Cloister 0.3.1

Cloister 0.3.1

Release tag: v0.3.1. The matching base image is
ghcr.io/yi427/cloister:0.3.1.

This patch fixes project workspace paths without changing Profile V7. After
upgrading the CLI, preview and apply the matching image update:

cloister profile upgrade --dry-run
cloister profile upgrade
cloister check

The upgrade creates an owner-only backup and preserves unrelated Profile
settings. Agent software continues to install and update independently.
The base tool versions are unchanged:

Base tool	Version
Node.js	24.19.0
Rust	1.97.1

Project-specific workspace paths

Different projects previously shared Guest /workspace, so Agent session
history recorded the same working directory and resume pickers could mix
unrelated projects.

The selected canonical Host path now appears under Guest /workspace, and
the Agent starts at that exact mount target. For example:

/Volumes/Projects/app -> /workspace/Volumes/Projects/app

Projects with the same directory name at different locations remain distinct.
Repeated launches and symbolic-link aliases of the same project use a stable
path. The rule applies to Codex, Claude, and explicit --workspace selection.
Only the selected project is mounted; its Host ancestors are not exposed.

Profile V7 and the shared Agent-state policy are unchanged. Project filtering
is an Agent feature, not a restriction on access to shared history. Codex users
can explicitly show all projects with cloister codex -- resume --all.

Existing sessions recorded at /workspace are left untouched and can be found
with resume --all. Moving a project changes its canonical path and therefore
its Guest working directory. The workspace remains a live read-write bind mount.

Documentation corrections

Installation instructions, Profile examples, and preview assets match 0.3.1.
Historical release records include the published 0.3.0 validation, and earlier
ADRs point to the decisions that amended them.

Development validation on 2026-10-10

• make verify passed all 216 tests and Clippy.
• Regression tests cover namesake projects with shared state for both Agents,
  repeated launches, symbolic-link aliases, explicit workspace selection,
  Unicode names, spaces, literal shell characters, and resume argument forwarding.
• A real Apple container 1.5 smoke check verified a nested workspace path with
  Unicode and spaces, a read-only root, and Guest writes visible on the Host.
  Its temporary container was removed.
• The user tested the fix and reported no problems. This confirmation did not
  record exact Agent versions or a separate per-operation acceptance trace.

Release validation on 2026-10-10

• Local make verify and the staged-snapshot hook passed all 216 tests and Clippy. GitHub Verify passed on the release commit fe2a79e9928683d3e45975edee54b54573ea87dc.
• The annotated v0.3.1 tag points to that verified main commit. The exact release image is sha256:8a54d60dad47cf90b4fa52732720a6411d067418f11dbf914bbac2fe64bec8d4; anonymous Linux ARM64 access and its source revision were verified. The 0.3 channel matches 0.3.1, the immutable SHA image was preserved, and the previous 0.3.0 image digest is unchanged.
• cargo install --locked --git https://github.com/yi427/Cloister.git --tag v0.3.1 cloister succeeded in a clean temporary installation root. Homebrew source installation, strict online audit, and brew test passed for the versioned source archive and its SHA-256.
• The exact image started with Node.js 24.19.0 and Rust 1.97.1, with neither Agent preinstalled. A project path containing Unicode and spaces mapped to its full canonical path under /workspace; its working directory matched the mount, Guest writes appeared on the Host, the root filesystem rejected writes, and the canonical Host Exec skill matched the release source.
• Isolated-state first-use launches installed Codex 0.162.1 and Claude Code 2.1.296. Cached offline launches and exact-version selection passed for both. An explicit Codex update check and two concurrent Codex launches with distinct bridge ports passed.
• Fresh init selected the exact 0.3.1 image, created an owner-only temporary Profile, and passed readiness including actual container-to-host connectivity. The existing local V7 Profile was backed up and upgraded while preserving unrelated fields and permissions. The upgraded Homebrew CLI passed the final local cloister check with no warnings after preparing both Agent caches without mounting user credentials.
• A temporary authenticated Host MCP server passed tool discovery, literal command execution, status reads, cancellation, and owner-only audit checks. Its server stopped and temporary token was removed.

No authenticated model tasks were performed. Release Agent smoke checks used isolated state without existing user credentials; the recorded Agent versions do not certify future independently installed versions. MCP checks used a temporary allowlist with harmless echo and sleep commands. Project workspaces remain read-write, shared Agent history remains shared when selected, and the default network permits internet access.