v0.7.5

Python and the Claude and Antigravity plugins are 0.7.5. The native crate is 0.1.3. npm stays 0.2.0.

Cursor

Cursor is a protocol map on the existing kernel. statutor hook detects hook_event_name, maps Write, StrReplace, Shell, Delete, MultiEdit, and NotebookEdit, and this repository dogfoods .cursor/hooks.json.

In-loop policy

• Governed MultiEdit and NotebookEdit are denied whether or not old_string is set. The denial tells the caller to write the complete file.
• A governed basename matches a case-variant path only when that path is the same directory entry. On a case-sensitive volume the two spellings stay different files.
• A governed file that is not valid UTF-8 is a validate() denial and a doctor error, so the hook does not fail open and the doctor keeps checking the other files.
• An apply_patch update of a state file denies a new task ID that does not advance past the current maximum, and denies the update when the current file cannot be read.
• An append-only write allows a pure line insertion and denies a rewrite that drops or reorders an existing line.

npm and crates.io publication of this revision stay pending.

Statutor 0.7.4: hardened enforcement and provenance

This patch hardens the existing enforcement and provenance contracts after a full v0.7.3 audit.

• Staged checks retain policy authority from nested directories and detect Git mode changes to trust roots.
• Python and Rust agree on policy parsing, glob classes, task IDs, and diagnostics.
• Global instruction/skill operations refuse retargeted ownership and safely recover failed replacements.
• Worker recording and completion require the originating ledger/worktree and supported evidence capability.
• Antigravity batch edits are guarded, CRLF is preserved, and malformed Stop metadata remains fail-open.
• Release verification tests the exact candidate snapshot with original-repository trust receipts. Current native global probes and a tracked release runbook are included.

Distribution versions: Python/root and Antigravity plugins 0.7.4, OpenCode npm adapter 0.2.0, native crate 0.1.2.

After upgrading, begin a fresh worker session if an existing local session predates recorded ledger scope. Existing version-1 registries remain readable.

The independent runtime and Standards reviews passed. Validation includes the complete artifact gate, 109 Python/Rust conformance cases, seven Rust unit tests, actual Rust 1.75 execution, and 149,481 generated glob comparisons without a mismatch.

statutor v0.7.3 — Grok Build vocabulary map on the existing plugin

Grok Build is a vocabulary map on the existing plugin (D-0028, T-0048).

• Kernel canonicalizes search_replace, write, run_terminal_command, and the Cursor-preset names StrReplace and Shell
• A truncated governed body is denied. A hashline_edit with no old_string is denied when the path is governed
• One Stop continues on end_turn. The next Stop in that turn, and a Stop whose reason is not end_turn, stay silent
• Harness id grok, verified against Grok Build 1.0.62. npm stays 0.2.0 and the Rust floor stays 0.1.1
• README lead names the planes and harnesses. The pre-commit example pin is v0.7.3

statutor v0.7.2 — Antigravity workspace scoping and OpenCode 2.x

Antigravity hooks stay inside an explicit workspace, and the OpenCode adapter speaks 2.x.

• Empty Antigravity workspacePaths allow immediately, so a global plugin cannot doctor an unrelated cwd (D-0026, T-0046)
• OpenCode 2.x setup and 1.x server() share one guard. npm package in tree is 0.2.0 (D-0027, T-0047)
• Publishing statutor@0.2.0 to npm remains a separate step

statutor v0.7.1 — Antigravity adapter and statutor version

First tagged 0.7 release. There is no v0.7.0 tag: that number lived only on two documentation commits between v0.6.0 and this tag.

• Google Antigravity adapter (D-0025, T-0044): tool normalization, Stop drift alerts, plugin bundle, harness ids antigravity and gemini
• statutor version prints the installed distribution version, with __version__ as fallback (T-0045)

statutor v0.6.0 — opt-out init profiles

Opt-out init profiles. Python and the Claude plugin move to 0.6.0. npm and the crate stay at 0.1.1.

• Profiles python, rust, node, docs, min, and none (D-0024, T-0043)
• init adds empty conventional directories only, and does not follow links out of the target
• min stays byte-identical to the pre-v0.6 scaffold

statutor v0.5.1 — bare CLI prints usage instead of stalling on stdin

Bare statutor prints usage instead of stalling on stdin.

• No-args prints usage and exits 64. --help exits clean
• A TTY on hook stdin fails fast (T-0042)

statutor v0.5.0 — worker provenance: machine identity, HANDOFF attribution, reconciliation

Worker provenance: machine identity, HANDOFF attribution, and reconciliation.

• statutor machine and statutor worker, including capabilities and compare
• Automatic hooks still prove an attempt only
• No universal skill library (D-0023)

statutor v0.4.0 — portable global instructions and skills management

Portable global instructions and Agent Skills.

• Opt-in user layer for instructions and skills, with backup and uninstall
• Automatic adapters enforce only a repository marked by .statutor.yaml (D-0019)
• State task IDs survive checkbox and detail edits (D-0016)
• Policy trust is anchored to Git snapshots

statutor v0.3.0 — public debut: PyPI + npm + crates.io real artifacts, four enforced surfaces, conformance-gated Rust floor

Public debut: PyPI, npm 0.1.0, and crates.io 0.1.0.

• apply_patch envelope parsing, and a pre-commit hook that fails closed when the CLI is absent
• Hermes adapter removed (D-0012). Four enforced surfaces remain
• statutor-staged Rust floor, conformance-gated against the Python kernel