BREAKING for anyone running the kit outside Claude Code; nothing changes inside Claude Code. The plugin id
(memory-kit@memory-kit), every skill, agent and hook, and the files the kit owns in your repository are unchanged.

Removed

• Every host other than Claude Code. The Cursor catalog (.cursor-plugin/marketplace.json,
  plugins/memory-kit/.cursor-plugin/plugin.json), the OpenCode shim (.opencode/plugins/memory-kit.js) and the
  root package.json that existed only to install it, and the AGENTS.md protocol block
  (templates/workspace/AGENTS-MEMORY-PROTOCOL.md) for hosts without hooks. Each host enforced a different subset
  and every claim needed its own probe; the kit now makes promises only where it runs.
• /memory-kit:setup no longer offers the AGENTS.md block and no longer carries the "running under another
  host" fallback.
• The per-host specs (docs/specs/{codex,cursor,copilot,opencode,cowork,agents-md}.md), the tier model in
  docs/ARCHITECTURE.md, the "Works with other agents" README section, the OpenCode CI step and the Cursor /
  OpenCode / protocol-marker checks in tools/check-repo.py. All of it stays in git history at tag v7.3.0.

Changed

• The product is called Claude Memory Kit in prose; both READMEs say it is an independent project, not made or
  endorsed by Anthropic. The plugin name, displayName and the GitHub repository stay as they were — the
  directory submission is bound to the repository, and its rules hold a displayName that matches a known brand.
• Three diagrams redrawn without the host list: 01-system-map-claude-code.png, 08-one-operator-claude-code.png,
  og-banner-claude-code.png (prompts kept in tools/asset-prompts/).
• The README comparison is against Claude Code's own auto memory specifically (machine-local, in
  ~/.claude/projects/<project>/memory/ — code.claude.com/docs/en/memory, read 2026-10-22).

Migration

• In Claude Code: nothing. claude plugin marketplace update memory-kit, then claude plugin update memory-kit@memory-kit.
• A repository that appended the protocol block to AGENTS.md: the block is no longer maintained; delete it
  (between the <!-- memory-kit protocol … --> markers) or keep it as a static note.
• OpenCode users: remove memory-kit@git+… from opencode.json; the install would now fail without package.json.

BREAKING: none — but read «Behaviour change». Spec: docs/plans/2026-10-22-v7.3-audit-fixes-readme.md;
platform facts: docs/research/platform-facts-2026-10-22.md; proof: docs/research/v7.3-evidence/.

Behaviour change

• An automatic compaction is never blocked. Claude Code skips a blocked proactive compaction, and on a
  context-limit recovery a block FAILS the user's request (hooks docs, 2026-10-22). A manual /compact still waits for
  saved memory. Over unsaved memory an automatic compaction leaves .claude/state/compact-unsaved, and the next context
  opens with "⚠ COMPACTION RAN OVER UNSAVED MEMORY — save MEMORY.md now"; a later compaction over saved memory is quiet.
• The git and secrets guards fail closed. "onFailure": "block" (Claude Code 2.1.295+): a guard that crashes or
  times out blocks the call instead of letting it through; each guard turns its own internal errors (and a command
  nested past the parser's depth) into an explicit ask; a python3 that cannot run (missing, or the macOS
  /usr/bin/python3 stub that exits 1 without the developer tools) stays a no-op, so such a machine is not bricked. Probed: 2.1.290 accepts the field and keeps every hook running, but lets a crashed guard's call through.
• Appending to .env is allowed in one form only: a single literal echo/printf with one >> redirection.
  Everything else touching a secret file is blocked as in 7.2.2 (the 2026-10-20 >> exemption was reopened three times
  by parser differentials — /proc/self/fd, heredoc bodies, fd duplication — so it was narrowed to a form with nothing
  left to parse).
• Five skills pre-approve edits only inside their own paths (close-session, memory-audit, code-sync); document
  and setup pre-approve no writes (Anthropic directory note "allowed tools unscoped write").
• SessionEnd timeout 1 s — plugin SessionEnd hooks share a 1.5 s budget a plugin cannot raise; the script now ends in
  ~0.6 s with stdin left open (was ~1.05 s).

Added

• guard-zsh-split.py — PreToolUse(Bash), active only when the Bash tool runs zsh: blocks an unquoted multi-word
  $var that zsh will not split the way bash does, and history modifiers on an unbraced $var:; CMK_ZSH_GUARD=off
  or a # zsh-split-ok comment opts out; a prefix assignment (X=v cmd) is not tracked past its command; nesting past
  the parser's depth asks. Ported from a production project hook onto the shared parser.
• Session start flags a project that wires its own COPY of a kit hook (it fires twice) — by the copy's content, never
  its filename; measured on 25 adopter repos: 8 flagged, 0 missed, 0 clean repos flagged.
• An over-cap handoff delivers its opening-note section first (a heading of level 2+ starting with "opening", fenced
  code ignored), itself capped; the handoff body never exceeds 6,000 characters.
• State writes under .claude/state/ refuse a symlinked .claude, state dir or entry, and anything resolving outside
  the project (hooks/lib/statefs.py, hooks/lib/state.sh); temp files via mkstemp/mktemp.
• reference/spec-depth.md — depth pass, a dated Practice line, review by stake, failure branches written first,
  outcome over proxy. SPEC-TEMPLATE carries the three header lines and a failure-branches table.
• check-repo.py check 8: the README names every shipped hook, skill, agent, reference doc, template and script
  (mutation-tested); check 3: a hook with onFailure: block must first prove its interpreter RUNS (command -v is rejected).

Changed

• The orchestration template has nine invariants (added: read one real output yourself; counts come from a script;
  what only the user decides). review-loop: triage before a finding is written down, layer 0 (data model / boundary),
  the stop signal on the 3rd fix round and the direction review, catches vs escapes. doc-governance: one status
  vocabulary, no symlinks, nothing cited from a scratchpad, a decision is built or says why not, external state expires.
• Knowledge articles: a new fact goes INTO its topic section and the replaced line to ## History — never an appended
  dated block (memory-audit merge step, the index template).
• idea-validator holds the parallel-review bar and checks currency; second-opinion defers to a user-level board.
• project-extensions and the system-audit gates lens: the 10,000-character hook-output cap, onFailure, double-wired copies.
• identity.md: the compaction semantics, plain-language reporting to the user, the spec-depth pointer.
• README rebuilt: every part of the plugin on the front page, three regenerated diagrams (prompts in
  tools/asset-prompts/), the demo clips moved to docs/ASSETS.md. Host specs carry a dated docs check (Codex and
  Copilot now document plugin hooks — unprobed on v7, still Tier 2).

Known limits

• protect-tests.py still writes its small ledger under .claude/state/ in a repository that never ran setup
  (unchanged from 7.2; now through the symlink-safe helper).
• A project that keeps its own zsh word-split hook runs it next to guard-zsh-split.py; the double-wired detector
  does not flag it (no content signal yet) — unwire the project copy.

[7.2.3] — 2026-10-08 — no skill pre-approves Bash; a plugin icon

BREAKING: none — but read «Behaviour change».

Behaviour change

• Six skills no longer pre-approve Bash (close-session, code-sync, document,
  memory-audit, setup, tour). allowed-tools is a pre-approval, not a limit: a bare Bash
  there ran ANY shell command without a prompt while the skill was active — the broad allow the
  kit's own permission rails tell users never to keep. The skills still run their commands; each
  one now goes through your normal permission mode (a prompt in default mode, the classifier in
  auto mode). Anthropic's plugin directory validator holds a plugin with this grant for review.
  The project-extensions skill template drops Bash the same way and says how to scope it.

Added

• .claude-plugin/icon.png — the four-layer stack from the banner, 1024 px; the directory takes
  the listing icon from it once, at the first submission.

Changed

• protect-tests.py: the no-opinion exit is named no_opinion(), not allow(). Behaviour is
  unchanged — the hook never returns an approving decision — but the directory's static check read
  the old name as a hook that grants permission.

[7.2.2] — 2026-10-07 — SessionEnd writes nothing in an unadopted repo; directory-ready README

BREAKING: none.

Fixed

• session-end.sh created .claude/state/session-end.log in every repository, adopted or
  not — the one hook that skipped the adoption test session-start and pre-compact already run.
  With a user-wide install, every repo you opened got a .claude/state/ folder it never asked
  for, while the plugin README said the hooks "write nothing" there. It now exits first unless
  .claude/memory/MEMORY.md or context/handoffs/ exists.
• package.json and the AGENTS.md protocol marker carried 7.2.0 through the 7.2.1 release
  (CI on main was red from 62b8685 until the follow-up commit).

Changed

• Plugin README: a «What it reads, writes and sends» section — no network calls, what
  system-audit reads (~/.claude/projects/ transcripts, settings files), what /memory-kit:setup
  writes into .claude/settings.json and only after a yes, and where hooks run (Claude Code and
  Cowork load them; Claude chat loads skills only). Written for Anthropic's plugin directory,
  whose security scan looks for undisclosed behaviour; the directory shows this README as the
  listing.
• Plugin README images use absolute URLs: the installed plugin and the directory listing get
  only the plugin folder, so ../../.github/assets/ never resolved there.
• Repository: SECURITY.md, GitHub Actions pinned to commit SHAs, Dependabot for
  github-actions.

BREAKING: none. Found by a system audit of the v7 testbed project the same day: its 18 specs
live in docs/plans/ with a plain Status: done (…) · Tier: … line and no Created:, so the v7
spec flags had never seen a single one of them.

Fixed

• SessionStart spec flags read a repo-level docs/plans/ (a ## Plans stats row beside the
  per-project rows) and a plain Status: header — at a line start or after a ·, so prose such as
  «the old status: building» never parses — with the date taken from a YYYY-MM-DD-<slug>.md file
  name when no Created: line exists. The bold **Created:** · **Status:** header reads as
  before. Run over the 23 kit projects on the maintainer's machine: no flag fires (no false alarm).
  code-sync reads the same shapes and lists a spec with no status line as no status.
• The OpenCode shim injected a memory-audit deferred list as the session handoff. 7.0.1 fixed
  this in session-start.py only; the shim now skips memory-audit-deferred-* too.

Changed

• The repo's own CLAUDE.md states that a DIRECTORY marketplace loads the plugin in place from
  this checkout (verified in a debug log), so a branch checkout here reaches every kit project on
  the machine; experiments go to a worktree with --plugin-dir.
• CI: a docs/plans/ fixture with plain headers and a decoy sentence, and a shim run where a newer
  deferred list must not replace the real handoff.

BREAKING: none. One new SessionStart nudge (never a block), skill text, one reference rule.
Carried back from a memory audit of a long-running kit project (MEMORY.md 119 → 61 lines,
30 → 10 KB) and a count over the 23 kit projects on the maintainer's machine (2026-09-25).

Added

• SessionStart flags session-headed blocks in MEMORY.md — hooks/session-start.py, mirrored
  in the OpenCode shim. The close ritual always said «never a chronicle»; two of 23 caches carried
  blocks headed ### s66 (2026-09-25) — …, ## Session 65 wrap, ## Findings [date] — … anyway.
  A ##–#### heading is flagged when a session tag stands outside ( )/[ ] or the heading
  opens with a date; a tag in parentheses is provenance on a topic heading and the current-state
  header may name its session. The nudge lists up to five headings with line numbers and runs on
  startup/clear/fork/resume, like the cap nudge. Measured on the same files, against the
  regex first proposed (^#{2,4} .*(\bs[0-9]{1,3}\b|[Ss]ession[ -]?#?[0-9]+|сесси[яи] ?[0-9]+)):

  File (2026-09-25)	Session blocks	Proposed regex	Shipped detector
  23 current caches	7 (in two projects: 6 + 1)	6 found · 1 missed (## Findings [2026-05-04] — <topic>) · 1 false (## Current state (…, end of session 4))	7 found · 0 missed · 0 false
  a third project's cache before its audit (git history)	3 (### s64…s66)	3 found · 2 false (### <topic> track (s37, …); s48 inside a file name in a heading)	3 found · 0 false
  the same cache, an earlier version	4 (### s62…s65)	4 found · 2 false (same two)	4 found · 0 false

  Left unflagged by design: handoff-shaped content under a topic-like heading
  (## Open for next session, ## P2 next-session priorities) — that is the audit's drop.

• memory-audit marks: session-block (dissolve by topic: a settled lesson → a line under its
  topic or a concept; the rest → drop), restates-rule (the entry repeats CLAUDE.md, an
  always-loaded rule or a reference/ file → drop, or one pointer line) and point to SSOT
  (a price, count or version copied from its source of truth → pointer; doc-governance R1 said
  so, the skill never applied it). In the audited project ~20 of 119 lines restated always-loaded
  rules, and a copied model price outlived the model.

• reference/orchestrator-fact-check.md — the history-window rule: a number or an error
  pulled from accumulated history (a DB, logs, past runs) carries its time window and the build
  that produced it; a present-tense claim is checked on current data; an error is dated before it
  is described. The audit that prompted this read counts from a stand spanning five days and 13
  engine builds as the current state, and reported a three-day-old billing error as live.

Changed

• memory-audit plans to ~60 % of the byte cap, not to «just under». One cache sat above
  32 KB and five more within 10 % of it: audits that stop at the line are undone within days.
  A flagged session block alone is now reason enough to run the audit.
• close-session files each captured line under a topic heading, never a session or date
  heading, and does not capture what the always-loaded layer already says or a number whose source
  of truth lives elsewhere. The T2 protocol block (AGENTS-MEMORY-PROTOCOL.md, still < 2.1 KB)
  carries the topic-heading line for hosts without hooks.

BREAKING: none. Skill text, one collector script and one line of the SessionStart hook.
These fixes lived in a personal copy of two kit skills (~/.claude/skills/); they move into the
kit so the personal copies can be deleted without any project losing them.

Fixed

• The session handoff was replaced by the memory-audit's deferred list. memory-audit saved
  declined candidates to context/handoffs/memory-audit-deferred-YYYY-MM-DD.md, and the
  SessionStart hook injects the newest file in that directory as the session handoff — so the
  next session started from the deferred list instead of the real handoff. The skill now writes
  to context/audits/, reads the newest deferred list back as an input, and the hook
  (newest_handoff) skips memory-audit-deferred-* files already sitting in context/handoffs/.
• system-audit read another repo's facts. The collector wrote to a fixed
  /tmp/system-audit-facts.md; a parallel session auditing a different repo overwrote it. The
  output path now carries the repo name and date, and the skill checks the repo: line before
  reasoning over the file.
• system-audit broken-reference false positives. A path written repo-root-relative with a
  leading / (the kit's own doc convention) was reported as broken; the collector now also tries
  it without the leading /.
• system-audit TODO count swept vendored code. The count now greps tracked files only
  (git ls-files), falling back to a recursive grep with .venv/venv/data excluded outside
  git — a plain recursive grep reported 1958 for a repo with 8.

Changed

• qa-sweep finds an existing protocol before scaffolding one. A project that keeps its QA
  protocol where its CLAUDE.md points, in docs/qa/README.md, context/qa/PROTOCOL.md,
  .claude/rules/qa-sweep.md or a project-local qa-sweep skill uses it as the SSOT; a second protocol under projects/<name>/qa/ is never created
  beside it.
• qa-sweep rails that hold even when the protocol is silent: cross-channel evidence, a
  clean bill names its oracle and commit, no real credentials in a QA agent's hands, coverage
  as a queue with archetype rotation, and codifying twice-clean golden paths as e2e specs.

The development lifecycle layer. Everything here is additive: a spec written under v6 still parses, still delegates, and still passes every gate.

Specs became verifiable. Acceptance rows carry AC-n ids, so a test, a QA finding and a Verified cell can all point at the same promise. A spec also carries a Value sources table naming where every value it asks for comes from, and an executor runs an input-coverage gate before its first file: a value with no named source is an owed decision and the build stops rather than inventing one.

Projects declare how much proof a done owes. A workflow tier — prototype · alpha · beta · ga — sets the bar, so a throwaway prototype is not held to a GA standard and a GA change cannot pass on a green test alone.

An executor's override is now a document. When it must deviate to proceed, it writes an assumed spec: a recorded override that session start surfaces as owed ratification, and that no skill may flip on its own.

Two new skills, ten in total.

• /document — writes a PR body, changelog entry, release note or postmortem from the real git diff, every sentence pointing at a hunk or a commit, never at what the model remembers building.
• /code-sync — reconciles spec statuses and the project map with repo evidence: building becomes done only from a gate run in-session or an already-filled Verified cell, and a spec the code contradicts becomes stale with a reason.

Session start also surfaces assumed specs and stale building specs (CMK_SPEC_STALE_DAYS, default 14), and qa-sweep findings, run records and the findings registry bind to AC-n ids.

Not verified in this release

Host compatibility (Cursor, Codex, Copilot CLI) was last probed at eight skills, before document and code-sync existed. The v7 spec put that re-probe on the release checklist and it has not been done; the README rows say so rather than implying otherwise.

/code-sync assumes a projects/<name>/ layout with a map table and Status: headers in plans/*.md. Run against a repository that keeps its documents elsewhere, it reconciles nothing — an applicability limit, not a defect.

Full changelog: docs/CHANGELOG.md

The demo. A real Claude Code session in a seeded folder with two clients, recorded with VHS, and not one slash command typed. "morning, where are we with Nestlé?" is answered from the handoff (the agent names the files it read); "the client came back: no em-dash…" becomes a dated line; "now IKEA, what's due this week?" switches project scope and saves a schedule change; "that's all for today, wrap up" triggers the close ritual from the skill's description, which proposes a rule for the pattern seen on four dates, writes it on "yes", updates both backlogs and writes the handoff; a second session the next morning answers from all of it. Four scene clips sit in the README next to the claims they prove; the full 68-second session is in .github/assets/demo-full-session.mp4. Reproducible: tools/demo/seed.sh · demo.tape · cut.py.

Fixed. session-end.sh printed "SessionEnd hook … failed: Hook cancelled" after every /exit and every claude -p: it read stdin with a bare cat that Claude Code never closed. Now a one-second select.

Recorded. Claude Code 2.1.258 treats .claude/memory/MEMORY.md as a sensitive file — the first edit per session asks, regardless of allow rules and even in auto mode. docs/specs/claude-code.md documents it; D14 keeps the path and says it out loud.

No hook or skill changes. This release is the positioning work and the fact-check that closed it.

The front page speaks to the operator. Two independent positioning reviews agreed on the same point: "wakes up knowing where you left off" is what Claude Code auto memory and Copilot Memory now promise by default. The lead is now the contrast — "Built-in memory decides what to remember. This one asks." — with a three-column comparison (built-in · kit · database tools) and a measured session-start cost. The manifest descriptions, the banner and the two diagrams that still named three hosts of five carry the same lead; the social preview is the new banner.

New: docs/specs/cowork.md (Claude Cowork loads plugin skills but runs no plugin hooks — upstream issues #27398 / #47993 / #51281 — so no injection there; decision D13 opened) · .github/ISSUE_TEMPLATE/first-week.md, the kit's first feedback channel · docs/DISTRIBUTION.md, the channels in order and the metric to distrust.

Fact-check: every README claim against code, every changelog bullet against the diff, every diagram opened and read. Fixed on the way: the git init hint (any folder works; git is optional), the cost row's provenance, "seven layers" → the layers by name, D7 and D10 settled.

Includes v6.5.1 (the audit release) and v6.5.2 (PreCompact blocked every compaction on Linux).