v0.11.0: facts layer, reviewed writes, delta sync, no silently dropped sources

[renezander030]

v0.11.0 in one branch: a facts layer, enforced write approval, honest partial results everywhere, delta-capable cache sync, and portable state. Ten commits, one per concern, in review order below. The mcp package is untouched beyond re-exports — the CLI remains the growth surface.

What's in it

Facts layer — ats kg (new). Durable subject–predicate–object knowledge beside the tasks, in an embedded append-only JSONL log (no graph server, nothing to operate). Single writer by construction: agents propose facts and retractions; only ratify writes the store, after a human approves — every fact records proposer, ratifier, source, and temporal validity. ats kg ask is deterministic lexical scoring with provenance (zero LLM); retraction closes the validity interval instead of deleting. ats kg export --cypher emits a LadybugDB/Kùzu-dialect load script. Proposals ride the same review queue as gated task writes, so ats review works on them unchanged.

Reviewed writes. intent.approvalRequired and security.approvalRequiredFor were declarative only; the CLI now enforces them. Guarded update/complete/delete stage into the review queue (the update path reuses the read it already makes for undo before-images, so no extra fetch); ATS_REVIEW_ALL=1 gates everything including creates. ats review apply executes through the normal adapter path with the approver recorded in the ledger — reviewed writes stay undoable. A failed apply keeps the item approved with its error recorded.

No silently dropped sources. The three remaining omission paths named in the README now reach warnings/degraded: composite fallback per-project failures, composite children whose native search errors (bubbled namespaced via __searchWarnings, which core reads after the native branch), and TickTick project fetches across its corpus loader, search, hybrid pool, and vector sync. The TickTick loader also stops caching a known-partial corpus — it previously cached whatever survived, serving the subset as complete and healthy for the whole TTL.

Fusion identity. Composite task ids are namespaced <backend>:<taskId> like project ids, closing the documented cross-backend id collision in RRF fusion. Routing accepts namespaced and raw ids both ways, so ids copied from find output resolve unchanged.

Cache sync + delta hook. ats cache sync|status|clear now falls back to Core's corpus cache for every adapter (it previously errored without an adapter cache extension, while doctor reported staleness with no remedy). New optional adapter hook bulkFetchDelta({cursor, since}): changes apply as whole-item replacements — never a field merge — with the cursor persisted in the cache. Backends without a changes API (TickTick's open API) keep full refresh.

Completed history in retrieval. New optional contract method listCompletedTasks(); ats find --include-completed appends completed items per query without ever writing them into the shared cache. TickTick maps its existing completed-tasks support onto the contract; composite unions children and names the ones that cannot answer; adapters without the method degrade the result with an explicit warning.

Concurrency safety. A shared lock/atomic-write module (extracted from the event spool's proven pattern) now guards the corpus cache (atomic replace under lock — a torn cache was possible), the ledger append (before-image lines can exceed the atomic-append size), and the whole undo critical section (two concurrent undos of one action can no longer double-apply). Verified with a multi-process lost-update test.

Trust boundaries. Composite children can be marked "trust": "public"; writes routed there are screened against configured redaction patterns and blocked with the rule named — never silently stripped. Invalid patterns fail loudly at load. Both READMEs state the honest scope: this guards ATS's own composite write path, not arbitrary data movement.

Portable state. ats state export|import bundles ledger, undo images, review queue, event checkpoint/spool, usage log, caches, and index metadata. Credentials are never bundled (whitelist registry), and import writes only to the local registry's paths — a crafted bundle cannot redirect a write. Also answers hosted-deployment ephemerality.

Hygiene + onboarding + backfill. ats dedup apply turns clusters into typed links (optionally closing duplicates) through the normal ledgered, review-gated path; ats garden reports stale-but-active tasks with per-task archive commands, detection only. ats agent-setup emits the CLAUDE.md/AGENTS.md policy block from live config. ats sync vector --all drains the embedding backfill in capped rounds, stopping without forward progress.

Verification

• Full gate green locally on Node 22: lint, PII + claims checks, 250+ unit tests across packages (36 new), intent/taskmaster/beads proofs, progress benchmark. The pre-commit hook ran the same gate on every commit.
• New coverage includes: multi-process lost-update test for the lock module; composite collision, warnings, redaction, and completed-history fan-out; corpus delta replace/remove/cursor semantics; review-queue lifecycle incl. failed-apply retry; kg propose→ratify→ask→retract round-trip; state-bundle import path-authority (bundle-supplied paths are ignored).
• Live CLI smoke on this machine: ats agent-setup against the real config, and the full kg propose → review approve → kg ratify → kg ask loop end-to-end.
• README "Tradeoffs and limits" updated where behavior changed, so the claims checker holds the docs to the new reality.

Deliberately not in this branch

• No version bump / tag / publish — the release commit (lockstep bump across packages, CHANGELOG date, tag, npm publish in dependency order) follows your review, per repo convention. The CHANGELOG section is drafted and marked Unreleased.
• No MCP feature work. New capabilities are CLI-first; the MCP server only gains what falls out of shared core exports.
• No native LadybugDB driver. The store is embedded JSONL; graph-engine users get a tested Cypher export instead of an untestable native binding. The driver seam is a clean follow-up if wanted.