spec: untrusted-content defense, repository map, debugger tool and transcript search

ROADMAP.md

@@ -89,6 +89,12 @@ The [current inventory](docs/implementation/spec-doc-reconciliation.md) contains
 
 **Proposed binary hex editor (P1):** [`add-binary-hex-editor`](openspec/changes/add-binary-hex-editor/proposal.md) extends the current file explorer with paged hex/ASCII inspection, staged byte edits, review/undo/recovery and a bounded model-facing binary tool. Specification only; implementation awaits review and scheduling after the existing Plugins/hooks and Daily coding workstreams. It does not imply that `/files` already provides a general manual text editor.
 
+**Proposed untrusted-content defense (`untrusted-content`, `permissions-modes`, `system-context`, P1):** [`add-untrusted-content-defense`](openspec/changes/add-untrusted-content-defense/proposal.md) implements the existing `workspace-trust` provenance rule for every tool that returns third-party content. `webfetch`, `websearch`, MCP tool results and browser pages are returned in one escape-safe `<untrusted_content>` frame that replaces today's MCP-resource frame. Hidden characters become visible markers, and a deterministic detector flags instruction-like text with a notice in the TUI, `exec` and the dashboard, without dropping content. After a flagged result, risky actions (network egress, writes outside the Location, classifier-allowed commands, secret reads) ask until the next user prompt; `bypass` shows the notice or refuses when configured. Specification only.
+
+**Proposed repository map (`code-intelligence`, `system-context`, `provider-catalog`, P1):** [`add-repository-map`](openspec/changes/add-repository-map/proposal.md) adds a ranked overview of the repository's files and symbols. Symbols come from tree-sitter tag queries, ranked by PageRank over references and personalised by the Session's recent files. The map is fitted to a token budget set by the model profile, offered as a read-only `repo_map` tool, and optionally included as an Epoch-pinned `core/repo-map` Context Source in trusted checkouts. Pinning means it never breaks the cached prompt prefix. The index is a local cache shared across worktrees; inspection is through `cyber lsp map` and `/map`. Semantic code search is deferred. Specification only; the budget field depends on archiving `improve-model-protocol-fidelity`.
+
+**Proposed transcript search (`session-search`, P1; agent tool P2):** [`add-session-transcript-search`](openspec/changes/add-session-transcript-search/proposal.md) adds full-text search over Session transcripts with a SQLite FTS5 index. The index is written in the same transaction as the events, with a resumable backfill, and deletion, revert and retention keep it consistent. Reasoning and opaque state are never indexed, and indexed text passes through secret redaction. It is exposed as `cyber sessions search`, `GET /api/v1/sessions/search`, the SDK and `/resume` content matches; a permission-gated `session_search` agent tool follows in P2. Title search is unchanged. Specification only.
+
 ## P2: Autonomy & orchestration (flagship)
 
 **Capabilities:** `workflows` (including automatic orchestration), `goals`, `loops-scheduling`, `agent-teams` (behind feature `teams`), `cross-session-messaging` (direct peers), `tui` (agent view, workflow monitor, goal panel), `background-tasks` (`notify`, `send_file`), `skills-commands` (bundled `batch`, `review`, `audit`), `exec-mode` (`--goal`, `--workflow`).
@@ -102,6 +108,8 @@ The [current inventory](docs/implementation/spec-doc-reconciliation.md) contains
 
 **Direct peers (`cross-session-messaging`, P2, not owned by an M2.x milestone): Status: implemented** (change `add-messaging-direct-peers`; [guide](docs/peers.md)). Pairing with pinned TLS fingerprints and hashed grant tokens, `name@machine` sends held on the receiver, polled outcomes, listing and watches, revocation, `cyber attach <session>@<peer>` and opt-in mDNS discovery have production-path tests and were accepted by hand on 2026-10-19 with two real servers on one macOS host. Open: OS keyring evidence (mocked with `--token-env`), two-way pairing with a reply, the SSH-tunnel flow, a two-host run, Linux and Windows CI on this work, and the archive; see [P2 evidence](docs/implementation/p2-status.md#cross-session-messaging-direct-peers-2026-10-19).
 
+**Proposed debugger tool (`debugging`, P2, experimental feature `debugger`):** [`add-debugger-tool`](openspec/changes/add-debugger-tool/proposal.md) lets the agent debug from runtime state through the Debug Adapter Protocol. One `debug` tool can launch a program and set breakpoints, then step, inspect bounded stack frames and variables, evaluate expressions and terminate. It is built like the LSP support (trusted launch, bounded framing, owned cancellation), with one debug session per Session owned by a `debug` Job. Launching needs the same permission as `bash` and runs in the Session's sandbox; `evaluate` asks by default. The first slice ships the stdio adapters `debugpy` and `lldb-dap`, and reads `.vscode/launch.json` read-only in trusted checkouts. Delve and js-debug (socket adapters) follow. Specification only.
+
 **Exit criteria**
 - A 300-file migration workflow finishes unattended, with each agent in its own worktree, under a declared reserved cost budget with uncertainty and any billing overrun disclosed. A killed run replays recorded host results and resumes incomplete child Sessions, reconciling unknown tool outcomes before further mutations.
 - A queue of 3 goals runs to completion with `check: cargo test`, and the queue advances automatically.