HZR 0.3.5

HZR 0.3.5 — Project-only activation and scoped evidence

HZR 0.3.5 makes “enable HZR here, keep the comparison project untouched” a real product mode.
Index and memory data were already isolated by repository, but the integration layer was global:
agent instructions applied everywhere, Claude initialized every opened directory, MCP registrations
were client-wide, and hzr stats reported one lifetime total. Those boundaries now switch together.

No provider-cost or task-quality improvement is claimed. Scoped statistics are still local
before/after output estimates, and provider receipts remain explicitly global until their schema
carries a workspace identity.

Project-only activation

From the project that should use HZR:

hzr install --project-only --dry-run
hzr install --project-only --force

Fresh release installation supports the same mode with:

HZR_PROJECT_ONLY=1 sh /tmp/hzr-install.sh

The selected-mode contract is fail-closed:

• enabled workspaces are stored as validated repository/worktree SHA-256 identities plus their
  canonical display root;
• the one global Claude hook runs init --if-enabled and emits no routing decision outside the
  enabled set;
• managed CLAUDE.md and AGENTS.md blocks live in enabled project roots instead of user-global
  files;
• HZR-owned global Codex and Claude Desktop MCP registrations are removed with the same
  content-addressed backup/CAS protections used during installation;
• MCP refuses unsafe, uninitialized, or unselected workspace bindings before any project-scoped
  daemon request.

Additional projects can be changed independently:

hzr enable --workspace /path/to/project
hzr disable --workspace /path/to/project

disable removes the activation entry and local managed instruction blocks. It does not delete the
managed index, memory, visualizer registration, or accounting history.

The default installation remains all-project for backward compatibility. A confirmed
hzr install --force switches selected activation back to the default and restores global managed
instructions and native MCP registrations.

Project-scoped statistics

hzr stats --workspace /path/to/project

The project filter applies consistently to direct output reduction, subsystem and command totals,
and the optimizer-bypass numerator and denominator. Descendant working directories are included;
string-prefix siblings are excluded.

Provider usage and degraded-hook accounting retain a visible global lifetime label. HZR does not
attribute those rows to a project without source evidence.

MCP binding is stricter

A directory that merely looks like a project can no longer own an MCP namespace. The server now
requires a verified managed .grepai placement, and selected mode also requires an activation
entry. Filesystem root, home, home ancestors, uninitialized projects, and unselected projects all
return a model-visible error before dispatch. The workspace-independent hzr_codec remains
available when binding is refused.

Project-only installation does not install a client-global MCP registration. A manually pasted
--workspace registration is still visible to every session using that client profile, so use a
separate profile when the MCP tool itself must be absent from baseline projects.

Observatory state correction

The dashboard now reports an index with ready on-disk artifacts and an intentionally idle on-demand
watcher as Standby. It no longer remains in Rebuilding for hours after a daemon restart when no
rebuild is active.

Upgrade impact

The upgrade does not rewrite memory rows, index artifacts, or ledger records. Existing configuration
deserializes as activation.mode = "all", preserving prior behavior. Project-only installation
removes only marker-owned global instructions and HZR-owned MCP registrations; unrelated hooks,
instructions, and MCP servers are preserved and backed up before changed files are committed.

Upgrade and verify with:

hzr update
hzr hooks status
hzr doctor --workspace .
hzr stats --workspace .

Restart already-open agent sessions after changing activation mode so they reload hooks,
instructions, and MCP configuration.

Verification

The release gate includes:

cargo fmt --all -- --check
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo test --workspace --all-targets --all-features
rustup run 1.85.0 cargo check --locked --workspace --all-targets --all-features
scripts/verify-fork-core.sh --test
cd integrations/caveman-code && npm ci --ignore-scripts && node --test bridge.test.mjs
cd visualizer && bun install --frozen-lockfile && bun test && bun run typecheck && bun run build

The bundle smoke gate additionally exercises clean installation, same-version re-attestation,
all-project adoption, project-only adoption, public hzr and compatibility rtk entrypoints, and
all four pinned engines before publication.