release: cut v0.3.0, and make the package prove it contains what the notes claim

README.md

@@ -35,16 +35,23 @@ Two things make it different from the rest of the terminal-agent shelf:
 **Aether Agent is in beta.** Updates are shipping quickly.
 
 > **What `npm i -g` gives you today: 0.1.0.** The npm `latest` dist-tag is still
-> `0.1.0`; **0.2.0 is on `main` but not yet published**. So the features described
-> under [v0.2.0 in the release notes](RELEASE_NOTES.md) — portable handoffs,
-> `--resume` reaching the brain, `aether agent --local "<task>"` working straight
-> after an install — are **not** in the package the command above installs. Until
-> the 0.2.0 release is cut, build from source to get them:
+> `0.1.0`, and 0.1.0 is the only version ever published. **`main` is 0.3.0 and is
+> not on the registry** — neither was 0.2.0, which was written up but never
+> released and is now superseded. So the features described under
+> [v0.3.0 in the release notes](RELEASE_NOTES.md) — `aether skills`,
+> `aether capabilities`, `aether support-bundle`, portable handoffs, `--resume`
+> reaching the brain, `aether agent --local "<task>"` working straight after an
+> install — are **not** in the package the command above installs. Until a
+> `v0.3.0` release is published, build from source to get them:
 >
 > ```bash
 > git clone https://github.com/AetherAI3/aether-agent
 > cd aether-agent && npm ci && npm run build && npm link
 > ```
+>
+> Publishing is owner-gated; the exact steps, the commit the tag must point at,
+> and the packed tarball's digest are in
+> [`docs/releases/OPERATOR-PACKET-v0.3.0.md`](docs/releases/OPERATOR-PACKET-v0.3.0.md).
 
 ## Carry the work across models and machines
 
@@ -101,7 +108,7 @@ aether agent --local           #      …same terminal, nothing leaves the machi
 
 > Running the separate Python brain instead — Aether's open-source (Apache-2.0) **[Unlimited Context](https://github.com/AetherAI3/Unlimited-Context-LLM)** engine, which gives an Ollama model a billion-token working memory — is opt-in with `AETHER_LOCAL_BRAIN=python` once you have installed it. It is not bundled with the npm package.
 
-> Prefer the installer UI? Download [`install.sh`](install.sh) or [`install.ps1`](install.ps1), inspect it, then run it locally. Both follow npm's `latest` dist-tag, which today is **0.1.0**; `AETHER_VERSION=<version>` (shell) or `-Version <version>` (PowerShell) pins an exact **published** release, so a version that is not on the registry yet — 0.2.0 included — will fail with `No matching version found`. The canonical npm command above verifies registry integrity and disables lifecycle scripts; there are no native or runtime dependencies and no daemon.
+> Prefer the installer UI? Download [`install.sh`](install.sh) or [`install.ps1`](install.ps1), inspect it, then run it locally. Both follow npm's `latest` dist-tag, which today is **0.1.0**; `AETHER_VERSION=<version>` (shell) or `-Version <version>` (PowerShell) pins an exact **published** release, so a version that is not on the registry yet — 0.2.0 and 0.3.0 included — will fail with `No matching version found`. The canonical npm command above verifies registry integrity and disables lifecycle scripts; there are no native or runtime dependencies and no daemon.
 
 ## Models & pricing
 

RELEASE_NOTES.md

@@ -1,3 +1,122 @@
+# Aether Agent v0.3.0 — skills, and a release that matches the repository
+
+**August 22, 2026**
+
+0.2.0 was never published. It was written up on August 19, and then `main` kept
+moving: a skills runtime, a capability contract, a redacted support bundle, a
+command-registration seam, and ten user-visible fixes landed on top of the
+version that was already spoken for. Rather than quietly widen 0.2.0 to mean two
+different things, this release takes the next number and describes everything
+actually on `main`.
+
+Covers `477f0fc..426b124` — every commit merged after the v0.2.0 notes were
+written, and everything the v0.2.0 notes described, which was never shipped
+either.
+
+## New
+
+- **Agent skills** — `aether skills` inspects, trusts and manages skills, and six
+  are built into the package: `review-pr`, `fix-ci`, `ship`, `doctor-project`,
+  `research-and-implement`, `frontend-from-screenshot`. Skills are discovered,
+  schema-validated, lazily loaded and trust-locked; an untrusted skill is not
+  silently run.
+- **`aether capabilities`** — the capability contract this build actually
+  implements, and, with `--available`, what is reachable right now. A surface the
+  build does not have reads as absent, not as unchecked.
+- **`aether support-bundle`** — a redacted diagnostic bundle you can hand to
+  someone without handing over your credentials or your file contents.
+- **A command-registration seam.** A command now carries its own help text, its
+  own flag table and its own loader in one entry, so adding one is a single edit
+  instead of three that have to agree. Flag collisions are load-time errors
+  rather than last-writer-wins, and reachability is structural rather than
+  asserted by a regex over the source. You feel this as the three `doctor` fixes
+  below — those flags were lost precisely because the old shape let a command's
+  flags and its dispatch drift apart.
+
+## Carried forward from the unpublished 0.2.0
+
+- **Handoffs** — `aether resume export` writes one portable file: the task, the
+  model that ran it, the verify gate's verdict, how many tests were still
+  failing, the files that changed, the verification command, and the repository
+  it belongs to. Continue anywhere with `aether agent --resume <file>`, on
+  whatever model you want. No absolute paths, no file contents, no shell
+  commands, no credential-shaped values ride along.
+- **`--resume` reaches the brain** — the prior session becomes a continuation
+  brief the model reads before its own instruction. With no new task, the run
+  continues the original one.
+- **`aether agent --local "<task>"` works after a plain npm install** — the
+  one-shot offline form used to die with `spawn python ENOENT`. It now drives the
+  Ollama brain that ships in the package. `AETHER_LOCAL_BRAIN=python` opts back in.
+- **Session logs stopped redacting your file paths** — the credential filter
+  matched `pat` inside `path`. Real credential keys are still redacted.
+- **`npm run demo:handoff`** — a deterministic end-to-end proof: two sessions,
+  two models, two checkouts, one verify gate, no account and no model download.
+  See [`docs/demo/handoff.md`](docs/demo/handoff.md).
+
+## Fixed
+
+- **Ctrl+C stops a local turn.** The abort signal now reaches local runs instead
+  of being dropped at the chat boundary.
+- **`/limit` is a real stop boundary**, and unknown spend is reported as unknown
+  rather than as zero — so a session nobody measured no longer looks like a
+  session that spent nothing.
+- **`/rollback` stopped lying about HEAD** and stopped accepting a count it never
+  used.
+- **`--repo` is validated and fetched** rather than reused blind, and the
+  worktree is pinned to the fetched revision; an unknown base is refused instead
+  of guessed.
+- **Tool execution is async with process-tree teardown** — cancelling a run kills
+  the whole tree, not just the shell that fronted it, so `npm test` or a compiler
+  no longer keeps running after you stopped it.
+- **Ollama's own `OLLAMA_HOST` format is accepted**, and the request timeout stays
+  armed through the body read instead of expiring at the headers.
+- **Ollama tool results are correlated by id**, schemas are generated, and steer
+  is no longer faked on the local path.
+- **CLI startup no longer blocks on an unbounded `git status`** in a large or
+  slow repository.
+- **The hosted dev-session protocol version the server answers is actually
+  checked**, instead of the version the client hoped for.
+- **`aether doctor --live` now actually runs the live proof.** It never had. The
+  CLI's argv parse swallowed any flag a command had not declared, so `--live`
+  was stripped before `doctor` saw it: the command quietly ran the fast
+  configured-only report and **exited 0**, presenting a live end-to-end
+  verification that was never performed. `--deep`, `--dry-run`, `--no-ui` and
+  `--only <id>` were lost the same way.
+- **`aether doctor --fix` is reachable at all.** The whole repair path was
+  unreachable, and because the global `--yes` never arrived either,
+  `aether doctor --fix --yes` answered *"re-run with `--yes`"* to someone who had
+  just passed it. `--fix` still changes nothing without `--yes`, and still shows
+  its repair plan first.
+- **A mistyped command no longer costs you a model call.** Command lookup
+  lowercased the token while dispatch was case-sensitive, so `aether Vault` fell
+  past the typo guard into a chat turn and billed it. Wrong case now reaches the
+  "did you mean" guard, as it always should have.
+
+## Availability — read this before upgrading
+
+**0.3.0 is not on npm.** At the time these notes were written the registry served
+exactly one version of `aether-agents`, `0.1.0`, and `latest` resolved to `0.1.0`.
+Neither 0.2.0 nor 0.3.0 has ever been published, and no GitHub release exists for
+either. So `npm i -g aether-agents --ignore-scripts` installs **0.1.0**, and none
+of the above is in it.
+
+Until a `v0.3.0` release is published, build from source:
+
+```bash
+git clone https://github.com/AetherAI3/aether-agent
+cd aether-agent && npm ci && npm run build && npm link
+```
+
+Publishing is founder-owned: it needs a `v0.3.0` tag on the release commit, a published
+GitHub release, the `npm-production` environment and an `NPM_TOKEN`. The exact
+sequence, with the packed tarball's digest and manifest, is in
+[`docs/releases/OPERATOR-PACKET-v0.3.0.md`](docs/releases/OPERATOR-PACKET-v0.3.0.md).
+
+When 0.3.0 is published it upgrades in place: no configuration changes, no
+migration, and 0.1.x session logs are read unchanged.
+
+---
+
 # Aether Agent v0.2.0 — the work outlives the session
 
 **August 19, 2026**
@@ -28,19 +147,12 @@ decide when it's done.
   two sessions, two models, two checkouts, one verify gate, no account and no
   model download. See [`docs/demo/handoff.md`](docs/demo/handoff.md).
 
-**Availability.** 0.2.0 is on `main`, but it is **not yet published to npm** —
-the registry’s `latest` dist-tag still resolves to 0.1.0, so a plain
-`npm i -g aether-agents` installs 0.1.0 and none of the above. Until the 0.2.0
-release is cut, build it from source:
-
-```bash
-git clone https://github.com/AetherAI3/aether-agent
-cd aether-agent && npm ci && npm run build && npm link
-```
-
-Once 0.2.0 is published, `npm i -g aether-agents --ignore-scripts` will upgrade in
-place: no configuration changes, no migration, and 0.1.x session logs are read
-unchanged.
+**Superseded — 0.2.0 was never released.** No `v0.2.0` tag, no GitHub release
+and no npm version ever existed for it. `main` kept moving after these notes
+were written, so the work above ships as part of **[v0.3.0](#aether-agent-v030--skills-and-a-release-that-matches-the-repository)**
+instead of widening 0.2.0 to mean two different things. This entry is kept as
+the record of what was written on August 19, not as an install instruction —
+see the v0.3.0 availability section above.
 
 ---
 

docs/releases/2026-08-22.md

@@ -0,0 +1,84 @@
+# Release notes — 2026-08-22
+
+**v0.3.0 — skills, and a release that matches the repository.**
+
+Release commit: `426b12464c2a19549f421adb43348f83d028628e`
+Commit range: `477f0fc..426b124` (17 commits, 2026-08-19 → 2026-08-22)
+
+## Why 0.3.0 and not 0.2.0
+
+The v0.2.0 notes were written on 2026-08-19 at `477f0fc` and describe handoffs,
+`--resume` reaching the brain, and `--local "<task>"` working out of the box.
+They were never published — there is no `v0.2.0` tag, no GitHub release, and
+`aether-agents@0.2.0` has never existed on npm.
+
+Seventeen commits landed after those notes. One of them, #72, is a feature:
+`aether skills`, `aether capabilities`, `aether support-bundle`, six built-in
+skills, and the runtime behind them. Under semver a backwards-compatible feature
+addition is a minor bump, and reusing 0.2.0 would mean two materially different
+artifacts answer to one version — including a `aether-agents-0.2.0.tgz` that was
+committed to the repository root in #83 and deleted in #90, whose contents
+predate the skills runtime entirely. That is the identity defect this release
+exists to close, so the version moves rather than the meaning.
+
+`0.2.0` is retired unused. Nothing will ever be published under it.
+
+## What landed after the v0.2.0 notes
+
+Features:
+
+- **#72** — skill runtime, instruction resolver, capability contract, redacted
+  support bundle, and six built-in skills. Adds the `skills`, `capabilities` and
+  `support-bundle` commands.
+- **#98** — command-registration seam. A command carries its own help metadata,
+  flag table and loader in one entry; flag collisions become load-time errors and
+  reachability becomes structural instead of a regex over `main.ts`.
+
+User-visible fixes:
+
+- **#73** — `--repo` mirrors are validated and fetched instead of reused blind.
+- **#74** — `/rollback` stops accepting a count it never used and stops
+  misreporting HEAD.
+- **#75** — Ollama tool results correlated by id, schemas generated, steer no
+  longer faked.
+- **#77** — the abort signal reaches local turns, so Ctrl+C works.
+- **#78** — `/limit` is a real stop boundary; unknown spend reports as unknown,
+  not as zero.
+- **#83** — a `--repo` worktree is pinned to the fetched revision; an unknown
+  base is refused.
+- **#84** — async tool execution with process-tree teardown.
+- **#88** — Ollama's own `OLLAMA_HOST` format is accepted; the timeout stays
+  armed through the body read.
+- **#89** — CLI startup no longer blocks on an unbounded `git status`.
+- **#91** — the dev-session protocol version the server answers is actually
+  checked.
+- **#98** — three defects, all shipped in the same commit as the seam that makes
+  them impossible to reintroduce:
+  - `aether doctor --live` never received `--live`. The argv parse is
+    non-strict, so a flag the command had not declared was captured globally and
+    stripped from what the command was handed. `--live` ran the fast
+    configured-only report and exited 0, presenting a live end-to-end proof that
+    was never performed — the exact "unknown rendered as verified" failure this
+    codebase forbids. `--deep`, `--dry-run`, `--no-ui` and `--only` were lost the
+    same way, and the entire `--fix` repair path was unreachable.
+  - `aether doctor --fix --yes` replied "re-run with `--yes`", because the global
+    `--yes` never reached the command either.
+  - Command lookup lowercased the token while dispatch was case-sensitive, so a
+    wrong-case token for an unmigrated command fell through to chat and billed a
+    paid model turn instead of reaching the typo guard.
+
+Not user-visible, recorded for completeness:
+
+- **#82, #85, #87** — tests only (doctor hanging-backend property, release
+  canaries made executable gates, brain-parity seam and canary 7).
+- **#86** — the ship rail module and canary 5. Landed unwired: no command
+  invokes it, so it changes no behaviour in this release.
+- **#90** — documentation honesty and repo hygiene; deleted the committed
+  `aether-agents-0.2.0.tgz`, moved `_loopstate/` under `docs/loops/`.
+
+## Availability
+
+Not published. At the time of writing the npm registry served exactly one
+version of `aether-agents` — `0.1.0` — and `dist-tags.latest` resolved to
+`0.1.0`. Publishing is founder-owned and is specified in
+[`OPERATOR-PACKET-v0.3.0.md`](OPERATOR-PACKET-v0.3.0.md).