Caveman 2.0.0 — engine, proxy, SDKs, unified CLI

[JuliusBrussee]

All 12 CI checks green (legacy CI Node 18/20/22 + Python · engine-ci go/typescript/python/root-surfaces/extension/windows · profile-contract · provider-catalog-contract).

Single-commit port of the Caveman 2 tree onto original repo history: candidate caveman-2@88878a4 applied over main@3098342. No unrelated-history merge, no force push to main; original history untouched. Rollback point: tag pre-caveman-2-2026-08-11.

Preserved v1 surfaces

• skills/caveman/SKILL.md byte-for-byte (plugin mirror + dist/caveman.skill rebuilt to match; tests/verify_repo.py passes)
• Legacy CI (ci.yml: Node 18/20/22 installer suite + Python 3.11) kept alongside engine-ci.yml
• cli/install.js compatibility shim → bin/install.js
• .codex/config.toml ships both hooks and codex_hooks for Codex ≤0.120.0 (Codex: shipped [features] hooks key is silently ignored on codex-cli <=0.120.0 (pre-rename versions) — auto-activation inert #617)
• README Trendshift + Skills.sh badges, local star-history asset
• curl installs stay pinned to v1.10.0; .claude-plugin, Gemini extension, commands, hooks intact

Fixed for public same-repo release

• SECURITY.md advisories → this repo; packages/cli/PUBLISHING.md rewritten for packages/ layout and same-repo flow
• release-binaries.yml publishes to this repo via job-scoped GITHUB_TOKEN (contents: write on the job only); cross-repo PAT removed; binary-release environment still gates signing
• profile-contract / provider-catalog-contract lanes skip their lane-scope gate on initial import (validation still gates)
• ANNOUNCEMENT.md: network claim corrected — compression is local, requests still go to your configured provider
• Secret-shaped redaction test fixtures split mid-literal so push protection never fires on synthetic vectors

Cross-platform and CI-correctness fixes surfaced by this PR's own gates

• Windows Go support (previously broken at runtime, not just in CI): sqlite parent-writability guard skipped on Windows with documented TODO for a DACL check (Go reports synthetic 0777 perms there); processAlive/processExecutable implemented via Win32 APIs; directory-fsync skipped in cache-replay atomic writes; cavemem retries SQLITE_BUSY writes; .exe-aware test helpers; POSIX perm asserts guarded
• PATHEXT resolver bug in all five vendored copies: extensionless commands no longer resolve to the non-executable Unix shim that npm/pnpm place next to the real .CMD shim
• WAL-sidecar TOCTOU race in secureSQLiteFile: a concurrently checkpointed -wal file vanishing between Lstat and open is no longer an error
• SDK deadline robustness: caveFetch holds a ref'd timer so AbortSignal.timeout (unref'd in Node) can't strand the deadline race when a custom fetch schedules nothing
• Graders regex worker: execution deadline starts at worker online, not spawn — cold CI spawns no longer fail valid patterns closed
• .gitattributes: * text=auto eol=lf (golden files, hook checksums); engine-ci typescript job enables unprivileged userns (agent sandbox tests) and prebuilds the proxy for the conformance suite
• Independent security review (Opus) on the guard changes: Unix behavior provably unchanged; findings folded in

After merge (not part of this PR)

1. 24–48h soak: checks green on main, fresh classic skill installs, no issue spike
2. Configure binary-release environment + CAVEMAN_BINARY_SIGNING_PRIVATE_KEY_PEM secret, then tag bin-v1.0.0 (annotated, signed)
3. Verify 36 binaries + manifests anonymously → publish @caveman-ai/cli → clean-machine smokes → tag v2.0.0 → README flip → announcement

🤖 Generated with Claude Code

https://claude.ai/code/session_01BLvb5QniwYjmcawyssQNw9