Restructure CLI internals, simplify memory, and harden releases

[yourconscience]

What this does

Five cleanups in one branch, all behavior-preserving for the CLI surface.

1. Root artifacts

• Deleted SPEC.md (completed internal implementation spec, no code/workflow references).
• Kept .agnix.toml (auto-discovered by dotagents doctor in the canonical root) and starter_assets.go (root-level go:embed manifest; embed cannot reach parent dirs). starter_assets.go now documents why it must stay at the root.

2. Memory layer

• Removed the duplicated per-provider digest implementations (amp_digest.py, factory_digest.py, hermes_digest.py). Provider payload normalization now lives in memory/lib/basic_memory.py, so digest rendering, redaction, replay detection, and locking exist once.
• Removed the second, hidden consolidation path (basic_memory.py dream). rem dream is the only supported consolidation workflow.
• Removed the duplicate Python reindex implementation; the Hermes sync hooks now trigger the one bounded, non-overlapping refresh helper.
• Fixed shell injection in generated memsearch.conf: values are POSIX-quoted and covered by a test that sources the file through /bin/sh.
• Deleted the stale unmanaged memory/hooks/omp-memory.ts and memory/hooks/README-codex-omp.md.
• Fixed release-binary scaffolding: memory/tools (rem, knowledge-sync) is now embedded, so setup on a release install actually carries the tool sources; a test scaffolds into a temp root and builds both binaries through the real installer path.

3. Command architecture

• cmd/dotagents is now a thin entrypoint (main.go only). Implementation, tests, and web assets moved to internal/app with git mv-style renames preserved.
• Canonical role parsing plus all seven harness role projections moved to internal/agentrole behind a Renderer registry. pi_agent.go, omp_agent.go, and the role code inside opencode.go/qwen.go are gone.
• Removed the now-pointless go.work.

4. Docs

• Deleted stale internal docs: docs/harnesskit-integration.md, docs/openai-skill-registry-publish.md, and the orphaned docs/status-preview.{html,png}.
• README release section now documents the actual gate; documentation list links every focused guide plus the landing page.
• Landing page: fixed the install row (brew / npm / curl / go) and added a Documentation section linking each docs/*.md.

5. Release

• scripts/release.sh is fail-fast (set -eu), validates strict vMAJOR.MINOR.PATCH, refuses dirty/staged/unmerged/untracked state, requires HEAD == origin/main and a newer version than the latest tag, runs the full check set, and only prints success after a successful push. Fixed the npm package name in the post-release hint.
• Added scripts/release_test.sh (tag validation, version ordering, clean-tree detection), wired into CI and into the release script itself.
• .github/workflows/release.yml gained a verify job (strict semver, tag commit must be on main, requires a green ci.yml run for that exact commit) and the release environment gate; actions are pinned to commit SHAs and GoReleaser to an exact version.
• CI now runs the memory Python suite and the release-script test, and dropped the obsolete nested-module matrix entry.

Verification

• go test ./..., go build ./cmd/dotagents, go vet ./... (with GOWORK=off, since the parent checkout's stale go.work shadows this worktree locally)
• python3 -m unittest discover -s memory/tests — 24 tests
• node --test npm/install.test.js
• sh scripts/release_test.sh
• Byte-stability check: rendered roles for all seven harnesses from a build of origin/main vs this branch are identical, file-for-file
• Release script exercised end-to-end in a throwaway clone with a local bare remote: tagged and pushed v0.9.0, then correctly refused a duplicate tag, an older version, a dirty tree, and untracked files

Release notes for v0.9.0 (not cut yet)

Since v0.8.0: canonical config TUI/web UI, Amp and Pi/OMP harness support, dotagents publish, AgentsView sessions integration, native hook review/cleanup, and this cleanup. Minor bump; no breaking changes found.

Gate before tagging:

1. Merge this PR after review and green checks.
2. Confirm the release environment exists with required reviewers, and move HOMEBREW_TAP_TOKEN to that environment.
3. scripts/release.sh v0.9.0 on a clean, up-to-date main.

Two orphan draft releases named v0.8.0 (IDs 386064068, 386172756) are leftovers from failed tag runs; deleting them needs your approval and is not done here.

Review follow-up (bot threads)

Three valid findings from the Codex connector review, all fixed:

1. go.work removal left AGENTS.md claiming the module layout is declared by go.mod and go.work — instruction updated, and it now notes that setup scaffolds a standalone go.mod beside each copied tool.
2. Hermes capture could record a stub digest when the provider session file had not appeared yet, which made the real transcript look like a replay later — capture is now deferred until the file is readable, with a regression test that proves the later retry still captures.
3. The shared transcript reader was stricter than the removed Factory parser and failed the whole session on a partially written trailing JSONL record — Factory/Droid reads are tolerant again, with a regression test.

Also fixed the build-and-lint failure this branch surfaced: the memory tools are now part of the root module, so lint finally covers them and found pre-existing unchecked errors in memory/tools/rem/dream_test.go.

[sourcery-ai]

Sorry @yourconscience, your pull request is larger than the review limit of 150,000 diff characters

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1e65d032-2fb7-4b73-9c20-4823c916b062

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9d7ce13aca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.