Bump @hraness/local-custody to 0.6.0

[0thernet]

Summary

• pin @hraness/local-custody to exact registry version 0.6.0 and refresh bun.lock
• load the new Rust-first custody engine once per daemon process, relying on local-custody's own bounded per-operation fallback notices
• route daemon capability atomic publication and the post-bind Claude host-tool socket assertion through the engine
• update the measured release inventory to 235 entries / 11,607 canonical JSON bytes / f24680adad7934ba885afb0e8143acb5e61dda2f461acc52aaa91afb32c02f9d

Custody engine evaluation

Adopted:

• src/daemon/local-transport.ts: capability publication is async, uses supported atomic publish with no commit hook, and preserves the existing Promise<void> behavior
• src/daemon/claude-host-tool-transport.ts: the async post-bind mode-0600 socket assertion is covered by Rust and does not treat a missing path as an expected outcome

Deferred:

• src/daemon/local-transport.ts: file/socket validation and capability stable-read stay on the TypeScript implementation because stale cleanup and client availability classification depend on a raw ENOENT; the sidecar authoritatively returns CustodyError (stat/open) instead
• src/daemon/claude-host-tool-transport.ts: stale-socket validation stays TypeScript because ENOENT means there is nothing to unlink
• src/claude/account.ts: the bounded metadata stable-read stays TypeScript because ENOENT maps to an absent optional document while other custody failures fail closed

No directory assertion was forced onto the sidecar. Unsupported platforms, including Windows, retain local-custody's automatic TypeScript path.

Verification

• bun test src/daemon/local-transport.test.ts src/daemon/local-transport-authenticated-entry.test.ts src/daemon/claude-host-tool-transport.test.ts src/claude/account.test.ts src/install-preflight.test.ts scripts/release-package-policy.test.ts — 93 pass
• bun run check — support/cost/install/effect/security/lint/typecheck all pass; test aggregates pass (2,212 scripts, 160 local-efficiency, 36 cloud-efficiency, 6,168 src, 407 Convex, 190 site, 668 app); site/app/CLI builds and package-policy tests pass
• the final package-history scan in the shared checkout rejects unrelated pre-existing remote commit ad92074 from origin/codex/credits-service; bun ./scripts/check-package.ts fails identically on clean origin/main
• bun ./scripts/check-package.ts passes for exact commit 3540f8d in an isolated single-branch checkout containing only the governed candidate refs, verifying the measured package inventory and installed package lifecycle

A prior aggregate attempt hit the known load-sensitive one-second readiness timeout in scripts/bounded-process.test.ts; the exact test then passed on the candidate and in 21 focused clean-main runs. The final aggregate test run was clean.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
oompa	Ready	Preview	Sep 19, 2026 4:58am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
oompa-app	Ignored		Sep 19, 2026 4:58am UTC