Harden plugin policy enforcement and runtime integration

.claude-plugin/marketplace.json

@@ -12,8 +12,8 @@
     {
       "name": "symbi",
       "source": "./",
-      "version": "0.5.0",
-      "description": "Block Claude Code from reading secrets and running destructive commands. Default-on protection with a runtime upgrade path to Cedar/ORGA governance."
+      "version": "0.6.0",
+      "description": "Optional local policy checks for supported tools, with strict parsing and runtime Cedar integration. Python 3.11+ required."
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "symbi",
-  "description": "Default-on protection that blocks Claude Code from reading secrets, writing to sensitive paths, and running destructive shell commands. No runtime required. Opt-in upgrade path to Cedar policy evaluation, SchemaPin tool verification, and ORGA-governed agents when the symbi binary is installed.",
-  "version": "0.5.0",
+  "description": "Optional local policy hooks with strict parsing, blocking Cedar integration and operator-managed controls. Python 3.11+ required; governed containment runs separately in Symbiont.",
+  "version": "0.6.0",
   "author": {
     "name": "ThirdKey AI",
     "email": "hello@thirdkey.ai",

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/plugin-checks.yml

@@ -0,0 +1,26 @@
+name: Plugin checks
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  hooks:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ['3.11', '3.14']
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Syntax and hook contract checks
+        run: |
+          python3 -I -m py_compile scripts/core/policy.py scripts/install-cursor.py tests/test_contract.py tests/runtime_e2e.py tests/harness_e2e.py
+          for script in install.sh scripts/*.sh scripts/core/*.sh adapters/cursor/*.sh tests/*.sh; do bash -n "$script"; done
+          shellcheck install.sh scripts/*.sh scripts/core/*.sh adapters/cursor/*.sh tests/*.sh
+          bash tests/run-tests.sh

.gitignore

@@ -1,9 +1,8 @@
-# Personal / machine-local Claude Code settings (never commit)
-.claude/settings.local.json
-
-# Symbiont runtime artifacts — generated locally, not part of the plugin
+# Generated runtime state
 .symbiont/audit/
 .symbiont/disabled
-
+# Python caches
+__pycache__/
+*.pyc
 # OS noise
 .DS_Store

CHANGELOG.md

@@ -1,6 +1,37 @@
 # Changelog
 
-## [Unreleased]
+## [0.6.0]
+
+### Security and compatibility
+
+- Require Claude Code 2.1.295+ with hook failures/timeouts blocked.
+- Require Python 3.11+ and use one strict JSON/TOML engine for both adapters.
+  Invalid or ambiguous input and unavailable enforcement now block calls.
+- Preserve native tool names and complete arguments through the runtime Cedar
+  contract; cover all tool events and reject implicit default allows, evaluator
+  failures and timeouts. This integration uses the current structured CLI result.
+- Remove environment-based policy bypasses. Protect direct file writes to local
+  controls and the installed plugin, including normalized and symlink aliases.
+- Local deny rules now override exceptions. Command exceptions match the entire
+  command. Unsupported policy sections fail rather than being silently ignored.
+- Cursor preToolUse sudo warnings block because its ask result is not enforced;
+  the dedicated shell event retains ask. Safely merge project hook installations.
+
+### Behavior and guidance
+
+- Make the runtime MCP server opt-in; add an explicit sample configuration.
+- Record local decisions and input digests, while preserving completion records.
+  These remain mutable diagnostics, not signed compliance journals.
+- Keep user opt-out available through operator-controlled settings or a marker;
+  commands provide instructions rather than editing their own controls.
+- Correct marketplace installation, managed CLI/Landlock examples, configuration
+  pinning, schema verification and signed-journal inspection guidance.
+- Replace obsolete development plans with current product guidance.
+- Add strict-parser, failure-path, adapter and installer regression tests plus a
+  real-runtime policy workflow test without model calls, plus an installed-client
+  smoke test for policy decisions and hook failure/timeout blocking.
+
+## Previous unreleased work
 
 ### Fixed
 - **Hook output now follows the documented Claude Code contract.** Blocks emit
@@ -28,8 +59,7 @@
   UI spam; recording is handled by the PostToolUse audit log.
 
 ### Added
-- Repo `.gitignore` (`.claude/settings.local.json`, `.symbiont/audit/`,
-  `.symbiont/disabled`).
+- Ignore generated local runtime state.
 - Output-channel regression tests for `policy-guard.sh` and a new
   `tests/test_install_check.sh` (suite now 84 tests).
 
@@ -86,7 +116,6 @@
 - README rewrites the lead with the plugin-only value proposition. Runtime
   sections (Cedar, ORGA, Mode B, dual-mode architecture) move below a
   "Going further" heading.
-- CLAUDE.md updated to reflect Tier 2 as the default behavior.
 
 ### Removed
 - `jq` from the prerequisites section of the README. The hooks now prefer
@@ -121,7 +150,6 @@
 
 ### Changed
 - Hooks now run `policy-guard.sh` (blocking) before `policy-log.sh` (advisory)
-- Updated CLAUDE.md and README.md to document governance tiers
 
 ## [0.2.0] - 2026-03-07
 
@@ -136,7 +164,6 @@
   - `examples/cli-executor/` -- CliExecutor-wrapped Claude Code with DSL + Cedar
   - `examples/agent-sdk/` -- headless Agent SDK wrapper pattern
 - `claude_code` executor type documentation for DSL agent definitions
-- Dual-mode documentation in README and CLAUDE.md
 
 ## [0.1.0] - 2026-03-07