jlitola · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -6,12 +6,12 @@
   },
   "metadata": {
     "description": "The code context layer for AI coding agents",
-    "version": "0.32.0"
+    "version": "0.33.0"
   },
   "plugins": [
     {
       "name": "githits",
-      "version": "0.32.0",
+      "version": "0.33.0",
       "description": "The code context layer for AI coding agents",
       "author": {
         "name": "GitHits"

diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "The code context layer for AI coding agents",
   "author": {
     "name": "GitHits",

diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "The code context layer for AI coding agents",
   "author": {
     "name": "GitHits"

diff --git a/.cursor-plugin/plugin.json b/.cursor-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "The code context layer for AI coding agents",
   "author": {
     "name": "GitHits"

diff --git a/.plugin/plugin.json b/.plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "The code context layer for AI coding agents",
   "author": {
     "name": "GitHits"

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,39 @@ changes use independent files under [`changes/`](changes/README.md) and are
 consolidated here only during release preparation. Dated, versioned sections
 are historical records and change only to correct blatant factual errors.
 
+## [githits 0.33.0] - 2026-10-20
+
+Pre-1.0 minor release that adds Launchpad Git targets, package registry
+repository provenance and clearer grep coverage and recovery. Existing
+commands and configuration keep working.
+
+### Added
+
+- **Registry repository provenance** - Package info adds the metadata-supplying registry repository name and URL under `Package registry`, after `Repository`; info, dependency and vulnerability JSON retain `registryRepository: {id,name,url}` when proven. The `packageInfo.selectedVersion.registryRepository` schema must be deployed to production before release or hosted adoption. Unknown evidence is omitted; existing inspection arguments and latest-only behavior are unchanged.
+
+- **Launchpad Git targets and shortcuts** - Search, read, list, grep and diff accept complete owner-qualified Launchpad Git paths and mutable project, distribution-source and owner-scoped defaults through `launchpad:`, case-insensitive `lp:` and supported HTTPS URLs. The backend resolves shortcut owners; follow-up actions retain canonical repository identities and refs. The CLI code skill and reference include the released addressing and replay rules. Bazaar is unsupported. Unequal raw diffs currently return nonretryable `RAW_DIFF_UNAVAILABLE`; equal-commit comparisons return an empty inventory.
+
+### Fixed
+
+- **Accurate grep coverage and recovery** - Text distinguishes complete empty searches from preparation, unavailable content and partial coverage. Retry guidance names eligible original targets and exact cursor/preparation controls, retains source-specific failure reasons and says whether unchanged retries are supported. Missing failure details and unknown retryability remain explicit.
+
+## [@githits/mcp 0.33.0] - 2026-10-20
+
+Pre-1.0 minor release that adds Launchpad Git targets, package registry
+repository provenance and clearer grep coverage and recovery. Existing hosts
+and service implementations keep working unchanged. Hosted MCP clients receive these changes after adoption and
+deployment of the released MCP package.
+
+### Added
+
+- **Registry repository provenance** - Package info adds the metadata-supplying registry repository name and URL under `Package registry`, after `Repository`; info, dependency and vulnerability JSON retain `registryRepository: {id,name,url}` when proven. The `packageInfo.selectedVersion.registryRepository` schema must be deployed to production before release or hosted adoption. Unknown evidence is omitted; existing inspection arguments and latest-only behavior are unchanged.
+
+- **Launchpad Git targets and shortcuts** - Search, read, list, grep, resolve and diff admission accept complete owner-qualified Launchpad Git paths and mutable project, distribution-source and owner-scoped defaults through `launchpad:`, case-insensitive `lp:` and supported HTTPS URLs. The backend resolves shortcut owners; follow-up actions retain canonical repository identities and refs. `quick_start` includes the addressing guidance. Bazaar is unsupported. Unequal raw diffs currently return nonretryable `RAW_DIFF_UNAVAILABLE`; equal-commit comparisons return an empty inventory.
+
+### Fixed
+
+- **Accurate grep coverage and recovery** - Text distinguishes complete empty searches from preparation, unavailable content and partial coverage. Retry guidance names eligible original targets and exact cursor/preparation controls, retains source-specific failure reasons and says whether unchanged retries are supported. Missing failure details and unknown retryability remain explicit.
+
 ## [githits 0.32.0] - 2026-10-19
 
 Pre-1.0 minor release that accepts `cargo:` as a crates.io registry alias and

diff --git a/bun.lock b/bun.lock
diff --git a/changes/grep-coverage-copy.fixed.md b/changes/grep-coverage-copy.fixed.md
diff --git a/changes/launchpad-shortcuts.added.md b/changes/launchpad-shortcuts.added.md
diff --git a/changes/launchpad-targets.added.md b/changes/launchpad-targets.added.md
diff --git a/changes/registry-repository-provenance.added.md b/changes/registry-repository-provenance.added.md
diff --git a/docs/backlog.md b/docs/backlog.md
@@ -68,14 +68,24 @@ Docker MEDIUM SDK resolution without a kind preference is explicitly accepted;
 repository-preferred Docker Engine remains HIGH Moby. No new ranking change or
 coverage requirement is inferred from GA promotion.
 
-## Launchpad CLI skill updates at release
+## Investigate intermittent production Launchpad shortcut timeouts
 
-When the Launchpad behavior is released or included on its release branch,
-update `skills/githits-code/SKILL.md` and `references/code-and-docs.md` with the
-three complete owner-qualified path forms, four mutable default forms,
-case-insensitive `lp:` input,
-canonical `launchpad:` replay and backend-owned raw-diff availability. The stable MCP
-guide/copy already move with implementation under their bounded parity rule.
-Acceptance: CLI examples match released addressing and raw-diff behavior,
-describe backend-owned shortcut acquisition accurately, and plugin checks pass.
-This timing follows the public Agent Skill lifecycle; no runtime work is deferred.
+During 0.33.0 release validation on 2026-10-20, the production CLI skill eval
+reported repository-provider timeouts while resolving `lp:software-properties`
+at `02bfa5ae3026843835e540bc507a517863e39c64` and
+`lp:ubuntu/+source/hello` at `c80e07d07e4ea27e0847ed731da7138b9e1df5d0`.
+Three list calls and two search calls failed. Other searches acquired canonical
+owners, and five canonical source reads succeeded; the eval completed with a
+cited answer. This is tool-use evidence, not an independently graded quality
+result.
+
+A subsequent bounded comparison through the built Node CLI passed both short
+and canonical list targets: short inputs completed in 1.5 seconds each and
+canonical inputs in 1.2 seconds each. The failure is intermittent; this check
+does not establish its root cause or recovery mechanism. The backend's provider
+resolution path owns shortcut acquisition. Inspect its provider calls and
+request deadlines using the failed eval time window (09:02:57-09:03:43 UTC)
+before changing client behavior. No CLI retry layer or caller constraint was
+introduced. Backend investigation is outside this release-preparation worktree.
+Local evidence is retained under `.agent-eval/release-0.33.0-launchpad-skills`
+and `/tmp/murex-release-launchpad-pairs.json`.
diff --git a/docs/implementation/repository-targets.md b/docs/implementation/repository-targets.md
@@ -163,13 +163,14 @@ the compact provider form. Both retain the exact commit.
 ## Packaging and release
 
 The stable MCP guide and its public skill copy stay byte-for-byte aligned.
-Launchpad CLI skill/reference updates follow the release lifecycle in
-[the backlog](../backlog.md#launchpad-cli-skill-updates-at-release).
+The 0.33.0 release includes Launchpad CLI addressing, canonical replay and
+backend-owned raw-diff guidance in `skills/githits-code/SKILL.md` and its
+`references/code-and-docs.md`, completing the release-boundary skill update.
 Generate and check plugin assets from canonical inputs; no manifest content
 change is needed when metadata is unchanged.
 
-The shortcuts fragment records pending minor impact for `githits` and
-`@githits/mcp`, superseding the qualified-only shortcut restriction. Hosted users
+Release 0.33.0 adds Launchpad Git shortcuts to `githits` and `@githits/mcp`,
+superseding the qualified-only shortcut restriction. Hosted users
 receive MCP changes after the package is released, adopted by `remote-mcp`, and
 deployed there.
 
@@ -266,6 +267,18 @@ and source lines, with reported high confidence. No isolation violation artifact
 was emitted. This is observed tool-use evidence, not an independently graded
 answer-quality score. The earlier qualified-only probe above remains historical.
 
+### Release validation (2026-10-20)
+
+The production CLI skill eval completed with 12 CLI calls and a source-cited
+answer at both requested commits, with reported high confidence. Five calls
+failed with provider-resolution timeouts before searches acquired canonical
+owners and five canonical reads succeeded. No isolation-violation artifact was
+emitted. This is observed tool use, not an independently graded quality score.
+A subsequent built Node CLI comparison passed both short and canonical list
+inputs for each repository. Intermittent resolution timeouts and the remaining
+backend investigation are recorded in
+[the backlog](../backlog.md#investigate-intermittent-production-launchpad-shortcut-timeouts).
+
 ## Review disposition (2026-09-07)
 
 One fresh Claude Opus review inspected the full delta and reported no runtime

diff --git a/gemini-extension.json b/gemini-extension.json
@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "The code context layer for AI coding agents",
   "mcpServers": {
     "githits": {

diff --git a/package.json b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "githits",
   "description": "The code context layer for AI coding agents",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "mcpName": "com.githits/githits",
   "type": "module",
   "workspaces": [

diff --git a/packages/mcp/package.json b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@githits/mcp",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "Reusable MCP server APIs and tools for GitHits",
   "type": "module",
   "files": [

diff --git a/plugin.json b/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "githits",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "The code context layer for AI coding agents",
   "author": {
     "name": "GitHits"

diff --git a/server.json b/server.json
@@ -16,7 +16,7 @@
     "source": "github",
     "id": "1165453165"
   },
-  "version": "0.32.0",
+  "version": "0.33.0",
   "remotes": [
     {
       "type": "streamable-http",
@@ -28,7 +28,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "githits",
-      "version": "0.32.0",
+      "version": "0.33.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

diff --git a/skills/githits-code/SKILL.md b/skills/githits-code/SKILL.md
@@ -66,6 +66,7 @@ githits read <docsReadTarget> --selector <heading-id>
 
 - For behavioral claims, prefer source, symbols, tests, and call sites over docs prose.
 - Package targets scope indexed source to the package subpath; omitted versions resolve to the latest release. Repository targets cover the full indexed snapshot. Pin versions/refs for source-layout questions and report the served identity.
+- Launchpad Git accepts mutable defaults (`lp:project`, `lp:distro/+source/source`, `lp:~owner/project`, `lp:~owner/distro/+source/source`) and complete owner-qualified paths (`launchpad:~owner/+git/repo`, `launchpad:~owner/project/+git/repo`, `launchpad:~owner/distro/+source/source/+git/repo`). `lp:` is case-insensitive; HTTPS URLs on `code.launchpad.net` and `git.launchpad.net` accept the same paths. The backend acquires current shortcut owners; reuse returned canonical `launchpad:` targets and refs for replay. Bazaar is unsupported. Raw-diff availability is backend-owned: unequal Launchpad diffs currently return nonretryable `RAW_DIFF_UNAVAILABLE`; equal-commit diffs return an empty inventory.
 - Source diff compares exact trees without requiring indexed navigation. Its package target resolves versions but does not filter to a package subpath. Report resolved commits, scope, and coverage limits; capped or sibling-only results do not prove a package is unchanged, and a patch does not establish compatibility.
 - For source work, locate symbols or matches first, then read a focused window with explicit `--lines`. Use `target#symbol` or `--selector <name>` when the exact indexed symbol is known; add an exact path to narrow ambiguous symbols. The backend decides whether a repository fragment identifies a code symbol or a documentation heading.
 - For docs reads, use the search snippet when sufficient; otherwise read the page target in its header. Use search `--json` when an exact selector or range is required, then replay its `followUp` with every supplied argument unchanged. From `docs list`, pass `docsReadTarget`. Hosted/crawled HTTP(S) targets address mutable current content. A direct HTTP(S) fragment read without explicit bounds returns its heading and full subtree through the next equal-or-higher heading. Use `--selector <heading-id>` for a known logical heading ID without a URL fragment. Repository docs remain snapshot-addressed and keep returned ranges. When composing a direct read, add `--lines` only to intentionally select a current page range; either bound replaces heading selection. Historical `pageId` works. Use `--json` only for required range/source metadata or an exact search follow-up.

diff --git a/skills/githits-code/references/code-and-docs.md b/skills/githits-code/references/code-and-docs.md
@@ -2,6 +2,36 @@
 
 Package target syntax requires an explicit registry: `registry:name@version`, for example `npm:express@5.2.1`; omit `@version` for the latest release. `cargo:` is accepted as an alias for `crates:`. Package targets scope to the package subpath, including within monorepos. Swift package targets use `swift:github.com/<owner>/<repo>` and Zig package targets use `zig:gh/<owner>/<repo>`. Use public repository targets for full repositories or sibling packages. Repository compact targets use `github:org/repo@ref`, `codeberg:owner/repo@ref`, `gitlab:group/subgroup/project@ref`, `github.com/org/repo@ref`, or `https://github.com/org/repo@ref`; omit `@ref` for the backend default branch. Exact standalone documentation sites use `site:<host[/path]>`. Output uses canonical `provider:path@ref` formatting so refs can contain `@` safely. `code` commands also support `--repo-url <url>` with optional `--git-ref <ref>`.
 
+## Launchpad Git
+
+Use `launchpad:` or case-insensitive `lp:` with these repository paths:
+
+| Repository | Target |
+| --- | --- |
+| Project default | `lp:project` |
+| Distribution-source default | `lp:distro/+source/source` |
+| Owner/project default | `lp:~owner/project` |
+| Owner/distribution-source default | `lp:~owner/distro/+source/source` |
+| Personal | `launchpad:~owner/+git/repo` |
+| Project | `launchpad:~owner/project/+git/repo` |
+| Distribution source | `launchpad:~owner/distro/+source/source/+git/repo` |
+
+Append `@ref` to select a branch, tag or commit. HTTPS URLs on
+`code.launchpad.net` and `git.launchpad.net` accept the same paths. Git transport
+on `git.launchpad.net` accepts complete owner-qualified paths only. Bazaar is
+unsupported. Mutable defaults resolve through the backend; the CLI does not
+look up or guess owners. Reuse returned canonical `launchpad:` identities,
+commit refs, paths and read actions unchanged.
+
+```bash
+githits list lp:beautifulsoup
+githits search func_file_conv --in lp:ubuntu/+source/hello --source code
+```
+
+Raw-diff availability belongs to the backend. Unequal Launchpad comparisons
+currently return nonretryable `RAW_DIFF_UNAVAILABLE`; equal-commit comparisons
+return an empty inventory. Do not infer compatibility from either outcome.
+
 ## Source Diff
 
 `githits code diff <unversioned-target> <from>..<to>` compares exact package

diff --git a/skills/githits-package/SKILL.md b/skills/githits-package/SKILL.md
@@ -22,6 +22,7 @@ Use GitHits package intelligence before making dependency claims from memory.
 - Most package commands use `<registry>:<name>[@<version>]`, for example `npm:lodash@4.17.20` or `pypi:requests`.
 - `cargo:` is accepted as an input alias for `crates:` (public crates.io); output and canonical identities use `crates`.
 - `pkg info` always reports the latest published version and does not accept a version pin.
+- `Package registry` identifies the artifact repository supplying validated release metadata, with a name and URL when proven. It is separate from the source Git `Repository`; missing evidence is omitted. Info, dependency and vulnerability JSON preserve `registryRepository: {id,name,url}`.
 - `pkg changelog` is package-only. Pin `@version` for one release; use `@from..to` or `--from`/`--to` for ranges. Repository and site targets are rejected.
 
 ## Core Commands