deps(deps): bump @sym-bot/sym from 0.7.6 to 0.7.18 in the sym-family group

[dependabot]

Bumps the sym-family group with 1 update: @sym-bot/sym.

Updates @sym-bot/sym from 0.7.6 to 0.7.18

Release notes

Sourced from @​sym-bot/sym's releases.

v0.7.18 — inbox payload fix

Fixed

• Inbox pull path preserves the opaque payload. A CMB's payload is a sibling of cmb.fields, but _pushInbox copied only fields — so any CMB pulled via node.inbox() (the sym_receive / sym_fetch path) silently lost its payload, while the channel-push path (reading entry.cmb.payload) kept it. Structured agent-to-agent data now survives cross-device directed delivery on both paths. Regression-tested in tests/inbox.test.js.

v0.7.10 — signed CMBs (authenticity + integrity)

Every CMB is now Ed25519-signed by its author. Receivers verify the signature against the sending peer's handshake-announced identity key and that the content-address key still matches the fields — a forged, tampered, or content-swapped CMB is rejected before it can surface or be stored (audit-metered cmb-signature-rejected). Unsigned CMBs pass for interop unless SYM_REQUIRE_SIGNED_CMB (strict mode). Cryptographic layer above transport identity + SVAF. New: signCMB/verifyCMB in @​sym-bot/core ^0.3.38. +6 tests; 182 pass. Also fixes two latent svaf-heuristic cold-start bugs (crash on fresh-memory receive; temporal-drift bypass).

v0.7.9 — ingestion flag on surfaced CMBs

Surfaced CMBs now declare whether the receiver ingested the CMB (remixed into memory with lineage → remixed: true) or only delivered it (surfaced but not stored → remixed: false, the directed-but-SVAF-rejected case), alongside the SVAF decision. Consumers check remixed to tell a recallable directed request from a transient one (MMP §9.2.2). Four committed test cases in tests/inbound-cmb-surfacing.test.js; 176 tests pass.

v0.7.8 — directed (peer-bound) CMB delivery

Directed CMBs (sym_send to=X) now surface to the receiving agent unconditionally, regardless of the SVAF verdict (MMP §4.4.4 / §9.2.2). The send path marks the wire frame with to + directed; the receiver surfaces a directed CMB exactly once (admit path on SVAF accept, dedicated delivery path on reject/redundant). SVAF governs memory admission only for directed CMBs, never delivery. Group-bound broadcasts (sym_observe) stay fully SVAF-gated — unchanged. Fixes the mesh receive-blindness where a directed coordination CMB scored low by SVAF was silently dropped.

Changelog

Sourced from @​sym-bot/sym's changelog.

0.7.18 — 2026-06-28

Fixed

• Inbox pull path preserves the opaque payload. A CMB's payload is a sibling of cmb.fields, but _pushInbox copied only fields — so any CMB pulled via node.inbox() (the sym_receive / sym_fetch path) silently lost its payload, while the channel-push path (reading entry.cmb.payload) kept it. Structured agent-to-agent data now survives cross-device directed delivery on both paths. Regression-tested in tests/inbox.test.js.

0.7.17 — 2026-06-27

Notes

• Reconciliation release: 0.7.16 (store rename + migration + role/EIP renames) was published off a stale main; 0.7.17 is the same content rebased onto origin, now also including #31 (lib-level resolveAvailableName) and #33 (ws 8.21.0). No new changes beyond the merge.

0.7.16 — 2026-06-27

Changed

• Per-node CMB store dir renamed meshmem/ → cmbs/ (it stores CMBs). A fresh node self-migrates its own dir on construct; migrateStores() (exported) bulk-renames every NON-live node at sym/mesh-channel install (live nodes are skipped — they self-migrate on restart). Readers read cmbs/ only — clean break, no fallback. Very old memories/ stores still migrate via the field-mapped path.

0.7.15 — 2026-06-27

Changed

• CLI sym observe → sym publish (+ the bundled sym skill), matching the MCP tool rename to canonical EIP verbs. Publishing emits a projection of the agent's state; the cognitive mechanism terms stay in the spec. Clean break — no alias.

0.7.14 — 2026-06-27

Changed

• Lifecycle role observer renamed to participant (MMP normalization). Frees the "observ-" stem for the projection/observation distinction (an emitted CMB is a projection; an admitted one a peer's observation). participant → validator → anchor; handshake lifecycleRole default is now participant. Clean break — no backward-compat alias.

0.7.13 — 2026-06-27

Fixed

• Loopback registry self-cleans on abrupt exit. A node writes ~/.sym/loopback/<nodeId>.json on start and stop() unlinks it on graceful teardown — but a process that exits or is killed without calling stop() (test runs that just finish, Ctrl-C) left the registration behind as a stale "group" until a pid-liveness check filtered it out. Now a one-shot sync unlink is registered on process.on('exit') so the common case self-cleans; the listener is removed again in stop(). (SIGKILL still can't be caught — that residue is what the pid-liveness check in readers is for.)

0.7.12 — 2026-06-25

Added

• IPC remember carries lineage parents. The daemon IPC remember now forwards opts.parents (each { key }) through to node.remember, so a CMB emitted via the IPC client (e.g. mesh-edge's emitCMB) can declare its source as a remix edge (MMP §14)

... (truncated)

Commits

• 72a8f8b release: 0.7.18 — inbox payload fix
• f62168f fix(node): preserve opaque payload on the inbox pull path
• 947a2e8 docs(skill): update /sym description to projection/observation + center-free
• fcaf704 test: isolate $HOME so the suite never writes into real ~/.sym/nodes
• b181d83 chore(release): 0.7.17 — reconcile 0.7.16 with origin (#31, #33)
• 5eebf06 refactor(store): rename per-node store meshmem/ → cmbs/ + install migration (...
• ee8dc1a feat(cli): rename sym observe → sym publish (EIP verb) (0.7.15)
• 8fd896b refactor(role): lifecycle role observer→participant (MMP normalization, 0.7.14)
• 1030de6 fix(discovery): self-clean loopback endpoint on abrupt exit (0.7.13)
• 7ef680a chore(deps): bump ws from 8.20.1 to 8.21.0 (#33)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.