v0.41.0

Added

• kac restore sends a personal access token as Basic auth where KAC_REGISTRY_USER is set. Azure Artifacts
  takes a personal access token in no other form, so a restore from your own machine was refused. Set
  KAC_REGISTRY_USER to any name, and KAC_REGISTRY_TOKEN to a token with the Packaging (Read) scope. Where
  KAC_REGISTRY_USER is unset, kac sends the token as a bearer token, which is what a pipeline's own token needs. A
  refused read and an empty version listing each name both variables.

Changed

• corpus-retrieval, raise-finding and request-deviation say what they hand you without gh or az. Each
  names the client it runs at the top, and its fallback section lists the cases that section covers: a client that is
  not installed, and a session that cannot run a command. raise-finding and request-deviation print the whole body
  for you to file by hand, and corpus-retrieval asks you for the section it needs.
• Each lookup skill lists what travelled. kac new, kac update and kac bundle send lookup skills that answer
  "which standards are there?" and its like for policies, glossary terms, controls, processes and fixes.
  standards-lookup reads the build index, and the others group their flat file or list their folder. Each counts an
  inherited record, answers with ids and titles, and reads the record to test whether a sentence is already stated. A
  question about what nothing covers goes to ask-the-corpus.

Fixed

• controls-lookup declares the reports it reads. It answers a question about the whole corpus from a report, so
  its plugin.json entry lists reports@2 under optional. Where the export includes reports at another shape,
  kac bundle refuses the plugin until the entry names that shape. Add "optional": ["reports@2"] to the
  controls-lookup entry of your plugin.json.
• Both starter pipelines run kac restore before validate. A new corpus can declare consumes: with no edit
  to its pipeline. Where consumes: is empty, the step prints that there is nothing to restore and succeeds. The
  GitHub starter grants packages: read and passes github.token as KAC_REGISTRY_TOKEN to the restore and
  validate steps, so validate checks each lock against the feed. The Azure starter passes $(System.AccessToken).
  Each header comment names the feed permission a package from another repository or project needs.
• The template's build-index hook prints the build index to each subagent, and again after a compaction. It
  printed once for each session id, so a subagent never received it, and a compaction kept the id and silenced it.
  The hook now keeps a marker for each agent, named <session_id>.<agent_id> for a subagent. A new SessionStart
  entry matching compact runs it with reset, which deletes the session's markers, so each agent's next tool call
  prints it again.