v0.19.1

[0.19.1] - 2026-08-14

First public npm publish. MCP registry field mcpName. server.json description fits the 100-character cap.

v0.19.0

[0.19.0] - 2026-08-14

Agent-first product surface. Python audit_hash is ledger-audit-v2. CI ci-ok is required on main. Docs and skills tightened. Manifests synced; check:versions + verify:full green.

• AGENTS.md, llms.txt, MCP README, skill triggers so agents find the kernel.
• Python reference hash matches TS (account type + name, stable tags). ETH scale 18.
• Single CI gate ci-ok. Branch protection requires it.

v0.18.0

[0.18.0] - 2026-07-02

(Minor, not patch: contains a BREAKING artifact-API change. mcp/package.json's
@eternal-roman/ledger dependency bumped in lockstep — artifact_make requires
the new makeCanonicalArtifact signature, and an older kernel would silently
drop the auditHash field. Manifests synced; check:versions + verify:full green.)

AI-proof binding: make narration accountable to real kernel output, not just the kernel's own math.

Added

• Claude Code Stop hook (hooks/verify-proof-binding.cjs) checks every currency
  amount / audit hash in the assistant's final message against real ledger MCP
  tool results from that session before the turn ends; blocks on a confident
  mismatch, fails open on its own infrastructure problems, and emits a visible
  warning (instead of looping) if a mismatch survives the one retry. Ships via
  hooks/claude-code-hooks.json, referenced explicitly by
  .claude-plugin/plugin.json's hooks field (file-split rationale in
  hooks/README.md; hooks/hooks.json, which Grok auto-discovers, is untouched).
• artifact_make now session-binds auditHash: it accepts only a digest
  the server itself returned from a kernel call this session (ledger_post /
  ledger_audit_hash / ledger_verify_determinism / trace_run /
  periods_guarded_post), or one it can recompute from an optionally supplied
  serialized ledger. A fabricated-but-well-formed 64-hex value is rejected —
  format validation alone cannot tell a real digest from an invented one.

Changed (BREAKING)

• makeCanonicalArtifact / the artifact_make MCP tool now require citations,
  kernelPlan, and auditHash — none are silently defaulted anymore.
  Previously a caller could get ok: true back with zero real citations and
  fabricated proof/reproducibility text; the "required" checks could never
  actually fail. (The offline kernel validator checks hash shape; the MCP layer
  adds the session binding above.)

Fixed

• The Stop hook matches MCP tool names as they actually appear in Claude Code
  transcripts (mcp__<server>__<tool> / mcp__plugin_<plugin>_<server>__<tool>),
  not bare names — bare-name matching rejected every real ledger tool result,
  blocking every correct kernel-proven answer while catching nothing.
• The Stop hook harvests proof only from kernel-computed value keys and only
  from hash-minting tools — previously ANY decimal-shaped string in a trusted
  envelope counted, so an account code ("3000"), a caller-authored entry
  description ("250 widgets"), or artifact_make's echo of the caller's own
  fabricated hash could rubber-stamp a made-up figure.
• The Stop hook compares amounts as canonical decimal strings, never floats
  (AGENTS.md rule) — float comparison collapsed distinct values past 2^53 and
  past 8 decimal places (ETH is scale 18 in the kernel registry).
• The Stop hook skips display-rounded figures ($1.8k, $1.2M) instead of
  truncating them to 1.8/1.2 and false-blocking fully-proven answers, and no
  longer treats acronym-first phrases (ADA 2010, DOT 49) as money. Fiat
  codes match both directions; word-like tickers (ADA/DOT/SOL) only
  number-first (0.5 ADA).
• The Stop hook's monetary-claim pattern no longer matches accounting/standard
  citations (IFRS 16, IAS 16.48, ASC 842, GAAP 2023, ISO 4217, ...) as
  unverified dollar amounts.
• The Stop hook no longer trusts a JSON-shaped blob of plain assistant text as
  proof — only content the transcript itself marks tool_result counts (falls
  back to shape-only trust if tool identity can't be resolved at all, so an
  undocumented transcript-schema change can't silently disable proof-checking).
• The Stop hook recognizes Money.toString()'s combined format ("0.30 USD"),
  thousands separators, and symbol prefixes; it no longer treats the v
  schema-version tag or incidental integer fields (entryCount, compare) as
  provable amounts.
• The Stop hook finds the final assistant message from the transcript tail and
  only fully parses tool-bearing lines when claims exist — previously it parsed
  the entire (unbounded) transcript on every turn, guaranteeing end-of-turn
  stalls in long sessions and eventual timeout-kill (which fail-opened the
  check exactly when sessions got long).
• Agent-facing docs that still described the pre-auditHash artifact contract
  (ledger://tools-guide resource, docs/SUCCESS-CHECKLIST.md) now match the
  enforced schema — following the server's own guide previously produced only
  schema-rejected artifact_make calls.

v0.17.0

[0.17.0] - 2026-06-29

Security & MCP integrity audit remediation.

Changed (BREAKING)

• Audit hash format ledger-audit-v1 → ledger-audit-v2. The hash now covers
  each line's account type and name (previously tamper-blind — a type flip or
  rename left the digest unchanged) and canonicalizes tag key order. Hashes
  produced by ≤0.16.x will differ; re-baseline any stored hashes. (H1, L3)

Fixed

• Money.div rejects division by zero, and mul/div/convert reject non-finite
  results instead of silently yielding Infinity/NaN. (H3)
• Money.allocate rejects negative ratios and ratios summing to zero; the MCP
  money_compute allocate now reports a verified sumsToOriginal. (M1)
• Ledger.apply and validateEntry reject reusing an account code with a
  conflicting type/name (ACCOUNT_REDEFINED), so balances and the fundamental
  equation can no longer be silently corrupted. (H2)
• verifyDeterminism now proves a JSON serialization roundtrip reproduces the
  hash (reports roundtripOk), instead of re-hashing the same in-memory objects. (M3)
• The MCP server installs asset decimal scales, so native-precision crypto
  (BTC 8dp, ETH 18dp, …) is accepted instead of capped at 2dp. (M2)
• MCP money-construction errors are labeled SUB_SCALE / NON_FINITE /
  INVALID_AMOUNT distinctly. (L2)

Security

• Private vulnerability reporting via GitHub Security Advisories; honest
  documentation of the best-effort release-signing posture; removed a stray
  empty .sig artifact. (L1)

v0.16.7

[0.16.7] - 2026-06-29

Conciseness patch + release sequencing hardening.

• Tightened MD files, notes and CHANGELOG (fewer words, no loss of value or depth): RELEASING.md (removed stale DEFERRED), README (precise claims), SCOPE/CITATION (minimal disclaimers), mcp/README, and repeated alignment boilerplate collapsed.
• Evaluated /release skill: Critical Sequencing Rules already forbade the prior "merge feature then bump on main" violation; added explicit "distinct + subsequent commit", post-merge git log check, bump-PR wording, and updated todo confirm list.
• All changes follow guarded process + check:versions.

Manifests synced; check:versions + verify:full green.

v0.16.6

[0.16.6] - 2026-06-29

MCP error response contract hardening + disclaimers (patch).

• Investigated and resolved real inconsistencies in MCP error signaling: isError usage was non-uniform across schema violations (SDK "MCP error -32602"), logical fail-closed (e.g. unbalanced via ok({ok:false, violations})), and runtime/precond (via fail()).
• Standardized response contract: all controlled responses include top-level ok: boolean; logical fail-closed use structured {ok:false, ...} (isError typically unset); errors use isError + {ok:false, error}.
• Added robust parsing in test call() and smoke callJson + expectError.
• Expanded smoke and added dedicated contract tests covering schema, logical, and error categories.
• Added minimal disclaimers (tests = "due diligence", MIT supported) in root/mcp READMEs, SCOPE, CITATION, SKILLs, SECURITY, AGENTS, python ref.
• Deepened adversarial MCP loop coverage.
• Response contract now documented in mcp/README.md.
• All gates: 27 MCP tests, smoke (with error shapes), check:versions, verify:full green. No impact to kernel determinism or first-class usage.

Versions aligned across package.json, package-lock.json (both), plugin.json, .claude-plugin/plugin.json, CHANGELOG.md, pyproject.toml, ledger/init.py (0.16.6-ref).