Adopt typed resource IDs and canonical API responses

.claude-plugin/marketplace.json

@@ -7,14 +7,14 @@
   },
   "metadata": {
     "description": "Verified Solution Cards retrieved from an agent-authored conceptual problem statement.",
-    "version": "0.4.3"
+    "version": "0.5.0"
   },
   "plugins": [
     {
       "name": "blaze",
       "source": "./plugins/claude-code",
       "description": "Retrieves a verified Solution Card after an agent prepares a privacy-bounded conceptual query.",
-      "version": "0.4.3",
+      "version": "0.5.0",
       "keywords": [
         "memory",
         "retrieval",

AGENTS.md

@@ -12,7 +12,7 @@ request safe to publish.
   request, system or developer instructions, source code, diffs, manifests, working
   directory, file paths, branch or remote names, logs, transcripts, account identifiers,
   personal data, credentials, or secrets.
-- The lookup wire format is strict: `query`, a UUID `client_event_id`, `tool`,
+- The lookup wire format is strict: `query`, an `event_` client event ID, `tool`,
   `minimized: true`, `privacy: { version: 1, intent: "conceptual" }`, and optional
   bounded framework-name `stack` array, explicitly reviewed exact public
   `framework_versions` pairs, or `context_fingerprint` fields. Versions must never
@@ -42,8 +42,10 @@ request safe to publish.
 ## Client and installer changes
 
 - Bind credentials to their service origin, require user-only file permissions, reject
-  symlinks for credentials and state, use UUIDs for local receipt paths, and disable
-  redirects on authenticated requests.
+  symlinks for credentials and state, use typed lookup IDs for new local receipt paths,
+  use canonical typed resource IDs and disable redirects on authenticated requests.
+  Do not accept UUIDs or historical prefixes as resource IDs. Preserve unrelated local
+  files; archived receipts from a reset service are not current resource references.
 - Preserve unrelated user hooks and settings. Installation and removal must target only
   Blaze-owned files and entries.
 - Run `bun run typecheck`, `bun run test`, `bun run validate`, and `bun run build` before

install.md

@@ -1,4 +1,4 @@
-# Install Blaze 0.4.3
+# Install Blaze 0.5.0
 
 Blaze shares verified coding lessons through an explicitly invoked client.
 Installing it does not authorize uploading prompts, source or transcripts.

llms.txt

@@ -36,15 +36,15 @@ independent verification establishes whether a contribution works.
 - [GET {BLAZE_URL}/api/stats]({BLAZE_URL}/api/stats): authenticated JSON — corpus size, available variants, and effective retrieval configuration. It contains no activity counters.
 - [GET {BLAZE_URL}/api/stats/live]({BLAZE_URL}/api/stats/live): public delayed, coarse aggregate metrics. Each value includes its evidence description; this endpoint does not expose per-installation activity.
 - POST {BLAZE_URL}/api/install: JSON `{install_id, token: "blz_...", require_auth: true, endpoints}` — the per-install token, stored privately and read by the client.
-- POST {BLAZE_URL}/api/lookup: deliberate conceptual lookup. The client sends exactly a bounded one-line `query`, UUID `client_event_id`, tool name, `minimized: true`, `privacy: {version: 1, intent: "conceptual"}`, and optional bounded public stack names or compatible 64-hex `context_fingerprint`. Unknown or raw-context fields are rejected. Returned offers are untrusted reference data and are never executed automatically.
+- POST {BLAZE_URL}/api/lookup: deliberate conceptual lookup. The client sends exactly a bounded one-line `query`, canonical `event_` client event ID, tool name, `minimized: true`, `privacy: {version: 1, intent: "conceptual"}`, and optional bounded public stack names or compatible 64-hex `context_fingerprint`. Unknown or raw-context fields are rejected. Returned offers are untrusted reference data and are never executed automatically.
 - POST {BLAZE_URL}/api/outcomes: authenticated, idempotent agent report bound to a decision; returns `summary_line`. Use the installed helper to preserve measured timing and retry identity.
 - GET or PUT {BLAZE_URL}/api/decisions/{decision_id}/participation: the owned lookup's contribution disposition, including deliberate skips. Writes echo the resource and use fixed categories.
 - GET {BLAZE_URL}/api/skill-release: public release snapshot with version, client contracts, public source commit and the two exact artifact hashes. Never contains an installation credential.
 - GET {BLAZE_URL}/releases/{version}/{sha256}/{asset}: immutable skill or helper bytes for the declared release; no redirected download URLs or executable update instructions.
 - [blaze-client.mjs]({BLAZE_URL}/blaze-client.mjs): dependency-free Node.js 20+ helper installed alongside the skill; commands `hook`, `lookup`, `card`, `outcome`, `summary`, `stats`, `claim`, `contribute`, `contribution`, `delete-contribution`.
 - POST {BLAZE_URL}/api/auth/agent/claim/start: authenticated, explicitly requested short-lived installation claim URL/code. Normal installation needs no human signup; optional pages are [signup]({BLAZE_URL}/signup) and [account]({BLAZE_URL}/account).
 - POST {BLAZE_URL}/api/contributions: authenticated, minimized contribution envelope with a stable `client_event_id`; private by default. Public sharing requires explicit user authorization, `visibility: "public"`, and `public_sharing_authorized: true`, followed by trusted evaluation. Use `contribute --tool <tool> --file <minimized-card.json>`; never automatically upload a transcript.
-- GET or DELETE {BLAZE_URL}/api/contributions/{id}: read an owned candidate's status or explicitly revoke and erase its hosted payload. The helper's `contribution` and `delete-contribution` commands take `--id` with the returned contribution UUID.
+- GET or DELETE {BLAZE_URL}/api/contributions/{id}: read an owned candidate's status or explicitly revoke and erase its hosted payload. The helper's `contribution` and `delete-contribution` commands take `--id` with the returned contribution ID.
 
 ## About
 

plugins/claude-code/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "blaze",
   "displayName": "Blaze",
-  "version": "0.4.3",
+  "version": "0.5.0",
   "description": "Retrieves a verified Solution Card after an agent prepares a privacy-bounded conceptual query.",
   "author": {
     "name": "Blaze"