Revise PR #236: duplicate CHANGELOG entry, a README sentence about the container, and three merged PRs still unlogged

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## Unreleased
 
+A2A message envelope: `POST /a2a/send` now accepts optional `refs` and `blocks` fields. `refs` is a list of up to 8 structured reference objects (kind, title, uri, etc.), and `blocks` is a list of arbitrary objects for rich content. The total serialized message is capped at 64KB. `body` remains required when `blocks` is absent, and is required alongside `blocks` when blocks are present (PR #212).
+
+CollectionStore opens `collections.db` via the shared `_db.connect` helper, gaining WAL journal mode and a busy timeout like every other store in the package (PR #215).
+
+Dev and test dependencies moved into a PEP 735 `[dependency-groups] dev` group, so a bare `uv sync` from a clean checkout installs pytest, pytest-asyncio, and the auth extras needed by the test suite with no flags (PR #219).
+
+A deleted-symbols CI gate (`scripts/check_deleted_symbols.py`) catches PRs that silently strip Python `def`/`class` symbols present on the base branch but absent from the merge result -- the "automatic merge went well, no conflict" failure mode where a branch cut before hardening commits landed would silently delete them. The gate reports each deleted symbol with the commit that introduced it, and a `Removes-Intentionally: <symbol>` trailer in the PR body waives named symbols so deliberate removals become a conscious, auditable act (PR #240).
+
+The deleted-symbols gate now prints the `Removes-Intentionally` waiver trailer in its failure message, built from the symbols that actually failed, so the escape hatch is discoverable from CI redness alone rather than requiring a contributor to dig through workflow comments or module docstrings (PR #243).
+
+A2A bus authentication design and three-stage transition plan (`docs/specs/a2a-bus-auth-transition.md`). The plan targets a state where `POST /a2a/send` requires a registry-signed Bearer JWT and `from` is derived from the token rather than read from the body, with handle normalisation applied at every boundary. It lays out fail-safe rules -- the pubkey fetch fails closed, cached keys carry an explicit age, and a verifier that cannot run is a startup error in enforce mode -- and a three-stage cutover (Stage 1 accept-and-annotate, Stage 2 verify-and-warn, Stage 3 hard enforce), each advancing on an exit test rather than a date so coordination is never black-holed mid-transition (PR #245).
+
 `GET /version` with a capability list (new `taosmd.capabilities` module). The server now publishes what the running build actually supports, because neither a status code nor a version number could answer that. `taosmd serve` renders the dashboard SPA on unknown non-API paths, so `GET /collections` returns `200 text/html` on a build with no collections code, and an integrator who "verified" a route by checking for a 200 got a confident yes from a server that could not do the thing (this really happened, against the wrong service). Semver does not close the gap either: features land continuously between bumps, and a production box sat a month stale without anyone noticing even though `GET /health` already reported a version. `/version` returns `{"version", "commit", "commit_source", "built_at", "built_at_source", "capabilities"}` and `GET /health` gains the same `capabilities` list alongside its existing `status` and `version` keys, which are unchanged (taOS and the dashboard consume both). Both endpoints are unauthenticated by design, joining `/health` in `_PUBLIC_PATHS`, so monitoring and drift probes keep working on a token-secured box; they expose build identity and capability identifiers only (no paths, no tokens, no configuration). Capabilities are **stable contract identifiers with an explicit version suffix** (`collections.v1`, `grants.v1`, `temporal.v1`, `a2a.v1`, `tasks.v1`, `ingest.v1`, `search.v1`, `graph.v1`, `shelves.v1`), not feature names: a breaking change to a wire contract becomes `collections.v2`, so a client pinned to `collections.v1` sees the capability disappear (a visible break it can act on) rather than `collections` silently meaning something new; additive changes keep the identifier. The list is derived at request time by probing the running build (each identifier is declared next to the module and symbols that implement it, and is advertised only if they resolve), so deleting or renaming an implementation deletes the claim instead of leaving a stale boast, and a divergence test asserts every declared capability's routes exist in the real dispatcher. The commit sha is resolved once at first call and cached, never per request and never by shelling out: `git rev-parse` in a request path can block on a lock or a slow filesystem, so the git plumbing is read directly from the filesystem (`.git/HEAD` -> loose ref or `packed-refs`, including the `gitdir:` indirection used by worktrees and submodules), with an optional packaged `taosmd/_build_info.py` stamp taking precedence for wheel and container builds. Every step degrades to `null` rather than raising, so a pip install with no checkout and no stamp still gets a working endpoint.
 
 Schema migration framework (`taosmd/migrations.py`, `docs/migrations.md`). Every SQLite database the package owns now carries a schema version in its own file via SQLite's native `PRAGMA user_version`, with an ordered list of migration steps per database and a runner that applies only the steps above the stored version, each inside its own transaction, stamping the new version atomically with the change it made. Before this there was no migration mechanism at all: schemas were created with `CREATE TABLE IF NOT EXISTS` and evolved by three hand-rolled `try/except ALTER TABLE` guards. That held only because every change so far was additive. `CREATE TABLE IF NOT EXISTS` does nothing to a database that already exists, so the first column added to an existing table would have reached new installs and no existing one, and every query naming it would have failed at runtime on exactly the stores holding real data. `collections.db` had no upgrade path whatsoever, so that break was one column away from every collections store in the field. The runner is cheap enough to call on every store open (one PRAGMA read when current) and each of `vector-memory.db`, `knowledge-graph.db`, `archive-index.db`, `session-catalog.db`, `claims.db`, and `collections.db` now runs it as part of opening, before its first query.

README.md

@@ -62,7 +62,7 @@ The agent will pull the repo, run the install, register itself, append the per-t
 
 ### One-Line Setup (manual)
 
-> **Install:** `pip install taosmd` (add the MCP server with `pip install "taosmd[mcp]"`). For a source/dev install instead, `git clone` then `pip install -e .`. The one-line bootstrap below additionally installs Ollama and downloads the embedding and LLM models; it is newer and still being validated across clean machines, so please report issues.
+> **Install:** `pip install taosmd` (add the MCP server with `pip install "taosmd[mcp]"`). For a source install instead, `git clone` then `pip install -e .`. Warning: `pip install -e .` installs the runtime only and gives you no test runner. The failure is silent, so a reader will otherwise assume their setup worked. See the Dev setup section below for the working commands. The one-line bootstrap below additionally installs Ollama and downloads the embedding and LLM models; it is newer and still being validated across clean machines, so please report issues.
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/jaylfc/taosmd/master/scripts/setup.sh | bash
@@ -80,6 +80,8 @@ This will:
 ```bash
 git clone https://github.com/jaylfc/taosmd.git
 cd taosmd
+
+# Runtime only -- pip install -e . gives you no test runner
 pip install -e .
 
 # 1. Embedding model (required)
@@ -97,6 +99,27 @@ hf download dulimov/Qwen3-4B-rk3588-1.2.1-base \
   --local-dir ~/.rkllama/models/qwen3-4b-chat
 ```
 
+### Dev setup
+
+```bash
+git clone https://github.com/jaylfc/taosmd.git
+cd taosmd
+
+# Install the package plus test dependencies
+uv sync
+
+# Verify the environment
+uv run python -c "import pytest, jwt, cryptography"
+
+# Run the test suite
+uv run pytest
+```
+
+`pip` is not documented as a working dev-setup path: `pip install -e .`
+installs the runtime only and does not read the PEP 735 `[dependency-groups]`
+dev group where the test dependencies live. `uv sync` is the supported short
+path.
+
 ### Install hygiene (avoid a shadowed install)
 
 Always install taOSmd into a virtual environment, and never with `sudo` into the