Solumbe¶

v4.11.0 published (2026-11-09)

The Claude request read writes its reasoning before its answers. No command or field was removed.

• The read's tool schema opens with a reasoning string, written before intent and never applied. On the 29-case reads suite with claude-haiku-5-5, capability accuracy rose from 23–24 to 27 of 29 and more irrelevant candidates were demoted, with no expected file demoted, for about a third more cost per read. Intent accuracy did not move.
• solumbe eval --reads --provider claude --no-reasoning runs the answers-only read for comparison; SOLUMBE_CLAUDE_READ_REASONING=0 turns reasoning off for context --online. Jev reads are unchanged.
• Dev-dependency bumps: @types/node 26.6.6, eslint 10.14.0.

npm v4.11.0 · GitHub Release · MCP Registry

v4.10.0 published (2026-10-31)

Search and ranking fixes, and shorter tool definitions. No command or field was removed.

• repo_search searches the repository at path (the working directory by default) instead of only the catalog, so a repository that was never indexed is no longer invisible to it. all: true adds every catalogued repository; each result names its scope.
• A symbol matches strongly only when two request words are in its own name, so look-alike helpers no longer outrank the file a request is about. Context engine version 7.
• The MCP tools/list response is about 700 tokens (13%) shorter. A declared intent is never written through a symlink or outside the repository.

npm v4.10.0 · GitHub Release · MCP Registry

v4.9.0 published (2026-10-28)

A change shows what depends on it. Ranking is unchanged, and no command or field was removed.

• With a diff (solumbe impact --diff-base, or diffBase over MCP), change_impact carries a dependents block: the files that import a changed file, directly or through other files, up to three hops and 20 files, each with its depth and the file it reaches the change through.
• Each dependent is EXTRACTED when every import on its path is stated in the source (a relative or root-alias specifier, or a Go package import) and INFERRED when one rests on a bare specifier matching exactly one file and no declared package. Docs and vendored files are left out.

npm v4.9.0 · GitHub Release · MCP Registry

v4.8.0 published (2026-10-23)

Dependency work is read as dependency work. No command or field was removed.

• An upgrade, audit or advisory request (upgrade vulnerable yarn dependencies (shell-quote, handlebars …)) owns the lockfile and the manifest that declares a named package, in change_impact, context_pack and convergence_score. A lockfile-only fix now converges instead of reading inconclusive.
• Package names are read whole: shell-quote no longer matches quote-templates.controller.ts, and "package" or "upgrade" no longer rank pricing components.
• .nvmrc, .node-version and .tool-versions are configuration and gate a merge. An eval case can be marked knownGap to record a miss before its fix.
• solumbe eval --history [repo] replays a repository's recent commits as retrieval cases (the subject is the request, the changed files the answer) and reports hit@k, recall@k and MRR on real work. On bashbop-api, dependency-request ranking moves hit@5 from 0.37 to 0.41.

npm v4.8.0 · GitHub Release · MCP Registry

v4.7.2 published (2026-10-19)

Two gate fixes found by dogfooding solumbe on another repository. No command or field was removed.

• Working-tree mode (converge, convergence_score, change_impact --diff-base, the local gate) diffs from the merge base, so commits that land on the base after the branch point no longer count as part of the change.
• The secret check scans only the lines a change adds, so a credential already on the base no longer fails a change that never touched it.

npm v4.7.2 · GitHub Release · MCP Registry

v4.7.1 published (2026-10-18)

Two fixes found by dogfooding solumbe in Claude Code. No command or field was removed.

• A tool that takes a repository path, called without one, no longer hangs a server that runs from / or the home directory (Claude Desktop starts its MCP servers from /). It answers at once with -32602 and says to pass path.
• A question about the code (where is, how does, why does, which file, is A consistent with B?) reads as explain instead of unknown; the heuristic's intent accuracy on the reads suite goes from 0.517 to 0.793.

npm v4.7.1 · GitHub Release · MCP Registry

v4.7.0 published (2026-10-18)

The request read can be answered by Claude, and the repository shows solumbe guarding a Claude agent. No command or field was removed.

• context --online can read a request through Claude: one forced tool call whose schema is the answer, one retry on a validation failure, and the same interpretRead backstop as Jev. SOLUMBE_READ_PROVIDER picks the provider, and solumbe eval --reads grades either on a new 24-case suite.
• .claude/settings.json gains project permission rules, and pull requests get a headless claude -p gate summary that skips without ANTHROPIC_API_KEY.
• integrations/agent-sdk/ is a Claude Agent SDK example that plans with context_pack, delegates to subagents and must pass review_gate before it proposes a merge.

npm v4.7.0 · GitHub Release · MCP Registry

v4.6.0 published (2026-10-18)

A subagent can be held to the tier the router chose, and hook scripts are found like any other file. No command or field was removed.

• scripts/hooks/enforce-agent-model.mjs is a Claude Code PreToolUse hook on the Agent tool. In the delegate arm of the routing trial it rewrites a call whose model is missing or names another tier to the routed one; the control arm is only observed, and route-outcomes counts both. The prompt hook's header and the model-routing docs no longer claim the injected text binds the subagent on its own.
• The repository commits .claude/settings.json, registering both hooks by $CLAUDE_PROJECT_DIR path and nothing else. A hook registered there and in ~/.claude/settings.json still routes and logs a prompt once.
• impact and context index git hook scripts under .githooks/ and .husky/ and rank them for hook requests; the index cache rebuilds once.
• solumbe install --host keeps the env of an entry it re-registers, and connects a Codex CLI that has no codex mcp add by writing its config table directly.

npm v4.6.0 · GitHub Release · MCP Registry

v4.5.0 published (2026-10-11)

A request can declare what it will touch before the edit, and the gate can delegate to the scanners you already run. No command or field was removed.

• solumbe declare <repo> "<request>" records the files Solumbe predicts for a request, and solumbe amend <file...> --reason "<why>" adds to them. With --intent, the gate adds a Scope contract check that fails a changed file that was never declared. It is opt-in, and over MCP it uses the existing tools.
• The gate delegates to gitleaks, Semgrep and osv-scanner when they are installed, each as its own check. Nothing is installed or fetched, SOLUMBE_SCANNERS selects them, and a repository with none set up sees no change.
• A request that predicts no owner file is inconclusive, with no convergence score, and the gate's convergence floor warns on it instead of failing. A request its words do not ground is grounded in the import graph. The convergence engine moves to 0.6.0.
• The attestation record is version 2: it binds the verdict to the stated request, the scope contract, the exact subject and the convergence receipt, and has a published schema. solumbe attest --sign-key signs it with an Ed25519 key and --status posts it as a commit status. Older and unsigned ledgers verify as before.
• A Go import reaches the files of the package it names, so Go repositories get import edges in a context pack; the index cache rebuilds once. Secret safety stops flagging a placeholder in a source-file comment. solumbe help now lists the core commands, and solumbe help --all lists every command.

npm v4.5.0 · GitHub Release · MCP Registry

v4.4.0 published (2026-10-10)

A check the gate cannot run reports SKIPPED instead of WARN, so a clean change can return PASS, and solumbe calibrate grades the gate's verdict against what happened next. No command or field was removed.

• Local Review state, CI-only Compliance controls, and a review decision, CODEOWNERS file or branch protection that GitHub did not return report SKIPPED and never move the verdict. The company and high-risk profiles still require them. The verdict schemaVersion is now 3 for the new check status.
• Release discipline fires only when a version field changes, read from the exact commit, staged tree or PR head, and Secret safety stops flagging templates and test placeholders. Known secret formats still fail everywhere.
• solumbe calibrate <repo> --gate replays the real gate and convergence score over history and reports the repair rate for PASS, WARN and FAIL, per check and per convergence band. On this repository PASS changes were repaired 16.0% of the time and WARN 36.7%, with overlapping intervals.
• solumbe calibrate <repo> --follow-through reads the local usage log for how often a warning had cleared on the next run, and SOLUMBE_CHECK_MODE=trial withholds the MCP convergence_score and local review_gate results from a control arm so calibrate --trial can grade whether showing them reduces repairs. A blocking FAIL is always shown.

npm v4.4.0 · GitHub Release · MCP Registry

v4.3.0 published (2026-10-10)

The MCP server tells every host which tool to call at each stage of a task, and convergence stops calling a change's own tests, changelog, fixtures and docs drift. No command, field or schema was removed.

• initialize returns instructions with the agent workflow: context_pack first, a repo_search retry when the pack is weak, change_impact before editing, convergence_score before each commit and review_gate before a pull request.
• convergence_score places a file by the lines the change adds to it: a test or source file that imports a confirmed file, a doc that names one, and the change's changelog entry and fixture data are in scope. The engine moves to 0.4.0.
• A request that names a tool reaches the module that implements it, through the registry's { name: "…" } entries and case "…": dispatch. The index cache moves to version 12 and rebuilds once.
• Fixture directories no longer trip the gate's risk paths, a repository deleted from disk is reported as stale instead of failing every search, and a failing accuracy eval says FAIL instead of crashing.

npm v4.3.0 · GitHub Release · MCP Registry

v4.2.1 published (2026-10-06)

Context packs rank by distinct request words, and a failing gate says what failed. No command or schema was removed.

• A word the request repeats counts once, a plural and its singular are one word, and the parts of a camelCase name count only together, so one repeated or generic word no longer pushes the right file out of the pack.
• gate --run-validation names the failing tests and shows up to 12 lines from the first failure beside the output digests. The excerpt is cleaned, credential-shaped lines are withheld, and the evidence and receipt still carry digests only.
• gate --out and the pre-commit hook from solumbe init print the verdict and the blocking check, instead of only the report path.

npm v4.2.1 · GitHub Release · MCP Registry

v4.2.0 published (2026-10-04)

Reviews look into a repository's companions and read what a migration does to existing data. No command, field or schema was removed.

• review_verdict and change_impact name the top files in each companion repository listed in .solumberc.json, so a web change whose rule the API also decides points at the API file. The verdict schemaVersion is now 2 for that one added field.
• A new Migration safety gate check warns when a changed SQL migration rewrites, deletes, truncates or drops existing data. Prisma schemas and SQL migrations are now mapped.
• review_verdict --head reviews exactly base..head, changed files rank by score, and .env.example no longer fails the secret check on its name.
• Go modules get validation commands, entrypoints and test guardrails, a multi-repo context pack keeps the small repo, and a checkout behind its upstream says so.

npm v4.2.0 · GitHub Release · MCP Registry

v4.1.0 published (2026-10-01)

One command connects Solumbe to your agents. No command, field or schema was removed.

• solumbe install --host all adds the solumbe MCP server to Claude Code, Claude Desktop, Codex CLI, Cursor, VS Code, Gemini CLI and Kimi Code CLI, wherever it finds them; --host claude-code,cursor names hosts instead, and --dry-run shows the plan. It checks that the server answers before writing anything, keeps a .solumbe.bak of each config it changes, and lists leftover entries from the 4.0.0 rename for you to remove. docs/02 has the detail.
• Host configs pin the absolute node and CLI path, so Claude Desktop, Cursor and VS Code start the server under nvm, Volta or Homebrew, where a bare solumbe command could not be found.
• The MCP setup guide has its Claude Code section, and post-merge attestation stays on main's first-parent line.

npm v4.1.0 · GitHub Release · MCP Registry

v4.0.0 published (2026-09-30)

Òtítọ́ is now Solumbe. Behaviour is unchanged from 3.5.0; every name moves, with no fallback to the old ones.

• Install @bashbop/solumbe and run solumbe; the MCP server is io.github.BASHBOP/solumbe, so point host configs at the new package and name the server solumbe (tools become mcp__solumbe__*).
• Rename .otitorc.json to .solumberc.json and otito.gate.json to solumbe.gate.json, move .otito/ and ~/.otito/ to .solumbe/ and ~/.solumbe/, and rename OTITO_* variables to SOLUMBE_*.
• The CHANGELOG has the full rename map. Releases before 4.0.0 stay on npm as @bashbop/otito.

npm v4.0.0 · GitHub Release · MCP Registry

v3.5.0 published (2026-09-30)

Model routing can make a share of requests follow the tier it picks, not only recommend it. No command, field or schema was removed.

• SOLUMBE_ROUTE_MODE=delegate turns on enforce mode: a share of requests (SOLUMBE_ROUTE_DELEGATE_SHARE, default 0.5) is told to do its tool work in a subagent on the routed tier, and the rest are a control. solumbe route shows the arm and the subagent model, and route-outcomes.mjs --arm grades each arm separately.
• On Claude Code, the premium tier names claude-opus-5-5, the model that actually runs.

npm v3.5.0 · GitHub Release · MCP Registry

v3.4.0 published (2026-09-29)

One context pack can span a web app and its API, and the router says when it has nothing to go on. No command, field or schema was removed.

• context_pack and solumbe context read companions from a repository's .solumberc.json ("companions": ["../api"]), so a web bug whose cause is in the API gets one pack covering both. Explicit paths still win; a companion that is not checked out is skipped.
• change_impact raises risk only from required and supporting files, plus any changed file, not from a domain that only an advisory lead touches.
• solumbe route shows each Score question's own confidence next to its score, display only, and says no recommendation when solumbe matched no files, while still naming the fail-safe tier. docs/18 has the detail.
• context_pack reads "bug", "broken" or "crash" as debugging, and ranks the repository a multi-repo request names first; change_impact keeps a UI page as a required owner without API wording.
• version:check fails when the site banner or What's New lags the released version.

npm v3.4.0 · GitHub Release · MCP Registry

v3.3.0 published (2026-09-27)

The terminal output gets colour and shape it didn't have before. No command, field or schema was removed.

• The default terminal look is plain Unicode (✓ ! ✗, box drawing, arrows) with no emoji; CI, NO_EMOJI, --no-emoji and TERM=dumb keep ASCII, and --emoji opts back in. Tables, trees and lists come from shared primitives, and every command that prints for a person ends with one closing line such as Verified. or Runs without errors.
• solumbe install asks a person at a terminal how to install, while --yes, --json, CI and agents get the same output as before.
• context_pack and change_impact stop ranking translation catalogs, file extensions and test notes ahead of the code a request names; a path or symbol named in the request is pinned as a required owner.
• A version bump that reaches main is tagged and released by the new Tag release workflow, without a hand-pushed tag.

npm v3.3.0 · GitHub Release · MCP Registry

v3.2.0 published (2026-09-26)

The gates gate what they are given. No command, field or schema was removed.

• solumbe gate and solumbe review take the repository from the positional or --path, in local and PR mode alike, and every gate, CLI or MCP, reads policy and governance from the .solumberc.json of the repository it gates, not the directory it runs in.
• The GitHub PR gate reads whether a PR is open, merged or closed and reports it as pr.state and pr.mergedAt, so a merged PR is no longer gated as if it were still open.
• A --pr or selector that names no PR is refused rather than gating the wrong thing. Over MCP a blank pr reads as no PR, and pr_merge_readiness with no selector gates the checked-out branch's PR again.
• Repair hints name the @nugehs packages that exist, and solumbe help no longer says the legacy MCP tool names stop working at 3.0; docs/02 maps each one to its canonical tool.

npm v3.2.0 · GitHub Release · MCP Registry

v3.1.0 published (2026-09-26)

The router gets graded, and the answer so far is that nothing can grade it yet. Nothing was removed or renamed.

• solumbe regret replays a repository's history and grades the tier each half of the router would have given against the same repaired outcome solumbe calibrate uses; --rescore grades a new arithmetic on frozen model answers, with no checkout and no model call.
• On three repositories no variant orders outcomes, and offline audits of the join and of a same-session outcome say why, so solumbe route stays advisory. docs/18 has the tables.
• The route-prompt hook now keeps every decision it makes (~/.solumbe/route-decisions.jsonl, never the prompt text), so the router can be graded once enough real requests exist.
• solumbe attest and solumbe attest --verify move post-merge attestation into the CLI, with versioned records and a reusable workflow.

npm v3.1.0 · GitHub Release · MCP Registry

v3.0.0 published (2026-09-25)

The first major since the Solumbe cutover. It follows 1.15.0 directly; the v2.x tags belong to earlier solumbe releases, from before the cutover.

• Breaking: solumbe stops interpreting the request and leaves that to the model. intent.hints, patterns and agentPrompt leave the context pack, implementationPlan leaves impact, and reviewPrompts and nextSteps leave PR review. The ranked files, hotspots, risk flags and review targets they were derived from are unchanged. See Migrating from 1.x.
• solumbe converge --head <ref> and solumbe gate --head <ref> score exactly base..head, so a dirty checkout no longer counts as scope drift. A confirmed owner's own siblings and tests are in scope, not drift; on a 25-file commit that moved convergence from 55 to 84.
• Working-tree convergence no longer scores untracked files by default (--include-untracked restores it).
• Fixed: post-merge attestation attested the wrong commit, the context pack reported a working tree that no longer existed, and a manual run can now reset an orphaned audit ledger.

npm v3.0.0 · GitHub Release · MCP Registry

v1.15.0 published (2026-09-23)

• model_route is now an MCP tool, so every MCP host (Cursor, VS Code, Claude Desktop, Codex, Gemini) can ask for a tier, not only the CLI.
• A request read rides the same System One call: what kind of work it is, which solumbe tool answers it, and which ranked files it needs. It is reported, never scored; the tier is identical with and without it.
• solumbe context --online / context_pack { online: true } applies that read to a context pack: it relabels a confident intent and demotes files the model judges irrelevant. Off unless asked.
• Any MCP host can appear on a local Realtime Canvas via SOLUMBE_CANVAS_URL and SOLUMBE_HOST, sending the request text only.

npm v1.15.0 · GitHub Release · MCP Registry

v1.14.0 published (2026-09-20)

• A UserPromptSubmit hook routes every request before any work starts, not only the ones a skill remembers to route. It advises the session and binds the model on delegated subagents; it cannot switch the session's own model, and says so.
• Markdown is now indexed, so skills and docs pages can be found. A request naming a skill used to rank unrelated library files; it now ranks the skill first.
• Fixed: a stale stored index kept serving after the indexer changed, including on offline workspace search. Indexes now carry a capability signature and are rebuilt when it moves.
• Fixed: a doc about an auth-like area escalated a typo fix to premium; the router escalated two thirds of requests because it bumped on a model's self-reported confidence (now 0% escalation over nine requests); post-merge attestation died on exit 128 and reported green when it had done nothing.

npm v1.14.0 · GitHub Release · MCP Registry

v1.13.1 published (2026-09-20)

• The documentation pack is rewritten for a reader rather than its author: seven overlapping pages become one deterministic verification page, and navigation is grouped by what you are trying to do.
• The model router skill can offer a realtime canvas, at most once per session.

v1.13.0 published (2026-09-20)

• solumbe route <repo> "<request>" scores a coding task before tokens are spent on it and recommends a cheap, mid, or premium tier. solumbe answers the repository half deterministically; a System One model answers the request half with calibrated probabilities. It ships advisory, because the weights have never been graded against an outcome.
• The router is not the gate and cannot become one. It runs before work starts; the gate runs after the diff exists. An unreachable or unkeyed model costs a tier, never a verdict.
• Fixed: zero matched files read as a contained change, so the request a repository understood least was routed to the cheapest model. Absence now fails safe to the ceiling.
• Nineteen report commands moved onto the shared document renderer, so every command reads like review and impact.

npm v1.13.0 · GitHub Release · MCP Registry

v1.12.0 published (2026-09-19)

• Model routing arrived as a prototype alongside the routing doc, dogfooded on a production application where the first pass routed every request to premium and surfaced two defects worth recording.
• A question whose answer never moves carries no information however well calibrated it is: asked as a yes/no, "is this request ambiguous?" returned 0.57 to 0.81 for every request including a typo fix.

npm v1.12.0 · GitHub Release · MCP Registry

v1.11.0 published (2026-09-19)

• solumbe calibrate <repo> grades the risk flags against the repository's own history, joining fix commits to the commits they repair by line overlap rather than by filename. Pointed at a small corpus it declines to answer most rows, which is the honest result.
• configuration was two signals under one name: manifest-only commits were repaired at 0.42x the base rate, real config files at 2.03x. Merged, they cancelled out and inverted the risk bands, leaving medium changes less likely to be repaired than low at every window.
• A zero-weight flag could gate a merge on its own; gating now requires a flag that scores.

npm v1.11.0 · GitHub Release · MCP Registry