v0.2.2

0.2.2 (2026-09-24)

Features

• dev: --lite / --promote — a running stack is no longer the price of a worktree (45228bd)
• dev: --lite / --promote — a running stack is no longer the price of a worktree [via gsdt] (99270c5)
• dev: derive each session's port band from its name [via gsdt] (6c9e501)
• dev: derive each session's port band from its name, not from a scan at 1 (b7e4f33)
• gryphon: $p IS [NOT] NULL — a predicate on an input alone (tap#360) (f0299ff)
• web: NESTS_UNDER page-to-page edge for an explicit nav parent [via highbar] (84131eb)
• web: NESTS_UNDER page-to-page edge nests a page under an explicit nav parent (efafd54)

Bug Fixes

• auth: owner_only alone was not enough — bind the owner grant by provider TYPE (3746c2e)
• auth: the owner grant claimed (provider, uid) and compared only uid (d314f8b)
• ci: a markdown change is not a bill-of-materials change (1be1c33)
• ci: a markdown change is not a bill-of-materials change [via gsdt] (75a424a)
• ci: bound the exclusion to skill prose, on an existing ruling (1b07232)
• ci: bound the markdown exclusion to tap_boot, and to the declared globs (60fc508)
• ci: redact gate-lean's container logs — an argument is not a control (b3cdda0)
• ci: the BOM declaration named a Dockerfile that does not exist (b8f6d32)
• ci: the BOM declaration named a Dockerfile that does not exist [via gsdt] (7b69642)
• codespaces: command: sleep infinity is required — the previous fix had it backwards (57cd4b1)
• codespaces: a visitor can sign in and a maintainer can SSH in [via demo-dev] (e72cc2a)
• codespaces: devbox never started sshd — command: displaced its entrypoint (577bc24)
• codespaces: pass the Codespaces inputs to web, not just the attach target (e32de7a)
• codespaces: tag@digest is unparseable — and the failure is SILENT, not loud (28271c9)
• codespaces: the login wall sent Codespace visitors to a passkey they cannot use (7ba650c)
• codespaces: the owner gets a role, the boot runs, and the page says what to do (f47fd2c)
• codespaces: trust the localhost origin too, and stop reporting a 403 as unreachable (227cb98)
• dc: check what compose RESOLVES, not what was typed (44a96bc)
• dc: escape seven — pipefail made the fail-closed sentinel fail open (3288020)
• dc: strip quotes like compose does, and stop AC2 claiming an untested boot (c3c9822)
• dc: the gate on the root check was itself an input inspection (ad16504)
• deps: update dependency htmx.org to v2.0.11 (aef89e8)
• deps: update dependency htmx.org to v2.0.11 (4b985de)
• dev: don't source the lite marker; keep it until promote actually succeeds (2e20292)
• dev: validate the promote name; verify the .env.local patch landed (d8f0ced)
• docker: the web container serves unprivileged [via demo-dev] (d96abb9)
• gryphon: a dotted path into dimensions silently returned 0 rows (08290cf)
• gryphon: a variable reused inside ONE pattern was not unified (8960049)
• gryphon: refuse a multi-step path into dimensions (reverses the B2 design) (b2a2947)
• gryphon: the param-null fold subscripts inputs, so an absent param fails closed (bd3e153)
• gryphon: two wrong-answer defects, one new input predicate, and the judge that agreed with both bugs [via gryphon] (1bd183d)
• tests: clear the mypy ratchet and re-stamp two stale implementation claims (76db0f9)
• web: cookie-name cleaning never collides distinct labels (58e30d6)
• web: only row_url_template sets a projection row's _url (01b6943)
• web: per-stack session and CSRF cookie names; scripts read the CSRF token from base.html (8708c9b)
• web: per-stack session/CSRF cookie names; scripts read CSRF from base.html [via highbar] (51f6a08)
• web: row links are judged on the URL the browser parses (9eedf53)
• web: row_url_template's same-origin rule holds at use, not only on save (03a75e3)
• web: the standard table renders a projection search's rows (df1a8c3)
• web: the standard table renders a projection search's rows [via highbar] (1016ad5)

Documentation

• dev: state the invariants; stop citing this PR's own review in the code (9c3762c)
• dimension keys are queried by bracket; a dotted path is refused (tap#781) (96a34d4)
• dimension keys are queried by bracket; a dotted path is refused (tap#781) [via highbar] (0347149)
• drop a citation to a requirement that is not on main yet (5881b91)
• grid: param-null is In Development, not Implemented — it never cleared its gates (db004d4)
• grid: req-grid-dimension-query-form is Implemented (b4bab8f)
• grid: req-grid-dimension-query-form is Implemented [via highbar] (ebf3034)
• readme: a fast path — clone, lite-spawn, describe what you want (cc085b9)
• readme: a fast path — clone, lite-spawn, describe what you want [via gsdt] (70d658b)
• readme: say that /new-project asks before it does anything (83f1e17)
• skills: gryphon-defect-response — the fix-on-the-fly SOP as a skill [via demo-dev] (a55bb65)
• skills: gryphon-defect-response — the fix-on-the-fly SOP, factored out of AGENTS.md (9a698d1)
• skills: icon-badge is the default graph node_style [via highbar] (5310f18)
• skills: icon-badge is the graph node_style unless formally told otherwise (7bac2d5)
• skills: new-project — idea to a running, login-able anchor (1fb1278)
• skills: new-project — idea to a running, login-able anchor [via gsdt] (422a56b)
• skills: new-project pins by commit SHA, not by tag (a5a3b83)
• skills: new-project pins by commit SHA, not by tag [via gsdt] (5fa8545)
• skills: record the PEELED tag SHA, not the tag object (dea87b6)
• skills: work from the contract, not a neighbour; no free-form JSON without a source (4e1fbe4)
• skills: work from the contract, not a neighbour; no free-form JSON without a source [via highbar] (05a78ff)
• spec: the maintainer dev box — programmatic access into a running Codespace [via demo-dev] (ff412ad)
• the dimension query rule counts steps, and does not decide the id-keyed shape (631c783)
• wishlist: link B1 and B2 to Issue# 780 - tap and Issue# 781 - tap (53edc35)