graphanov · graphanov · Jun 28, 2026 · Jun 28, 2026 · Jun 28, 2026
diff --git a/.osc/plans/active/175-ambient-capture-trust-package-sync.md b/.osc/plans/active/175-ambient-capture-trust-package-sync.md
@@ -0,0 +1,55 @@
+# Plan: 175-ambient-capture-trust-package-sync
+
+## Status
+
+active
+
+## Context
+
+Issue #239 requests a release-prep PR for `open-scaffold@0.34.0` because npm `latest` remains `0.33.0` while `origin/main` contains package-visible work merged after `v0.33.0`. The release target must be `0.34.0`, not the stale `0.4.0`/`0.5.0` line, and the release must be cut from current `origin/main`.
+
+## Goal
+
+Prepare a draft release-sync PR for `open-scaffold@0.34.0` with package metadata, changelog, and release-prep evidence ready for owner-gated publish and GitHub Release follow-through.
+
+## Constraints / Out of scope
+
+- This plan prepares a draft PR only; it does not merge, publish to npm, create/move tags, create/move GitHub Releases, dispatch workflows, change branch protection, or touch secrets.
+- Keep all release language in candidate/prep state until npm and GitHub Release proof exists.
+- Follow current `origin/main` truth. The release delta includes PRs #229, #230, #232, #236, #237, and #238.
+- Do not change ambient capture product behavior, local Claude/Codex user config, package publication workflow authority, or package version beyond `0.34.0`.
+- Do not close issue #239 merely because the prep PR exists; owner-gated publish/release proof remains follow-through after merge.
+
+## Files to touch
+
+- `package.json` — bump the package version from `0.33.0` to `0.34.0`.
+- `package-lock.json` — keep the root and `packages[""]` lockfile versions aligned with `package.json`.
+- `docs/CHANGELOG.md` — add a top `v0.34.0` release-candidate entry with source PRs, evidence links, and owner-gated boundaries.
+- `.osc/plans/active/175-ambient-capture-trust-package-sync.md` — this release-prep work record while in progress.
+- `.osc/releases/2026-06-28-175-ambient-capture-trust-package-sync.md` — release-prep evidence note with observed verification.
+- `tests/section-parser.test.ts` — update live-corpus hash comments only if validation proves the new plan/evidence records are the sole snapshot change.
+- `MISSION.md` — only if `osc close` records the verified plan closeout.
+
+## Acceptance criteria
+
+- [ ] `package.json`, `package-lock.json` root, and `package-lock.json` `packages[""]` all read `0.34.0`.
+- [ ] `docs/CHANGELOG.md` contains a top `v0.34.0` candidate/prep entry that links issue #239, source PRs #229, #230, #232, #236, #237, and #238, prior release `v0.33.0`, npm `0.33.0`, and this evidence note.
+- [ ] The release-prep evidence note records observed version alignment, registry/release availability checks, package dry-run output, verification commands, and the no-merge/no-publish/no-release authority boundary.
+- [ ] Open Scaffold plan/evidence records contain no placeholder text and validate after any intentional live-corpus hash update.
+- [ ] A draft PR is opened or updated against `main` from `forge/issue-239-release-open-scaffold-ambient-capture-trust-package`, with `Closes #239` or an explicit keep-open explanation and a public-safe authority boundary.
+- [ ] No forbidden external release action is performed: no merge, real publish, workflow dispatch, tag, GitHub Release, force-push, settings change, secret change, or package version beyond `0.34.0`.
+
+## Verification steps
+
+1. `node -e "const p=require('./package.json'), l=require('./package-lock.json'); if (p.version !== '0.34.0' || l.version !== '0.34.0' || l.packages[''].version !== '0.34.0') process.exit(1)"` — expected pass.
+2. `npm view open-scaffold dist-tags --json` and `npm view open-scaffold@0.34.0 version --json` — before owner publishing, expected `latest` remains `0.33.0` and `0.34.0` is not found, or record environment/network failure honestly.
+3. GitHub tag/release/PR overlap checks — expected no `v0.34.0` release/tag and no open overlapping PR before this draft PR.
+4. `git diff --check` — expected pass.
+5. `./verify.sh --strict && npm test -- --run` — configured required verification, expected pass.
+6. `npm run build` — expected pass.
+7. `npm pack --dry-run --json` — expected package id `open-scaffold@0.34.0`; record observed tarball/file counts.
+8. `npm publish --dry-run --tag latest` — dry-run only if npm auth/network permits; if blocked, record as not observed without attempting a real publish.
+
+## Open questions
+
+- None for release-prep. npm publish, GitHub Release creation, tag/release movement, and post-publish smoke remain owner-gated follow-through after review/merge.
diff --git a/.osc/releases/2026-06-28-175-ambient-capture-trust-package-sync.md b/.osc/releases/2026-06-28-175-ambient-capture-trust-package-sync.md
@@ -0,0 +1,61 @@
+# Release / Evidence Note: 175-ambient-capture-trust-package-sync
+
+## Summary
+
+Prepared the `open-scaffold@0.34.0` release-sync candidate for the ambient capture trust/setup package surface now on `origin/main`. This note records draft-PR preparation evidence only; it does not claim merge, npm publication, tag creation, GitHub Release creation, or owner approval for those follow-through actions.
+
+## Traceability
+
+- Roadmap / issue / task: https://github.com/graphanov/open-scaffold/issues/239.
+- Plan: `.osc/plans/active/175-ambient-capture-trust-package-sync.md` while this prep PR is in progress; expected final path `.osc/plans/done/175-ambient-capture-trust-package-sync.md` after closeout.
+- Release delta from `v0.33.0` to current `origin/main`: #229, #230, #232, #236, #237, and #238.
+- Source PRs:
+  - #229 — https://github.com/graphanov/open-scaffold/pull/229
+  - #230 — https://github.com/graphanov/open-scaffold/pull/230
+  - #232 — https://github.com/graphanov/open-scaffold/pull/232
+  - #236 — https://github.com/graphanov/open-scaffold/pull/236
+  - #237 — https://github.com/graphanov/open-scaffold/pull/237
+  - #238 — https://github.com/graphanov/open-scaffold/pull/238
+- Previous release: https://github.com/graphanov/open-scaffold/releases/tag/v0.33.0.
+- npm current latest before owner publishing: https://www.npmjs.com/package/open-scaffold/v/0.33.0.
+- Run ID / run packet: N/A; this release-prep slice was implemented directly from issue #239's approved design and critique.
+- Branch / PR: intended branch `forge/issue-239-release-open-scaffold-ambient-capture-trust-package`; draft PR not opened from this workspace because branch creation/commit publication is blocked by environment permissions.
+
+## Verification
+
+- `npm run osc -- resume` — PASS: handoff packet compiled; unrelated active plan `163-proof-harness-v2` noted.
+- `./verify.sh --quick --quiet` — PASS before content edits.
+- GitHub connector PR overlap search for issue #239, title, release scope, and branch — PASS: no open overlapping PR returned before edits.
+- `git fetch --prune origin` — PASS; local `HEAD` and `origin/main` both at `46fe3f405076cc02001e9d73447109fbcddadfcb` before edits.
+- `git log --oneline v0.33.0..origin/main` — PASS: release delta observed as #229, #230, #232, #236, #237, and #238.
+- `npm version 0.34.0 --no-git-tag-version` — PASS: package metadata bumped without tag creation.
+- Version alignment command — PASS: `package.json`, package-lock root, and package-lock `packages[""]` all read `0.34.0`.
+- `npm view open-scaffold dist-tags --json` — BLOCKED in this workspace: `ENOTFOUND registry.npmjs.org`.
+- `npm view open-scaffold@0.34.0 version --json` — BLOCKED in this workspace: `ENOTFOUND registry.npmjs.org`.
+- `git show-ref --verify refs/tags/v0.34.0` — PASS negative local tag check: no local `v0.34.0` tag ref.
+- `gh release view v0.34.0 --repo graphanov/open-scaffold` — BLOCKED in this workspace: `gh` could not connect to `api.github.com`.
+- `git diff --check` — PASS.
+- `./verify.sh --strict` — PASS before live-corpus hash refresh: 10 pass / 0 fail / 0 warn.
+- `npm test -- --run tests/section-parser.test.ts` — EXPECTED FAIL before live-corpus hash refresh: only the pinned plan hash changed after adding the new release-prep plan/evidence corpus (`received a2f1bd25dae3e5eeebfed71332f0dd9334b00d87a4dcd97c7fdce1b799c3c3b4`).
+- `npm run build` — PASS.
+- `npm pack --dry-run --json` — initial run BLOCKED by the Hermes profile npm cache (`EPERM` under `.npm/_cacache/tmp`); rerun with `npm_config_cache=/private/tmp/open-scaffold-npm-cache` PASS for `open-scaffold@0.34.0`, tarball `open-scaffold-0.34.0.tgz`, 228 files, 406175 bytes packed, 1868312 bytes unpacked, shasum `40c386f49cf4440011723af94bf63d477e410cf2`.
+- `npm_config_cache=/private/tmp/open-scaffold-npm-cache npm publish --dry-run --tag latest` — PASS dry-run only; npm reported `+ open-scaffold@0.34.0`. No real publish was performed.
+- `npm test -- --run tests/section-parser.test.ts` after live-corpus hash refresh — PASS: 1 file / 7 tests.
+- `./verify.sh --strict && npm test -- --run` after live-corpus hash refresh — PARTIAL / BLOCKED BY SANDBOX: strict verification passed again (10 pass / 0 fail / 0 warn), then full Vitest failed because this sandbox forbids local IPC/listen operations used by `node_modules/.bin/tsx` subprocesses and cockpit loopback tests (`listen EPERM` on `/var/.../tsx-501/*.pipe` and `127.0.0.1`). Observed test summary under that environment: 51 files, 30 passed / 21 failed; 625 tests, 458 passed / 167 failed; failures were dominated by subprocess/loopback listener setup, not assertion deltas in the release-prep files.
+- `TSX_DISABLE_CACHE=1 node_modules/.bin/tsx src/cli.ts verify --help` — BLOCKED by same `listen EPERM` pipe failure.
+- `node --import tsx src/cli.ts verify --help` — PASS: CLI help rendered.
+- `node dist/cli.js --version` — PASS: `0.34.0`.
+- `node dist/cli.js verify --help` — PASS: compiled CLI help rendered.
+- Draft PR body generation with `$HERMES_HOME/scripts/john_lomein_comment_templates.py pr-draft-body` — PASS: generated public-safe Summary, Scope, Out-of-scope, Verification, Risk, Linked issue, and Authority boundary sections with an explicit keep-open explanation for issue #239.
+- GitHub connector `_create_branch` for `forge/issue-239-release-open-scaffold-ambient-capture-trust-package` from `main` — BLOCKED: connector call was canceled by the environment before branch mutation.
+- `git switch -c forge/issue-239-release-open-scaffold-ambient-capture-trust-package` — BLOCKED: local `.git/refs/...lock` cannot be created (`Operation not permitted`).
+- `git push -u origin forge/issue-239-release-open-scaffold-ambient-capture-trust-package` — BLOCKED: local branch/refspec does not exist after the branch-create failure.
+
+## Outcome
+
+Draft release-sync preparation is complete locally for `open-scaffold@0.34.0`, but branch/commit/PR publication is blocked in this managed workspace by read-only local git metadata and canceled GitHub connector branch mutation. Owner-gated follow-through remains out of scope for automation: merge, npm trusted publishing, npm `latest` movement, tag creation, GitHub Release creation/Latest movement, and post-publish smoke must happen only after explicit owner approval.
+
+## Follow-up
+
+- Before draft PR: publish these prepared local changes to `forge/issue-239-release-open-scaffold-ambient-capture-trust-package` from an environment with git metadata write access or working GitHub connector mutation, then open the draft PR with the generated public-safe body.
+- After merge and owner gate: dispatch trusted publishing for `expected-version=0.34.0`, verify npm `latest`, create GitHub Release `v0.34.0`, and record post-publish smoke evidence.
diff --git a/README.md b/README.md
@@ -80,7 +80,7 @@ Use for multi-session AI work, PRs needing intent and evidence, audit-sensitive
 
 ## Honest limits
 
-Pre-1.0 (`v0.33.x`). Does not make your model smarter — it makes the loop around the model disciplined. Maturity contract: [`docs/STABILITY.md`](docs/STABILITY.md). Claim ledger: [`docs/PROOF_HARNESS.md`](docs/PROOF_HARNESS.md). Raw receipts: [`harness-bench`](https://github.com/graphanov/harness-bench).
+Pre-1.0 (`v0.34.x`). Does not make your model smarter — it makes the loop around the model disciplined. Maturity contract: [`docs/STABILITY.md`](docs/STABILITY.md). Claim ledger: [`docs/PROOF_HARNESS.md`](docs/PROOF_HARNESS.md). Raw receipts: [`harness-bench`](https://github.com/graphanov/harness-bench).
 
 ## Key docs
 

diff --git a/ROADMAP.md b/ROADMAP.md
@@ -40,7 +40,7 @@ Not every small task needs every link, but meaningful work should make the chain
 
 ## Historical baseline milestones
 
-The early milestones below preserve the project-history shape that was once called v1. The current public package line is `v0.33.x` pre-1.0; these entries are proof of dogfood history, not a fresh npm/GitHub Release authorization.
+The early milestones below preserve the project-history shape that was once called v1. The current public package line is `v0.34.x` pre-1.0; these entries are proof of dogfood history, not a fresh npm/GitHub Release authorization.
 
 ## Milestone 0 — Product contract and dogfood baseline
 
@@ -397,7 +397,7 @@ Acceptance criteria:
 
 ### Milestone 18 — historical v1.0.0 stability launch
 
-Status: completed as a historical launch line through `.osc/plans/done/069-v1-launch.md`, `.osc/releases/2026-05-25-v1-launch.md`, PR #113, and later package/release follow-through. As of the `123-evidence-chain-package-release-sync` closeout, the forward-moving channel was intentionally corrected back to pre-1.0 hardening; after the `osc capture` package sync, that current hardening line is `v0.33.x` until the public product surface earns a mature 1.0 contract.
+Status: completed as a historical launch line through `.osc/plans/done/069-v1-launch.md`, `.osc/releases/2026-05-25-v1-launch.md`, PR #113, and later package/release follow-through. As of the `123-evidence-chain-package-release-sync` closeout, the forward-moving channel was intentionally corrected back to pre-1.0 hardening; after the ambient capture trust package sync, that current hardening line is `v0.34.x` until the public product surface earns a mature 1.0 contract.
 
 Goal: make the adoption contract explicit before the first major-release experiment.
 

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
@@ -4,6 +4,30 @@ This is a curated human-readable changelog. It compresses the detailed `MISSION.
 
 For live package truth, check npm. For live release truth, check GitHub Releases. Repository evidence notes describe what was prepared and, when applicable, the publication proof after trusted publishing/GitHub Release follow-through.
 
+## v0.34.0 — Ambient capture trust and setup package sync
+
+Status: release-sync candidate prepared for `open-scaffold@0.34.0`; not yet published to npm, not yet tagged, and no GitHub Release `v0.34.0` exists until owner-gated follow-through after review/merge. npm `latest` remains `0.33.0` before that owner action.
+
+Highlights:
+
+- Prepares the post-`v0.33.0` mainline work for the public npm package surface, cut from current `origin/main`.
+- Adds the ambient capture setup helper for Codex and Claude Code, including dry-run/setup-all behavior and guarded config writes.
+- Adds ambient record verification and trust-report behavior for validating captured records without exposing raw transcript contents.
+- Feeds ambient capture records into `osc resume` / handoff summaries so resumed work can cite observed ambient records without treating transcripts as semantic truth.
+- Adds MCP coding-agent quickstart documentation.
+- Carries the `@types/node` development-dependency refresh and the `0.33.0` publication proof closeout into the release delta.
+- Keeps Open Scaffold core repo-native and authority-limited: it records and verifies work artifacts, but does not grant runtime, merge, publish, release, tag, workflow-dispatch, or settings authority by itself.
+- Keeps ambient capture observational. Trust reports check record shape and captured trust signals; they are not semantic correctness, compliance certification, or transcript truth beyond the captured evidence boundary.
+
+Evidence:
+
+- Issue: https://github.com/graphanov/open-scaffold/issues/239
+- Source PRs: https://github.com/graphanov/open-scaffold/pull/229, https://github.com/graphanov/open-scaffold/pull/230, https://github.com/graphanov/open-scaffold/pull/232, https://github.com/graphanov/open-scaffold/pull/236, https://github.com/graphanov/open-scaffold/pull/237, and https://github.com/graphanov/open-scaffold/pull/238
+- Release-sync plan: `.osc/plans/active/175-ambient-capture-trust-package-sync.md`
+- Release-sync evidence note: `.osc/releases/2026-06-28-175-ambient-capture-trust-package-sync.md`
+- Previous release: https://github.com/graphanov/open-scaffold/releases/tag/v0.33.0
+- npm current latest before owner publishing: https://www.npmjs.com/package/open-scaffold/v/0.33.0
+
 ## v0.33.0 — Evidence battery package sync
 
 Status: published to npm as `open-scaffold@0.33.0`; GitHub Release `v0.33.0` is Latest after owner-approved trusted publishing and release follow-through, superseding `v0.32.1`.