Skip to content

release: v0.66.0 — compliance, leaner kit, Agent HQ, security commands, org policy - #6

Merged
8syncdev merged 6 commits into
mainfrom
feat/agent-hq
Oct 12, 2026
Merged

release: v0.66.0 — compliance, leaner kit, Agent HQ, security commands, org policy#6
8syncdev merged 6 commits into
mainfrom
feat/agent-hq

Conversation

@8syncdev

@8syncdev 8syncdev commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

Summary

Includes PR #5 (compliance hardening + leaner role-routed kit + LSP + public plugin marketplace) and adds:

  • 8sync hq: Discord Agent HQ (server layout, task-board forum, persona webhooks driven by Claude Code hooks, standup, systemd lead unit with the official Channels plugin). Never touches Claude credentials.
  • Security commands /rules, /sec, /harden + 8sync ccc policy (managed-settings for the org, documented keys only).
  • Kit agents pm/architect/qa; stop gate yields to an explicit user stop; size ceiling 5392 → 5632 KiB with attribution.
  • Version 0.66.0, CHANGELOG [0.66.0].

Test plan

  • cargo test 235 passed; --no-default-features build; clippy clean on changed files
  • release build 5,612,000 B local; size gate OK
  • UAT: mock Discord full flow; parallel-hook race → 1 post; real claude -p sessions back to back → tasks posted/tagged/commented; systemd-analyze verify on units; /rules + /sec live in Claude Code
  • reviewer: 3 rounds → MERGEABLE; /aup-audit PASS
  • CI 3 OS (this PR)
  • release assets + install-smoke after tag
  • real Discord (needs the owner's bot token)

🤖 Generated with Claude Code

8syncdev and others added 6 commits October 12, 2026 10:39
@8syncdev @claude
fix(security): keep Claude tokens on sanctioned routes; drop the 9rou…
ed7ab36 
…ter Claude proxy

- harness claude-code: exact-host allowlist (api.anthropic.com, Bedrock,
  Vertex, Foundry, loopback, EIGHTSYNC_SELF_HOSTED_GATEWAY), https except
  loopback, checked before any write; subscription/OAuth tokens only for
  api.anthropic.com; omp and Windows env get Console keys (sk-ant-api) only;
  token masked to last 4; probe uses x-api-key + anthropic-version via stdin
- harness gateway: remove the cc/ provider that made omp pose as Claude
  Code, strip deployed 9router-cc blocks, provider-scoped key read/write,
  refuse sk-ant- keys, keep other providers, opt-in EIGHTSYNC_GATEWAY_ACCEPT=1
- harness add-model: refuse non-Console Anthropic tokens and Claude-protocol
  providers outside the allowlist; re-check registry entries on sync
- forge: Console key only for anthropic, refuse claude_code provider, warn on
  existing claude_code OAuth credential, credentials file 0600
- codex-web: opt-in (EIGHTSYNC_CODEX_WEB_ACCEPT=1)
- feynman: bridge skips every Claude/Anthropic model; find Pi packages under
  @earendil-works/* then @mariozechner/* (Feynman >= 0.5.35)
- Claude 5.5 model IDs; setup-claude-key.{sh,ps1} only forward to
  `8sync harness claude-code` on stdin

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@8syncdev @claude
feat(ccc): leaner, role-routed Claude Code kit
6c3345a 
- repo CLAUDE.md block compact (<=1.1 KB), no forced SKILL.md reads, no
  "MCP always present" claim; skip su-code/ memory dirs; no new block under
  an ancestor that already has one (existing blocks refreshed, never stripped)
- kit CLAUDE.md summarises the 8 Sync / Anthropic rules instead of @importing
  the 6.7 KB doc; integrity + subagent-envelope lines; /aup-audit triggers
- user-scope skillOverrides name-only for linked on-demand bundled skills,
  keyed by frontmatter name, core skills and user values kept
- agents: model/effort/maxTurns/disallowedTools by role; new researcher +
  verifier; deep-research v2 pipeline (adapted from Feynman, MIT —
  THIRD_PARTY_NOTICES.md); /ship cites command output for done claims
- stop gate on Haiku 5.5 allows waiting on background agents; ask gate on
  Sonnet 5.5; mirror_mcp reports why servers are not registered, serena
  alwaysLoad:false
- `8sync ccc hook session-start`: byte-stable su-code STATE/KNOWLEDGE digest
  (<=6000 B, startup|clear|compact, found from subdirectories)
- legal snapshot date in docs/legal/anthropic/index.md (refreshed on change)
- CHANGELOG, KNOWLEDGE lessons, research plan plans/2026-10-12-ccc-beyond-omp.md

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@8syncdev @claude
feat(ccc): official LSP plugins + public 8sync-kit plugin marketplace
7e2b99f 
- `8sync ccc kit` enables claude-plugins-official LSP plugins
  (rust-analyzer, typescript, gopls, pyright) only for servers on PATH,
  insert-only; serena stays as fallback
- `.claude-plugin/marketplace.json` publishes `8sync-kit` (subagents +
  /ship from assets/claude); validated with `claude plugin validate`
- test keeps plugin.json version in sync with the crate
- README kit table updated (rules summary, role-routed agents, stop gate,
  LSP, SessionStart digest, plugin install)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@8syncdev @claude
feat(hq): Discord Agent HQ for the Claude Code agent team
0209b8a 
- `8sync hq setup` builds a private server idempotently: categories,
  task-board forum (required status/role/priority tags), rfcs, notes,
  standup, team rooms, ops channels, persona roles, one webhook per channel,
  pinned charter disclosing that personas are AI
- `hq hook` maps Claude Code TaskCreated/TaskCompleted/TeammateIdle/
  Notification to persona posts, forum tags and thread comments; always exits
  0, ~4 ms no-op until setup; tasks scoped by team_name else session_id
  (Claude Code restarts task numbering per session); lock-held reservation so
  parallel async hooks post once; 8 s hook budget
- `hq post|task|standup|status|up`: status lists recent tasks; task ids
  resolve by suffix; `up` prints/installs a systemd unit running the lead with
  the official Channels plugin in tmux plus a 09:00 standup timer
- never touches Claude credentials; bot token + webhooks in a 0600 file, sent
  to curl on stdin, masked everywhere; API base override loopback-only; state
  keeps ids/titles only and is pruned
- UAT: mock Discord API full flow, parallel-hook race, real `claude -p`
  sessions back to back, `systemd-analyze --user verify` on generated units

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@8syncdev @claude
feat(ccc): security slash commands, org policy, HQ team agents
32fff3e 
- /rules (Anthropic AUP/terms + 8 Sync rules + VN data law with clause and
  link), /sec (secrets as file:line only, sensitive files, dep audit, kit
  guard, OWASP), /harden (Claude Code posture) next to /aup-audit
- `8sync ccc policy [--org-uuid] [--out] [--strict-hooks] [--lock-mcp]`:
  managed-settings JSON from documented keys only (bypass off, deny rules,
  claude.ai login optionally pinned to the org, marketplace allowlist,
  sandbox, channelsEnabled; MCP lock opt-in); never writes system paths;
  `ccc status` shows managed settings presence
- kit agents pm, architect (docs/ADR/RFC only), qa; async hq hooks registered
  idempotently
- stop gate yields when Claude quotes the user's own stop/wait words
- release size ceiling 5392 -> 5632 KiB with per-commit attribution
- CHANGELOG, KNOWLEDGE lessons (task-id scoping, systemd quoting, size gate
  not in PR CI, gate vs explicit stop)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@8syncdev @claude
release: v0.66.0 — Claude-token compliance, leaner role-routed kit, A…
d420ac2 
…gent HQ on Discord, security commands, org policy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@8syncdev
8syncdev merged commit 5caa5f0 into main Oct 12, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@8syncdev