v0.2.0 - Enforced local-hybrid governance plane

A control release, not a savings release

v0.2.0 is the release in which this plugin stopped claiming a token or privacy benefit and became an enforced governance control. The metered model specifies and is denied write and shell access; a local worker implements inside a workspace-bounded directory; a verdict — never code — crosses back. Promotion accepts a file only when its bytes hash-match a machine-checked or operator-attested record.

Metadata note: this tag points at 8f8f923. It was originally created at f532e0c, which was seven commits behind the version metadata it named — at that commit plugin/package.json still declared 0.1.0. It has been moved forward so the tagged tree is internally consistent.

Release metadata

• 0b32f04 — aligned the version metadata with v0.2.0: plugin/package.json, its lockfile and the README all said 0.1.0 while the tag said v0.2.0. They now agree.
• 61afc66 — rewrote the package description, which still sold the retired cost-and-privacy premise. It now describes the boundaries and the hash-bound promotion gate.

Behaviour fix — a refusal that pointed at an impossible remedy

• 1057885 — the missing-skeleton branch told every caller to "build the declarations", which is right for src/ and unachievable for tests/: tsconfig.json sets rootDir: ./src and include: [src/**/*], so a test file sits outside the emit root and no build will ever produce its .d.ts. A reader following the instruction looped. The branch now discriminates between tests/ and src/, verified against seven paths including the near-misses src/latest.ts and contest/a.ts.

Packaging fix — a bare import that only resolved by accident

• 02701fb — src/index.ts imported from the bare name cordis, which resolved only because it is a transitive dependency of @deepseek-ai/cordis. That is the failure mode the framework's dependency-scoping rule exists to prevent: it works on the author's machine and breaks for every consumer. Now import type { Context } from '@deepseek-ai/cordis'. Removing the bare dependency took 16 transitive packages with it — 95 to 79 under npm ci. Every scoped import in the plugin is now type-only and audited.

Documentation — the retired claims, corrected rather than deleted

• d45b7ce, c2c0d7d, 8f8f923 — three rounds of correction. Retired cost and privacy claims are recorded as retired in Retired claims, and why, and docs/control-effectiveness.md now states plainly what the control does not cover.

Two operational limits were codified, both found by operating the thing rather than reasoning about it:

• Egress policy is session-scoped. sourceReadEgress is read once at registration from the profile patch, so changing it is a restart rather than a setting. As shipped the key is unset — the option, the hook and its oracle all exist, and the control is currently off.
• The contract files the architect may write are the ones it cannot read back. The write guard's contract carve-out is reached before its extension check, so tests/ is writable under contractWriteMode: 'allow'; nothing under tests/ emits a declaration, so the same file is unreadable under declarations mode.

Corrections to previously published reasoning

Two claims in earlier revisions of docs/control-effectiveness.md were false, and both are corrected in place with the retraction preserved:

1. That sourceReadEgress had been verified to reload live. It had not — the option never applied, and the earlier observation was an artifact of an approval prompt in a different session.
2. That scripts/check-promotion.cjs had no oracle because the write guard refuses .cjs. The oracle exists, and a .cjs test under tests/ was never refused — the contract carve-out short-circuits before the extension rule. Direct probe of the built guard: tests/oracles/thing.oracle.cjs allow → permitted, deny → denied, while scripts/check-promotion.cjs and lib/util.cjs are denied as ordinary source.

Verified state at this tag

• Build clean; committed dist matches a clean build.
• 39/39 unit tests, 356/356 regression oracles.
• Three .mjs oracles: promotion socket 12/12, attestation identity 6/6, tool surface 5/5.
• README consistency check green (8 policy rules).
• CI: run 37962806250, all 11 steps success on Windows.

Scope, stated honestly

This release claims no token, cost, session-length or privacy benefit. Measured: the delegation path saved roughly $0.15 on a $10.63/month bill. The value is the control — a file ships only against a hash-bound record — and the limits are documented: the recorder shares a process with the recorded, the guard sees tool calls rather than intent, and OPERATOR_ATTESTED is tamper-evidence rather than cryptographic non-repudiation.