Release Codex plugin v0.3.3 with verified bootstrap

.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "tree-ring-memory",
-  "version": "0.3.2",
-  "description": "Local-first memory lifecycle and receipt-backed harness guidance for coding agents using Tree Ring Memory v0.14+.",
+  "version": "0.3.3",
+  "description": "Local-first memory lifecycle, project bootstrap, and receipt-backed harness guidance for coding agents using Tree Ring Memory v0.15+.",
   "author": {
     "name": "TerminallyLazy",
     "url": "https://github.com/TerminallyLazy"
@@ -25,7 +25,7 @@
   "interface": {
     "displayName": "Tree Ring Memory",
     "shortDescription": "Local-first memory lifecycle guidance for Codex agents.",
-    "longDescription": "Tree Ring Memory gives coding agents a lifecycle-aware practice for project recall, durable decisions, receipt-backed harness readiness, same-host fan-out/fan-in, idempotent worker writes, coordinator-authorized shared publication, explicit forgetting, and privacy-safe memory capture using Tree Ring Memory v0.14 or newer.",
+    "longDescription": "Tree Ring Memory gives coding agents a lifecycle-aware practice for verified project-local setup, project recall, durable decisions, receipt-backed harness readiness, same-host fan-out/fan-in, idempotent worker writes, coordinator-authorized shared publication, explicit forgetting, privacy-safe memory capture, and scope-preserving CLI updates using Tree Ring Memory v0.15 or newer.",
     "developerName": "TerminallyLazy",
     "category": "Developer Tools",
     "capabilities": [

.github/workflows/hol-plugin-scanner.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
-      - name: Validate v0.14 wrapper contract
+      - name: Validate v0.15 wrapper contract
         run: sh scripts/validate-plugin.sh
       - name: HOL Plugin Scanner
         uses: hashgraph-online/ai-plugin-scanner-action@5d17bb20ed8878ef1e82ed3ddf433522dbd36b26

.github/workflows/validate.yml

@@ -10,16 +10,16 @@ permissions:
   contents: read
 
 env:
-  TREE_RING_VERSION: "0.14.0"
-  TREE_RING_LINUX_X86_64_SHA256: "c72191aca81f195472272a1962df354fe0af04a08b01a7472a1faf987cd177fa"
+  TREE_RING_VERSION: "0.15.0"
+  TREE_RING_LINUX_X86_64_SHA256: "9b47873268dbb94712a49b02bd785cc69507facee1e879e46e6922778b4afbe6"
 
 jobs:
   validate:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
-      - name: Install checksum-pinned Tree Ring v0.14
+      - name: Install checksum-pinned Tree Ring v0.15
         shell: bash
         run: |
           set -euo pipefail
@@ -58,6 +58,6 @@ jobs:
       - name: Validate plugin package
         run: sh scripts/validate-plugin.sh
 
-      - name: Smoke Tree Ring v0.14 integration
+      - name: Smoke Tree Ring v0.15 integration
         shell: bash
-        run: bash scripts/smoke_v014.sh
+        run: bash scripts/smoke_v015.sh

README.md

@@ -6,9 +6,10 @@ This plugin packages one Codex skill that teaches agents when to recall, write,
 audit, consolidate, and forget project memory using the open-source
 [Tree Ring Memory](https://github.com/TerminallyLazy/Tree-Ring-Memory) CLI.
 
-Plugin `0.3.2` requires Tree Ring Memory CLI **>= 0.14.0**. The minimum is
-intentional: v0.14 adds receipt-backed harness readiness on top of the v0.13
-schema-v3, coordinated-write, and idempotency contracts used by this guidance.
+Plugin `0.3.3` requires Tree Ring Memory CLI **>= 0.15.0**. The minimum adds
+verified project-local bootstrap and scope-preserving CLI updates on top of the
+receipt-backed harness, schema-v3, coordinated-write, and idempotency contracts
+used by this guidance.
 
 The public ZIP is a skills-only package. It intentionally omits
 `interface.screenshots`, which OpenAI's ZIP ingestion does not accept for this
@@ -31,30 +32,44 @@ privacy-safe.
   observed use in a fresh agent session.
 - Explicit forgetting, redaction, and supersession guidance.
 - DOX and Revolve adapter usage with dry-run-first guardrails.
+- Verified project-local CLI bootstrap and scope-preserving update guidance.
 
 ## Install Tree Ring Memory
 
-macOS ARM64 with Homebrew:
+From the actual project root, after the user has authorized Tree Ring setup:
+
+Download the official version-pinned `v0.15.0/install.sh` to a temporary file,
+verify its SHA-256 is
+`ef0d5eb8f09cbe2e4c3abe80ee9a98a56759c89ad4ddd103d6c68314cd653ade`, inspect
+it, then run these commands from the project root:
 
 ```bash
-brew tap TerminallyLazy/tree-ring
-brew install tree-ring
+sh <verified-installer-path> --project --init --release latest --no-animation
+.tree-ring/bin/tree-ring --root .tree-ring integrations status --verbose
 ```
 
-For other install paths, use the canonical project README:
-<https://github.com/TerminallyLazy/Tree-Ring-Memory#install>
+Do not pipe a network response directly to a shell.
+
+The verified prebuilt installer supports macOS ARM64 and Linux x86_64. Homebrew
+remains available on macOS with `brew install tree-ring`. The agent may proceed
+when the user's request already authorizes setup; otherwise it obtains
+permission before the download or software installation.
 
 Verify the installed core before using this wrapper:
 
 ```bash
 tree-ring --version
 ```
 
-The result must be `tree-ring 0.14.0` or newer.
+The result must be `tree-ring 0.15.0` or newer.
 
-If the CLI is absent or older, the plugin reports the limitation. It does not
-install or upgrade software, edit shell configuration, or claim a memory action
-ran without explicit user permission and observed command output.
+Use `tree-ring update --check` for a read-only release check. With update
+authorization, `tree-ring update` verifies official assets and preserves the
+active project-local, direct-prefix, or Homebrew scope. The plugin does not edit
+shell configuration, change global installation scope, or claim a memory action
+ran without the required authorization and observed command output. For other
+install paths, use the canonical project README:
+<https://github.com/TerminallyLazy/Tree-Ring-Memory#install>.
 
 ## Use
 
@@ -174,8 +189,8 @@ backup.
 ## Canonical Project
 
 - Framework repo: <https://github.com/TerminallyLazy/Tree-Ring-Memory>
-- Canonical v0.14 skill: <https://github.com/TerminallyLazy/Tree-Ring-Memory/blob/v0.14.0/skills/tree-ring-memory/SKILL.md>
-- v0.14 release: <https://github.com/TerminallyLazy/Tree-Ring-Memory/releases/tag/v0.14.0>
+- Canonical v0.15 skill: <https://github.com/TerminallyLazy/Tree-Ring-Memory/blob/v0.15.1/skills/tree-ring-memory/SKILL.md>
+- v0.15 release: <https://github.com/TerminallyLazy/Tree-Ring-Memory/releases/tag/v0.15.1>
 - Launch page: <https://terminallylazy.github.io/Tree-Ring-Memory/>
 - Homebrew tap: <https://github.com/TerminallyLazy/homebrew-tree-ring>
 

SUBMISSION.md

@@ -17,8 +17,8 @@ Long description:
 > Tree Ring Memory gives coding agents a lifecycle-aware practice for project
 > recall, durable decisions, receipt-backed harness readiness, same-host
 > fan-out/fan-in, idempotent worker writes, coordinator-authorized shared
-> publication, explicit forgetting, and privacy-safe memory capture using the
-> open-source Tree Ring Memory 0.14 CLI.
+> publication, explicit forgetting, verified project setup, scope-preserving
+> updates, and privacy-safe memory capture using Tree Ring Memory 0.15.
 
 ## Starter Prompts
 
@@ -31,12 +31,12 @@ Long description:
 1. Prompt: "Recall what we decided about release behavior in this project."
    Expected behavior: check the local runtime and project guidance, run scoped
    recall, and summarize source-linked results. Expected shape: concise memories
-   with confidence or source context. Fixture: an initialized v0.14 store with a
+   with confidence or source context. Fixture: an initialized v0.15 store with a
    project-scoped release decision.
 2. Prompt: "Remember that the signed archive must be inspected before release."
    Expected behavior: confirm the lesson is durable and privacy-safe, then create
    one concise source-linked memory. Expected shape: the observed CLI result and
-   stored memory identifier. Fixture: an initialized writable v0.14 store.
+   stored memory identifier. Fixture: an initialized writable v0.15 store.
 3. Prompt: "Audit this store for stale or sensitive memory without changing it."
    Expected behavior: use report-only audit and maintenance commands. Expected
    shape: grouped findings and recommended follow-up, with no mutation claim.
@@ -49,7 +49,7 @@ Long description:
 5. Prompt: "Is Tree Ring active for this Codex project?"
    Expected behavior: run verbose integration status and report its exact state;
    configuration alone must not be called active. Expected shape: harness name,
-   state, capability, and next step. Fixture: a configured v0.14 project without
+   state, capability, and next step. Fixture: a configured v0.15 project without
    a fresh matching receipt.
 6. Prompt: "Preview the DOX contracts in this repository before syncing them."
    Expected behavior: read the applicable `AGENTS.md` chain, run DOX sync in
@@ -77,15 +77,14 @@ Long description:
 
 ## Release Notes
 
-Version 0.3.2 of the v0.14-compatible skills-only package keeps coordinator
-capabilities out of shell history by requiring a shell-appropriate no-echo
-prompt or approved secret-manager injection, and routes support and security
-reports through the canonical repository. It retains the v0.3.1 ZIP-ingestion
-fix that removed unsupported `interface.screenshots`, plus runtime preflight,
-receipt-backed harness readiness, exact non-active states, same-host
-coordination rules, the logo and composer icon, and explicit privacy-safe
-fallback when local execution is unavailable. The plugin has no MCP server,
-hosted service, credentials, telemetry, or reviewer account requirement.
+Version 0.3.3 of the v0.15-compatible skills-only package adds verified
+project-local bootstrap, project-root-safe initialization, and scope-preserving
+CLI update guidance. It retains the ZIP-ingestion fix that omits unsupported
+`interface.screenshots`, plus receipt-backed harness readiness, same-host
+coordination rules, safe capability handling, the logo and composer icon, and
+guidance-only fallback when local execution is unavailable. The plugin has no
+MCP server, hosted service, credentials, telemetry, or reviewer account
+requirement.
 
 ## Review Note
 

scripts/smoke_v014.sh → scripts/smoke_v015.sh

@@ -7,7 +7,7 @@ if [[ "${tree_ring_bin}" == */* ]]; then
 else
   command -v "${tree_ring_bin}" >/dev/null
 fi
-test "$("${tree_ring_bin}" --version)" = "tree-ring 0.14.0"
+test "$("${tree_ring_bin}" --version)" = "tree-ring 0.15.0"
 
 smoke_base="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
 smoke_base="${smoke_base%/}"
@@ -255,4 +255,4 @@ snapshot_tree "${store_root}" > "${smoke_dir}/upgraded-before.sha256"
 snapshot_tree "${store_root}" > "${smoke_dir}/upgraded-after.sha256"
 cmp "${smoke_dir}/upgraded-before.sha256" "${smoke_dir}/upgraded-after.sha256"
 
-printf 'Tree Ring v0.14 integration smoke passed\n'
+printf 'Tree Ring v0.15 integration smoke passed\n'

scripts/validate-plugin.sh

@@ -30,8 +30,8 @@ root = Path(".")
 manifest = json.loads((root / ".codex-plugin/plugin.json").read_text())
 if manifest.get("name") != "tree-ring-memory":
     raise SystemExit("plugin name must remain tree-ring-memory")
-if manifest.get("version") != "0.3.2":
-    raise SystemExit("wrapper version must be 0.3.2")
+if manifest.get("version") != "0.3.3":
+    raise SystemExit("wrapper version must be 0.3.3")
 
 interface = manifest.get("interface", {})
 prompts = interface.get("defaultPrompt", [])
@@ -66,10 +66,12 @@ if "tree-ring-memory-codex-plugin/issues" in public_text:
     raise SystemExit("support and security links must use the canonical repository")
 PY
 
-assert_contains "$README" 'CLI **>= 0.14.0**'
+assert_contains "$README" 'CLI **>= 0.15.0**'
 assert_contains "$README" 'Receipt-Backed Harness Readiness'
-assert_contains "$SKILL" 'version: 0.14.0'
-assert_contains "$SKILL" 'Runtime Preflight'
+assert_contains "$SKILL" 'version: "0.15.1"'
+assert_contains "$SKILL" 'Runtime Bootstrap And Updates'
+assert_contains "$SKILL" '--project --init --release latest --no-animation'
+assert_contains "$SKILL" 'tree-ring update --check'
 assert_contains "$SKILL" 'DOX Contract Flow'
 assert_contains "$SKILL" 'tree-ring dox sync --source-root <path> --dry-run'
 assert_contains "$SKILL" 'Certification Boundary'

skills/tree-ring-memory/SKILL.md

@@ -1,21 +1,11 @@
 ---
 name: tree-ring-memory
 description: Guides AI agents in using Tree Ring Memory for durable recall, project decisions, user preferences, warnings, future seeds, privacy-safe memory capture, and lifecycle-aware forgetting.
-version: 0.14.0
 license: MIT
-tags: ["memory", "agents", "recall", "privacy", "projects", "dox", "revolve", "skills", "cli"]
-triggers:
-  - "remember this"
-  - "recall what we decided"
-  - "what did we learn"
-  - "tree ring memory"
-  - "consolidate memory"
-  - "forget this"
-  - "project memory"
-  - "sync DOX"
-  - "sync Revolve"
-  - "evidence loop"
-  - "multi-agent memory"
+metadata:
+  version: "0.15.1"
+  tags: "memory, agents, recall, privacy, projects, dox, revolve, skills, cli"
+  triggers: "remember this; recall what we decided; what did we learn; tree ring memory; consolidate memory; forget this; project memory; sync DOX; sync Revolve; evidence loop; multi-agent memory"
 ---
 
 # Tree Ring Memory
@@ -31,23 +21,59 @@ Tree Ring Memory preserves meaningful agent learning like tree rings:
 - speculative future work stays as seeds
 - sensitive data is blocked, redacted, or kept out by default
 
-## Runtime Preflight
-
-Before running a Tree Ring command:
-
-1. Read project-local `.tree-ring/SKILL.md` and `.tree-ring/CLI.md` when they
-   exist. They describe the configured root and exact installed commands.
-2. Confirm that the local runtime is available:
+## Runtime Bootstrap And Updates
+
+Resolve the actual project root before running Tree Ring. Never initialize a
+plugin cache, downloaded package directory, home directory, or arbitrary
+working directory by accident.
+
+1. If `<project-root>/.tree-ring/bin/tree-ring` exists, prefer that binary for
+   this project. Otherwise check `command -v tree-ring` and run
+   `tree-ring --version`.
+2. Read existing `<project-root>/.tree-ring/SKILL.md` and `CLI.md` when present.
+3. This package targets Tree Ring Memory CLI 0.15.0 or newer. If no compatible
+   CLI is available and the user's request already authorizes Tree Ring setup,
+   install the verified current release project-locally from the project root.
+   Otherwise explain the exact operation and obtain permission before the
+   network download or software installation. Download the official,
+   version-pinned `v0.15.0/install.sh` installer to a temporary file, verify its
+   SHA-256 is
+   `ef0d5eb8f09cbe2e4c3abe80ee9a98a56759c89ad4ddd103d6c68314cd653ade`,
+   inspect it, and only then run:
 
    ```bash
-   tree-ring --version
+   cd <project-root>
+   sh <verified-installer-path> --project --init --release latest --no-animation
    ```
 
-3. This package targets Tree Ring Memory CLI 0.14.0 or newer. If the command is
-   missing or older, do not invent results, edit shell configuration, or install
-   or upgrade software without the user's explicit permission. Explain the
-   limitation and point to the canonical install guide:
-   <https://github.com/TerminallyLazy/Tree-Ring-Memory#install>
+   Do not pipe a network response directly to a shell. The installer verifies
+   the selected release archive against its published SHA-256 before placing
+   the binary at `<project-root>/.tree-ring/bin/tree-ring`.
+
+4. For an existing global CLI, initialize from the project root with
+   `tree-ring --root .tree-ring init`. For a project-local CLI, use
+   `.tree-ring/bin/tree-ring --root .tree-ring init`. This must place
+   `memory.sqlite`, `AGENTS.md`, `SKILL.md`, and `CLI.md` under that project's
+   `.tree-ring/` directory.
+5. Verify the created paths and run the same binary with
+   `--root .tree-ring integrations status`. Initialization creates safe local
+   guidance and bridge material; it is not receipt-backed activation proof.
+
+Check for releases without changing files with `tree-ring update --check`. Run
+`tree-ring update` only when the user has authorized an update. It updates the
+active binary in its existing project-local, direct, or Homebrew-managed scope,
+verifies official release assets, and must not create a second shadowing binary.
+After an update, return to each project root and rerun `tree-ring --root
+.tree-ring init` (or the project-local equivalent) to backfill managed guidance
+without replacing custom files.
+
+CLIs older than 0.15.0 do not have `tree-ring update`. Upgrade those with the
+same manager or prefix that installed them: `brew upgrade tree-ring` for
+Homebrew, `--project --release latest` for an existing project-local install,
+or `--install-dir <existing-prefix> --release latest` for another direct
+install. Check `command -v tree-ring` and `which -a tree-ring` afterward. Do not
+edit a shell profile or change global installation scope without separate user
+authorization.
 
 If the current host cannot execute a local shell or access project files, use
 this skill only as memory-lifecycle guidance. Do not claim that recall, capture,