Skip to content

CHANGELOG.md

Latest commit

 

History

History
169 lines (121 loc) · 13.2 KB

CHANGELOG.md

File metadata and controls

169 lines (121 loc) · 13.2 KB
Raw

Changelog

All notable changes to Symdicate will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

Added

Multi-engine skill architecture

  • skills/ — new canonical top-level directory for Symdicate-authored skills. Engine-neutral format; both Copilot and Gemini discover skills here via projection
  • project.ps1 / project.sh — projection scripts that create engine-specific copies (or symlinks) from skills/ into .github/skills/ (Copilot) and .agents/skills/ (Gemini)
  • -Engine parameter added to both installers (install.ps1, install.sh). Supports copilot (default), gemini, or all. Gemini skills are installed to ~/.gemini/config/skills/
  • -IncludeSkills / --include-skills parameter added to both installers. Installs Symdicate-authored skills from the canonical skills/ directory. Always enabled when -Engine gemini
  • Installers now include Fetch.agent.md, Imprint.schema.json, and Imprint.example.json in the default Copilot agent manifest

[v1.1.0] — 2026-06-23

Added

  • Standardized repository configurations (.editorconfig, Prettier)
  • Automated CSpell dictionaries and validation workflows
  • Automated GitHub Release workflows

Added

Fetch — Cognitive Imprint agent (Item 9)

  • Fetch.agent.md — new Symdicate agent that builds, maintains, and projects the user's cognitive identity across every AI platform
  • Five commands: /init (scan existing platform config files + structured interview + confirm before write), /update (natural language targeted edits — no re-interview), /sync (generate platform bridge files for all enabled platforms), /show (human-readable Imprint summary), /load (compact context output for other Symdicate agents to consume)
  • /init Phase 1 scans all known platform config files automatically: copilot-instructions.md, CLAUDE.md, .cursorrules, AGENTS.md, GEMINI.md, Warp context files
  • /init Phase 2 surfaces and asks the user to resolve conflicts where existing files contradict each other — never silently picks one
  • /sync generates bridge files with an explicit two-tier priority block at the top of every file: neverDo entries as immutable constraints (cannot be overridden by project-level config), rules entries as extensible baseline defaults
  • /load outputs a compact prose block that any agent — including NeuroGraft — can consume to personalise its behaviour without running Fetch's full workflow
  • Bridge file support for: GitHub Copilot (copilot-instructions.md, user-level and repo-level), Claude / Claude Code (CLAUDE.md), Cursor (.cursorrules), OpenAI Codex CLI (AGENTS.md), Gemini CLI (GEMINI.md), Warp context
  • Safety rules: never writes without user confirmation; never exposes raw JSON by default; refuses to store secrets or credentials; never writes outside home directory or current workspace without explicit confirmation

Imprint schema

  • Imprint.schema.json — JSON Schema draft-07 for the platform-neutral user cognitive profile. Seven top-level sections: identity, style, rules, neverDo, expertise, projects, memory, platforms
  • Two-tier constraint model formalised in schema: neverDo (immutable, priority-language in bridge files) vs rules (baseline defaults, project-context extensible)
  • platforms block drives the /sync bridge generator — each entry has enabled, path, level, and optional notes
  • Imprint.example.json — committed reference example using a fictional user; follows the same convention as profile.example.json

Repository

  • .gitignore updated: Imprint.json excluded at all paths (personal instance is private); generated bridge files at repo root (CLAUDE.md, GEMINI.md, AGENTS.md) excluded; Fetch.agent.md added to the tracked-agents exception list alongside NeuroGraft.agent.md
  • TODO.md title updated from "NeuroGraft Roadmap" to "Symdicate Roadmap" to reflect the full framework scope; Item 9 (Fetch) added as completed
  • README.md updated: agent summary table added to intro; full Fetch agent section added; repository structure updated; roadmap and FAQ updated

[v1.0.1] — 2026-04-18

Security

  • H1 — Prompt injection boundary added to NeuroGraft agent: pasted agent file content is now treated as user-supplied data only; instruction overrides and system directives within pasted content are discarded rather than executed
  • H2 — API-returned filenames validated against an allowlist before use as filesystem paths in both installers, preventing path traversal via a crafted GitHub API response
  • H3 — -Ref / --ref parameter validated against ^[a-zA-Z0-9._/-]+$ in both installers, preventing injection via crafted ref values
  • M1 — TLS 1.2/1.3 explicitly enforced in install.ps1 to prevent protocol downgrade on older PowerShell 5.1 / Windows systems
  • M2 — Temp files in install.sh now created in a private mktemp -d directory instead of world-readable /tmp, preventing local file read/replace between download and hash verification
  • M2b — Temp files in install.ps1 now created in a private GetRandomFileName() subdirectory, consistent with the mktemp -d fix applied to install.sh
  • M3 — github.ref_name in release workflow body now routed through env: variable, eliminating direct expression interpolation in the release body
  • M4 — Installer scripts (install.ps1, install.sh) added as release assets and included in checksums.sha256; SECURITY.md updated with step-by-step verification instructions using release asset URLs
  • I2 — .github/CODEOWNERS added; changes to the workflow, installers, and NeuroGraft agent file require owner review

Added

Naming refinement

  • Renamed profile low-load → spacious — describes the quality of the output (well-spaced, room to breathe) rather than implying the reader has limited capacity. low-load retained as an alias for backwards compatibility.

Persona library expansion (Item 7)

  • Five new archetypes: scientist, mentor, bureaucrat, comedian, stoic
  • Three new special guests: hermione-granger (Harry Potter), data (Star Trek: TNG), wednesday-addams (The Addams Family)
  • Installer static fallback list updated with all new files

Accessibility and wellbeing profiles (Item 8)

  • New personalities/profiles/ category that change how any agent communicates, not who it is. Anyone can use any profile; no diagnosis or label required.
  • 15 profile files: _TEMPLATE.profile.md plus 14 seed profiles
  • Foundation profiles (no extends): direct, spacious, structured, high-context, dyscalculia, screen-reader, eal, and mental-health (base only)
  • Derived profiles with extends inheritance: dyslexia (extends direct), dyspraxia (extends spacious), anxiety, depression, stress (all extend mental-health), cognitive-fatigue (extends spacious + mental-health)
  • Profile files include accessibilityFocus, communicationRules, and neverDo fields; extends field for rule inheritance
  • Framing principle in template and all profiles: differences, not deficits; tools to help, not labels
  • NeuroGraft updated: Profile: parameter added to structured input format and greeting; profile resolution added to Step 1 (archetypes → guests → profiles → infer); Persona and Profile Discovery section updated with affirming profile listing; Profile line added to graft summary block
  • Installers updated: personalities/profiles/ included when --include-personalities / -IncludePersonalities is passed; dynamic API fetch + static fallback list both updated

v1.0.0 — 2026-04-16

Added (v1.0.0)

NeuroGraft — Persona Transformer agent

  • Four transformation modes (A — Surface Graft, B — Voice Graft, C — Cognitive Graft, D — Full Symbiote Graft)
  • Structured and natural language input formats with sensible defaults
  • Agent profile caching — SHA-256 content-hash-based cache at .github/agents/.cache/<agentName>.profile.json; cache schema defined in profile.schema.json; reference example in profile.example.json
  • Graft summary block on every response (mode, persona, target agent, agent profile, cache status, session status, persona source)
  • Greeting — when invoked with no parameters, NeuroGraft responds with a quick-start guide linking to the agent catalogue and persona library

Agent resolution

  • Four-step fallback chain: workspace → github/awesome-copilot → ask user to paste → infer from name (explicit consent only)
  • Any agent in the awesome-copilot collection resolves automatically without file copying
  • Agent profile source noted in graft summary block (workspace, github/awesome-copilot, pasted by user, or inferred)

Personality system

  • Personality taxonomy split into archetypes (personalities/archetypes/) and special guests (personalities/guests/)
  • Archetype template (_TEMPLATE.archetype.md) and guest template (_TEMPLATE.guest.md)
  • Six seed archetypes: child, detective, philosopher, pirate, poet, robot
  • Two seed special guests: glados (Portal), jack-sparrow (Pirates of the Caribbean)
  • File-based persona resolution — workspace search then infer from label
  • Persona discovery — NeuroGraft lists available personas grouped by category on request, with scope note
  • Real-person safeguard — contentNote field on guest files is an absolute constraint overriding user instruction

Session persistence

  • Session State section in agent instructions — active graft persists across all turns in a conversation
  • Silent session inheritance — follow-up prompts with no Mode/Persona/Agent reuse the active session
  • Session commands: end session, current graft?, resume: <token>
  • Cross-session file persistence at .github/agents/.cache/neurograft-session.json
  • Stale session detection — if the target agent file changes between sessions, cognitive identity is re-extracted automatically
  • Resume token appended to every response for portable cross-session restart
  • Session line in graft summary block

Distribution

  • install.ps1 — PowerShell installer for Windows, macOS, Linux; user-level and repo-level targets; dry-run and uninstall support
  • install.sh — Bash installer for macOS and Linux; same feature parity; Cursor detection
  • .github/workflows/release.yml — GitHub Actions workflow that builds symdicate-agents.zip and creates a GitHub release on version tag push

Repository

  • README.md with full usage guide, persona tables, installation instructions, and ecosystem references
  • TODO.md tracking all expansion items
  • LICENSE (MIT)
  • .gitignore and .gitattributes

Fixed

  • Agent and persona search used hardcoded .github/agents/ paths — replaced with workspace-wide **/* glob patterns so both repo-level and any workspace-visible files are found
  • Discovery response said "none detected" when user-level installs exist but aren't workspace-visible — now correctly explains the workspace scope and directs users to name agents directly
  • Step 0 / Step 1 merge artifact in Agent Reading Protocol — cache hit/miss bullets were incorrectly placed inside Step 0; moved to Step 1 where they belong
  • create_file and replace_string_in_file tools added to NeuroGraft frontmatter — cache and session files can now actually be written (previously only declared, never possible)
  • NeuroGraft tool list trimmed: removed vscode/memory, vscode/resolveMemoryFileUri (wrong persistence scope — would bleed sessions across workspaces), and agent (would enable actual sub-agent invocation, conflicting with the simulate-from-instructions design); updated to non-legacy tool name format
  • install.ps1 Invoke-RestMethod call had no timeout — added -TimeoutSec 30
  • install.sh used diff -q for change detection instead of SHA-256 — aligned with install.ps1 behaviour; sha256sum/shasum -a 256 used with cross-platform fallback
  • install.sh || true on arithmetic counter increments now includes explanatory comment clarifying this suppresses the expected exit code 1 from ((n++)) when n is 0, not genuine errors
  • HIGH — Script injection in release.yml: ${{ github.ref_name }} was interpolated directly into a run: shell command; moved to env: block so it is passed as an environment variable and never raw-interpolated
  • HIGH — Mutable action version pins in release.yml: actions/checkout@v4 and softprops/action-gh-release@v2 pinned to immutable commit SHAs
  • MEDIUM — SECURITY.md documented SHA-256 checksum verification but release workflow published no checksum file; checksums.sha256 is now generated and attached to every release
  • LOW — install.ps1 uninitialised counter keys: not-found and would-remove added to $counts initialisation
  • LOW — README one-liner install commands had no proximate security note; callout added directing users to pin to a release tag and verify checksums