docs: close out the governance layer and cut 0.3.0

[oratis]

Summary

PR 8 — the closeout for the adoption plan, plus the 0.3.0 version bump.

Minor rather than patch: the unattended permission clamp in #244 is breaking on 0.x.

Threat model

docs/security-model.md gains three threats and one strengthened entry:

#	Threat	Status
8	Model reads an in-project secret (.env, *.pem) through a read tool	Partly mitigated
9	Unattended job runs with a permissive mode inherited from interactive settings	Mitigated
10	User cannot audit or undo what the agent wrote	Mitigated
6	Untrusted AGENTS.md drives harmful action	Strengthened — a contract deny is independent of model judgement, so prompt injection cannot argue past it

#8 is deliberately "partly". A new residual-risk section states plainly what the file contract is not: it constrains dispatcher tool calls, not what a shell command does after Bash starts, and path normalization is string math rather than realpath. It ends with an instruction to maintainers not to describe it as secret protection in user-facing text — that false confidence is the risk the plan named as this feature's biggest.

An honest deviation log, not a victory lap

The plan is marked implemented with a table of six places the implementation diverged — including two where the plan was simply wrong:

• PR 0's premise. It claimed unattended runs might "silently allow". They didn't; runHeadless already installs an auto-deny. feat(core): give unattended runs an explicit approval policy #237 rewrote its own scope to the real gap rather than shipping the claim.
• The four-client consistency test. Only the CLI and app-server resolve policy independently. VS Code and LSP are thin protocol clients that consume the server's answer verbatim. The test asserts the two real paths and documents why the other two are equal by construction, instead of implying four verified paths.

Two P2 items are listed as not done: Grep/Glob result filtering (the contract judges the search root, not each hit) and artifact provenance. Trigger source abstraction (ICS/watch) also remains unbuilt.

Version bump found a doc gap

The repo's own scripts/version-consistency.test.ts caught Cargo.lock still pinning 0.2.0 — a sixth location that docs/RELEASING.md's four-item checklist never mentioned. Both the lock and the checklist are fixed; the checklist now names all six and points at the test that enforces them.

Test plan

• pnpm test — 1414 passed, 16 skipped (from 1156 at the start of this work: +258)
• pnpm typecheck · pnpm lint · pnpm format:check · pnpm build · node scripts/check-docs.mjs
• scripts/version-consistency.test.ts green across all six version locations

Documentation

• docs/security-model.md — threats fix(ci): Node 22 + EPIPE in hooks dispatcher + bash cwd test regex #8–feat(core,cli): M3c — MCP client (stdio) + /mcp slash + REPL wire-up #10, strengthened feat(core,cli): M5 — plugins (manifest+hash) + Skill tool + CLI integration #6, residual-risk section
• docs/FLOATBOAT_ADOPTION_PLAN.md — status, deviation table, final answers to the four open assumptions
• docs/RELEASING.md — six-location version checklist
• README.md — doc map entries for the three new user docs and two design docs
• CHANGELOG.md — 0.3.0, including a "deliberately not adopted" section

Release notes label

• release-notes:internal — docs and version metadata; the features themselves are labelled on their own PRs

Related

Closes out plan PRs 0–8: #237 #238 #239 #240 #241 #242 #243 #244.

🤖 Generated with Claude Code