v0.6.0

First 0.6.0 release of oxison — point it at a repo (or an idea) and it writes the product docs, plans a roadmap, and builds the work, on Claude, Kimi, or Grok. Read-only by default, sandboxed when it writes.

Highlights

• Cross-run build memory (#37). oxison build captures grader-verified outcomes to oxison-build/memory.db and front-loads relevant priors from past runs in the same repo into each worker's prompt. Default-on (--no-memory to disable), grader-gated, repo-scoped, and abstaining — a weak match injects nothing rather than a plausible-but-wrong prior.
• Safe --integrate (#59). When composing a roadmap into one product, oxison build --integrate now never advances main/master in place — it composes onto a dedicated oxison/integration branch and restores your original branch, leaving main for you to review and git merge. A defense-in-depth backstop refuses to fast-forward a protected branch even if that redirect is bypassed.
• External security-audit hardening (F1–F10). OCR dynamic-import RCE closed; worker base image pinned; --api-key argv exposure flagged; lockfiles + CI configs protected from build-worker tampering; direct-build roadmaps gated on protected paths; worker container memory/pid ceilings; document-parser DoS surface bounded (incl. pypdf GHSA-jm82-fx9c-mx94); worker log size capped; unused PyYAML dropped.

Install

Not on PyPI — install from the repo:

```bash

zero-install, pinned to this release

uvx --from "git+https://github.com/escotilha/oxison.git@v0.6.0" oxison run /path/to/repo

or

pip install "git+https://github.com/escotilha/oxison.git@v0.6.0"
```

Source-adapter extras (PDF/pptx/docx): `pip install "oxi-son[sources] @ git+https://github.com/escotilha/oxison.git@v0.6.0"\`

Requires Python ≥ 3.11 and the Claude Code CLI. Full notes: CHANGELOG.md.