release: v2.65.0 — Agent Locks, and a way to switch a built-in guard off

[drknowhow]

Four merged PRs (#54–#57) had accumulated past the v2.64.0 tag, so the version stopped identifying the code: the installed build reported 2.64.0 while running leases, a new tool, a new CLI command and a new Hub tab.

Correction: this is MINOR, not patch

I earlier called it 2.64.1. That was wrong — it adds c3_locks, c3 locks, a Hub tab and a locks config section. New surface, not a fix. 2.65.0.

What ships

Agent Locks — two mechanisms, because two different problems get conflated:

• A cross-process file lock stops two c3-mcp processes tearing each other's writes. It now covers create mode, which ran outside the lock entirely — two agents creating one path both reported success and one file silently won.
• Leases stop two agents doing overlapping work. c3_edit takes one automatically, carrying the intent from your edit summary, so a blocked agent is told who holds the file and why. TTL is the real release mechanism — agents forget to release, so nothing assumes they will, and a crashed agent can't wedge a repo.

Plus c3_locks, c3 locks with the human-only force-release, and a Hub Locks tab. That tab badges a project whose lock state can't be read as UNREADABLE rather than showing it with zero leases — "all clear" is a different claim from "we don't know".

Access Guard built-in opt-out — two-key: a config entry and a keyring attestation. Either alone leaves the built-in enforcing. That's the point: an agent that manages to write config.json — exactly the move a prompt-injected one would make to grant itself write access to ~/.claude/settings.json — still can't produce the attestation. The credential vault stays absolute.

Honesty the changelog keeps

Coverage is stated, not implied: leases gate C3's own tool surfaces. A raw c3_shell redirect, a non-Claude agent, or a human in an editor is not covered, and the UI says so on screen.

The ### Fixed section names the class that produced three separate CI failures across these PRs — a lock key computable two ways, disagreeing by platform, which made the guard a silent no-op wherever it disagreed.

Checks

• 1805 pass, ruff clean
• Both version constants bumped; test_version_sync guards the pair (it exists because v2.56.0 shipped with them out of sync and c3 --version lied)
• c3 --version → 2.65.0

Tag v2.65.0 after merge to trigger the PyPI release workflow.

https://claude.ai/code/session_01Sbd9NbQfDcoJvvURD7KCVf