v0.4.1 — post-identity parser fix

Real fix for the silent onboard bug

v0.4.0 was a version-bump-only release based on a wrong theory (stale hook registration). The actual bug is in the post-identity response parser:

Claude Code delivers MCP tool_response as a bare list of content parts:

[{"type": "text", "text": "{...inner json...}"}]

But hooks/post-identity expected the dict-wrapped shape:

{"content": [{"type": "text", "text": "..."}]}

The isinstance(resp, dict) and "content" in resp check rejected every real call, exit 0'd, and never wrote the slot-scoped session cache. That cascaded — post-edit saw no session, auto check-ins never landed.

What changed

• hooks/post-identity now accepts both shapes.
• Added regression test test_bare_list_response_shape_is_parsed using the actual shape captured from a live identity(resume=true) call.
• Existing test suite used the wrapped shape exclusively, which is why the bug had no coverage.

Upgrade

/plugin update unitares-governance

Then restart Claude Code and verify: call onboard(), confirm ~/.unitares/session-<slot>.json appears, and watch ~/.unitares/checkins.log for event=auto_edit after a few edits.