v2.0.3

v2.0.3 — Security patch and public-repo polish

No kernel or schema changes. Framework PROTOCOL_RULES.md version stays at 2.0.0.

Fixed

• Path traversal in migrate_to_v2.py (security): --actor, --agent, LEAD_PROTOCOL_ACTOR_ID, and LEAD_PROTOCOL_AGENT_ID values are now validated before being used to construct .agents/local/<actor>/<agent>/. Values containing /, \, :, .., absolute paths, or drive letters are rejected with a clear error message. A belt-and-suspenders destination check verifies the resolved path stays under .agents/local/. New TestSlugValidator and TestCheckSlugDestination test classes added.

Changed

• README.md Quick Start now clones v2.0.3 with a comment directing users to the Releases page for the current version number. PowerShell Copy-Item block added for Windows users. Version history updated to include 2.0.2 and 2.0.3.
• SECURITY.md scope corrected: supported surface is the scaffold, schemas, docs, validator, and migration tool. CLI and MCP server noted as planned. Supported versions table updated.
• CONTRIBUTING.md updated: CLI/MCP noted as planned surfaces accepting design input via issues.
• CI workflow permissions: contents: read added to state-validation.yml.

Upgrading

No migration needed. Replace framework files verbatim per the standard patch upgrade procedure in README.md §Upgrading.

v2.0.2

Lead Protocol v2.0.2 — Documentation overhaul

A documentation-only patch release. No kernel, schema, or tooling changes — the framework PROTOCOL_RULES.md version stays at 2.0.0. This release makes the protocol far easier to approach for newcomers without losing any depth for developers.

What changed

• Opening rewritten for non-technical readers. The tagline is now a plain-language analogy — a shift-change logbook for your AI coding assistants — and "The problem" opens with a concrete, relatable scenario instead of a list of engineering verbs.
• Jargon tucked away, not removed. The mem0/LangGraph comparison, the agent-stack diagram, the actor×agent concurrency detail, and the pre-1.8.0 version history are now in collapsible <details> blocks labeled For developers — beginners are not blocked, developers still find everything.
• Solution described by everyday use. Each state file is explained by what it does for you (handoff = current state, decisions = why, lessons = mistakes not to repeat), and the folder layout is shown immediately, so the product is visible before the install steps.
• Clearer versioning guidance. "Checking which version you have" now explains that PROTOCOL_RULES.md records the kernel version (a floor, not the release number) — e.g. this release ships kernel 2.0.0 — and that the installed release is the top entry of CHANGELOG.md.

Fixes

• Removed an orphaned "Option 2" heading left after the duplicate git clone block was merged into Quick start.
• Retargeted the operational-manual link to .agents/CORE_RULES.md.
• Preserved the CHANGELOG.md → README.md#version-history back-reference by collapsing (not moving) the old version history.

Install

git clone --branch v2.0.2 --depth 1 https://github.com/mmilanez/lead-protocol.git /tmp/lp
cp -R /tmp/lp/.agents   your-project/.agents
cp    /tmp/lp/CLAUDE.md  your-project/CLAUDE.md
cp    /tmp/lp/AGENTS.md  your-project/AGENTS.md

Full details in CHANGELOG.md.

v2.0.1

Lead Protocol v2.0.1 — Clean public scaffold

Lead Protocol v2.0.1 is the first clean public scaffold for the v2.0
protocol line. It packages the file-based operating protocol, state
schemas, validation helper, and v1-to-v2 migration helper.

No CLI or runtime service is required. A CLI and MCP server are planned,
but this release is intentionally simple: copy the scaffold into a project,
customize PROJECT_RULES.md, and validate the state files.

What's included

• Three-layer state model: Framework, Project, and Actor x Agent.
• Per-pair handoff state under .agents/local/<actor>/<agent>/.
• Append-only decision log in .agents/decisions.jsonl.
• Curated project history (JOURNAL.md) and queryable lessons (LESSONS.md).
• JSON Schemas for state validation.
• validate_state.py for local and CI validation.
• migrate_to_v2.py for consumer repositories upgrading from v1.x.
• GitHub issue templates, PR template, and state-validation workflow.

What's fixed in v2.0.1

• migrate_to_v2.py --dry-run is now accepted. MIGRATION-v2.md
  documented this flag; the tool previously rejected it. Now it works as
  an explicit no-op alias for the default (no --apply) behavior. Passing
  --dry-run --apply together errors out cleanly.
• First-ever migration no longer false-positives on pristine
  LESSONS.md. The previous rerun-safety heuristic detected the
  example heading inside the template scaffold's code block and refused
  the migration. Replaced with byte-for-byte comparison against the
  template scaffold.
• MIGRATION-v2.md Step 3 now leads with an agent-driven example
  (--apply --yes) and a prominent callout explaining why. The previous
  structure buried the --yes requirement, causing automated agent
  sessions to hit the interactive confirmation prompt and hang.
• MIGRATION-v2.md warns about the --agent slug. The slug you pass
  during migration seeds pair-local continuity (local/<actor>/<agent>/)
  permanently. Passing the wrong slug (e.g., --agent claude while
  running Codex) means the next session reads from the wrong pair.

What's unchanged

• No kernel rule changes. PROTOCOL_RULES.md, CORE_RULES.md, and
  all module files are byte-identical to v2.0.0.
• No state-file schema changes. Consumer repos already on v2.0.0 do
  not need to do anything.
• No CLI yet. The lead-protocol CLI remains planned roadmap work.

Installing v2.0.1

git clone --branch v2.0.1 --depth 1 https://github.com/mmilanez/lead-protocol.git /tmp/lp
cp -R /tmp/lp/.agents   your-project/.agents
cp    /tmp/lp/CLAUDE.md  your-project/CLAUDE.md
cp    /tmp/lp/AGENTS.md  your-project/AGENTS.md
cd your-project
python .agents/scripts/validate_state.py

See README.md §Installing a specific version.

Upgrading from v2.0.0

Already on v2.0.0? Re-copy these two files from the v2.0.1 tag — that is
the full upgrade:

cp /tmp/lp/.agents/scripts/migrate_to_v2.py your-project/.agents/scripts/migrate_to_v2.py
cp /tmp/lp/docs/MIGRATION-v2.md             your-project/docs/MIGRATION-v2.md

No state migration needed; no config change.

Why this release exists

The first external-style consumer migration surfaced these issues in real
use. The consumer got through the migration, but several steps required
manual intervention that the documentation did not anticipate. v2.0.1
closes those gaps so the next consumer can follow the guide literally
without improvisation.

Full changelog: CHANGELOG.md