temper v0.6.3

What's Changed

• chore(release): roll the register for v0.6.2 by @jcoletaylor in #1181
• ci: move macOS release runners from macos-14 to macos-15 by @jcoletaylor in #1182
• chore(deps): the web on TypeScript 6 and vitest 5, and its toolchain majors held by hand by @jcoletaylor in #1183
• chore(deps): Bump the ts-clients group across 2 directories with 1 update by @dependabot[bot] in #1184
• chore(deps): Bump the agent-workflows group across 2 directories with 2 updates by @dependabot[bot] in #1185
• fix(deps): take the patched webpki crates; the 0.26 shim's advisory ignored as not exposed by @jcoletaylor in #1197
• chore(deps): Bump the bun-workspace group with 5 updates by @dependabot[bot] in #1186
• ci: headroom for the guard and Rust Quality jobs, and hold TypeScript majors for the TS clients by @jcoletaylor in #1195
• chore(ci): Bump taiki-e/install-action from 2.87.28 to 2.87.29 in the actions group by @dependabot[bot] in #1187
• chore(deps): Bump the cargo group across 1 directory with 3 updates by @dependabot[bot] in #1188
• chore(deps): Bump tower-http from 0.6.8 to 0.7.1 by @dependabot[bot] in #1191
• chore(deps): Bump similar from 2.7.0 to 3.2.0 by @dependabot[bot] in #1192
• chore(deps): Bump dirs from 5.0.1 to 7.0.0 by @dependabot[bot] in #1190
• chore(deps): Bump jsonschema from 0.45.0 to 0.49.9 by @dependabot[bot] in #1189
• temper-design: the theme contract and its themes move into the monorepo, checked in core CI by @jcoletaylor in #1196
• fix(query): the act registry declares MCP as serving the acts run_query reaches by @jcoletaylor in #1194
• chore(deps): Bump vite from 7.3.6 to 8.3.4 in /packages/agent-workflows/steward by @dependabot[bot] in #1199
• chore(deps): Bump vite from 7.3.6 to 8.3.4 in /packages/agent-workflows/mention by @dependabot[bot] in #1200
• fix(shapes): a shape schema never makes the server fetch anything by @jcoletaylor in #1193
• feat(data-artifacts): the per-resource artifact list is bounded by @jcoletaylor in #1201
• release: temper-design rides the npm lane as a --design leaf by @jcoletaylor in #1202
• design: declare the toolchain majors, and check each surface against them by @jcoletaylor in #1203
• feat(query): what an ask of artifacts may say is decided without I/O by @jcoletaylor in #1209
• chore(deps): Bump tokenizers from 0.22.2 to 0.23.2 by @dependabot[bot] in #1204
• chore(deps): Bump indicatif from 0.17.11 to 0.18.4 by @dependabot[bot] in #1206
• design: the shared rendering modules move into temper-design; the web renders through them by @jcoletaylor in #1210
• feat(data-artifacts): the CLI and MCP artifact list answer one bounded page behind limit by @jcoletaylor in #1211
• design: a withheld video or audio keeps its author's fallback words by @jcoletaylor in #1212
• design: the web's shell paints only contract roles, held there by a shared colour guard by @jcoletaylor in #1213
• feat(query): a refused plan's teaching reaches MCP and CLI callers as structure by @jcoletaylor in #1214
• feat(substrate): the database answers an artifact ask as the reference does by @jcoletaylor in #1215
• design: the resource view onto the roles; markdown paint moves into the package by @jcoletaylor in #1216
• QoL: pin node 24.22.1 (mise and CI) for the 2026-10-21 Node.js security release by @jcoletaylor in #1217
• design: the vault onto the roles; the guard refuses a custom property laundering a private name by @jcoletaylor in #1218
• chore(deps): adopt the open Dependabot majors and close two npm advisories by @jcoletaylor in #1221
• design: the graph onto the roles; the web presents both appearances by @jcoletaylor in #1220
• A shape's by-id read carries askable; asks share one session per request by @jcoletaylor in #1219
• design: core's doc types on the categorical slots; the web paints doc types only through the binding by @jcoletaylor in #1222
• web: bounded lists state their omission through the shared sentence; search arms say whether more follow; references link only once answered for by @jcoletaylor in #1223
• feat(query): find-resources-with narrows by what a resource's data artifacts hold by @jcoletaylor in #1224
• chore(deps): Bump the bun-workspace group with 2 updates by @dependabot[bot] in #1227
• chore(deps): Bump the agent-workflows group across 2 directories with 1 update by @dependabot[bot] in #1225
• chore(deps): Bump askama from 0.12.1 to 0.16.1 by @dependabot[bot] in #1234
• chore(deps): Bump the cargo group across 1 directory with 6 updates by @dependabot[bot] in #1231
• web: the appearance control, identity and Sign out move to a menu at the sidebar's head by @jcoletaylor in #1236
• search: the wide arm says what it drew from; the palette names the draw by @jcoletaylor in #1237
• chore(deps): OpenTelemetry JS 3.0, sha2/askama, and the October Dependabot set by @jcoletaylor in #1235
• register: the search truncated entry no longer claims CLI stdout by @jcoletaylor in #1238
• chore(deps): bump ts-rs from 10 to 12 by @jcoletaylor in #1240
• feat(query): an artifact ask's trace entry carries the population it counted by @jcoletaylor in #1241
• design: one graph geometry and edge grammar; the web draws its graph through it by @jcoletaylor in #1242
• fix(deps,ui): off the cookie and zod advisories on SvelteKit 2; refuse //-leading paths by @jcoletaylor in #1244
• chore: adopt the tasker-systems conventions baseline (deny, audit, clippy, ruff) by @jcoletaylor in #1243
• Body links show the title temper holds; list resources by id by @jcoletaylor in #1245
• ui,design: the web's first view starts from the reader's own work by @jcoletaylor in #1246
• chore(conventions): move the pin to af5ffd1, the generated register by @jcoletaylor in #1247
• feat(data-artifacts): one ask returns the matching artifacts themselves, whole, in bounded pages by @jcoletaylor in #1248
• test(e2e): the adversarial ask walk has CI headroom, measured by @jcoletaylor in #1250
• api,services: a reader's own changes are readable across their places by @jcoletaylor in #1249
• feat(ui): the first view puts the places the reader works in first by @jcoletaylor in #1251
• feat(core): a changed_by=@me row says when the reader last changed it by @jcoletaylor in #1252
• feat(ui): the first view offers a return to the work the reader last changed by @jcoletaylor in #1253
• The web's first view leads with resume and the opening of the work, without the handoff by @jcoletaylor in #1254
• fix(client): trust the OS root store alongside the bundled webpki roots by @jcoletaylor in #1255
• fix(cli): a named vault makes the config file optional by @jcoletaylor in #1256
• fix(shapes): a shape compiles only as a field tree by @jcoletaylor in #1259
• skill: bound enabling work, make the mechanism rule altitude-aware, keep evidence beside the goal by @jcoletaylor in #1260
• fix(cli): accept --goal with any --type on resource list by @jcoletaylor in #1261
• skill: a separability check before two or more child goals land by @jcoletaylor in #1262
• fix(api): an over-size property value is a 400, not a 500 by @jcoletaylor in #1264
• feat(shapes): drain shape-reconcile jobs in production by @jcoletaylor in #1263
• fix(api): an over-long family name and U+0000 in an act's authorship are refused by name, not 500 by @jcoletaylor in #1265
• chore(deps): Bump the bun-workspace group with 5 updates by @dependabot[bot] in #1268
• chore(ci): Bump the actions group with 2 updates by @dependabot[bot] in #1269
• refactor(ask): the schema walk reads only field trees by @jcoletaylor in #1266
• chore(deps): Bump the cargo group with 10 updates by @dependabot[bot] in #1270
• Team authority: reading inherits down the team tree, changing things does not by @jcoletaylor in #1271
• fix(ask): an ancestor's enum or const narrows the paths below it by @jcoletaylor in #1272
• fix(teams): a personal team holds its owner and the owner's machines, and no one else acts on it by @jcoletaylor in #1273
• A soft-deleted team confers nothing by @jcoletaylor in #1274
• fix(teams): temper-system is admin-only for attaching and roster acts, like the gating team by @jcoletaylor in #1276
• feat(authz): personal space is its owner's alone; a system admin acts on it only by erasure by @jcoletaylor in #1275
• A field tree carries format and x-* keys as inert annotations, and a refused schema names the first keyword and path that failed by @jcoletaylor in #1284
• A shape's const and enum values are scalars, and its parsed size is budgeted by @jcoletaylor in #1280
• fix(authz): map authorship follows the admin-only regime; subscribers must be authored by @jcoletaylor in #1277
• fix(ui): sign-in returns a person only to a path on this site by @jcoletaylor in #1279
• fix(register): the soft-deleted-team entry scopes its share claim to people; a test pins the cogmap axis by @jcoletaylor in #1281
• docs(body_hash): define it as chunk-content identity; pin heading-only edits by @jcoletaylor in #1286
• fix(supply-chain): the cargo-audit ignore list matches the lock; the temper-design register entry tells the truth by @jcoletaylor in #1278
• fix(authz): a private cogmap is personal space; one person per map; an admin stopped at personal space is told what they hit by @jcoletaylor in #1285
• fix(ui): a newcomer is told how work arrives, and two first-day dead ends are closed by @jcoletaylor in #1287
• fix(authz): a grant to a machine you registered needs a grant right held in your own name by @jcoletaylor in #1282
• fix(temper-cloud): give Vercel's api/*.ts type check node types, and gate it in CI by @jcoletaylor in #1288
• fix(authz): a non-admin keeps no reach through a machine they control after losing the right by @jcoletaylor in #1289
• fix(standing): a join-request decision moves standing only by a legal transition by @jcoletaylor in #1290
• fix(deps): bump pulldown-cmark to 0.13.6 for RUSTSEC-2026-0433 by @jcoletaylor in #1293
• chore(release): prepare v0.6.3 by @jcoletaylor in #1292

Full Changelog: v0.6.2...v0.6.3