release: v0.3.0

.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "nott",
       "source": "./",
       "description": "Engineering methods for decisions, delivery, observed verification, and safety.",
-      "version": "2.0.0",
+      "version": "0.3.0",
       "category": "development",
       "homepage": "https://github.com/menot-you/n-soul",
       "tags": [

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "nott",
-  "version": "2.0.0",
+  "version": "0.3.0",
   "description": "One intent into one proof-bound deliverable, with attention, observed verification, and rollback.",
   "author": {
     "name": "menot-you"

.codex-plugin/mcp.json

@@ -6,13 +6,6 @@
       "args": ["./bin/nmemory-mcp", "--project", "nott"],
       "cwd": ".",
       "env_vars": ["NOTT_NMEMORY_BIN"]
-    },
-    "nbrowser": {
-      "type": "stdio",
-      "command": "/bin/sh",
-      "args": ["./bin/nbrowser-mcp"],
-      "cwd": ".",
-      "env_vars": ["NOTT_NBROWSER_BIN"]
     }
   }
 }

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nott",
-  "version": "2.0.0",
+  "version": "0.3.0",
   "description": "One intent into one proof-bound deliverable, with attention, observed verification, and rollback.",
   "author": {
     "name": "menot-you",

.github/workflows/public-release.yml

@@ -25,6 +25,13 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          # This workflow runs in a PUBLIC repository on GitHub-hosted runners, and
+          # nothing after this step needs a credential: the gates are local, the one
+          # download is a public release archive verified against its pinned digest,
+          # and tools/public-release-check.sh makes no network git call and reads no
+          # token. So the checkout credential would only ever sit in .git/config for
+          # a later step to leak. Dropping it costs this job nothing.
+          persist-credentials: false
       - name: Install pinned Gitleaks
         shell: bash
         run: |

.mcp.json

@@ -4,11 +4,6 @@
       "type": "stdio",
       "command": "${CLAUDE_PLUGIN_ROOT}/bin/nmemory-mcp",
       "args": ["--project", "nott"]
-    },
-    "nbrowser": {
-      "type": "stdio",
-      "command": "${CLAUDE_PLUGIN_ROOT}/bin/nbrowser-mcp",
-      "args": []
     }
   }
 }

ARCHITECTURE.md

@@ -41,10 +41,10 @@ named gap, or a pre-computed next action — and NEVER in an unobserved success
    every turn regardless of the chosen skill. The default set persists no prompt, response,
    or session identifier.
 
-5. **External adapters.** nMEMORY and nBrowser are declared MCP integrations, resolved by
-   plugin-local launchers. A launcher resolves a documented environment override first,
+5. **External adapter.** nMEMORY is a declared MCP integration, resolved by a
+   plugin-local launcher. The launcher resolves a documented environment override first,
    then one command on `PATH`, and rejects absence with a non-zero exit. **No MCP server
-   binary is bundled** — nSOUL depends on them, it does not contain them.
+   binary is bundled** — nSOUL depends on it, it does not contain it.
 
 ## Trust boundaries
 

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.3.0 — 2026-08-01
+
+- Version realigned with the n-modules line (nMEMORY 0.3.0). This is a
+  DECREASE from 2.0.0, taken deliberately so one number means one thing across
+  the family; a client that orders updates by semver can read it as a
+  downgrade, and that cost is accepted rather than hidden.
+- Withdrew the nBrowser adapter: `bin/nbrowser-mcp` is removed, along with its
+  entries in `.mcp.json`, the Codex MCP manifest, the public contract, and the
+  release inventory. It shipped in 2.0.0 and is withdrawn rather than carried
+  forward unproven.
+- Removed the retired `assets/nsoul-mark.svg` brand mark. Every other asset is
+  unchanged.
+
+Both removals are declared in the release's strip manifest rather than left as
+omissions, so the release states what it takes away from people who already
+have it.
+
 ## 2.0.0 — 2026-07-22
 
 - Established nSOUL as the public distribution of the NOTT plugin.

PRIVACY.md

@@ -1,38 +1,73 @@
 # Privacy
 
-nSOUL has no telemetry and sends no hook state to a network service.
+nSOUL has no telemetry and sends no hook state to a network service. Everything
+described below is written to your own disk and read by nothing else.
 
-## Default behavior
+## What the shipped hooks persist
 
-The shipped hooks persist no prompt, response, transcript, or session
-identifier by default. The public hook does not implement automatic handoff.
-Optional MCP services have their own privacy boundaries and do not become part
-of nSOUL merely because an adapter can start them.
+Two hooks write local state. Neither is optional, and both are silent — nothing
+they record is shown to you unless you open the file yourself.
 
-## Optional voice-lint state
+## Voice-lint state
 
-Voice lint runs only when `NOTT_VOICE_LINT=on`. It reads the last assistant text
-from the transcript path supplied by the host, classifies the final close in
-the local process, and discards the text. Persistent state contains only:
+Voice lint runs on every `Stop`. There is no opt-in variable and no way to turn
+it off; `NOTT_VOICE_LINT_MODE` selects `warn` (the default) or `block`, and
+neither value disables the recording. It reads the last assistant text from the
+transcript path the host supplies, classifies the closing paragraph in the local
+process, and appends one JSON line **only when that classification finds
+something**. A clean close writes nothing.
+
+Each recorded line contains:
 
 - `ts` — UTC timestamp;
+- `session_id` — the session identifier the host supplied;
 - `mode` — `warn` or `block`;
-- `findings` — local rule classes and counts.
+- `findings` — local rule classes and counts;
+- `evidence` — at most the last 240 bytes of the closing paragraph of the
+  assistant's own text.
+
+So a recorded line DOES contain a short excerpt of assistant output and DOES
+contain the session identifier. Your prompt text is never recorded, the
+transcript path is never recorded, and no part of the transcript other than that
+closing excerpt is ever recorded.
 
-Prompt text, assistant text, transcript paths, and session identifiers are not
-stored. The log retains at most 200 records and is created with private process
-permissions under:
+The file lives at:
 
 ```text
 ${XDG_STATE_HOME:-$HOME/.local/state}/nott/voice-lint.jsonl
 ```
 
-Delete it at any time:
+**It is not private, and it is not bounded.** The hook creates the directory and
+the file with your default permissions — observed `755` and `644`, so any local
+account can read them — and nothing trims the file, which grows for as long as
+findings keep occurring. Both are stated because they are what the code does; if
+either matters to you, tighten the directory yourself or delete the file. Nothing
+depends on its contents:
 
 ```sh
 rm -f "${XDG_STATE_HOME:-$HOME/.local/state}/nott/voice-lint.jsonl"
 ```
 
-`tests/hooks-test.sh` binds the reviewed hook bytes and enforces the behavior and
-retention limit. The negative gate first proves a write-capable mutation reaches
-an isolated sink, then requires the reviewed-byte binding to reject it.
+## Auto-handoff state
+
+`UserPromptSubmit` appends a reminder to the prompt context once a session has
+run past a turn threshold, and it rate-limits itself with one small stamp file
+per session:
+
+```text
+${XDG_STATE_HOME:-$HOME/.local/state}/nott/autohandoff/<session-id>
+```
+
+The **file name is the session identifier** and the contents are a single unix
+timestamp. No prompt text, assistant text, or transcript content is written.
+Stamps older than seven days are deleted automatically on the next run. Delete
+the directory at any time:
+
+```sh
+rm -rf "${XDG_STATE_HOME:-$HOME/.local/state}/nott/autohandoff"
+```
+
+## Optional MCP services
+
+Optional MCP services have their own privacy boundaries and do not become part
+of nSOUL merely because an adapter can start them.

README.md

@@ -81,8 +81,8 @@ it (watch Act 3).
   discipline, post-edit proof, and an opt-in local voice lint. A claim without
   observed verification is a protocol failure.
 - **Clone-and-own, nothing bundled.** Runs on Claude Code and Codex, no account, no
-  service. nMEMORY and nBrowser attach as **external** MCP adapters through
-  fail-closed launchers — the MCP servers are **not bundled**, no server binary ships
+  service. nMEMORY attaches as an **external** MCP adapter through a
+  fail-closed launcher — the MCP server is **not bundled**, no server binary ships
   inside nSOUL.
 
 ## Quickstart
@@ -132,7 +132,6 @@ voice lint. The default hooks persist no prompt, response, or session identifier
 | Server | Default executable | Override |
 |---|---|---|
 | nMEMORY | `nmemory` on `PATH` | `NOTT_NMEMORY_BIN` |
-| nBrowser | `nbrowser-mcp` on `PATH` | `NOTT_NBROWSER_BIN` |
 
 An override must name an executable file. An invalid override is rejected even when a
 fallback exists on `PATH` — a misconfigured explicit choice never silently reaches a
@@ -157,8 +156,8 @@ class, at most 200 local records. Exact boundary: [`PRIVACY.md`](PRIVACY.md).
 ## What it is NOT (yet)
 
 nSOUL ships methods, roles, hooks, adapters, and repository gates. It does **not**
-ship a sovereign trust spine, an independent witness kernel, an nMEMORY server, or
-an nBrowser server. A session reports *observed* verification; it cannot self-issue
+ship a sovereign trust spine, an independent witness kernel, or an nMEMORY
+server. A session reports *observed* verification; it cannot self-issue
 kernel closure. The private experimental lab is not part of nSOUL and never ships.
 
 ## Roadmap

RUNBOOK.md

@@ -46,7 +46,6 @@ binary instead, set:
 
 ```sh
 export NOTT_NMEMORY_BIN=/path/to/nmemory
-export NOTT_NBROWSER_BIN=/path/to/nbrowser-mcp
 ```
 
 The explicit path wins. It must be a regular executable file. The launchers do
@@ -56,7 +55,6 @@ Probe resolution without starting the server:
 
 ```sh
 bin/nmemory-mcp --probe
-bin/nbrowser-mcp --probe
 ```
 
 ## Voice lint

SECURITY.md

@@ -23,9 +23,9 @@ Security-sensitive surfaces are:
 - authority and instruction documents;
 - release gates and their negative controls.
 
-nMEMORY and nBrowser server implementations are external dependencies. The
-adapter boundary is owned by `PRD.md` §7, and `SPEC.md` §2 states the controlled
-proof basis. Repository checks use controlled local fixtures and cover only
+The nMEMORY server implementation is an external dependency, and the adapter
+boundary is where that dependency stops being nSOUL's to vouch for.
+Repository checks use controlled local fixtures and cover only
 candidate-local launcher behavior; mutable digest literals are regression
 guards, not independent provenance. nSOUL does not attest to an external server
 or an arbitrary executable selected from the host `PATH`.