v5.3.1

Added — OpenSpec import adapter (/mb openspec)

• scripts/mb-openspec.sh + scripts/mb-openspec.py — one-way import adapter: an OpenSpec
  changes/<id>/ (proposal + delta specs ADDED/MODIFIED/REMOVED/RENAMED + tasks) is parsed
  directly (no openspec CLI dependency) and written as an MB spec triple under
  specs/<topic>/{requirements,design,tasks}.md. The OpenSpec tree is read-only; every write is
  asserted under .memory-bank/ (topic path-traversal + symlink-escape guarded). Deterministic core.
• Drift-aware list/status/sync — import records openspec_source/openspec_hash
  frontmatter; list [--all] reports imported/drifted/not-imported, status <topic> one
  topic, sync [<topic>] re-imports only on hash drift (a match is a pure no-op, no write).
• Re-import preserves work — REQ-NNN reused by requirement name (not document position),
  /mb work task check-state preserved by text, orphaned tasks appended to backlog.md (never
  silently dropped), crash-consistent write order (orphans durable first, hash written last).
• Opt-in --normalize — fills LLM text slots (prose-SHALL → EARS, missing scenario, Covers),
  cached by source-requirement hash so an unchanged requirement never regenerates, fail-open (LLM
  unavailable → deterministic fallback + warn). Omit for the byte-deterministic path (NFR-001).
• Spec .memory-bank/specs/openspec-adapter/ (20 REQs, 6 tasks); 81 pytest + 15 bats. Cleared a
  4-round Codex GPT-5.5 review + Opus verification gate (all findings fixed, round-4 APPROVED).

Added — Running list of agreements

• scripts/mb-agree.sh — the single writer for the canonical registry of confirmed
  decisions (<bank>/agreements.md): add [--supersedes N] [--adr NNN] [--source S] | defer | reject | question | resolve | list [--all] | sync. Monotonic never-reused AGR-NNN/Q-NNN
  IDs issued under an atomic owner-token mkdir lock (kill-0 PID-liveness stale-break), every
  write temp-file + mv. Lazy: nothing exists until the first add. Kill-switch MB_AGREEMENTS=off.
• Managed-block sync — after every mutation the active one-liners are rendered into a
  <!-- mb-agreements:start/end --> block in project-root CLAUDE.md/AGENTS.md (replace between
  markers only, surrounding bytes preserved; distinct from the adapters' memory-bank:* block), so
  a fresh session sees the full canon with no extra tooling. > 25 active warns, never truncates.
• /mb agree + /mb verify integration — router entry in commands/mb.md + commands/agree.md;
  the Plan Verifier classifies every active agreement as satisfied / violated / not-applicable and
  fails the verdict on any violation (agents/plan-verifier.md, Step 3.7). Rules trigger in
  rules/RULES.md + rules/CLAUDE-GLOBAL.md; full protocol in references/agreements.md.
• Spec triple .memory-bank/specs/agreements/{requirements,design,tasks}.md (16 REQs, 8 tasks);
  70 bats across test_mb_agree.bats + test_mb_agree_docs.bats, green on bash 3.2 and default.

Added — SessionStart "newer release?" notice + opt-in auto-update

• scripts/mb-version-check.sh — the single resolver for "is a newer release out?":
  compares the local VERSION against the latest GitHub Release (PyPI JSON as fallback),
  TTL-cached (MB_UPDATE_CHECK_TTL, default 86400), strict JSON output, fail-open on every
  network/parse error.
• hooks/mb-update-notify.sh — SessionStart hook rendering that answer: silent when
  up to date, otherwise a ≤3-line notice naming current -> latest and the exact upgrade
  command for the detected install flavor (git/pipx/pip/brew). Reads the cache only
  (--cache-only, no network from the hook path itself) and fires a detached background
  refresh when the cache is cold. MB_UPDATE_CHECK=off disables the check entirely.
• Opt-in auto-update (MB_AUTO_UPDATE=on, default off): applies the update automatically
  via mb-upgrade.sh --force, but only for a git clone install with a clean working tree — a
  dirty tree refuses, and pipx/pip/brew installs are never auto-run, only named in the notice.
  Fail-open: a stuck or failing auto-update attempt never blocks the session.
• Docs: commands/mb.md upgrade section, SKILL.md hooks table, README.md "Staying up to
  date" section, and references/structure.md control envelopes cover the three new env vars
  (MB_UPDATE_CHECK, MB_UPDATE_CHECK_TTL, MB_AUTO_UPDATE).