion formation” — lands in .wolf/SKILL.md §7 and the wolf-brainstorm template: each council member states their view before any reveal, so the set of opinions is itself a first-class object.
• Single-writer claims gain a heartbeat (REQ-03, A11): a <slug>.heartbeat file next to the claim keeps long-running operations alive past the PID/TTL check. Default heartbeat window is 10 minutes; the absolute TTL stays at 24h; isStale is PID dead OR (now - written_at > 10 min) OR (now - acquired_at > 24h). The writer is the owner from WOLF_ACTOR (debug, not auth). A new wolf claim heartbeat <artifact> command drives the refresh; legacy 2.17.1 claim files (no .heartbeat) keep the 2.17.1 rules — readHeartbeat returns null and the heartbeat branch is skipped. Atomic replace uses a unique tmp (hrtime.bigint() + Math.random() — pid-sharing between worker_threads on macOS is handled) plus rename, so parallel writers never corrupt the JSON.
• Base sets polished for publication (REQ-04, B0): templates/base/agents/*.md stay in lock-step with the shipped .opencode/agent/*.md; init-project and scaffold-agent enforce face_owner_skill === agent_id; sync-base-set no longer overwrites a local mutation, divergence is reported. Re-wolf init on a 2.17.x project preserves steward-touched faces; nothing in the base set is overwritten.
• Public docs audited for removed commands (REQ-02, A10): tests/e2e/docs-audit.test.ts greps docs/, README.md and README.ru.md for wolf learn, wolf run, Sandbox Replay, STOP-гейт, sandbox-replay and learn --from-session and fails CI if any non-historical file references them. Specs that describe the removed learn/run surfaces are kept readable but marked historical: true in the frontmatter. The same files now state “8 core memory types + extensions” instead of a stale “7 types” count.

Fixed

• docs/reference/cli.md is regenerated by npm run docs:build; the new wolf claim heartbeat subcommand is in the registry from this release.
• The English-surface gate now runs first in npm run check and surfaces leftover placeholders before any test.

Upgrade notes

• For users on 2.17.x: npm i -g mister-wolf@2.18.0 (or local npm i). No forced migration. Run wolf sync after upgrading to align templates.
• Claim files written by 2.17.1 keep working; 2.18.0 readers see them without heartbeats. The first heartbeat write creates the new file atomically; no re-acquire needed.
• Council opinions and syntheses written before 2.18.0 are still readable; v2 fields default to empty arrays and confidence: 'medium'. The persist-path for v2 opinions is a follow-up (T-A9 outstanding); read and analytics work today, write requires a separate 2.19.x task.
• The STOP-гейт / Sandbox Replay / wolf learn surfaces are removed commands and historical text. If your hooks or scripts still call them, they will simply 404 — replace with wolf add --type lesson, wolf task-eval --campaign <id> and the active claim workflow.
• A F-03 waiver for REQ-02 AC-2 (“Действующий контракт версии” section in every ≥5KB public doc) is in effect for 2.18.0: the docs-audit gate plus historical: true markings carry the load. A future release can reintroduce the per-doc section if a reader-facing gap is found.

2.17.1 — Memory safety: worktree identity, atomic face mutations, artifact claims

Added — Memory safety: worktree identity, atomic face mutations, artifact claims

• Worktree memory identity (WT-ID): writes made from a linked worktree are scoped to worktree:w-<12hex> — a hash of the worktree's real path, computed fail-closed (two copies with the same directory name get different identities). Delivery filters on exactly one path — wolf call, in all modes and selection branches; conflicting scope records surface as stderr warnings instead of silent drops. The rest of the read surface (wolf brief, search, get, doctor, faces — everything except wolf call) sees the whole project memory; that composition is now a documented frozen contract guarded by a doc-test. Legacy worktree:<name> objects stay readable; promoting a legacy scope that matches several worktrees reports an honest conflict instead of a silent guess.
• Atomic face mutations: every face change (create version, G17 record, relation, activate, supersede, announce, legacy migration) runs as one journaled operation (op_started → … → op_committed). A crash mid-mutation leaves a readable candidate plus an operation record — never a half-written canon. wolf face recover <opId> resumes (idempotently — it adds exactly the missing steps) or aborts cleanly; wolf doctor lists incomplete operations with recover hints; a later command auto-resumes an interrupted operation with the same input. Seeding and wolf face migrate run on the same mechanism, so an interrupted upgrade is finished, not restarted. A nine-case fault matrix (F1–F9) covers the failure points.
• Single-writer claims on shared artifacts: wolf claim acquire / release / list (and --transfer-to on release) gives an agent session exclusive ownership of a shared artifact id — dev:<date>-<slug> or a worktree identity worktree:w-<12hex>; the second concurrent writer is rejected with the holder named. wolf scaffold artifact now requires the claim for the artifact it is about to write; the refusal names the exact claim acquire command.

Fixed

• Face recovery paths no longer resume a healing/migration operation into a broken state: such operations are rejected by resume-with-input paths (wolf face recover, auto-resume, wolf face new) and are completed only by wolf face migrate. Previously, creating a face version while a migration was interrupted could activate a face with an empty body and retire the real canon.
• wolf doctor no longer reports every live WT-ID-scoped object as an orphaned worktree: identity tokens are checked against the live worktree registry (realpath gitdir records); legacy name-based checks are unchanged.

Upgrade notes

• Migrations: none forced. Run wolf sync after upgrading. Memory written from worktrees by 2.16.x keeps the name-based scope and stays deliverable; new writes get the WT-ID scope. If wolf promote reports a conflict for a legacy scope, two linked copies share the same name — resolve the stale copy and re-run. Renaming or moving a linked worktree directory changes its identity: the copy's older scoped records stop being delivered and surface in wolf doctor as orphaned scopes (promote them before renaming).
• Known limitations: a claim has no heartbeat — it lives up to 24h (TTL) and ends with wolf claim release or expiry; wolf claim list does not mark stale entries yet.

2.17.0 — Faces: versioned agent playbooks (wave 2.17)

Added — Faces: versioned agent playbooks (wave 2.17)

• face is a core type — the canonical playbook of an agent as a first-class memory object (the taxonomy grows 7 → 8 types). Required fields: owner_skill, version, reason; optional based_on (the previous version id); initiator records who created the version (steward | owner | breakglass | migration | seed). Versions live in shared/faces/ and chain through the existing supersede mechanism; direct wolf add --type face is refused with a pointer to wolf face (the versioning path is the only door, for CLI and MCP alike).
• wolf face command group: new (Steward only — requires the G17 mutation fields), restore/breakglass (owner only; breakglass refuses to run inside a live agent session), migrate (legacy playbook notes → face v1, idempotent, per-owner report, exit 1 on partial failure), list/history/show (read views resolve duplicates by highest version).
• G17 mutation records: every Steward face version leaves a note (facet history, title mutation: <owner_skill> v<N>) with the seven design fields — reason, minimal_change, boundaries, example_helps, example_keep, verification, rollback — linked to the version by a mutates relation. The template is mandatory: a version without the record is refused before anything is written.
• wolf propose (add/deliver/list) and the proposal signal facet: a structured proposal on any core type carries a 5-field contract (addressee, basis, proposed_change, expected_benefit, applicability_bounds); deliver stamps delivered_at; wolf face new --from-proposal <id> links the new version to its proposal (proposes relation). The --facet help in add/list/search mentions proposal.
• wolf doctor gains a ## Faces section: duplicate canon per owner_skill, a based_on that points nowhere, legacy note + live face for the same owner (hint: wolf face migrate), and faces outside the contract (files silently dropped by the store).
• Router variant B (.opencode/plugins/wolf-router.ts): delivery is memoized per session — the injected playbook text is sealed for the whole session, so a mid-chat mutation cannot change what the session already reads — while the TTL cache is now version-guarded: a cached entry is served only when its id still matches the current head, so a stale version is never delivered; every new session runs one fresh search as the freshness barrier.

Changed

• Seeding and scaffolding go through the face contract: wolf init seeds base-set playbooks as faces (skipped when a live face or a legacy note exists for the owner), and wolf scaffold agent creates the face instead of a playbook note (--from-playbook accepts face ids).
• wolf sync Steward-zone hint now points face maintenance at wolf face * instead of generic supersede.
• README and site guides updated for the 8-type taxonomy, the face model of delivery, wolf propose, and the proposal facet; CLI reference regenerated (wolf face, wolf propose).

Upgrade notes

• Migrations: none forced. Legacy playbook notes (note + facet: howto + owner_skill) remain readable through the alias path; run wolf face migrate to convert them into versioned faces — idempotent, safe to re-run, wolf doctor flags owners where both forms coexist. Run wolf sync after upgrading to receive the updated wolf-router plugin (variant B).

2.16.3 — Fix: agent spawn regression on OpenCode v2 (mode: all)

[2.16.3] - 2026-10-13

Fixed — Agent spawn regression on OpenCode v2 (default mode: primary)

• Base-set agent templates executor-lead, worker-implementer, worker-researcher, and worker-reviewer now declare mode: all explicitly. The templates never carried a mode field; OpenCode v1 compensated with its all default, while v2 defaults agent frontmatter to primary and gates the subagent tool ("Agent X cannot run as a subagent") — silently killing the whole Wolf Task-chain (L0 → L1 → L2). all keeps both live scenarios: Task-spawn by coordinators and direct opencode run --agent … CLI invocations (the current pipeline workaround).
• New unit guard agents-mode-guard: npm run check fails when any templates/base/agents/*.md lacks a valid mode (primary | all | subagent) or when a Task-chain agent (executor-lead, worker-*) is primary — protection against the next platform default change.
• steward template: the hardcoded model: zai-coding-plan/glm-5.3 literal is replaced with {{model.primary}} (projects without model context omit the line → platform default model). In the wolf repo itself the stale 2.16.1 render — locally mutated to comment the literal out, which had permanently triggered the sync mutated-skip (T010) — was consciously superseded and re-created by wolf sync; the stamp now tracks the current set.

Upgrade notes

• Migrations: none. Run wolf sync after upgrading to receive the fixed agent templates. Affected: every project where wolf rendered agents — until then, Task-spawn of executor-lead/worker-* keeps failing there with "cannot run as a subagent"; the direct opencode run --agent … path is unaffected. Caveat: if wolf sync reports an agent file as "mutated after render" (local edits on top of the render, like the steward case fixed here), it deliberately skips that file — resolve the local delta and re-sync, otherwise the fix silently does not reach that agent.

2.16.2 — Platform lifecycle: v1→v2 doctor repair, wolf uninstall, versioning rule

[2.16.2] - 2026-10-12

Added — Platform lifecycle: v1→v2 repair & uninstall

• wolf doctor detects the "installed under OpenCode v1, runtime v2" mismatch: the minimal plugin stamp recorded in wolf-sync-state.json below 2.14.1 (the v1-only plugin era) against a v2 runtime; the issue names wolf doctor --repair. The check runs for registry projects and for the current directory; without sync-state evidence it stays silent (no disk guessing). The reverse direction (v2-only render on v1) is covered by the same comparison and activates once a v2-only release exists.
• wolf doctor --repair now covers the platform zone before the storage zone: it re-renders stamped files under the current templates (local edits stay protected by mutated-skip), canonicalizes opencode.json (mcp.wolf, default_agent, subagent_depth), reports orphaned stamped files with a recommendation (repair never deletes them), and honors --dry-run (plan only, zero writes). A project without an OpenCode install gets an honest skip line.
• wolf uninstall removes wolf-managed content from a project: plan first (default run writes nothing), --yes executes, --purge additionally erases .wolf/. Ownership is identified by wolf-sync-state records cross-checked against stamps; projects installed before sync-state existed (pre-2.11.0) fall back to stamp scanning. Foreign files, foreign MCP servers, and user-configured default_agent/subagent_depth (exact-value criterion) are never touched; AGENTS.md/CLAUDE.md wolf blocks are kept by design and reported as manual cleanup; empty wolf-owned directories are pruned; the final hint points to npm uninstall -g mister-wolf. Idempotent: a second run reports "nothing to remove".

Changed

• AGENTS.md base template now carries the versioning discipline rule: version numbers are always full X.Y.Z (plans, threads, waves, tags, conversation); a bare minor ("2.16") is not a release name. Initialized projects receive it through the regular sync delivery.
• --help output budget raised 33 → 34 lines to accommodate the new uninstall command (C-06).

Upgrade notes

• Migrations: none. Run wolf doctor --repair once after upgrading OpenCode v1 → v2; run wolf sync to receive the AGENTS.md versioning rule.