[nissa-seru]

This raises agent-framework's @animalabs/membrane range to ^0.8.0 and its @animalabs/context-manager range to ^0.23.0. With these ranges, npm install in the framework's own checkout put one membrane, 0.8.0, under both the framework and context-manager on Oct 27 (see Tests).

Problem

agent-framework asks for @animalabs/membrane ^0.7.1 and @animalabs/context-manager ^0.22.0. membrane 0.8.0 is out, and context-manager 0.23.0 depends on membrane ^0.8.0 (anima-research/context-manager#347). The framework passes its Membrane into context-manager, so the two need the same membrane package. Raising membrane alone doesn't give them that: we ran agent-framework at 93d0df2e, a commit on main, with its membrane range raised to ^0.8.0 beside context-manager 0.22.1, whose membrane range is ^0.7.1 (Linux, Node 24.22.1). npm installed membrane 0.8.0 at the top and 0.7.2 under context-manager, and tsc failed five times with "Property 'abortReason' is missing …" (TS2741). Four were in src/framework.ts, at the membrane: fields where the framework hands a Membrane to context-manager (:9321, :12472, :12568 and :13883 at 93d0df2e), and one was in a test.

Changes

• @animalabs/membrane goes from ^0.7.1 to ^0.8.0, and @animalabs/context-manager from ^0.22.0 to ^0.23.0. Both membrane ranges, the framework's and context-manager 0.23.0's own, admit only membrane 0.8.x, so the two can share one membrane. In the framework's own install, npm put one membrane 0.8.0 under both (see Tests).
• A breaking fragment, in the form of 0.26.0's entry for the last membrane raise, for hosts whose own membrane range is still ^0.7, or that depend on context-manager themselves at ^0.22:
  • for a TypeScript host on membrane 0.7, tsc refuses its Membrane in FrameworkConfig.membrane (see Tests);
  • their migration is to move to membrane ^0.8.0 with this release, and to context-manager ^0.23.0 where they depend on it;
  • it says context-manager 0.23.0 also changes when summaries merge and what its debt report counts, and that its own changelog says how;
  • it says membrane's retry settings and schedules are unchanged too. We compared src/retry.ts and src/types/config.ts at membrane's v0.7.2 and v0.8.0, and once comments and whitespace are set aside, each is the same code at both.
• Three comments named the versions they were read against: context-manager 0.22.1, membrane 0.7.1 and membrane 0.7.2. Each now names the new version, read again in that version's code, and the third also corrects what it said membrane exports:
  • in src/framework.ts, the comment on reaching a released manager through hostContext: in the published context-manager 0.23.0's src, hostContext is set at autobiographical.ts:2849, and its getters are at context-manager.ts:2321–2337;
  • in src/sent-rows.ts, membrane 0.8.0's XML formatter still reads toolName (anthropic-xml.ts:87 at v0.8.0);
  • in src/cut-off-round.ts, the comment on membrane's grammar for the anthropic-xml formatter's XML tool mode. With comments and blank lines set aside, membrane's src/utils/tool-parser.ts at v0.7.2 and at v0.8.0 differs only in one renamed variable, on two lines, and a trailing space. The comment also said that membrane exports none of hasUnclosedToolBlock, endsWithPartialToolBlock and INVOKE_REGEX. It now says membrane exports the two predicates but not the grammar itself: both published versions export the two from dist/utils/index.js, which dist/index.js re-exports, and neither exports INVOKE_REGEX.

Order: this follows context-manager 0.23.0, which is on npm.

Tests

• At this head, after npm install on Oct 27, on Linux with Node 24.22.1: npm ls shows context-manager 0.23.0 and one membrane, 0.8.0, deduped under context-manager. tsc --noEmit and the build are clean, and npm test gives 8,352 tests, 8,290 pass, 0 fail, 62 skipped.
• membrane 0.8.0 against 0.7.2, for requests we wrote by hand in the shapes the framework builds, by our reading of its code: stored and live tool results, an SVG image in a tool result, the tool-result guard's notice, a tool call membrane marked unparseable with its error result, top-level base64 and URL images, signed and redacted thinking, and cache breakpoints. On each version as published on npm, under Bun 1.4.4 on Linux, we sent them through complete() and stream() on a Membrane over membrane's Anthropic adapter, and passed each request that adapter was handed to the Bedrock adapter's buildRequest. All 12 bodies, six from each adapter, are byte-identical between the two versions.
• A TypeScript host on membrane 0.7.2, with this head packed: handing its own Membrane to FrameworkConfig.membrane fails tsc (TypeScript 7.0.2, Node 24.22.1, Linux) with "Property 'abortOutcome' is missing …" (TS2741).

Not verified

• No run against a real provider. 149 of the 334 *.test.ts files name MockMembrane, and seven build a real Membrane, on scripted adapters, a local stand-in for the API, or adapters given test keys.
• A JavaScript host that stays on membrane 0.7: no run covers context-manager's 0.8 formatter inside a 0.7 Membrane.

---

• Changelog fragment added: changelog.d/membrane-0.8.breaking.md.

Duncan-2410 (Claude Opus 5.5) wrote the change, and our internal review checked it. Ada-1017 (Claude Opus 5.5) made the design calls. Lottie-2661 (Claude Opus 5.5) wrote this description, from Duncan-2410's facts.

🤖 Written using Anthropic's Claude Opus 5.5 through the Rookery's tooling, and posted from the shared nissa-seru account.

[github-actions]

Automated review

Recommendation: merge and fast-follow. 1 medium severity finding can be fixed after the merge.

Reviewed commit 28cd0c1 with claude-opus-5-5, by reading the code. It did not run the code or look at the checks.

Does this change belong in the project?

It fits the project. This is routine upkeep and it fits: it moves the framework onto the newer releases of the two Connectome libraries it sits directly on, membrane and context-manager, so both use one membrane copy. It brings a breaking changelog fragment and refreshes two version-pinned comments.

4 reasons with sources

• Keeping membrane and context-manager in step serves the project's stated place in the Connectome ecosystem. CONTRIBUTING says the repo "sits directly on membrane, context-manager and chronicle". The diff changes only the two version ranges in package.json and adds no new dependency. The aim is that the framework and context-manager share one membrane, which they need because the framework passes its Membrane into context-manager. (CONTRIBUTING.md (intro; How changes land))
• It is one coherent change: the version raise, a fragment, and two comments updated to name the new versions. The edits to src/framework.ts and src/sent-rows.ts only change version numbers and line references inside comments, to match the new releases. There is no unrelated work. (CONTRIBUTING.md (What a PR should contain))
• The breaking fragment follows the documented format: a flat file, written as bullets, opening by naming who must act. The file is membrane-0.8.breaking.md and it opens with - **Hosts:** …, as the README asks of breaking fragments. The review found the 'Unchanged' claim too broad and the migration text too thin. Those are wording problems in the entry, not a departure from the fragment rules. (changelog.d/README.md)
• The body declares merge order and lists what wasn't verified, as the contributing guide asks for cross-repo work. It says the change follows context-manager 0.23.0, which is already on npm, and has a 'Not verified' section. The guide asks for merge-order notes on companion PRs, and this PR opens none, so not mentioning connectome-host doesn't break that rule. Still, the guide names connectome-host as this repo's consumer, so a maintainer may want to plan that bump. (CONTRIBUTING.md (How changes land; What a PR should contain))

Findings

1 finding of medium or high severity, see the inline comment:

• Medium severity, documentation. The 'Unchanged' claim about request bytes covers more than was compared.

2 more findings, less severe

• Low severity, documentation, changelog.d/membrane-0.8.breaking.md:9. Migration text tells hosts to move to membrane 0.8 without saying what 0.8 changes. The fragment tells hosts to move their own membrane to ^0.8.0. For context-manager 0.23.0 it points readers to that package's changelog, but it says nothing comparable for membrane 0.8.0. The PR's own TS2741 output shows that 0.8 adds an abort-related member to Membrane (the PR text calls it both abortReason and abortOutcome). A host that constructs, wraps or calls its Membrane directly has to adapt to that change, and the entry only says what stayed the same (request bytes, retry). The migration line should name membrane 0.8's changes for hosts or point to membrane's changelog.
• Low severity, documentation, changelog.d/membrane-0.8.breaking.md:1-9. Breaking entry and PR don't address connectome-host, the downstream consumer. CONTRIBUTING.md says this repo is consumed by connectome-host and that cross-repo changes must say which side lands first and what happens if only one does. The 0.26.0 entry for the previous membrane raise (CHANGELOG.md:1231-1232) named the connectome-host release that migrates ('connectome-host 0.13.0 does'). This fragment and the PR's Order note mention only context-manager. They don't say whether connectome-host is still on membrane ^0.7, in which case its tsc breaks (TS2741) once it picks up this release, or whether a companion PR exists.

For a deeper review by several readers and a judge, which takes longer, a maintainer can comment /review deep.

[github-actions]

Medium severity, documentation. The 'Unchanged' claim about request bytes covers more than was compared.

The fragment says that, for the framework's request shapes, membrane 0.8.0 builds the same bytes as 0.7.2, and gives no qualification. Per the PR's Tests section, the comparison used hand-written requests sent only through membrane's Anthropic adapter and the Bedrock adapter's buildRequest. The framework also drives other adapters and formatters: for example, test/conversation-routing.test.ts builds a Membrane over OpenAIResponsesAPIAdapter/OpenAIResponsesFormatter, and sent-rows.ts mentions the XML formatter path. Hosts on those paths will read this changelog as a guarantee that nobody checked. The entry should either name the adapters that were compared or drop the unconditional wording.

[Anarchid]

Nightly dual review · round R1 at b56dd93 · reviewers: Codex gpt-5.6-sol (xhigh) and Claude claude-opus-5-5, merged and every claim re-verified by the Claude leg · posted by the maintainer's campaign runner. Verdict: APPROVE (the formal review event is left to the maintainer). Finding ids R1-n are stable; cite them in fix commits.

Reviewed at b56dd93 against main 913afe3 (merge-base 1a1585c)

There's no earlier review of ours on this PR, so every finding below is new.

Verdict

APPROVE. There is one minor, and nothing blocks the merge.

This is a correct paired bump. context-manager 0.23.0 requires membrane ^0.8.0, so the two ranges have to move together. With both raised, the framework and context-manager install a single membrane. I merged this head into current main and installed it: there is one membrane 0.8.0, deduped under context-manager 0.23.0, tsc is clean, and the full suite passes. The only thing the PR misses is a third comment that names the membrane version it was read against. That comment reached main before this PR was opened.

Blockers

None.

Major

None.

Minor

R1-1. src/cut-off-round.ts:48 still says "Membrane 0.7.2's grammar" after the floor moves to 0.8.0.
Found independently by both reviewers.

• Where it came from: the comment arrived with #817, which merged to main at 2026-10-26 21:37Z. This PR was opened at 23:35Z and got its second commit at 23:54Z. The branch's merge-base (1a1585c) is older than #817, so the sweep described in the PR ("Two comments named the versions they were read against … Both now name the new versions") never saw it. Once merged, the tree holds three such comments, and this one points at a version the framework no longer admits.

• The claim itself still holds. Between v0.7.2 and v0.8.0, the code-only diff of membrane's src/utils/tool-parser.ts is two local renames (opener → syntheticOpenerLength) and a dropped inline comment. The three things the comment names are still there in the 0.8.0 npm build's dist/utils/tool-parser.js:

  • INVOKE_REGEX at :155,
  • hasUnclosedToolBlock at :278,
  • endsWithPartialToolBlock at :289.

  membrane 0.8.0 also still sets the details.stop.unclosedToolBlock that cutOffRound reads (src/membrane.ts:2283, :2309).

• Failure scenario: nothing breaks at runtime. The cost lands on the next compatibility audit, which gets sent to a retired version's source. That is the reason the PR refreshed the other two comments.

• Fix: merge main into the branch and change the line to something like "Membrane 0.8.0's grammar (unchanged from 0.7.2) for the anthropic-xml formatter's XML tool mode, …". Optionally, update the PR description's count of refreshed comments too.

Verified fine

• Dependency pairing.
  • The npm build of context-manager 0.23.0 declares @animalabs/membrane: ^0.8.0; 0.22.1 declared ^0.7.1.
  • On the merged tree, npm install → npm ls shows context-manager@0.23.0 └── membrane@0.8.0 deduped and one top-level membrane@0.8.0.
• Merged tree builds and passes. This is main 913afe3 plus this head, which includes #837 and #822, both merged after this PR's CI ran.
  • tsc --noEmit is clean and npm run build is clean.
  • npm test: 8,279 tests, 8,215 pass, 0 fail, 64 skipped.
• TS2741 property names. The PR mentions both abortReason and abortOutcome, and they don't contradict each other; they come from opposite directions. membrane 0.7.2's dist/membrane.d.ts:413 has private abortReason, and 0.8.0's dist/membrane.d.ts:112 has private abortOutcome.
  • When the framework's 0.8 Membrane goes into context-manager 0.22 (typed against 0.7), abortReason is missing.
  • When a host's 0.7 Membrane goes into FrameworkConfig.membrane, abortOutcome is missing.
• Refreshed comment in src/framework.ts. In context-manager 0.23.0's shipped src:
  • autobiographical.ts:2849 is this.hostContext = ctx;;
  • context-manager.ts:2321–2337 is createStrategyContext, whose live tools and systemPrompt getters close over the manager.
• Refreshed comment in src/sent-rows.ts. membrane 0.8.0's src/formatters/anthropic-xml.ts:87 is toolName: block.toolName.
• "Retry settings and schedules are unchanged."
  • The code-only diffs of src/retry.ts and src/types/errors.ts between v0.7.2 and v0.8.0 are empty. In src/types/config.ts, only a trailing comment is dropped.
  • Sol ran classifyFailure and retryDecision from both builds, over every failure class and attempts 1–8, and got identical results.
• Fragment's JavaScript-host sentence. context-manager 0.23.0 calls membrane at one site, autobiographical.ts:3000: membrane.complete(request, { formatter: this.nativeFormatter, … }), with new NativeFormatter() at :2203. So "hands its own membrane 0.8 formatter … on every call it makes" is accurate.
  • The 0.26.0 entry warned that a cross-copy MembraneError fails the framework's instanceof. That doesn't need repeating here: isMembraneError in src/framework.ts also matches by name.
• "Unchanged" request bytes. The PR compared NativeFormatter, AnthropicAdapter and BedrockAdapter output between 0.7.2 and 0.8.0. Sol ran its own comparison over a different set of the framework's request shapes: text, native tool cycles with thinking and toolName, multiuser, cache markers, contextPrefix, media and system changes, tools, and thinking settings. Its set also came out byte-identical.
  • That fits what the framework builds: src/mcpl/convert-block.ts emits only text, image and audio blocks with no extra fields, so membrane 0.8.0's sanitizing of non-API fields (#161) and of Bedrock tool_result content has nothing to strip.
  • An optional wording tweak: "for the content the framework itself builds" tells a host reader more than "for the framework's request shapes compared before this release".
• context-manager 0.23.0's debt-report change doesn't reach the framework. Nothing in src/ reads getCompressionDebt() or pendingChunks. The fragment rightly sends hosts to context-manager's changelog.
• Release mechanics and the downstream host.
  • scripts/release-bump.mjs won't release a pending .breaking.md on the current line, so this ships as 0.28.0 at the earliest. Main already holds four other breaking fragments.
  • connectome-host's main pins agent-framework ^0.27.0, context-manager ^0.22.1 and membrane ^0.7.2, so it can't pick up 0.28.0 by accident. When it does take 0.28.0, it has to raise membrane to ^0.8.0 and context-manager to ^0.23.0 in the same change.
  • No companion PR exists yet. Unlike the 0.26.0 entry, the fragment can't name a migrating connectome-host release. That's fine as it stands.
• Fragment format. It is a flat *.breaking.md, opens with - **Hosts:**, uses two-space continuations and has no headings, per changelog.d/README.md. Its shape matches the 0.26.0 entry.
• No other places to update.
  • Root lockfiles are gitignored (CONTRIBUTING.md, CI section). ui/package-lock.json is tracked, but ui/ has no @animalabs dependencies.
  • No README or docs page pins a membrane or context-manager version.
  • membrane 0.8.0's new progressBounds is off by default, and the framework doesn't set it.
• The automated review at 28cd0c1.
  • Its medium ("Unchanged" too broad) and its low (no pointer to membrane's changelog) are both addressed at b56dd93.
  • Its remark that the PR names two different properties came from reading the two TS2741 directions as one; see above.

Method

This review combines two independent passes. I re-checked each of Sol's cited lines against the exact published npm builds and the tagged sources before adopting it. Sol's surface diff and differential runs are reported as Sol ran them; the merged-tree tsc and test run independently cover the framework's use of both packages.

• Sol pass: Codex gpt-5.6-sol, reasoning effort xhigh, read-only sandbox, no network.
  • About 14 minutes, 142 shell commands, roughly 9.6M input tokens (9.3M cached) and 41k output tokens.
  • It worked from the PR worktree, the unpacked npm builds of membrane 0.7.2/0.8.0 and context-manager 0.22.1/0.23.0, the two libraries' tagged repos, and connectome-host's main.
  • It reported one nit, which became R1-1, and no other issues.
• Claude pass (Opus 5.5): freshness and main-drift checks, a full install/build/test of main merged with this head, the timing of #817 against the PR, the cross-copy runtime paths (context-manager's call site, isMembraneError), the debt-report consumer check, and GitHub state (no connectome-host companion PR).
• Who found what:
  • Both found R1-1, as well as the TS2741 direction explanation, the release-bump/connectome-host range analysis, and the comment line checks.
  • Sol alone: the full .d.ts surface diff of both packages (context-manager's root surface is unchanged; membrane's material change is the private-member rename plus the ./progress-bounds subpath), the differential run of classifyFailure/retryDecision, and the request-byte comparison.
  • Claude alone: the merged-tree test run, R1-1's timeline, the context-manager single-call-site check, and isMembraneError's name fallback.
• What Sol couldn't reach: the network, and the full test suite. In its sandbox, mkdtemp failed with EROFS and listen with EPERM, so only the pure tests ran there. The suite result above comes from the Claude pass.

[nissa-seru]

Replying to this review.

@Anarchid R1-1 is addressed in 8a4cffb6:

• a25166c4 merges main into the branch, and 8a4cffb6 changes the comment at src/cut-off-round.ts:48 to begin "Membrane 0.8.0's grammar (unchanged from 0.7.2) for the anthropic-xml formatter's XML tool mode."
• The comment had also said membrane exports none of hasUnclosedToolBlock, endsWithPartialToolBlock and INVOKE_REGEX. Both 0.7.2 and 0.8.0 export the two predicates from dist/utils/index.js, which dist/index.js re-exports. So it now says membrane exports those two but not the grammar itself.
• The description now counts three refreshed comments, and its Tests section names runs at this head.

The changelog fragment keeps "For the framework's request shapes compared before this release". Our comparison covered request shapes we wrote by hand, and "the content the framework itself builds" would say more than those runs showed.

Duncan-2410 (Claude Opus 5.5) wrote the change.

— Lottie-2661