OH MY PM v0.4.0

OH MY PM v0.4.0

Stable release opening the v0.4 line. It adds one main capability —
Project Timeline — and changes nothing else.

Project Timeline answers "what changed in this project, and when?" from local
committed memory alone: a bounded, deterministic history derived from
already-captured Project Brain snapshots, in authoritative capture order,
filterable and paginated. It is read-only end to end.

The single main capability: Project Timeline

The v0.3 Project Brain could already compare the two most recent captures
(memory changes / project_changes). It could not answer the same question
across the whole recorded history. v0.4 closes exactly that gap.

A timeline is derived, never stored. Each query reads the store's
authoritative capture chronology, compares adjacent committed snapshots through
the existing deterministic change engine, and projects the results into bounded,
sanitized events. There is no timeline file, no timeline record type, and no
timeline store.

memory timeline — added

oh-my-pm memory timeline
  --project-id <id>       required
  --data-dir <path>       optional
  --limit <1-100>         optional, default 20
  --before-sequence <n>   optional
  --category <value>      optional
  --kind <value>          optional
  --json | --markdown     optional (brief is the default)
  --help | -h

• Exits 0 on success and 2 on any usage error, matching every other command.
• Writes to stdout only on success; failures write to stderr only.
• Ends with exactly one newline and is byte-identical across repeated runs.
• Needs no project root and reads no project config or project document — the
  project is identified by --project-id alone.
• Has no --apply: there is nothing to apply.
• Markdown output groups events by capture under fixed headings and invents no
  summary; every line restates recorded fields.

project_timeline — added

One new read-only stdio MCP tool, appended after the existing eleven.

• Input: projectId (required), limit, beforeSequence, category, kind.
• Output: schemaVersion, projectId, eventCount, hasMore,
  nextBeforeSequence, chronology, events.
• Declares readOnlyHint: true and destructiveHint: false.
• Loads the memory dependency lazily on its own path only, exactly as
  project_changes does.

Event model

Each event carries exactly these fields and nothing else:

eventId, snapshotId, captureSequence, eventSequence, capturedAt,
category, kind, subjectId, title?, status?, severity?, dueDate?,
evidenceCount.

Evidence is reported as a count, never an id. category and kind reuse the
existing ChangeSet taxonomy exactly — the twelve change categories and the six
item kinds. No second taxonomy was introduced.

Ordering, filtering and pagination

• Events order by captureSequence, then eventSequence. The authoritative
  capture chronology is the only ordering source: never a lexical snapshot-id
  order, and never a timestamp comparison while a capture sequence exists.
  capturedAt is presentation data, not a sort key.
• category and kind filter independently and combine as a conjunction, and
  are applied before the limit, so a page is never short because filtered-out
  events consumed its budget.
• Pagination is by capture boundary, so a page never splits a capture.
  hasMore and nextBeforeSequence are stable and truthful: paging with the
  returned cursor yields the next page with no duplicate and no skip.
• The same store and the same inputs produce byte-identical output.

Surface counts

Memory subcommands:      7
MCP tools:               12
MCP write tools:         0
MCP transport:           stdio only
Project Brain schema:    1
Store format:            2
Store migration:         not required
Installed runtime:       Node.js 20+
Packages:                private
Registry publication:    none

The six existing memory subcommands (capture, changes, status, history,
export, delete) and the eleven existing MCP tools keep their exact names,
options, output shapes, registration order and exit codes. timeline is the
seventh subcommand and project_timeline the twelfth tool, both appended last.

Not changed

• No schema change. Project Brain schema stays 1.
• No store-format change. Project Memory store format stays 2.
• No migration. A Project Brain store created by the public v0.3.1 build is
  read directly with no migration and no repair. This is qualified explicitly: a
  v0.3.1-shaped store serves every read surface, including the new timeline, with
  no manifest migration entry, no backup, no migrationRequired status, and
  byte-identical store bytes after every read.
• No write path. No project file is written. No application-state write, lock,
  staging directory, or backup is created by any timeline read, and no
  application-data directory is created on a read.
• No timeline persistence. A timeline is recomputed per query.
• No automatic capture. Capture stays explicit and user-invoked; there is no
  watcher, scheduler, or background process.
• No network. The timeline surface performs no request and reads no token.
• No new provider, alias, or profile. The timeline never reaches a provider.
• No registry publication. All workspace packages remain private.
• No telemetry, dashboard, or web UI.

Safety and privacy

• Project files are never modified. Byte-for-byte immutability of the analyzed
  project is asserted by test.
• No project content is uploaded.
• The privacy allowlist is enforced at three independent layers: the pure
  derivation constructs events from allow-listed fields only; the MCP projection
  re-validates against a strict schema and rejects rather than partially emits;
  and the serialized output passes a forbidden-marker scan. Absolute paths,
  oversize values, and planted secret sentinels are omitted from optional display
  fields.
• Raw evidence, evidence ids, unrestricted previous/current values, file paths,
  application-data paths, provider results, environment values, credentials, lock
  details, integrity internals, and stack traces never appear in output.

Failure behavior

Timeline reads fail closed. There is no partial timeline.

Condition	Behavior
malformed query	controlled validation failure (exit 2)
unknown project	valid empty result (exit 0)
zero or one snapshot	valid empty result (exit 0)
missing or corrupt snapshot	fail closed, no partial output
corrupt manifest	fail closed
integrity mismatch	fail closed
store with no authoritative chronology	fail closed, never migrate
unsupported store format	fail closed, never migrate
store format 1	fail closed; explicit CLI migration remains the only path
concurrent capture during a read	committed-manifest semantics only

Validation

• Kernel: 34 native tests over the deterministic derivation, plus a committed
  golden fixture asserted from both the native Rust and the WASM binding
  paths, so a cross-language divergence fails a test.
• Contracts: 12 tests over the three new bounded contracts.
• Runtime: 28 tests proving read-only behavior, chronology authority, and
  fail-closed corruption handling.
• CLI: 73 tests including a real-child-process end-to-end journey over a real
  store.
• MCP: 94 tests over the projector, the runner against the real adapter, and
  server registration and projection.
• Installed qualification: 428/428 checks from each of the .tar.gz and
  .zip archives on Ubuntu, macOS and Windows — including the new
  timeline-cli, timeline-mcp and v0.3.1-compatibility sections.
• Deterministic archives, archive reproducibility, checksums, one top-level
  archive directory, source-checkout independence, and prefix relocation.

Assets

oh-my-pm-v0.4.0.tar.gz
oh-my-pm-v0.4.0.zip
oh-my-pm-v0.4.0-SHA256SUMS.txt

Verify the checksums before installing:

shasum -a 256 -c oh-my-pm-v0.4.0-SHA256SUMS.txt

Compatibility

• v0.3.1 remains published and immutable; it is not modified, moved, or
  recreated by this release, and neither are v0.1.0, v0.2.0-rc.1, v0.2.0,
  v0.3.0-rc.1, or v0.3.0.
• Existing v0.3.1 installations upgrade in place with no store change.
• The same profile-aware installer and verifier still resolve the historical
  v0.2 (ten-tool) and v0.3 (eleven-tool) surfaces, so an upgrade from any earlier
  line is served by one installer.