Edgebase v0.1.8

Edgebase 0.1.8 Release Audit

Date: 2026-05-26

Scope: Advisory Change Blast Radius release.

Release Goal

Add a careful planning surface that answers: "If this file changes, what routes, migrations, tests, downstream modules, and side effects should the agent inspect before editing?"

The key product constraint is that radius output must not become another edit gate. It should help an agent plan and test around likely impact, while making clear that listed paths are not mandatory edits.

Release Changes Reviewed

• Added edgebase radius CLI command.
• Added edgebase_radius MCP tool.
• Added generated /edgebase-radius project skills and MCP prompt alias through the existing /edgebase-* command set.
• Added advisory Change Blast Radius sections to Goal Capsules when a target file is known.
• Added radius findings with category, path, reason, confidence, and source.
• Documented radius usage in README, agent-client docs, architecture notes, validation docs, and launch copy.

Safety Review

• Radius is advisory only. It does not affect PreToolUse, preflight freshness, or edit blocking.
• Findings are confidence-scored and source-backed when graph edges exist.
• Heuristic findings are labeled with path.heuristic and lower confidence.
• Migration paths are phrased as "inspect only if schema or data shape changes."
• Radius output explicitly says it is an impact map, not an edit requirement.

Verification

Required checks:

python3 -m compileall -q src tests
python3 -m unittest -v
git diff --check

Focused radius checks:

python3 -m unittest -v \
  tests.test_edgebase.EdgebaseTests.test_change_radius_classifies_routes_tests_migrations_and_risks \
  tests.test_edgebase.EdgebaseTests.test_radius_cli_and_mcp_return_advisory_surface \
  tests.test_edgebase.EdgebaseTests.test_goal_capsule_markdown_and_contract_schema \
  tests.test_edgebase.EdgebaseTests.test_mcp_exposes_context_and_goal_surfaces

Expected billing smoke output includes:

Changing `src/billing/subscription.ts` likely affects:
- API route: `src/routes/billing.ts`
- DB migration path: `migrations/*`
- tests: `tests/billing/subscription.test.ts`
- downstream module: `src/notifications/invoices.ts`
- risk: payment provider side effects
Advisory: this is an impact map, not an edit requirement.

Release v0.1.8 is acceptable if checks pass, the public tag install smoke passes, CI passes, and the GitHub release tag points at the final commit.

Edgebase v0.1.7

Edgebase 0.1.7 Release Audit

Date: 2026-05-26

Scope: Agent-visible lifecycle command and graph verification release.

Release Goal

Make Edgebase's lifecycle operations available from slash-capable agent clients, then verify that the local knowledge graph, freshness updates, preflight memory, checkpoint memory, graph artifacts, and patch passports work together end to end.

Release Changes Reviewed

• Added /edgebase-checkpoint, /edgebase-resume, /edgebase-fork-plan, /edgebase-passport, /edgebase-preflight-status, /edgebase-preflight-refresh, /edgebase-index, /edgebase-stats, /edgebase-doctor, /edgebase-setup, /edgebase-disable, and /edgebase-version project skills for Claude Code and Codex.
• Added MCP prompt aliases for the same /edgebase-* command set.
• Updated edgebase init, setup output, README, agent-client docs, architecture docs, validation docs, universal setup prompt, and launch post to describe the lifecycle commands.
• Extended doctor coverage and regression tests for generated lifecycle skills and disable cleanup.
• Added graph lifecycle verification notes in docs/GRAPH_VERIFICATION_0.1.7.md.

Safety Review

• The new slash commands delegate to existing Edgebase CLI/MCP surfaces; they do not add new repository edit behavior.
• Generated skill files are marker-bounded and setup refuses to overwrite unmarked user-owned skills.
• Doctor validates branded, compatibility, and generated /edgebase-* command files.
• Disable removes generated lifecycle skills while preserving unrelated user config.
• Graph verification used a throwaway git repository and disposable virtual environment.

Verification

Required checks:

python3 -m compileall -q src tests
python3 -m unittest -v
git diff --check

Graph lifecycle smoke:

python3 -m edgebase setup --agents claude,codex --scope project
python3 -m edgebase doctor --agents claude,codex --scope project
python3 -m edgebase context "<task>" --changed-file app/auth.py --json
python3 -m edgebase index --changed
python3 -m edgebase hooks claude-user-prompt-submit
python3 -m edgebase hooks claude-pre-tool-use
python3 -m edgebase hooks claude-post-tool-use
python3 -m edgebase checkpoint "<message>"
python3 -m edgebase resume
python3 -m edgebase hooks claude-pre-compact
python3 -m edgebase hooks claude-session-end

Release v0.1.7 is acceptable if checks pass, graph lifecycle smoke passes, setup smoke passes, CI passes, and the GitHub release tag points at the final commit.

Edgebase v0.1.6

Edgebase 0.1.6 Release Audit

Date: 2026-05-26

Scope: Branded Goal Capsule command release.

Release Goal

Make the explicit Goal Capsule path easy to discover as an Edgebase command while keeping the existing /goal alias compatible for users who already installed it.

Release Changes Reviewed

• Added /edgebase-goal <goal> Claude Code project skill.
• Added /edgebase-goal <goal> Codex project skill.
• Added edgebase-goal MCP prompt next to edgebase and goal.
• Added edgebase --version for install and smoke-test verification.
• Updated setup, doctor, AGENTS marker text, README, agent-client docs, architecture docs, validation docs, and the universal setup prompt.
• Kept /goal <goal> as a compatibility alias.
• Hardened Codex setup so pre-existing unmarked project skills are skipped instead of overwritten or causing setup to abort.

Safety Review

• The new command is an alias over the existing edgebase goal implementation; it does not add a new execution path for repository edits.
• Skill files are marker-bounded and setup refuses to overwrite unmarked user-owned skills.
• Doctor validates both branded and compatibility command files.
• MCP prompt handling records the prompt source as mcp-prompt-edgebase-goal or mcp-prompt-goal for provenance.

Verification

Required checks:

python3 -m compileall -q src tests
python3 -m unittest -v
git diff --check

Setup smoke:

edgebase setup --agents claude,codex --scope project
edgebase doctor --agents claude,codex --scope project
test -f .claude/skills/edgebase-goal/SKILL.md
test -f .agents/skills/edgebase-goal/SKILL.md
edgebase --version

Release v0.1.6 is acceptable if checks pass, setup smoke passes, and the GitHub release tag points at the final commit.

Edgebase v0.1.5

Edgebase 0.1.5 Release Audit

Date: 2026-05-26

Scope: GitHub presentation and repository polish release.

Release Goal

Make the GitHub repository look credible on first visit while preserving the technical promise: Edgebase is a local, git-native preflight context layer for coding agents.

Release Changes Reviewed

• Added SVG logo and mark assets under assets/.
• Added GitHub Actions CI for Python 3.10 and 3.12.
• Added issue templates and pull request template.
• Updated README first screen with logo, badges, clearer positioning, and concrete behavior bullets.
• Added docs/LAUNCH_POST.md.
• Updated package description and security docs.

Safety Review

• SVG assets are static and contain no scripts or external references.
• CI runs only compile and unit tests.
• GitHub templates do not alter runtime behavior.
• README claims remain scoped to implemented behavior: local index, MCP tools, Claude/Codex hooks, preflight gate, provenance, and reversible setup.

Verification

Required checks:

python3 -m compileall -q src tests
python3 -m unittest -v
git diff --check

Security spot checks:

rg -n "<script|http://|https://" assets .github docs/LAUNCH_POST.md

Release Decision

Release v0.1.5 is acceptable if checks pass and the GitHub release tag points at the final commit.

Edgebase v0.1.4

Edgebase 0.1.4 Release Audit

Date: 2026-05-26

Scope: install documentation patch release.

Release Goal

Make the first install instruction a universal prompt users paste into their coding agent, not a command they personally run. The agent should install, run setup, verify with doctor, and report changed files.

Release Changes Reviewed

• README install section now leads with "Install With Any Agent."
• Agent client docs now state that the normal install path is a prompt.
• docs/UNIVERSAL_AGENT_PROMPT.md provides the standalone prompt for Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Windsurf, and similar tools.
• Manual pip install and edgebase setup commands remain documented as fallback/reference.

Safety Review

• The prompt tells agents not to overwrite existing agent config and not to commit unless explicitly asked.
• The prompt keeps generated architecture summaries out of AGENTS.md.
• The prompt requires edgebase doctor --scope both after setup.
• The prompt documents the disable path and emergency preflight bypass.

Verification

Required checks:

python3 -m compileall -q src tests
python3 -m unittest -v
git diff --check

Remote install smoke:

python3 -m pip install --user --upgrade git+https://github.com/ychampion/edgebase.git@v0.1.4
python3 -m edgebase setup --scope project --agents claude,codex
python3 -m edgebase doctor --scope project --agents claude,codex

Release Decision

Release v0.1.4 is acceptable if the checks pass and the GitHub release tag points at the final commit.

Edgebase v0.1.3

Edgebase 0.1.3 Release Audit

Date: 2026-05-26

Scope: release readiness review for the Agent Preflight Gate release.

Release Goal

Ship Edgebase as an automatic local agent context substrate. A user should install once, restart the agent, and get fresh, source-backed Goal Capsules before edits without saying "use edgebase_context" on every task.

Threat Model

Primary trust boundaries:

• Local repository paths enter generated hook command strings.
• Agent clients launch Edgebase through stdio MCP config.
• Claude Code and Codex hooks receive prompt/tool JSON from the client.
• Edgebase writes marker-bounded project config and local .edgebase/ state.
• The MCP server accepts local JSON-RPC from the configured agent process.

Assets to protect:

• User source files and git history.
• Existing agent configuration owned by the user.
• Integrity of preflight state, checkpoints, and patch passports.
• Local shell execution boundaries for generated hooks.

Out of scope:

• Remote hosted MCP transports.
• Secret scanning for arbitrary user repositories.
• Perfect dynamic-language call graph precision.

Release Changes Reviewed

• Claude Code UserPromptSubmit, PreToolUse, PostToolUse, PreCompact, and SessionEnd hook paths.
• Codex project .codex/config.toml, .codex/hooks.json, and .agents/skills/* setup.
• Preflight state freshness checks across HEAD, working tree changes, stale index files, and TTL.
• MCP tools: edgebase_context, edgebase_goal, edgebase_checkpoint, edgebase_fork_plan, and edgebase_resume.
• Context checkpoint, fork-plan, resume, and Patch Passport persistence under .edgebase/.
• Setup, disable, and doctor paths for reversible integration.

Findings And Fixes

EB-2026-003: Context skill accidentally recorded preflight with an unsupported flag

Status: fixed before release.

Risk:

The generated /edgebase skill called edgebase context ... --record-preflight, but only edgebase goal supports --record-preflight. That would make the explicit context skill fail for Claude Code.

Fix:

The /edgebase skill now calls edgebase context ... --budget 1200. The /goal skill keeps --record-preflight. Regression coverage asserts the Codex /edgebase skill does not include the flag and the /goal skill does.

EB-2026-004: Codex setup needed doctor-visible hook and skill validation

Status: fixed before release.

Risk:

Writing only MCP config would not make Edgebase unavoidable for Codex-style project workflows. Setup also needed local hooks, skills, and a verification path that detects partial installs.

Fix:

Project setup now writes .codex/config.toml with hooks = true, .codex/hooks.json, .agents/skills/edgebase/SKILL.md, and .agents/skills/goal/SKILL.md. edgebase doctor --agents codex --scope project validates all of them.

EB-2026-005: Named read tools should not be blocked by the pre-edit gate

Status: fixed before release.

Risk:

Codex-style hooks may run for every tool call. Treating any payload with file_path as an edit would incorrectly block named read tools.

Fix:

The gate now trusts explicit tool names first. Read with file_path is allowed, while Write, Edit, MultiEdit, and apply_patch remain gated. Regression coverage verifies named read tools produce no deny payload.

EB-2026-006: Codex hook setup must preserve unrelated project hooks

Status: fixed before release.

Risk:

Replacing .codex/hooks.json would clobber unrelated project automation and violate the reversible setup contract.

Fix:

Codex hook install now parses existing JSON, removes only prior Edgebase hook entries, appends current Edgebase entries, and preserves unrelated keys and hooks. Disable removes only Edgebase hook entries and leaves unrelated hooks intact. Regression coverage verifies merge and disable behavior.

Security Review

Manual review covered:

• generated shell command quoting
• hook JSON parsing and invalid-input fallback
• preflight deny decisions
• MCP JSON-RPC request validation
• local config merge and disable paths
• subprocess use
• checkpoint/fork-plan filesystem writes

Notes:

• Hook commands are generated with shlex.join.
• Runtime subprocess calls use argument arrays; no release path requires shell=True.
• Existing JSON config with invalid syntax is refused instead of overwritten.
• Edgebase state is local and rebuildable under .edgebase/, which setup ignores through .git/info/exclude.
• The emergency bypass is explicit: EDGEBASE_PREFLIGHT=off.
• The normal path needs no Docker, cloud service, graph database, or API key.

Verification Commands

Required local checks:

python3 -m compileall -q src tests
python3 -m unittest -v
git diff --check

Fresh install smoke:

python3 -m venv /tmp/edgebase-smoke/venv
/tmp/edgebase-smoke/venv/bin/python -m pip install -q --upgrade pip
/tmp/edgebase-smoke/venv/bin/python -m pip install -q -e .
mkdir /tmp/edgebase-smoke/repo
cd /tmp/edgebase-smoke/repo
git init
git config user.email t@example.com
git config user.name T
mkdir app tests
printf 'def login(x):\n    return x\n' > app/auth.py
printf 'from app.auth import login\n\ndef test_login():\n    assert login("x")\n' > tests/test_auth.py
git add .
git commit -m init
/tmp/edgebase-smoke/venv/bin/edgebase setup --agents claude,codex --scope project
/tmp/edgebase-smoke/venv/bin/edgebase doctor --agents claude,codex --scope project
printf '{"prompt":"change login behavior"}' | /tmp/edgebase-smoke/venv/bin/edgebase hooks claude-user-prompt-submit --root /tmp/edgebase-smoke/repo
printf '{"tool_name":"Edit","tool_input":{"file_path":"app/auth.py"}}' | /tmp/edgebase-smoke/venv/bin/edgebase hooks claude-pre-tool-use --root /tmp/edgebase-smoke/repo
/tmp/edgebase-smoke/venv/bin/edgebase preflight status --root /tmp/edgebase-smoke/repo

Security tooling:

bandit -q -r src --severity-level medium
pip-audit

Client Evidence

• Claude Code: generated .mcp.json, .claude/settings.json, /edgebase, and /goal skill files are validated by edgebase doctor; hook smoke verifies prompt injection and pre-edit freshness.
• Codex: generated .codex/config.toml, .codex/hooks.json, .agents/skills/edgebase, and .agents/skills/goal are validated by edgebase doctor.
• Cursor, Gemini CLI, OpenCode, and Windsurf: generated config shape and MCP stdio handshake remain covered by setup/doctor checks when the binaries are not installed.

Release Decision

Release v0.1.3 is acceptable if the verification commands above pass from the tagged commit and the GitHub release points at that commit.

Edgebase v0.1.2

Edgebase v0.1.2

First public hardening release for Edgebase as a local, git-native agent context substrate.

Highlights

• Claude Code automatic UserPromptSubmit context injection for coding prompts.
• Project /edgebase skill for explicit context refresh.
• Single primary MCP tool: edgebase_context(task, changed_files?, budget?).
• MCP prompt named edgebase for clients that expose prompt menus.
• setup/doctor/disable flows for Claude Code, Codex, Cursor, Gemini CLI, OpenCode, and Windsurf config generation.
• .edgebase/ cache ignored through .git/info/exclude without modifying committed ignore files.

Security and audit

• Generated git and Claude hook commands now use shlex.join for shell-safe repo path handling.
• Optional benchmark competitor commands now run as argv lists with shell=False.
• Release audit: docs/RELEASE_AUDIT_0.1.2.md

Verification

• python3 -m unittest -v
• python3 -m compileall -q src tests
• git diff --check
• bandit -q -r src --severity-level medium
• pip-audit --path src
• pip install from git tag v0.1.2
• edgebase setup/doctor smoke
• claude mcp get edgebase connected
• codex mcp get edgebase enabled
• Claude UserPromptSubmit hook JSON smoke returned an Edgebase context capsule

Install

python3 -m pip install --user git+https://github.com/ychampion/edgebase.git@v0.1.2 && python3 -m edgebase setup --scope both

Known limits

Cursor, Gemini CLI, OpenCode, and Windsurf binaries were not installed in the release environment. Their generated config shape and Edgebase MCP stdio handshake were verified; live planner behavior should be validated as those clients are available.