chore: prepare the authorized 0.7.0 release

AGENTS_SETUP_INSTRUCTIONS.md

@@ -19,13 +19,13 @@ pip install fava-trails
 # Confirm the loaded runtime (package + module + MCP product version):
 fava-trails version
 
-# Or from source (for development / unreleased 0.6.1 RC on main)
+# Or from source (for development / unreleased 0.7.0 RC on main)
 git clone https://github.com/MachineWisdomAI/fava-trails.git && cd fava-trails && uv sync
 ```
 
 **Version boundary:** PyPI and GitHub Releases still list **0.6.0** as latest.
 Governed identity, `mode="authoring"`, and related isolation behavior described in
-this guide and the usage guide are the **unreleased 0.6.1 release candidate** on
+this guide and the usage guide are the **unreleased 0.7.0 release candidate** on
 `main` (this tree). Published **0.6.0** does **not** match that model. After any
 install or upgrade, run `fava-trails version` and restart the MCP client so the
 process loads the intended entrypoint. See

CHANGELOG.md

@@ -4,11 +4,41 @@ All notable changes to FAVA Trails are documented here.
 
 ## Unreleased
 
+## [0.7.0] — merged on main, not published (candidate)
+
+> **Publication status:** GitHub/PyPI latest remain **0.6.0**. This tree identifies
+> as **0.7.0**. The unpublished **0.6.1** candidate identity is superseded and was
+> never tagged. A normal `pip install fava-trails` still resolves **0.6.0** until
+> an authorized tag-driven release. See
+> [docs/runtime-and-upgrade.md](docs/runtime-and-upgrade.md).
+
+### Compatibility and migration
+
+- **Identity:** Governed read/draft isolation is process-scoped. Set
+  `FAVA_TRAILS_AGENT_ID` on each ordinary authoring MCP process; caller
+  `agent_id` must match. A shared endpoint or shared data filesystem is one
+  identity boundary, not per-caller crypto isolation. Enable
+  `FAVA_TRAILS_OPERATOR=1` only on a separate operator-controlled endpoint.
+  Published **0.6.0** does not implement this model — confirm the loaded runtime
+  with `fava-trails version` after install or upgrade.
+- **MCP:** Runtime requires MCP SDK 2.2.x (`mcp>=2.2.0,<3.0`). Handshake
+  `serverInfo.version` is the FAVA product version, not the SDK version.
+- **JJ:** `install-jj` reuses any JJ `>= 0.28.0` and does not silently downgrade
+  or overwrite a user-managed binary.
+- **Not claimed:** Trust Gate is rubric process control, not independent truth
+  verification. Secret preflight is not complete DLP and does not erase stored
+  records. `recall` is lexical whitespace-token substring AND, not semantic
+  search. This release does not report measured user adoption. Local Rich Views
+  remain a local reader; five real-session acceptance was waived and is not
+  claimed.
+
 ### Added
-- `FAVA_TRAILS_MCP_SURFACE=compact` advertises shorter initialize instructions and tool descriptions and omits list-time `outputSchema`, with `get_usage_guide` as on-demand protocol. Default remains `full`. `fava-trails measure-mcp-context` records tokenizer-labeled session-init size, loads a frozen issue #104 tested-release artifact (not relabeled from the current SDK), and the same-task comparison runs through `mcp.Client` sessions. Prompt-coverage gaps are instruction scans, not observed client skips, and the comparison payload does not label those scans as `called`/`skipped`; missing-scope recovery selects an exact returned path and retries recall with the original arguments except `trail_name`, requiring a non-empty result. Full initialize instructions are a maintained subset of `AGENTS_USAGE_INSTRUCTIONS.md`, not a verbatim inject. See [docs/mcp-context-overhead.md](docs/mcp-context-overhead.md). Addresses #104.
+- **Governed read / draft isolation (#72, #93; [PR #93](https://github.com/MachineWisdomAI/fava-trails/pull/93)):** default `recall` / `get_thought` expose approved current records only. Explicit `mode="authoring"` retrieves only the server-configured agent's draft/proposed records; operator-only `mode="history"` selects lifecycle statuses and superseded records. Neither a namespace nor a supplied `agent_id` grants access.
+- **Local Rich Views after 0.6.0 ([PR #92](https://github.com/MachineWisdomAI/fava-trails/pull/92), [PR #97](https://github.com/MachineWisdomAI/fava-trails/pull/97)):** reader generate/serve lifecycle and Astro managed-background startup for the existing local loopback reader. This is not a claim of five real production sessions.
+- `FAVA_TRAILS_MCP_SURFACE=compact` advertises shorter initialize instructions and tool descriptions and omits list-time `outputSchema`, with `get_usage_guide` as on-demand protocol. Default remains `full`. `fava-trails measure-mcp-context` records tokenizer-labeled session-init size, loads a frozen issue #104 tested-release artifact (not relabeled from the current SDK), and the same-task comparison runs through `mcp.Client` sessions. Prompt-coverage gaps are instruction scans, not observed client skips, and the comparison payload does not label those scans as `called`/`skipped`; missing-scope recovery selects an exact returned path and retries recall with the original arguments except `trail_name`, requiring a non-empty result. Full initialize instructions are a maintained subset of `AGENTS_USAGE_INSTRUCTIONS.md`, not a verbatim inject. See [docs/mcp-context-overhead.md](docs/mcp-context-overhead.md). Addresses #104 ([PR #115](https://github.com/MachineWisdomAI/fava-trails/pull/115)).
 - `fava-trails register` prints native MCP registration using an ordinary `FAVA_TRAILS_AGENT_ID`, the resolved executable, and the intended data repository. Unresolved executables fail unless `--executable` names an existing executable file. `--write` is an explicit client-config opt-in (atomic write, `.bak` backup, files opened with the final mode before content is written, modes capped at `0600` while stricter existing modes are kept, new files `0600`, non-writable existing configs refused). `--verify` labels a direct MCP smoke test, client-config inspection, and MCP Inspector config-load (`inspector_config_load`). It does not claim Claude Code/Desktop loaded the registration. Failures stay distinct (`inspector_unavailable`, `inspector_invocation_failed`, `config_load_failed`, `server_spawn_failed`, `server_initialize_failed`, `inspector_failed`, stale runtime path, registration not loaded). Native-session evidence that a client loaded Claude-shaped `mcpServers` config is `test_native_client_registration_loads_and_initializes`.
-- Bounded obvious-secret preflight before save, update, supersede, and promotion persist or transmit. Supported high-confidence patterns are refused with a safe explanation, including nested caller-controlled metadata and relationships after hook mutation, and the complete MCP request (tool name plus arguments) before schema validation, logging, lookup, auto-initialization, or JJ operations. Assembled Trust Gate result metadata is scanned before governance persist. Nested walks deeper than 32 fail closed. Block logs use a fixed message without pattern ids. Legacy matching drafts are left unchanged and are not sent for review. Documents data flow and detection limits; does not claim complete DLP. Fixes #102.
-- **Trust Gate data-egress disclosure (issue #101):** `describe_trust_gate_egress`
+- Bounded obvious-secret preflight before save, update, supersede, and promotion persist or transmit. Supported high-confidence patterns are refused with a safe explanation, including nested caller-controlled metadata and relationships after hook mutation, and the complete MCP request (tool name plus arguments) before schema validation, logging, lookup, auto-initialization, or JJ operations. Assembled Trust Gate result metadata is scanned before governance persist. Nested walks deeper than 32 fail closed. Block logs use a fixed message without pattern ids. Legacy matching drafts are left unchanged and are not sent for review. Documents data flow and detection limits; does not claim complete DLP. Fixes #102 ([PR #112](https://github.com/MachineWisdomAI/fava-trails/pull/112)).
+- **Trust Gate data-egress disclosure (issue #101; [PR #111](https://github.com/MachineWisdomAI/fava-trails/pull/111)):** `describe_trust_gate_egress`
   + `fava-trails doctor` **Data egress** section and MCP startup log show the
   effective review destination/model and which candidate fields are sent before
   promotion. Successful LLM or operator `propose_truth` paths (and credential /
@@ -27,8 +57,9 @@ All notable changes to FAVA Trails are documented here.
   configuration, local runtime selectors that can keep an old checkout active,
   and release-candidate install/upgrade verification. Wheel/sdist packaging
   tests cover fresh install, upgrade from published 0.6.0, installed-entrypoint
-  MCP protocol (#83), and governed recall isolation (#72). Prepares #99; **0.6.1
-  remains merged but unreleased on PyPI until an authorized tag is published.**
+  MCP protocol (#83), and governed recall isolation (#72). Prepares #99
+  ([PR #109](https://github.com/MachineWisdomAI/fava-trails/pull/109)); **0.7.0
+  remains unreleased on PyPI until an authorized tag is published.**
 - Issue #99 verification depth: real native MCP client registration via
   `@modelcontextprotocol/inspector` loading Claude-shaped `mcpServers` config
   (distinct from direct stdio probes); two separately configured ordinary server
@@ -44,23 +75,19 @@ All notable changes to FAVA Trails are documented here.
   **draft** GitHub Release (title/notes/target bound to the candidate), publishes
   the same `dist/` to PyPI, requires published PyPI SHA-256 to match
   `candidate-SHA256SUMS` before undraft (still owner-gated; no automatic
-  publication from this PR).
+  publication from this changelog).
+- **Local-only sync (#105; [PR #116](https://github.com/MachineWisdomAI/fava-trails/pull/116)):** `sync` distinguishes a repo with no remotes (local-only) from a configured remote that is broken. It does not invent hosted remotes or treat missing-remote as a fetch failure.
 
 ### Changed
-- `fava-trails init` and `fava-trails scope set` persist scope in `.fava-trails.yaml` and no longer write application `.env` files unless `--write-env` is passed. Existing `FAVA_TRAILS_SCOPE` reads are unchanged. Generated agent guidance (`AGENTS_USAGE_INSTRUCTIONS.md`, server instructions, data-repo `agents-guide.md`) and root `AGENTS.md` no longer tell agents to edit application-owned `.env` files. `fava-trails register --write` and `--verify` fail unless a real data-repository path is resolved; print-only guidance may still show a placeholder.
+- Safer onboarding (#103; [PR #113](https://github.com/MachineWisdomAI/fava-trails/pull/113), [PR #114](https://github.com/MachineWisdomAI/fava-trails/pull/114)): `fava-trails init` and `fava-trails scope set` persist scope in `.fava-trails.yaml` and no longer write application `.env` files unless `--write-env` is passed. Existing `FAVA_TRAILS_SCOPE` reads are unchanged. Generated agent guidance (`AGENTS_USAGE_INSTRUCTIONS.md`, server instructions, data-repo `agents-guide.md`) and root `AGENTS.md` no longer tell agents to edit application-owned `.env` files. `fava-trails register --write` and `--verify` fail unless a real data-repository path is resolved; print-only guidance may still show a placeholder.
+- Honest substring recall (#100; [PR #110](https://github.com/MachineWisdomAI/fava-trails/pull/110)): public docs and the retrieval baseline state that `recall` is lexical whitespace-token substring AND across content and selected metadata. They do not promise semantic search, hallucination prevention, or truth verification.
 - Public Trust Gate wording no longer implies that a review verdict prevents secret persistence or egress.
-- Support MCP SDK 2.2 with explicit low-level handlers, preserving tool schemas, annotations, input/output validation, structured results, and Markdown usage guidance over stdio and Streamable HTTP. Adds installed-wheel protocol tests for legacy initialization and current SDK clients. Resolves #83.
-- **JJ installer policy (issue #98):** `fava-trails install-jj` (canonical `jj_install.py`; `scripts/install-jj.sh` is a thin Bash 3.2-safe delegate) reuses any installed JJ `>= 0.28.0` before platform checks, never silently downgrades or overwrites a user-managed binary, resolves current GitHub stable when install is needed (explicit `--version` / `JJ_VERSION` override retained), verifies GitHub asset SHA-256 digests when published, requires exactly one safe regular `jj` archive member, installs atomically with restore of the prior managed binary after any post-replacement failure, and PATH-hints the selected install directory. CI matrix covers JJ **0.28.0** and **0.45.1**. See `docs/jj-compatibility.md`.
-
-## [0.6.1] — merged on main, not published (candidate)
-
-> **Publication status:** GitHub/PyPI latest remain **0.6.0**. Main identifies as
-> **0.6.1** and includes governed-read and MCP registration fixes. A normal
-> `pip install fava-trails` does **not** receive those fixes until an authorized
-> release. See [docs/runtime-and-upgrade.md](docs/runtime-and-upgrade.md).
+- Support MCP SDK 2.2 with explicit low-level handlers, preserving tool schemas, annotations, input/output validation, structured results, and Markdown usage guidance over stdio and Streamable HTTP. Adds installed-wheel protocol tests for legacy initialization and current SDK clients. Resolves #83 ([PR #94](https://github.com/MachineWisdomAI/fava-trails/pull/94)).
+- **JJ installer / current-stable policy (issue #98; [PR #108](https://github.com/MachineWisdomAI/fava-trails/pull/108)):** `fava-trails install-jj` (canonical `jj_install.py`; `scripts/install-jj.sh` is a thin Bash 3.2-safe delegate) reuses any installed JJ `>= 0.28.0` before platform checks, never silently downgrades or overwrites a user-managed binary, resolves current GitHub stable when install is needed (explicit `--version` / `JJ_VERSION` override retained), verifies GitHub asset SHA-256 digests when published, requires exactly one safe regular `jj` archive member, installs atomically with restore of the prior managed binary after any post-replacement failure, and PATH-hints the selected install directory. CI matrix covers JJ **0.28.0** and **0.45.1**. See `docs/jj-compatibility.md`.
 
 ### Fixed
-- Raised direct MCP (`>=1.28.1`) and Starlette (`>=1.3.1`) floors and refreshed the lockfile to clear open Dependabot advisories (including high-severity transitive updates such as NLTK and Transformers). Supersedes #81.
+- Raised direct MCP (`>=1.28.1`, later `>=2.2.0`) and Starlette (`>=1.3.1`) floors and refreshed the lockfile to clear open Dependabot advisories (including high-severity transitive updates such as NLTK and Transformers). Supersedes #81 ([PR #91](https://github.com/MachineWisdomAI/fava-trails/pull/91)).
+- Duplicate-recovery receipts stay private and durable before retry ([PR #95](https://github.com/MachineWisdomAI/fava-trails/pull/95)).
 
 ## [0.6.0] — 2026-07-31
 

README.md

@@ -13,7 +13,7 @@ Every thought, decision, and observation is stored as a markdown file with YAML
 ## Governed recall
 
 > **Release status:** The governed visibility model below describes the **current
-> unreleased 0.6.1 tree** (release candidate on `main`). PyPI and GitHub Releases
+> unreleased 0.7.0 tree** (release candidate on `main`). PyPI and GitHub Releases
 > still list **0.6.0** as latest; that published build does **not** include the
 > later governed-read isolation / MCP registration fixes. Confirm what you loaded
 > with `fava-trails version` — see [docs/runtime-and-upgrade.md](docs/runtime-and-upgrade.md).
@@ -36,7 +36,7 @@ For a long-lived private ChatGPT connection, follow the deployment-neutral
 ## Why
 
 - **Supersession tracking** — a proposed correction leaves the original current; approved replacements make predecessors historical in default recall. Lineage is recorded; supersession does **not** prove the replacement is true.
-- **Draft isolation (0.6.1 RC)** — working thoughts stay in `drafts/`. Default governed `recall`/`get_thought` expose approved current records only; own drafts need explicit `mode="authoring"` on a configured identity. A shared MCP endpoint or shared data filesystem is one boundary, not per-caller crypto isolation. Published **0.6.0** does not match this isolation model — upgrade/check the loaded version before relying on it.
+- **Draft isolation (0.7.0 RC)** — working thoughts stay in `drafts/`. Default governed `recall`/`get_thought` expose approved current records only; own drafts need explicit `mode="authoring"` on a configured identity. A shared MCP endpoint or shared data filesystem is one boundary, not per-caller crypto isolation. Published **0.6.0** does not match this isolation model — upgrade/check the loaded version before relying on it.
 - **Trust Gate** — default policy is `llm-oneshot` (synchronous single-record rubric review). Non-LLM promotion is **not** a config toggle: on an operator endpoint use `propose_truth(..., approval="human")`. Rubric review is process control with limited context — **not** independent verification of project facts, and not a guarantee that hallucinations never enter shared truth. A reject does not mean the draft was never stored or sent for review. A separate [bounded obvious-secret preflight](docs/secret-preflight.md) refuses a small set of high-confidence credential shapes before normal write and promotion paths persist or transmit them. It is not complete DLP and does not erase already-stored records.
 - **Lexical recall** — `recall` matches lowercased whitespace-separated query tokens as substrings across content and selected metadata (AND). It is not semantic similarity search. See [docs/retrieval-baseline.md](docs/retrieval-baseline.md).
 - **Full lineage** — every thought carries who wrote it, when, and why it changed.
@@ -62,8 +62,8 @@ pip install fava-trails
 ```
 
 **Publication note:** PyPI and GitHub Releases still list **0.6.0** as latest.
-Main identifies as **0.6.1** with governed-recall and MCP registration fixes
-**merged but unreleased**. Confirm what you actually loaded with
+Main identifies as **0.7.0** with governed-recall, MCP registration, and later
+fixes **merged but unreleased**. Confirm what you actually loaded with
 `fava-trails version` (see [docs/runtime-and-upgrade.md](docs/runtime-and-upgrade.md)).
 Local `uv run --directory …` or vendor checkout selectors can keep an older tree
 active after a package upgrade — restart the MCP client registration after