Rootloom 4.1.0

Added

• Add the Core Reset v2 evaluator: actual Codex token-usage fields, isolated randomized
  repetitions, exact public-Skill/Reference route checks, and Guidance/Setup scenarios.
• Add orchestrate_evidence.py prepare and finish as an additive, lower-turn strict
  Evidence path while retaining the frozen Baseline v2–v4, Summary revision 5, contract,
  manifest, seal, and existing low-level CLI formats.
• Add a formal core-reset-release-eval target that requires a supplied v2 scored matrix
  with at least three repetitions.
• Load the official VibeLoft browser telemetry runtime exactly once on the public GitHub
  Pages site, with a repository contract for the registered product, production origin,
  privacy signals, and collector boundary.

Changed

• Make Direct Change a real fast path: it reads no Reference, limits inspection to the
  exact target, runs the smallest relevant check, and treats a dirty worktree as a
  preservation constraint rather than an escalation signal.
• Make Governed and Evidence Reference loading explicit and route-scored rather than
  relying on implicit composition.
• Require Governed and Evidence References before the first edit, add a compact
  Governed completion contract, and stop when a required Reference cannot load.
• Advance Core Reset scoring to mechanical v4 so successful relative Reference reads
  (including quoted plugin paths containing spaces) and bounded equivalent
  Review/Migration wording are scored from their actual evidence instead of reported
  as route or quality regressions.
• Distinguish exact user authorization from a pre-launch host-policy refusal; Rootloom
  does not repeat consent prompts or misreport that platform blocker as missing consent.
• Require Project Guidance completion to detect and remove only current-task
  verification artifacts, preventing cache, coverage, or build output from escaping the
  authorized guidance path.
• Make Direct and Scoped self-contained routine routes with no Reference load, batch
  independent inspection, and retain behavior-mapped verification plus one challenge
  pass inside the Change Skill.
• Keep initially unknown defect causes in bounded Scoped diagnosis and escalate only
  material root-cause uncertainty that remains afterward.
• Allow repository guidance to request automatic validation while requiring explicit
  user intent or one exact consumable marker for persistent refinement.
• Define the Evidence orchestrator as a single-verification-command convenience path;
  heterogeneous governed evidence continues through the low-level lifecycle.
• Retain the sanitized 126-run 4.1 candidate matrix and report, and enforce that result
  in a version-tag workflow that fails closed when the formal rubric is not satisfied.
• Refresh that matrix against the self-contained Routine tree so previous token
  efficiency, route, and quality failures pass without weakening thresholds.

Fixed

• Keep the website workflow cards equal in height and prevent hover styling from
  changing padding, content position, or layout.

Security

• Exclude unsafe package.json script names from generated SessionStart project context
  so untrusted script metadata cannot be rendered as a suggested shell command.
• Keep the VibeLoft browser credential only in the global script configuration, forbid
  local/manual collectors and Supabase access, and pin the exact upstream build whose
  GPC/DNT, navigation, API-only, and credentials: omit behavior was verified with all
  telemetry requests blocked before network delivery.

Rootloom Personal Core 3.4.0

Rootloom Personal Core 3.4.0 completes the second-stage Core Reset around dynamic context and Experimental Project Memory.

Highlights:

• SessionStart now uses a dedicated incremental renderer with a hard 4 KiB limit over the complete additional context.
• Plan sessions skip project-context injection, and repositories with existing guidance no longer receive duplicate verification commands.
• Analyzer and Finalizer read Project Memory only when callers explicitly pass --include-project-memory.
• Baseline v2-v4 and Summary revision 5 remain frozen; no Evidence schema or quality-state changes were introduced.

Compatibility:

• The new Memory flag is additive. Workflows that intentionally relied on implicit .project-memory/ reads must opt in explicitly.
• Sensitive-change quarantine continues to take precedence over the opt-in and blocks repository reads.

Verification:

• Local make check: 189 tests passed, with 2 filesystem-capability skips.
• Local Codex compatibility smoke passed with codex-cli 0.144.2 and left no installation or rollback residue.
• Pull request and post-merge main CI both passed Linux Python 3.11-3.14, macOS, Windows, and pinned Codex CLI contracts.

Rootloom Personal Core 3.3.0

Rootloom Personal Core 3.3.0 is a Core Reset: it reduces persistent governance, clarifies optional capability boundaries, and closes the remaining 3.2 reviewability defects without introducing another Evidence schema version.

Highlights

• Define the everyday Core as Change, Review, and Guidance; keep Autonomy and Evidence opt-in, Project Memory experimental, and the preserved Assurance branch archived.
• Make SessionStart project-guidance detection read-only; repository guidance is written only through an explicit seed request.
• Remove committed one-time plans and release records, compact global and repository guidance, and keep release facts in GitHub.
• Position Rootloom as an inspectable, bounded personal engineering workflow rather than a verified-quality or content-aware secret-scanning system.

Reliability and security

• Require exact integer component-policy version: 1 and fail closed for missing, malformed, zero, string, or future versions.
• Separate historical Baseline v4 wire validation from current execution policy; incompatible old declarations return reintake-required before content capture.
• Report honest policy and captured-file provenance, add strong PEM private-key names, and cap Reviewable Paths at 64.
• Pin actions/setup-node v6.4.0 by full commit SHA so CI uses the supported Node 24 action runtime.

Compatibility

• Public presets are skills-only, guidance, and personal; engineering and command-safety remain accepted input aliases.
• Baseline v4 and Summary revision 5 remain the current formats; this release adds no Baseline v5 or Summary v6.

Verification

• Local make check: 184 tests passed with 2 environment-dependent skips.
• Local Codex CLI 0.144.2 compatibility smoke passed without install side effects.
• PR #10, PR #11, and merged-main CI run 29461951922 each passed all seven Linux, macOS, Windows, and Codex jobs.

Full details are in CHANGELOG.md and the accepted Personal Core product-boundaries decision record.

Rootloom Personal Core 3.2.0

Rootloom Personal Core 3.2.0 closes the reviewable-path capture and privacy boundary.

Fixed

• Reject ignored, assume-unchanged, skip-worktree, hardlinked, and case-ambiguous reviewable targets at Intake and during stable capture.
• Treat DER as ambiguous secret material and keep common PEM/DER key names non-overridable.
• Expose the Intake-sealed reviewability paths, policy hash, source, and captured identity/link metadata in Summary revision 5.

Compatibility

• Default baseline v3 and the published baseline-v4 schema remain unchanged.
• Baseline v2, v3, and v4 evidence remains readable and sealable; unsafe declarations now fail closed.

Verification

• Local and clean-clone make check: 181 tests passed with 2 filesystem-dependent skips.
• Codex CLI 0.144.2 compatibility smoke passed locally and in a clean clone.
• PR #9 and exact merged-main run 29427110772 each passed all seven Linux, macOS, Windows, and Codex CI jobs.

Full details are in CHANGELOG.md and the accepted material/capture decision record.

Rootloom Personal Core 3.1.0 — Precise Sensitive Material Review

Rootloom Personal Core 3.1.0

3.1.0 refines Sensitive Material review policy so privacy quarantine remains strict without hiding ordinary reviewable security configuration.

Highlights

• Classifies exact environment-secret forms (.env, .envrc, and non-template .env.<name>) as material while keeping .env.example, .env.sample, .env.template, and .env.dist patch-readable and high risk.
• Keeps public certificate formats (.crt, .cer, .der, .p7b, and .p7c) patch-readable and high risk; private keys and keystores remain metadata-only.
• Adds Intake-only begin_review.py --reviewable-path FILE for exact, existing, regular non-symlink files. The sealed declaration can downgrade ambiguous material such as a public .pem, but cannot override strong secrets or declared Sensitive roots.
• Emits opt-in rootloom-change-baseline-v4 only when reviewable paths are declared. Default Intake remains baseline v3, and readers/sealers/Finalizer accept v2, v3, and v4.
• Clarifies refusal diagnostics for a symlink target versus a symlinked parent component following release-review feedback.

Verification

• Candidate clean-clone and final post-review local make check: 174 tests passed; one environment-only non-UTF-8 filename test skipped on the current macOS volume.
• Corrected release PR #8 run 29408409629 passed all seven Linux, macOS, Windows, and Codex CLI jobs after review feedback was fixed.
• Merged main run 29408654603 independently passed the same seven jobs before tagging.
• Annotated v3.1.0 peels to release commit 4e010ea26c871a603a955b88ede8c5cea5066572.

See CHANGELOG.md for the complete compatibility and security notes.

Rootloom Personal Core 3.0.0

Rootloom Personal Core 3.0.0 separates privacy quarantine from security-domain review and completes aggregate capture resource bounds.

Highlights:

• Secret material and security-domain source now use separate classifiers. Files such as src/auth/token.py remain patch-readable and raise risk, while .env*, private keys, credential material, and explicit sensitive roots remain metadata-only.
• CamelCase secret material such as clientSecret.json, apiToken.json, and serviceAccountKey.json is classified consistently after targeted Git discovery.
• Stable repository capture now has one finite 90-second default monotonic deadline across both consistency passes, in addition to the independent per-Git-command ceiling.
• Summary revision 5 adds stable evidence_complete, capture-limit/duration evidence, and identity-neutral intake-sealed / workflow-sealed provenance.
• Baseline v3 is now produced; valid baseline v2 evidence remains readable and sealable.
• Public JSON/CLI SemVer rules are now explicit. This is a Major release because provenance enum values and the newly produced persisted baseline format intentionally change public contracts.

Verification:

• Local make check passed 164 tests with one environment-only non-UTF-8 filename skip on the current macOS volume.
• make compatibility-smoke, make validate, and git diff --check passed.
• A clean governed replay returned REVIEW_EVIDENCE_COMPLETE, evidence_complete: true, complete claim binding, and a valid hash chain for the exact release patch.
• Release PR CI and merged-main CI both passed Linux Python 3.11–3.14, macOS, Windows, and Codex CLI compatibility contracts.

See CHANGELOG.md and docs/decisions/2026-07-15-sensitive-material-and-capture-bounds.md for the complete contract and migration details.

Rootloom Personal Core 2.4.0

Rootloom Personal Core 2.4.0 makes Strict Review evidence-honest and resource-bounded.

Highlights:

• Summary revision 4 reports REVIEW_EVIDENCE_COMPLETE only for a complete sealed evidence chain plus an explicit operator assertion; redacted evidence remains review-blocking.
• Git capture now shares bounded process-tree ownership, finite time/output ceilings, closed stdin, and cross-platform descendant cleanup.
• Sensitive discovery uses targeted case-insensitive pathspecs with separate candidate and classified-result budgets.
• Dirty-baseline attribution now drives scope, risk analysis, and bundle patch construction consistently.
• Contract sealing gains exact, no-overwrite recovery for interrupted publication.
• Windows Job Object accounting receives a bounded post-exit convergence grace, verified by the Windows CI runner.

Verification:

• 156 repository tests pass locally (one environment-only non-UTF-8 filename skip on the current macOS volume).
• Release PR CI and merged-main CI both pass Linux Python 3.11–3.14, macOS, Windows, and Codex CLI compatibility contracts.

See CHANGELOG.md and docs/decisions/2026-07-15-evidence-honest-strict-review.md for the complete contract and migration details.

Rootloom Personal Core 2.3.0

Rootloom Personal Core 2.3.0

This release makes action authorization easier to understand and reuse, while keeping high-risk operations explicit.

Highlights

• Adds three authorization modes: Single Action, Standard Access, and Full Access.
• Standard Access can persist across tasks for ordinary, non-high-risk operations.
• Full Access remains limited to the current task and declared scope.
• Keeps the platform approval system authoritative and prevents plugin guidance from duplicating prompts.
• Replaces the old architecture artwork with separate, version-neutral English and Chinese professional diagrams.
• Refreshes README, setup, architecture, brand, decision, compatibility, and validation documentation.

Verification

• Repository validation passed.
• Compatibility smoke passed.
• 145 repository tests passed; one pre-existing conditional test was skipped.
• GitHub CI passed on Python 3.11–3.14, macOS, Windows, and the pinned Codex CLI contract job.

Install or upgrade

codex plugin marketplace upgrade rootloom
codex plugin add rootloom@rootloom

Rootloom Personal Core 2.2.2 — Governed Evidence Hardening

Added

• Transactional review intake with editable draft contracts, explicit immutable sealing, strict evidence JSON, and hash binding across baseline, manifest, final contract, and seal.

Changed

• Strict VERIFIED_CHANGE now requires two identical bounded captures, unchanged HEAD/ref/index, post-verification evidence revalidation, structured sealed claims, and an explicit semantic-review assertion.
• Strict review uses quality exit codes by default; --strict-bundle-only remains the explicit nonblocking path.
• Risk analysis includes bounded non-sensitive untracked text, repository globs are segment-aware, and legacy evidence remains self-declared compatibility input.

Fixed

• Sensitive replacements, renames, nested paths, and newly ignored additions are quarantined before ordinary content reads, including after verification.
• Intake, baseline, seal, evidence, and bundle paths reject symlink redirection plus worktree/Git-common-directory containment.
• Stale summaries, mixed-time captures, partial command execution, nonexclusive intake publication, and Windows fallback/test portability no longer overstate review quality.

Verification

• Local make check: 144 tests passed, 1 platform-conditional skip.
• Local compatibility smoke passed with no install side effects or rollback leftovers.
• PR #4 and merged main CI passed Linux Python 3.11–3.14, macOS, Windows, and Codex CLI contracts.

Rootloom Personal Core 2.2.1

Fixed

• Require operator-sealed begin-review manifests before strict review output can claim VERIFIED_CHANGE; self-declared or after-the-fact baselines now remain MECHANICALLY_VERIFIED.
• Reject symlinked baseline inputs before content hashing/parsing by reading baseline evidence through no-follow descriptor validation.
• Report detached_descendant_possible: true with isolation: process-group-only, avoiding overclaims about process containment.
• Treat transient Windows lock-create PermissionError as a busy cooperative lock so concurrent Project Memory writers retry instead of dropping an update.

Verification

• Local: make check passed (92 tests, 1 skipped).
• GitHub Actions for PR #2 passed: Linux Python 3.11, 3.12, 3.13, 3.14; Portable contracts on macOS and Windows; Codex CLI contracts.