Intentloom 1.0.2

Documentation and package-metadata release. The published CLI also includes the post-v1 read-only evidence implementation merged before this release; no mutating provider, MCP, extension-installation, or dependency behavior was introduced.

Changed

• Made the GitHub Pages site the canonical public documentation destination in the repository and npm-facing READMEs.
• Updated the GitHub and npm project description to describe the local, vendor-neutral framework and CLI.
• Published intentloom@1.0.2 through the protected npm trusted-publishing workflow with SLSA v1 provenance.
• Included bounded live GitHub/GitLab provider reads and the untrusted external-MCP evidence boundary from PR #160.

Verification

• GitHub Pages root and key documentation routes return HTTP 200.
• Full local verification passed: 851 tests passed, 3 skipped.
• Compatibility, CodeQL, dependency-review, governance, and release workflow checks passed.
• The remaining Dependabot alert is glib@0.18.5 in the Tauri GTK3 stack; a direct glib@0.20.0 update is incompatible with gtk@0.18.2 and remains tracked under the expiring exception.

The read-only provider/MCP hardening gate remains active. Full changelog: https://github.com/vitala89/Intentloom/blob/main/CHANGELOG.md

Intentloom 1.0.0

First stable release of Intentloom: a local-first, offline-first control layer for reliable agentic software engineering.

Install

npm install --global intentloom
# or pin it
npm install --global intentloom@1.0.0

intentloom@1.0.0 is published to npm and holds both the latest and next dist-tags. RELEASE_STATE.md is the authoritative record of what is published.

This artifact was published manually before the trusted-publishing release workflow existed, so it carries no npm provenance attestation and cannot gain one retroactively. A local build reproduces the published tarball byte for byte (shasum 434fcb624ddb3706502a29ad96b27aee36df675c), which establishes reproducibility, not provenance. Later releases publish through release.yml and carry provenance automatically.

Added

• First stable release: local-first, offline-first AI agent control layer and process intelligence platform.
• Full local protocol contract v1: intentloom.doctor.v1, intentloom.inspect.v1, intentloom.diff.v1, intentloom.timeline.v1.
• Multi-adapter merging and rule generation for Claude Code, Codex, Cursor, and Copilot.
• CLI (intentloom), published to npm. MCP stdio server (intentloom-mcp) and local daemon (intentloomd), both built from source in this repository and not published as npm artifacts.
• Process intelligence suite: workflow variant summaries, duration metrics, conformance trends, repetition analysis, and transition interval tracking.
• Bounded security model: security and supply-chain audit sign-off, dependency review, CodeQL static analysis, and Dependabot updates.

Verification

Compatibility verified on macOS, Linux, and Windows across Node.js 22 and 24 (run 30529498050, 6/6 green). CodeQL green for both actions and javascript-typescript (run 30529497908).

Known security disposition

Dependabot alert #2 (glib@0.18.5, transitive, medium) is open under an approved temporary exception expiring 2026-10-29. It reaches only the desktop Tauri/WebKitGTK dependency graph; no direct glib or VariantStrIter use exists in the source.

Corrections since publication

This release note originally stated that 1.0.0 was not on npm, and listed the MCP server as intentloom mcp serve --stdio. Both were corrected on 2026-07-31: the package is published and the default install, and no mcp command exists on the CLI. The release scope itself is unchanged.

Full changelog: https://github.com/vitala89/Intentloom/blob/main/CHANGELOG.md

v0.4.0-beta.1 candidate release

Release v0.4.0-beta.1 candidate containing the complete Controlled Agent Learning & Procedural Memory Candidate Milestone (Candidates L1–L8).

Highlights:

• Candidate L1 (PR #60): Task state machine & procedural memory summaries (intentloom summary)
• Candidate L2 (PR #61): Progressive skill discovery & loading levels (intentloom skill discover)
• Candidate L3 (PR #62): Skill proposal lifecycle (intentloom proposal <list|get|create|approve>)
• Candidate L4 (PR #63): Skill evaluation & security regression gates (intentloom evaluate <run|list>)
• Candidate L5 (PR #64): Memory inspection & prepared mutation plans (intentloom memory inspect, intentloom proposal plan/apply)
• Candidate L6 (PR #65): Checkpoint pause, redirect, and resume (intentloom checkpoint)
• Candidate L7 (PR #66): Provider-neutral optional semantic ranking (intentloom rank)
• Candidate L8 (PR #67): Profile isolation & role-aware delegation (intentloom profile, intentloom delegate)

Intentloom 0.1.0-alpha.3

Intentloom 0.1.0-alpha.3

Intentloom is a vendor-neutral engineering intent framework for AI coding tools and development workflows.

This alpha release aligns the public npm package with the canonical Intentloom repository and includes the completed public-repository readiness work.

Highlights

• Updated npm repository, homepage, and issue-tracker metadata to vitala89/Intentloom.
• Added a comprehensive public project README.
• Added an actionable private security-reporting policy.
• Fixed the Windows portability of adoption-path tests.
• Confirmed compatibility on Ubuntu, macOS, and Windows with Node.js 22 and 24.
• Verified npm and pnpm clean-room installations from the public registry.

Installation

npm install --save-dev intentloom@next

Pin this release when reproducibility is required:

npm install --save-dev intentloom@0.1.0-alpha.3

Verification

• 35 test files: 522 passed, 2 expected skips, 0 failures.
• Public npm package: intentloom@0.1.0-alpha.3.
• Package SHA-256 verified locally: 40469fa3c50692dadba709d7cca3b808886c76e4c5922d6c854f7c784105eab1.

This is a prerelease. No runtime or schema compatibility changes are intended; .aif and urn:aif:* identifiers remain unchanged.