Repository navigation
[1.2] - 2026-09-16
Changed
- Refresh all twelve chapters across the ten stable APM releases after 0.23.1
through 0.31.0, preserving the concept-first progression, Meridian story,
and engineering-leader track. - Explain consented discovery of existing packages, declaration-first source
selection, explicit targets, and the distinction between legacy plugin
projection and native Agent Plugins 1.0. - Update lockfile and lifecycle guidance for timestamp-free state, deployment
ownership, source-specific identities, bounded frozen checks, cold audit,
and registry Current/Wanted/Latest reporting. - Reconcile security and governance guidance with actual scan coverage,
local policy inheritance, warn/block behavior, consumer fail-closed settings,
protected CI inputs, and precisely documented APM limitations. - Expand the producer path with current local-only bundles and a real ZIP
consumer round-trip. Distinguish experimental registry implementation from a
public hosted hub, and correct gh-aw target/version inputs and context isolation.
Added
- Version-pinned practice fixtures for core installation, operations/policy,
and producer workflows, with genuine lockfiles and independent per-chapter
verification and editorial evidence. - A canonical Git/LF checkout check for five primary fixtures and the ZIP
round-trip on Windows, with source-identity records linking reviewed bytes
to the published Git content.
Fixed
- Overbroad install, frozen-restore, audit, trust, and integration guarantees.
Observed upstream failures remain visible rather than being treated as
network skips or successful security guarantees. - Cross-chapter carry-forward of Meridian's reviewed dependencies, MCP
declaration, and script; the raw-download checksum and gh-aw cross-reference.
Historical 0.23.1 recordings and the 2026-07-01 competitor snapshot
remain explicitly dated. Private infrastructure, paid runtimes, and live
package-publication examples retain their specific execution exclusions.