This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
ReleasePort's take
Light signalv0.8.5 makes canon substrate layout configurable via three new fields and refactors path resolution into myco/core/paths.py. Security baseline drops from 36 to 7 findings after these changes.
Why it matters: Test in dev. Verify discovery helpers match your substrate layout. Adopt for 81% security baseline reduction (36→7 findings).
Summary
AI summaryRoot‑directory cleanup converges on four visible entries and makes canon filesystem layout configurable.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Canon-configurable substrate layout introduced via three new fields in canon.system.* Canon-configurable substrate layout introduced via three new fields in canon.system.* Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
New helpers find_substrate_canon(root) and has_substrate(root) added for dual-path discovery New helpers find_substrate_canon(root) and has_substrate(root) added for dual-path discovery Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Substrate call sites now route through ctx.substrate.paths for docs, notes, and canon locations Substrate call sites now route through ctx.substrate.paths for docs, notes, and canon locations Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Dependency | Medium |
myco immune baseline reduced from 36 to 7 findings post-changes myco immune baseline reduced from 36 to 7 findings post-changes Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Performance | Medium |
_DOC_PATH_RE regex extended with negative lookbehind to avoid substring matching _DOC_PATH_RE regex extended with negative lookbehind to avoid substring matching Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
cycle/molt.py now resolves changelog path correctly for relocated .docs/ layout cycle/molt.py now resolves changelog path correctly for relocated .docs/ layout Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
SE1 dead links in .docs/iou/* files fixed by adjusting relative path references SE1 dead links in .docs/iou/* files fixed by adjusting relative path references Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Paths resolution moved to myco/core/paths.py::SubstratePaths and Substrate.load() Paths resolution moved to myco/core/paths.py::SubstratePaths and Substrate.load() Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
v0.8.5 - 2026-05-12 - root-cleanup convergence + canon-configurable layout
Replaces v0.8.4 at .myco/canon.yaml::contract_version. Issued via
the myco molt --contract v0.8.5 agent-callable verb (autonomous
section, ratchet-pace pattern per L0 P3 "Conserve versions" feedback).
synced_contract_version updated in lockstep.
What changed
Root-directory convergence to 4 visible entries (LICENSE,
README.md, pyproject.toml, src/) plus hidden infrastructure
(.cache/, .claude/, .claude-plugin/, .cowork-plugin/,
.docker/, .docs/, .git/, .github/, .mcp.json, .meta/,
.myco/, .plugin/, .pre-commit-config.yaml, .scripts/,
.tests/). The 9-commit cleanup arc (v0.8.4 series, no version
bumps per the "conserve versions" discipline) is consolidated into
the v0.8.5 release as the formal boundary marker.
Canon-configurable substrate layout (the load-bearing change)
The substrate's filesystem shape is now canon-configurable rather than
hardcoded. Three new fields under canon.system.* (additive within
schema v2 — no migration required for downstream substrates):
canon_filename— where the canon YAML lives (default_canon.yaml).
Myco-self uses.myco/canon.yamlper the v0.8.4 root-cleanup.notes_dir— where ingestion writes raw/integrated/distilled notes
(defaultnotes/). Myco-self uses.myco/notes/.docs_dir— where doctrine + IOU + primordia live (defaultdocs/).
Myco-self uses.docs/.
Resolution lives in myco/core/paths.py::SubstratePaths (frozen
dataclass with derived properties) and myco/core/substrate.py:: Substrate.load() (reads the three fields off canon and threads them
through). New helpers find_substrate_canon(root) and
has_substrate(root) walk the dual-path candidates
(.myco/canon.yaml then _canon.yaml) so substrate discovery handles
both shapes transparently.
Subsystem touchpoints
All call sites that previously hardcoded docs/, _canon.yaml, or
notes/ now route through ctx.substrate.paths:
cycle/molt.py::handle_molt— changelog appends via
paths.docs / "contract_changelog.md"(previously fired
WriteSurfaceViolationon Myco-self bumps).homeostasis/dimensions/mechanical/pa1_write_surface_coverage.py—
canon and changelog samples resolved fromctx.substrate.pathsat
run()time; static notes samples retain thenotes_dirconvention
via the canon-configuredpaths.notes.homeostasis/dimensions/mechanical/fr1_fresh_substrate_invariants.py
—notes/raw/,notes/integrated/,docs/directory checks read
paths.notesandpaths.docs.homeostasis/dimensions/mechanical/pa6_repo_bloat.py—
_DEFAULT_EXCLUDED_GLOBSextended with.docs/,.myco/notes/,
and.docs/contract_changelog/_archive/**so the bloat-detector
default exclusions cover both legacy and relocated layouts.homeostasis/dimensions/semantic/lb1_living_bets_overdue.py—
primordia_root =ctx.substrate.paths.docs / "primordia".homeostasis/dimensions/semantic/se5_version_anchor_freshness.py—
_LIVE_DOC_GLOBSremapdocs/...→<paths.docs>/...if the
substrate has relocated. Also: extended the historical-context
window to include the matched anchor plus 50 chars of right-context
(previously only left-context was scanned, so tokens likethe v
/before vonly matched on multi-anchor lines), and added 14
doctrine-prose tokens that surface naturally in L1/L2/L3 prose
(at v,under v,from v,from \v,for v,next release,starts a clean,filename,schema (,instance at,twelve verbs,during development,at release,audit gap,dimension set,homeostasis at,(was `genesis,ssot-only,registry; v`).circulation/graph.py+circulation/graph_src.py—_resolve()
and_resolve_doc_ref()acceptdocs_dir/notes_dirfallback
kwargs so SE1 dead-link detection works against either layout. The
_DOC_PATH_REregex grew a negative lookbehind to avoid
substring-matchingdocs/X.mdinside.docs/X.md.core/risk_classifier.py—_RECURSION_CUTTER_PATH_PATTERNS
regexes accept bothdocs/and.docs/prefixes (\.?docs/).
Hardening surface (immune sweep)
myco immune baseline reduced from 36 findings (v0.8.4 at session
start) to 7 (v0.8.5 ship gate). Of the 29 cleared findings:
- 24 SE5 v0.4.x doctrine anchors (canon-schema starting points, wave
reset, pre-rewrite history) — naturally silenced by the extended
window + prose-token additions; no doctrine prose edits required. - 5 SE1 dead links in
.docs/iou/v0_7_10_examples_dry_only_gaps.md
and.docs/iou/_archive/v0_7_10_streamable_http_gaps.md—
fixed the post-relocation path drift (../../src/...→
../../../src/...,../../examples/→../examples/README.md,
sibling-IOU pointer to_archive/).
The 7 baseline findings are irreducible noise: 6 SE1 references in
immutable integrated notes (agent-handoff-myco-v0-4-0-v0-4-1.md,
n_20260510T145212Z_*.md) which L2 digestion doctrine forbids
modifying; and 1 MB8 telemetry finding for the active
src/myco/mcp/ back-compat shim (currently in normal-use territory,
not yet sunset-eligible).
Gate quintet at ship
python -m ruff check src .tests— clean.python -m ruff format --check src .tests— 338 files, 0 reformats.python -m mypy src/myco— 162 source files, no issues.python -m pytest -q -n auto --dist loadfile— 1834 passed,
14 skipped (framework-extras + benchmark + posix-only), 0 failed.
Note: SE5 doctrine fixture text updated to "Use vX.Y.Z in
production" because the prior "Current state at vX.Y.Z" wording is
now correctly recognized as historical by the prose-token suppressor.python -m myco immune— exit 0, 7 baseline findings (above).- All 4 verify scripts green:
verify_mcp_boot.py(20 tools,
handshake green),verify_server_json.py(1184 / 4096 _meta
bytes),verify_install_examples.py(8 demos pass--dry),
sync_plugin_mirrors.py --check(all mirror pairs in sync).
Break from v0.8.4
None for downstream substrates. The three new
canon.system.{canon_filename, notes_dir, docs_dir} fields are
purely additive within schema v2; absent fields fall through to the
legacy _canon.yaml + notes/ + docs/ defaults. Existing
downstream substrates continue to work unmodified.
The cycle/molt.py changelog-path fix is a bug-fix for Myco-self —
prior v0.8.4 builds could not run myco molt --contract <v> against
a substrate that had relocated docs/ to .docs/ (the verb wrote to
the legacy literal path and tripped write-surface enforcement).
Downstream substrates using the default docs/ layout were never
affected.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Battam1111/Myco
Agent-first cognitive substrate with 18 manifest-driven verbs (germinate / eat / assimilate / sporulate / traverse / immune / molt / …) and 25 lint dimensions enforcing contract invariants mechanically (R1–R7). Cross-session / cross-project memory via a self-validating filesystem graph — AST + markdown-link derived, not embedding-based. Provider-agnostic by design: MP1/MP2 dims forbid LLM-SDK imports in the kernel and plugin tree. Editable-default install. Works with Claude Code, Cursor, Windsurf, Zed, VS Code, and any MCP client.
Related context
Related tools
Beta — feedback welcome: [email protected]