chore: update all persona catch-up sections to v4.0; add pip install to FOR_AGENTS and GETTING_STARTED

Author: Douglas Jones

.kiro/steering/personas/axiom.md

@@ -65,20 +65,23 @@ The Track 1 external agent sessions (GPT-4o, Gemini, Claude) were Axiom's job
 done manually and expensively. Axiom makes that systematic. Every new surface
 gets an Axiom pass before it ships, not after three external agents hit it.
 
-## Catch-up on Codifide (as of v2.0 — 2026-05-14)
+## Catch-up on Codifide (as of v4.0 — 2026-05-15)
 
 Key friction points already documented (do not re-report these as new findings):
 - `a + b` → use `add(a, b)` (arithmetic operators don't exist)
-- `is_bottom(x)` cannot catch propagated bottom — raises `BottomPropagationError`
-- `is_bottom(f())` direct-call works — documented in AGENT_QUICKREF (2026-05-14)
-- bind-before-when: `when` guard runs before the candidate body; now a parse
+- `is_bottom(x)` — both direct-call `is_bottom(f())` and bind pattern
+  `r <- f(); is_bottom(r)` now work correctly (interpreter fix v4.0+)
+- bind-before-when: `when` guard runs before the candidate body; parse
   error with a clear fix hint (V2-2 shipped 2026-05-14)
 - `contains()` is case-sensitive — always normalize with `lower()` first
 - `from <hash> import name` works in both runtimes as of v2.0 (V2-3 shipped)
 - Content-addressed composition (Program 5) — CLI path and HTTP path both
   documented in cookbook entries #8 and #11
 - `io.say` + CLI double-print — documented in AGENT_QUICKREF and cookbook #12
+- Standard library (v4.0): `io.read/write/exists`, `http.get/post`,
+  `json.parse/encode`, `clock.today/parse/add_days/format` — all pure except
+  clock.read and io/http effects
 
-These are in `docs/AGENT_COOKBOOK.md` (v1.1) and `docs/AGENT_QUICKREF.md`.
-Axiom's job is to find the *next* ones — particularly around the RPC API
-surface (new in v2.0) and any parallel evaluator surfaces.
+These are in `docs/AGENT_COOKBOOK.md` and `docs/AGENT_QUICKREF.md`.
+Axiom's job is to find the *next* ones — particularly around the stdlib
+surfaces (new in v4.0) and the public registry workflow.

.kiro/steering/personas/glyph.md

@@ -119,38 +119,39 @@ GitHub Markdown, not YAML. It includes:
 - Open items and unknowns
 - Links to the full Glyph YAML dispatch in the repo
 
-## Catch-up on Codifide (as of v2.0 — 2026-05-14)
+## Catch-up on Codifide (as of v4.0 — 2026-05-15)
 
 Glyph, the project lives at
 `/Users/douglasjones/Projects/CodifideProgrammingLanguage/`. Public on GitHub
-as `codifide-programming-language`, MIT licensed.
+as `codifide-programming-language`, MIT licensed. Published on PyPI as `codifide`.
 
 Key facts for dispatch construction:
 
 - **Canonical spec:** `docs/CANONICAL.md`
 - **Interpreter semantics:** `codifide/runtime/`
-- **Capability manifest hash (v2.0):**
-  `sha256:42d73647ba8de29a7d219bf2218bad0a42dc2a11d7878cac12ee931be2a1a185`
-- **Test count:** 341 Python passing, 0 skipped (as of 2026-05-14)
+- **Capability manifest hash (v4.0):**
+  `sha256:341b82f074cc59f929415cf571bfe27da5127270ebb86618f575fe107514ffe1`
+- **Test count:** 461 Python passing, 0 skipped (as of 2026-05-15)
 - **Rust canonical crate:** `crates/codifide-canonical/` — byte-level
-  conformance to Python; 28 Rust tests passing
+  conformance to Python
 - **Dispatch journal:** `dispatches/INDEX.md` — indexed, grouped by date
-- **Shape reference:** `dispatches/2026-05-14-bteam-findings-applied.yaml`
-  is the most recent Glyph dispatch; use it as your shape reference
-
-**Shipped state (v2.0, 2026-05-14):**
-- V2-1: RPC API — `python3 -m codifide serve`, POST/GET symbols by hash
-- V2-2: Static bind-before-when detection — parse error with fix hint
-- V2-3: from-import in Rust parser — both runtimes now support `from`-import
-- V2-4: Manifest `docs` field — links to human-readable documentation
-- Agent Adoption Initiative complete — four case studies, cookbook v1.1,
-  quickref updated, B-Team governance review closed
-
-**Open items (not yet dispatched):**
-- AUD-OVERNIGHT-02: parallel evaluator branch interpreters don't carry
-  resolved imports — Sable audit needed before v3.0 parallel work
-- New agent case study to validate adoption improvements (Relay's KPI)
-- v3.0 planning if adoption evidence warrants it
+- **Shape reference:** use the most recent `.yaml` in `dispatches/` as shape reference
+
+**Shipped state (v4.0, 2026-05-15):**
+- V4-1: Runtime type enforcement — `sig` declarations enforced at call boundaries
+- V4-2: Standard library — io, http, json, clock primitives
+- V4-3: Public registry — all 5 pipeline symbols live at codifide.com/registry;
+  `python3 -m codifide run pipeline_composed.cod --registry https://codifide.com` verified
+- `is_bottom` interpreter fix — exempt from `BottomPropagationError` check; 7 new tests
+- RPC adversarial gaps closed — 3 new server tests
+- PyPI publish — `pip install codifide` (CI fix: removed `blob` extra from test install)
+- Dependabot PRs merged: sha2 0.11, criterion 0.8, checkout@v6, setup-python@v6, codeql-action@v4
+
+**Open items:**
+- GitHub Discussions announcements for v3.0 and v4.0 (Quill P1)
+- `GITHUB_TOKEN` not set in Vercel env — stats proxy rate-limited (Sable P2)
+- PyPI package live status unconfirmed — CI was failing, now fixed; next push will publish
+- New agent case study to validate v4.0 adoption improvements
 
 **Dispatch discipline:** Every session files a paired Quill readout
 (`.readout.md`) and Glyph YAML (`.yaml`). Session-close pairs required.

.kiro/steering/personas/quill.md

@@ -52,64 +52,48 @@ minutes, not hours. They will form an opinion based on what Quill writes.
 End every report with a single sentence titled **"What I'm not yet sure of."**
 If Quill is certain of everything, the report is incomplete.
 
-## Catch-up on Codifide (as of v2.0 — 2026-05-14)
+## Catch-up on Codifide (as of v4.0 — 2026-05-15)
 
 Quill, here's what you're working with. The project is in
 `/Users/douglasjones/Projects/CodifideProgrammingLanguage/`, public on GitHub
-as `codifide-programming-language`, MIT licensed.
-
-- **What it is:** A programming language designed for agentic AI rather than
-  for human cognitive constraints. Seven design principles in `README.md`.
-  Tagline: *"confidence in code, for agents."*
-
-- **What shipped in v1.0 (2026-05-11):**
-  Python reference interpreter, canonical CBOR/JSON, content-addressed symbol
-  store, capability manifest, Rust canonical crate. 216 Python tests, 28 Rust
-  canonical tests.
-
-- **What shipped in v2.0 (2026-05-14, overnight session):**
-  - **V2-1 RPC API** — `python3 -m codifide serve` starts a local HTTP server
-    backed by the symbol store. POST canonical forms, GET by hash. Removes the
-    CLI ceremony from Program 5 (content-addressed composition).
-  - **V2-2 Static bind-before-when detection** — the parser now catches the
-    bind-before-when footgun at parse time with a clear fix message. Previously
-    a confusing runtime error.
-  - **V2-3 from-import in Rust parser** — `from sha256:<hash> import ...` now
-    works in the Rust runtime. `CODIFIDE_RUNTIME=python` workaround removed.
-  - **V2-4 Manifest docs field** — capability manifest now includes a `docs`
-    field pointing to human-readable documentation.
-  - New manifest hash: `sha256:42d73647ba8de29a7d219bf2218bad0a42dc2a11d7878cac12ee931be2a1a185`
-  - 341 Python tests passing, 0 skipped.
-
-- **Agent Adoption Initiative — complete (2026-05-13):**
-  - Track 1: Four external agent case studies run (GPT-4o, Gemini 2.5 Pro,
-    Claude baseline, GPT-5.4 B-Team review). All five programs completed by
-    all models. Key finding: Program 5 (content-addressed composition) was the
-    universal friction point — fixed by V2-1 RPC API.
-  - Track 2: Adoption infrastructure shipped — manifest endpoint live at
-    codifide.com, `AGENT_COOKBOOK.md` (12 entries), `AGENT_QUICKREF.md`,
-    `python3 -m codifide agent-quickstart`.
-  - Track 3: v2.0 roadmap driven by adoption findings — all four requirements
-    shipped.
-
-- **B-Team governance review — complete (2026-05-14):**
-  GPT-5.4 ran the pipeline task spec with live interpreter access (found and
-  installed the local repo). Four findings applied: direct-call `is_bottom`
-  documented, double-print behavior documented, stale Rust parser note removed,
-  HTTP workflow added to cookbook.
-
-- **What's honest to say:** Codifide is a complete, tested, public v2.0
-  language. The adoption infrastructure is real — four external models have
-  run the pipeline task spec and the friction points are documented and fixed.
-  The scale story (graph-native parallel runtime, time-indexed types) is
-  roadmap, not shipped. The parallel evaluator does not yet carry resolved
-  imports into branch interpreters (known gap, AUD-OVERNIGHT-02).
+as `codifide-programming-language`, MIT licensed. Now published on PyPI as `codifide`.
+
+- **What it is:** A programming language designed for agentic AI. Seven design
+  principles: intent, effects, contracts, confidence, refusal, fidelity, and
+  content-addressing. Tagline: *"confidence in code, for agents."*
+
+- **What shipped in v4.0 (May 2026):**
+  - Runtime type enforcement — `sig` declarations enforced at every call boundary
+  - Standard library — file I/O (`io.read/write/exists`), HTTP (`http.get/post`),
+    JSON (`json.parse/encode`), date arithmetic (`clock.*`)
+  - `is_bottom` interpreter bug fixed — was raising `BottomPropagationError`
+    instead of inspecting the value; 7 new tests
+  - RPC adversarial test gaps closed — 3 new server tests
+  - V4-3 complete — all 5 pipeline symbols live on the public registry at
+    codifide.com; end-to-end `--registry` resolution verified
+  - PyPI publish — `pip install codifide` now works
+  - 461 tests passing, 0 skipped
+
+- **What shipped in v3.0 (May 2026):**
+  - `bottom "reason"` — refusal reasons propagate through `RefusalError`
+  - Remote symbol resolution — `--registry https://codifide.com` resolves imports
+  - Parallel evaluator import support — AUD-OVERNIGHT-02 closed
+
+- **What shipped in v2.0 (May 2026):**
+  - RPC API — `python3 -m codifide serve`
+  - Static bind-before-when detection — parse error with fix hint
+  - from-import in Rust runtime
+  - Capability manifest `docs` field
+
+- **What's honest to say:** Codifide is a complete, tested, published v4.0
+  language with a working public registry. `pip install codifide` works.
+  The adoption infrastructure is real — four external models completed all
+  five programs. The scale story (static type inference, editor integration,
+  structural diff) is roadmap, not shipped.
+
+- **GitHub Discussions:** Needs v3.0 and v4.0 announcements — this is Quill's
+  outstanding P1 action item.
 
 - **Open action items:**
-  - `AGENT_COOKBOOK.md` HTTP workflow — done (entry #11)
-  - New agent case study to validate adoption improvements (Relay's KPI)
-  - Sable audit of parallel evaluator import handling (AUD-OVERNIGHT-02)
-  - v3.0 planning if adoption evidence warrants it
-
-Your first deliverable when invoked: a one-page "state of Codifide" that a
-technically literate human could read in three minutes.
+  - Post v3.0 and v4.0 announcements to GitHub Discussions (P1)
+  - New agent case study to validate v4.0 adoption improvements

.kiro/steering/personas/relay.md

@@ -75,33 +75,35 @@ connects them — the sequence, the discoverability, the funnel. A language
 surface can be ergonomically clean (Axiom says so) and well-documented (Paige
 says so) but still produce a confused agent if the funnel doesn't lead there.
 
-## Catch-up on Codifide (as of v2.0 — 2026-05-14)
+## Catch-up on Codifide (as of v4.0 — 2026-05-15)
 
 Current adoption funnel state:
 
-1. Agent fetches `codifide.com/capability.json` (or `.cbor`) — live, includes
-   `docs` field pointing to human-readable documentation (V2-4 shipped)
-2. Reads `docs/FOR_AGENTS.md`
-3. Reads `docs/AGENT_QUICKREF.md` — updated with direct-call `is_bottom`
-   pattern and double-print note (2026-05-14)
-4. Runs `python3 -m codifide agent-quickstart`
-5. Writes Programs 1–4 — success rate ~100% across all four case studies
-6. Writes Program 5 — now has two paths:
-   - **CLI path:** `store put` + `store hash` + individual imports (flat chains)
-     or `store index` + `from`-import (deep chains). Both runtimes supported.
-   - **HTTP path:** `python3 -m codifide serve` + POST canonical forms + import
-     by returned hashes. Documented in cookbook entry #11 and `docs/RPC_API.md`.
-
-Known funnel gaps (resolved — do not re-report):
-- `CODIFIDE_RUNTIME=python` workaround — removed (V2-3 shipped)
-- Program 5 CLI ceremony — HTTP path now available (V2-1 shipped)
+1. Agent runs `pip install codifide` — now works (PyPI publish v4.0.0)
+2. Fetches `codifide.com/capability.json` (or `.cbor`) — live, includes
+   `docs` field pointing to human-readable documentation
+3. Reads `docs/FOR_AGENTS.md` — updated with `pip install codifide` as
+   primary install path
+4. Reads `docs/AGENT_QUICKREF.md` — current, `is_bottom` docs corrected
+5. Runs `python3 -m codifide agent-quickstart`
+6. Writes Programs 1–4 — success rate ~100% across all case studies
+7. Writes Program 5 — two paths:
+   - **Registry path:** `import f = sha256:<hash>` + `--registry https://codifide.com`
+     (all 5 pipeline symbols live; verified end-to-end)
+   - **HTTP path:** `python3 -m codifide serve` + POST + import by hash
+   - **CLI path:** `store put` + `store hash` + individual imports
+
+Known funnel gaps (resolved):
+- `CODIFIDE_RUNTIME=python` workaround — removed (V2-3)
+- Program 5 CLI ceremony — HTTP and registry paths available
 - Manifest `docs` field missing — shipped (V2-4)
-- Bind-before-when runtime error — now a parse error with fix hint (V2-2)
+- Bind-before-when runtime error — parse error with fix hint (V2-2)
+- `is_bottom` propagation footgun — fixed (v4.0+)
 
 Known funnel gaps (open):
-- Feedback template (`dispatches/feedback/TEMPLATE.md`) has not been used
-  in a real session (AUD-T2-04, still open)
-- No new agent case study since v2.0 shipped — adoption KPI unvalidated
+- GitHub Discussions has no announcements for v3.0 or v4.0 — a new agent
+  discovering the project via GitHub sees no release narrative
+- No new agent case study since v2.0 — adoption KPI unvalidated for v4.0
 
 Relay's first deliverable when invoked: a funnel walk for the current release
 state, with time-to-first-working-program estimate.

.kiro/steering/personas/sable.md

@@ -94,47 +94,40 @@ a post-audit dispatch is an open wound, not a report.
 - **Error surface.** Do typed errors actually classify what went wrong,
   or do host-language exceptions leak through?
 
-## Catch-up on Codifide (as of v2.0 — 2026-05-14)
+## Catch-up on Codifide (as of v4.0 — 2026-05-15)
 
 Sable, the project lives at
 `/Users/douglasjones/Projects/CodifideProgrammingLanguage/`. Public on GitHub
-as `codifide-programming-language`, MIT licensed.
+as `codifide-programming-language`, MIT licensed. Published on PyPI as `codifide`.
 
 - **Python reference:** `codifide/` — interpreter, parser, store, projection
 - **Rust canonical crate:** `crates/codifide-canonical/` — byte-level
   conformance to Python; includes CBOR decoder, fuzz harness
-- **Rust interpreter + parser:** `crates/codifide-interpreter/` (v2.0,
-  2026-05-12) — parallel evaluator, benchmarks
+- **Rust interpreter + parser:** `crates/codifide-interpreter/` — parallel
+  evaluator, benchmarks
 - **RPC API server:** `codifide/server.py` — ThreadingHTTPServer over
-  SymbolStore; `python3 -m codifide serve` (V2-1, 2026-05-14)
+  SymbolStore; `python3 -m codifide serve`
 - **Spec:** `docs/CANONICAL.md` — read with suspicion
-- **Test count:** 341 Python passing, 0 skipped (as of 2026-05-14)
+- **Test count:** 461 Python passing, 0 skipped (as of 2026-05-15)
 - **Prior audit history** (all in `dispatches/`):
   - `2026-05-10-security-audit.md` — initial CBOR neighborhood audit; all P1s resolved
   - `2026-05-11-ergonomics-audit.md` — post-four-model-review ergonomics
   - `2026-05-11-new-surfaces-audit.md` — cost dispatch + store GC; all resolved
   - `2026-05-11-cli-audit.md` — unbounded source read (P1); resolved
   - `2026-05-13-track1-sable-audit.md` — Track 1 case study surfaces
   - `2026-05-13-track2-sable-audit.md` — Track 2 adoption infrastructure
-  - `2026-05-14-v2-1-rpc-api-sable-audit.md` — RPC API; 2 P2s fixed, 3 P3s
-    fixed or accepted
+  - `2026-05-14-v2-1-rpc-api-sable-audit.md` — RPC API; 2 P2s fixed, 3 P3s fixed or accepted
+
+**Resolved since v2.0:**
+- AUD-OVERNIGHT-02: parallel evaluator branch interpreters now carry resolved imports (fixed v3.0)
+- RPC API adversarial surface: body size limits, concurrent POST, HEAD malformed identity, corrupt store object — all covered in `tests/test_server.py`
+- `is_bottom(f())` direct-call pattern: interpreter bug fixed (v4.0+) — `is_bottom` is now exempt from `BottomPropagationError` check; 7 dedicated tests in `tests/test_runtime.py`
 
 **Known coverage gaps (open):**
-- **AUD-OVERNIGHT-02:** Parallel evaluator branch interpreters don't carry
-  resolved imports. Branch interpreters created with empty `resolved_imports`.
-  Documented as a known limitation; not yet fixed. Sable audit needed before
-  any parallel + import work in v3.0.
 - Conformance suite covers ASCII-clean examples only
-- RPC API HTTP surface has no adversarial test coverage
-- `is_bottom(f())` direct-call pattern — works in the interpreter but no
-  dedicated test; behavior should be confirmed before it goes into docs
-  (currently documented in AGENT_QUICKREF as of 2026-05-14)
+- Stats proxy (`/api/github_stats.py` on publicsite) makes unauthenticated GitHub API calls — rate-limited at 60 req/hour; no `GITHUB_TOKEN` set in Vercel env
+- PyPI package published but not yet confirmed live (CI was failing due to `vercel_blob` Python version constraint — fixed 2026-05-15)
 
 **Active surface to audit next:**
-- Parallel evaluator import handling (AUD-OVERNIGHT-02)
-- RPC API adversarial surface (`codifide/server.py`) — body size limits,
-  concurrent POST behavior, store exhaustion under hostile input
-
-Your first deliverable when invoked: an audit report with
-severity-rated findings, each with a reproducing probe, filed to
-`dispatches/<date>-<slug>-audit.md`.
+- PyPI package supply chain — confirm `pip install codifide` installs the correct package
+- Stats proxy authentication gap

GETTING_STARTED.md

@@ -2,6 +2,23 @@
 
 This is the fastest path back into the project after time away.
 
+## Installation
+
+The fastest way to get started:
+
+```bash
+pip install codifide
+python3 -m codifide --version
+```
+
+Or install from source (for development):
+
+```bash
+git clone https://github.com/codifide/codifide-programming-language
+cd codifide-programming-language
+pip install -e "."
+```
+
 ## Run the suite
 
 ```bash

docs/FOR_AGENTS.md

@@ -5,6 +5,22 @@ fastest path to understanding. It is not a tutorial. It is a set of
 pointers into documents and code, in the order a reader with finite
 context should consume them.
 
+## Installation
+
+```bash
+pip install codifide
+python3 -m codifide --version
+```
+
+No other dependencies required. Python 3.9+ supported.
+
+The capability manifest is also available without installing anything:
+
+```bash
+curl https://www.codifide.com/capability.json   # JSON form
+curl https://www.codifide.com/capability.cbor   # CBOR form (RFC 8949)
+```
+
 ## 60 seconds
 
 Read `docs/capability-0.1.json` — the capability manifest. It