# OpenClerk v0.2.13

This patch release promotes runner-owned inspection for supplied public source URLs, expands web source ingestion to public Markdown and GitHub README/blob content, and keeps URL intake approval at durable writes instead of public fetches.

## Changed

- Added read-only `ingest_source_url` inspect mode for supplied public PDF, HTML, Markdown, and GitHub URLs, returning source metadata, bounded text previews, duplicate placement status, discovered related source candidates, and exact approval-ready follow-up `ingest_source_url` requests without creating or updating source notes.
- Extended `ingest_source_url` web ingestion to public Markdown sources and GitHub README/blob URLs, normalizing GitHub repository and blob URLs to public raw content while keeping canonical source notes under the existing `source_type: "web"` contract.
- Added alias-aware duplicate/update lookup for normalized public source URLs so GitHub-facing URLs and their raw-content equivalents resolve to the same source record instead of creating duplicate source notes.
- Updated `openclerk capabilities`, `openclerk document --help`, `README.md`, and `skills/openclerk/SKILL.md` to advertise inspect/plan/create/update URL intake boundaries and to clarify that supplied public URL fetch/inspection is permitted through the runner while durable writes still require approval.
- Recorded the public URL inspect decision with separate safety, capability, and UX quality passes in `docs/architecture/knowledge-configuration-v1-adr.md`.
- Refreshed dependency pins through Dependabot maintenance without changing the OpenClerk runner contract.
- Preserved `ingest_source_url` update mode behavior from the v0.2 line: missing `source.mode` defaults to `create`, duplicate creates reject, `source.mode: "update"` re-ingests an existing `source.url`, and mismatched `path_hint` or `asset_path_hint` values conflict without writing extra docs or assets.
- Preserved same-SHA source URL update behavior: same-SHA updates are no-ops without `source_updated` provenance or projection invalidation churn.
- Preserved changed-PDF source URL update behavior: changed-PDF updates preserve source and asset paths, refresh searchable extracted text and citations, emit previous/new SHA provenance, and expose stale dependent synthesis through `projection_states`.

## Verification

- Local release-doc validation passed for `v0.2.13`.
- Local Agent Skill validation passed for `skills/openclerk/SKILL.md`.
- Local module skill validation passed for `modules/ollama-embeddings/skill/ollama-embeddings/SKILL.md`, `modules/gemini-embeddings/skill/gemini-embeddings/SKILL.md`, and `modules/tesseract-ocr/skill/tesseract-ocr/SKILL.md`.
- Local committed-artifact validation passed with repo-relative artifact paths and neutral raw-log placeholders.
- Local formatting, linting, and unit-test gates passed with the repository-pinned toolchain.
- The current production OpenClerk AgentOps gate is committed at `docs/evals/results/ockp-agentops-production.md`.
- Expanded repo-docs dogfood evidence is committed at `docs/evals/results/ockp-repo-docs-dogfood.md`, covering installed-runner retrieval, synthesis maintenance, decision-record explainability, release-readiness answers, read-side tag filtering, memory-router recall reports, and release synthesis freshness over this repository's committed public markdown docs.
- Targeted workflow-action evidence is committed at `docs/evals/results/ockp-compile-synthesis-workflow-action.md`, `docs/evals/results/ockp-source-audit-workflow-action.md`, and `docs/evals/results/ockp-evidence-bundle-workflow-action.md`; source-audit and evidence-bundle natural rows pass safety, capability, and `workflow_action_acceptable` UX, while compile-synthesis passes safety/capability but remains `taste_debt` tracked by follow-up Work item `oc-olo9`.
- Targeted source URL update evidence remains committed at `docs/evals/results/ockp-source-url-update-mode.md`, covering duplicate create rejection, same-SHA no-op behavior, changed-PDF stale synthesis visibility, and path-hint conflict no-write behavior for the shipped runner and skill.
- Live install, upgrade, and module-command smoke evidence is committed at `docs/evals/results/ockp-live-install-upgrade-module-smoke.md`.
- Optional Promptfoo smoke validation and eval passed against a current-checkout runner binary as non-authoritative interoperability checks; OCKP remains the release authority.
- Optional local release bundle construction passed for `v0.2.13`, including platform archives, skill archive, source archive, SBOM, checksums, and installer generation.
