v0.5.0 — cold archive, gc, evidence assurance

Capacity governance round: a lossless cold archive, explicit garbage
collection, graded evidence assurance and a one-command upgrade.

Breaking changes

• verified is stricter. The verification record of coverage and handoff
  now has a mandatory references check and an assurance grade
  (claimed < ref_resolved < ref_bound < externally_checked).
  verified=true additionally needs every contributing evidence reference at
  ref_resolved or better; a free-text or missing-path reference reports
  verified=false with reason=evidence_self_reported and the self-reported
  evidence ids. Reports that were true for plain-text references become
  false. The completion gate is unchanged: a claimed pass still lets a task
  become done.
• init writes project-continuity/v6. init --schema v2 keeps the legacy
  inline format. Builds before 0.5.0 refuse v6 by name.
• status, handoff and coverage report an absent writer or lease as JSON
  null instead of the string "null".
• On v6, "extensions": {"key": null} archives and removes that key instead
  of storing a null value. Managed keys are refused.

Added

• Schema project-continuity/v6 with a cold archive. A write that stays at
  or above the trigger after receipt compaction moves a referentially closed
  set (finished tasks, resolved blockers, and the evidence, decisions and
  corrections bound only to them) into content-addressed archive records,
  oldest first, until it is below the target. Nothing is deleted: the archive
  is part of the logical state, migrate_compare.py folds it back in, and
  --verify-integrity re-hashes every archived object.
• archive command: page through the archive or print records verbatim with
  --id. status and handoff carry an archive summary.
• migrate --to-v6 (from v5) and migrate --to-latest, which previews the
  whole remaining chain and applies every step as its own source-bound commit.
• gc command: a report by default; --apply needs the live lease and
  deletes history snapshots beyond --keep-history (default 50) and objects
  that neither CURRENT nor a kept snapshot reaches. Receipt segments and
  unrecognized files are never collected; an unparseable hand-named snapshot
  blocks object collection.
• prune (explicit, referentially closed deletion of enumerated records) and
  the verification-frequency rule ADR-T004-007, both previously shipped only
  in local installs.
• examples/evidence.json, a complete evidence patch for the example task.

Fixed

• Receipt compaction no longer thrashes. A document above the trigger whose
  receipts could not reach the target wrote one tiny segment per commit (one
  real project accumulated 208 segments). Receipts now move only in batches of
  at least 16, when the hard limit forces it, or on compact --apply; v6
  keeps 16 inline instead of 32.
• Index leaves are written 16 entries wide, so appending one record rewrites
  one small leaf and its ancestors instead of a whole wide leaf (about 24 KiB per
  evidence append before). Wide leaves written by 0.4 stay readable.
• Field errors name the missing fields and count the unexpected ones without
  echoing values; identifier errors name the field; symlink refusals name the
  offending path; a read-only .relay is reported as such.
• Hand-written v1 documents with empty writer:/lease_until: lines are read
  as having no lease.
• capacity models growth for v2/v3 documents and for projects whose first
  task is finished, instead of reporting the model as unavailable.
• The package allowlist now contains every test module, and a test enforces it.
• The Git fingerprint budget is 256 MiB (was 64 MiB).
• Windows: object names reachable from a document are /-separated on every
  platform, which repairs export and lets gc find reachable objects; the
  custom Markdown region of a v5/v6 document is read from CRLF files (for
  example a Git autocrlf checkout) like the managed blocks already were.

Migration notes

• Run migrate --to-latest (dry run), review the steps, then apply with the
  reported --source-sha256. Back up .relay/ first. v1 conversions still
  set mapping_review_required and stay UNVERIFIED until reviewed.
• After a migration, recover --snapshot accepts only snapshots of the new
  schema; older snapshots remain readable files.
• Expect verified=false with evidence_self_reported where evidence points
  at free text; point evidence at files inside the project, at relay objects,
  or acknowledge external checks explicitly.

SHA-256 of project-continuity-v0.5.0.zip: 5b44271bb964ed960c21cded18655a9f9cac2fad63191d51cc2469195d41a085

v0.2.0 — automatic receipt capacity governance

Project Continuity v0.2.0

Features

• Explicit v2-to-v3 migration with source hash, revision CAS and no active lease.
• Automatic lossless receipt capacity governance at 80% of the 64 KiB limit;
  retain the newest 32 receipts after governance and preserve all business data.
• Compact managed rendering, full candidate budgeting, and read-only previews.
• Archived operation retries, integrity validation, recoverable commit ordering.
• Controlled export/verify handoff bundles and per-write manual capacity mode.

Compatibility

Existing v2 projects are not automatically migrated. v3 requires a receipt-aware
client; old clients reject v3. CURRENT remains the only editable current progress
source. Safe cross-machine continuation also requires the reachable receipt
archives. Use a verified handoff bundle, not a copy of CURRENT alone.

Verification

66 tests cover lifecycle, capacity growth, leases/CAS, Git drift, archived retries,
storage fault injection, security boundaries and clean extracted-package execution.
The release commit is tested on macOS/Linux/Windows × Python 3.11/3.12/3.13.
CI: https://github.com/seriousz158/project-continuity/actions/runs/34184645027

A private historical-snapshot rehearsal completed migration and cross-writer
handoff while retaining business records and custom Markdown. Pending business
patches were NOT applied and no live project cutover was performed.

Limitations and recovery

64 KiB is still a hard CURRENT limit; business growth may require explicit review.
Archive validation is linear in committed history, archives are never automatically
deleted, and locks are local rather than distributed. Status/validate diagnose
missing archives; restore them from verified backups rather than editing managed
state. See references/commands.md and references/protocol.md.

Disk installation, client discovery and actual model-session reload are different
verification levels. No active client restart, automatic project migration,
background watcher, DSH modification or live paid experiment is included.

Pinned CI actions currently emit a Node.js 20 deprecation warning while GitHub
runs them on Node.js 24; the warning is non-blocking and tracked as maintenance.

Remote clean clone, re-downloaded release archive (SHA-256 verified), and local
installed directory each passed 66 tests. Seven configured local entrypoints
were verified against the 29-file package; no active client was restarted.

v0.2.0-rc.1 — receipt capacity governance (CI blocked)

Candidate only — cross-platform validation blocked

This is a prerelease, not the stable v0.2.0 release. Existing installations and
active projects have not been upgraded or migrated.

Changes

• Explicit v2 → v3 migration with source hash, CAS and no active lease.
• Transactional lossless receipt archives at 80% capacity; retain latest 32
  after governance, with compact managed rendering as a fallback.
• Archived operation retries, integrity checks, typed progress preservation.
• Shared candidate budgeting and fully parameterized read-only previews.
• Controlled handoff export/verify and manual capacity mode.

Verification

• 66 local tests, including 700 sequential growth updates, fault injection,
  archived retry, handoff validation, and clean extracted-package tests.
• Remote clean clone and re-downloaded release archive each passed 66 tests;
  the downloaded SHA-256 matches the published sidecar.
• Historical private snapshot rehearsal completed without applying pending
  business changes or changing the active project. This is not live cutover.
• GitHub CI run 34181254480: all nine jobs were prevented from starting by
  an account billing lock. No macOS/Linux/Windows matrix success is claimed.

Compatibility and recovery

v2 remains readable and writable with its original capacity behavior. Explicitly
migrate before enabling v3; old clients reject v3. CURRENT remains the only
editable progress authority. Safe cross-machine continuation also requires its
reachable receipt archives. Never resolve conflicts by picking the newest file.
Use status/validate, restore missing archives from a verified backup, and consult
references/commands.md and references/protocol.md. Do not hand-edit managed state.

Limitations

CURRENT retains a hard 64 KiB limit. Business data can still exceed it. Archive
validation is linear in history, archives are not automatically deleted, and
local locks are not distributed locks. No background watcher, DSH changes, model
calls, or automatic Git actions are included. Stable release and client rollout
remain gated on cross-platform CI and final release verification.

Project Continuity v0.1.1

Project Continuity v0.1.1

Documentation-focused patch release. The CLI and project-continuity/v2 state protocol are unchanged; existing v2 files require no migration.

What's changed

• Redesigned the English and Chinese READMEs around the single-file continuity workflow.
• Added a Mermaid lifecycle diagram and clearer quick-start/common-workflow examples.
• Added concise model, guarantees, compatibility, installation, migration, and safety sections.
• Clarified that project progress, source artifacts, and historical evidence remain separate concerns.

Verification

• GitHub Actions: macOS, Linux, and Windows with Python 3.11, 3.12, and 3.13 (9/9 jobs passed).
• 52 tests passed in the release commit's clean remote checkout.
• The deterministic 28-file source archive passed the same 52 tests after extraction.
• Skill structure validation passed for both the remote checkout and extracted archive.
• The release asset is accompanied by a SHA-256 sidecar.

Compatibility and limits

• No CLI or protocol behavior changes from v0.1.0.
• The private ToFu migration remained an isolated rehearsal; this release does not migrate or modify any live project.
• Writer leases coordinate a shared local directory only, not distributed machines.
• Git drift detection and secret scanning are guardrails, not security boundaries.
• No watcher, background service, database, cloud service, transcript archive, or automatic Git push is added.

Project Continuity v0.1.0

Project Continuity v0.1.0

First stable release of the project-continuity/v2 structured project-progress Skill and standard-library-only CLI.

Added

• One authoritative .relay/CURRENT.md with embedded JSON and a derived Markdown view.
• Stable task, blocker, evidence, decision, next-step, and project-extension records.
• Explicit init, status, validate, resume, update, save, migrate, and recover commands.
• Revision CAS, writer leases, idempotent operation receipts, local locks, history snapshots, and atomic replacement.
• Git baseline/drift classification and evidence review status.
• Deterministic allowlisted Skill archive with SHA-256 sidecar.

Compatibility and verification

• GitHub Actions: macOS, Linux, and Windows on Python 3.11, 3.12, and 3.13 — 9/9 jobs passed for commit 2b7e1c50ce579a4aed50256ec5e6a4d1b66aeba1.
• Source checkout: 52 tests passed and Skill validation passed.
• Clean extracted archive: 52 tests passed and Skill validation passed.
• A private isolated complex-project rehearsal preserved the full verifier result with zero migration-added failures. Existing business failures remained; no live project cutover was performed or authorized.

v1 to v2 breaking change

v1 remains read-only. Run migrate for a dry-run preview, then use migrate --apply only with the preview's exact source hash. Applied migration remains UNVERIFIED until project-specific field mapping and every active reader are reviewed and cut over. Do not dual-write old and new authorities.

Known limits

• File locks coordinate only processes sharing the same local directory; they are not distributed locks.
• Git sharing is opt-in. The tool never commits, pushes, scans directories in the background, starts a watcher, calls a model, or performs deployment/external work.
• Secret detection is a defensive guard, not a complete redaction system.
• CI and disk installation do not prove that an already-running client has hot-loaded the new Skill.

Recovery

Use status and validate first. recover is explicit, requires an expired lease and expected revision, and repairs only supported recovery cases. Current files and immutable history snapshots remain local unless the user intentionally shares CURRENT.md.