v0.9.0

Added

• Versioned, Zod-enforced HTTP contract for the viewer endpoints (P6). The
  seven viewer endpoints plus new GET /api/health and GET /api/freshness are
  now a versioned contract (contract version: 1, decoupled from the package
  semver). One Zod schema per response in
  src/mcp-server/api-schemas.ts is the single
  source of truth: it validates at runtime, derives the TS type via z.infer, and
  generates the committed JSON Schema docs under docs/api/ (via
  scripts/gen-api-schemas.ts, npm run gen:api-schemas),
  guarded by a byte-identity drift test. A respond() chokepoint
  (src/mcp-server/api-respond.ts) validates every
  payload (throw in test/CI or under CORTEX_API_STRICT=1, else log-and-send) and
  stamps the version/freshness/ETag headers. Decision D-tszm;
  design,
  onboarding doc.
• Freshness over HTTP — a two-signal model: an ETag derived from the index
  baseline drives If-None-Match → 304 conditional revalidation on the data
  endpoints, while an X-Cortex-Freshness header + a lightweight GET /api/freshness
  carry the live staleness verdict (reusing freshnessForContext). Lets a consumer
  (Mesh) replace its blind TTL cache with verdict-keyed revalidation.
• HTTP hardening, env-gated and inert by default — loopback-default bind
  (CORTEX_BIND_HOST), GET/HEAD method gate, CORS origin allowlist
  (CORTEX_CORS_ORIGINS), opt-in constant-time bearer auth (CORTEX_API_TOKEN,
  /api/health exempt), traversal-safe static serving, security headers
  (CSP / X-Frame-Options / nosniff / Referrer-Policy), oversized-request-target
  → 414, and request/headers timeouts. The CSP permits the viewer's Geist web
  fonts while keeping script-src 'self'.

Changed

• All viewer endpoint responses now carry a top-level version field (additive —
  Mesh M1's existing reads are unaffected); GET /api/decisions/:id is wrapped as
  { version, decision }. The viewer HTTP server now binds 127.0.0.1 by default
  (was all interfaces).
• The hand-written AdaptedDecision / GovernsRef / FileEdge TypeScript
  interfaces are now derived from the Zod schemas via z.infer (single source of
  truth). New env vars: CORTEX_BIND_HOST, CORTEX_API_TOKEN, CORTEX_CORS_ORIGINS,
  CORTEX_API_STRICT.

v0.8.0

The cycle: Cortex grows from a code-graph MCP server into a decision-provenance
system with a 2D frames viewer, and the native indexer is split into its own
repository and consumed as a prebuilt binary. This is the structural / data /
provenance half of the new design; the "multiplayer canvas" half is descoped (see
Removed), and the remaining single-player items (TODO entity, floating-entity
placement, record drawer for TODOs) are deferred to 0.8.5.

Added

Decision provenance

• Durable decision store (.cortex/decisions.db, relocated to the per-repo durable
  store under ~/.cortex/<repo-id>/) that survives every reindex — decisions are
  never overwritten by the derived graph.
• Decision tools: create_decision, update_decision, propose_decision,
  promote_decision, supersede_decision, link_decision, get_decision,
  search_decisions, why_was_this_built, decision_candidates, delete_decision.
• Decision links key on stable string qualified-names / file paths / PR numbers,
  not graph node IDs, so they survive re-indexing.
• Reconciliation engine (flag-gated behind CORTEX_RECONCILE): hashes the
  working-tree source a decision governs, lets the agent judge match/partial/drift,
  and projects a derived display_state (active / active · drifting / stale).
  Tools record_reconciliation, pending_reconciliations; on-read drift block.
• Cold-start seeding (seed-decisions skill + decision_candidates): frames
  decision candidates from git history + docs for human ratification on a freshly
  indexed repo.

Frames

• Frame-extraction pipeline: tf-idf + HDBSCAN clustering, co-change signal,
  framework-aware tokenisation, auxiliary-content detection, two content streams,
  and graph integration.
• Frame ranking — Path 1: a deterministic, taxonomy-free budget-cut ranker
  (score = nameability × structural_weight) plus a seeded d3-force gravity layout
  behind /api/frames.
• Frame coverage: HDBSCAN min_samples retune + graph-reclamation of residual
  noise to its most-connected cluster — measured semantic-file coverage 29% → 88%
  on the Cortex graph.

2D frames viewer

• Live viewer (/viewer) wired to /api/graph, /api/projects, /api/decisions,
  /api/frames, with a project switcher, force-directed frame layout, and
  decision governance pills + record drawer (decision card / marginalia) on the
  focused frame.

Native indexer (now a separate project)

• The indexer ships as a prebuilt binary fetched at postinstall
  (scripts/fetch-indexer.mjs) from a cortex-indexer GitHub release, pinned by
  CORTEX_INDEXER_VERSION, checksum-verified and cached, with a lazy runtime
  version guard (ensureIndexer). CORTEX_INDEXER_PATH overrides for local dev.
• Cross-repo binary contract (--version JSON, cli <tool> <json>, CORTEX_DB
  staging target, release asset naming) recorded as a decision in cortex-indexer.

PR data model

• PR schema + tools (open_pr, add_pr_touch, merge_pr, get_pr); data only,
  not yet rendered on canvas.

Graph storage & multi-project

• Per-repo canonical graph store .cortex/db + a machine-wide project registry
  under the XDG data home; durable metadata separated from regenerable cache.
• MCP multi-project routing: every tool takes an absolute repo_path; decisions
  and graph reads/writes route to the addressed repo instead of pooling into the
  server's home repo.

Changed

• Indexer distribution: replaced the in-tree C build (internal/indexer/ +
  scripts/build-indexer.sh, postinstall compile) with the prebuilt-binary fetch.
  Cortex is now pure TypeScript/MCP and needs no C toolchain to install.
• Graph publish path: reindex now builds into a private staging DB and publishes
  into .cortex/db via a single libsqlite3 WAL transaction (publishStagedDb),
  so the long-lived MCP handle never sees a corrupt/out-of-band rewrite
  (supersedes the former in-place truncate).
• cortex git history was rewritten to sever the codebase-memory-mcp/CBM fork
  lineage; that lineage is preserved in cortex-indexer.

Fixed

• Viewer decisions were not project-scoped: /api/decisions (list + :id) read
  from the server's startup-bound home repo, so the viewer showed the home project's
  decisions for every project. Now resolves the requested project's own decisions
  store (openProjectDecisions).
• Decision-governed frames could be invisible: a decision governing a frame the
  ranker left non-ambient had no on-screen frame to attach to. Such frames are now
  promoted into the render set (withGovernedFramesRendered) so their decisions
  always surface. (Stopgap ahead of the 0.8.5 floating-entity work.)
• Removed the legacy CBM_BINARY_PATH alias and all cbm naming residue from the
  cortex tree.

Removed

• Multiplayer scenario DSL (spec §9.3) and the multiplayer canvas chrome
  (merge animation, agent cursors) are not being pursued.
• codebase-memory-mcp MIT attribution moved out of cortex (into cortex-indexer,
  where the derived code now lives); cortex is wholly proprietary.

Deferred to 0.8.5

• TODO entity (schema, state machine, tools, external bridge) — the headline
  0.8.5 feature.
• Floating-entity placement of post-reclamation residual nodes + aggregates.
• Record drawer adoption for TODOs (the drawer already ships for decisions).