@crvouga/atlas 0.10.0 → 0.10.2

package/CHANGELOG.md

@@ -1,6 +1,18 @@
 # Changelog: @crvouga/atlas
 
-## 0.10.0 (2026-10-21)
+## 0.10.2 (2026-10-24)
+
+### Fixes and improvements
+
+- stabilize report identity and add issue resolution skill (#19) ([1772e03](https://github.com/crvouga/atlas/commit/1772e03b6376854aecc1da692a1da87d21ebf370))
+
+## 0.10.1 (2026-10-24)
+
+### Fixes and improvements
+
+- patch Vite and Zod vulnerabilities (#17) ([4d8e389](https://github.com/crvouga/atlas/commit/4d8e389acb31eccfc34736cb83c6b10fdd6e292e))
+
+## 0.10.0 (2026-10-20)
 
 ### Features
 

package/dist/reports/src/layer-merge.d.ts

@@ -128,5 +128,9 @@ export declare function distinctHeaders<T extends {
 export declare function distinctEvidence(layers: readonly LayerEvidence[]): LayerEvidence[];
 /** Drops each mutable layer whose execution is already archived as an immutable one, and keeps one summary per id. */
 export declare function distinctLayers(layers: readonly LayerSummary[]): LayerSummary[];
-/** A string equal for the mutable and the archived address of one execution: its producer, sha, time and parts. */
+/**
+ * A string equal for the mutable and the archived address of one execution: its producer, sha, time and parts.
+ * Object key order is ignored at every depth, including check evidence and extensions; array order is preserved.
+ * This is an advisory execution identity, not the content digest that addresses an immutable layer in storage.
+ */
 export declare function layerExecutionKey(layer: LayerSummary): string;

package/dist/reports/src/layer-merge.js

@@ -269,7 +269,22 @@ export function distinctLayers(layers) {
     const kept = new Set(layers.filter(layer => archived(layer.id)).map(layerExecutionKey));
     return [...new Map(layers.filter(layer => archived(layer.id) || !kept.has(layerExecutionKey(layer))).map(layer => [layer.id, layer])).values()];
 }
-/** A string equal for the mutable and the archived address of one execution: its producer, sha, time and parts. */
+/**
+ * A string equal for the mutable and the archived address of one execution: its producer, sha, time and parts.
+ * Object key order is ignored at every depth, including check evidence and extensions; array order is preserved.
+ * This is an advisory execution identity, not the content digest that addresses an immutable layer in storage.
+ */
 export function layerExecutionKey(layer) {
-    return JSON.stringify([layer.producer, layer.sha, layer.recordedAtMs, layer.parts]);
+    return JSON.stringify([layer.producer, layer.sha, layer.recordedAtMs, orderedValue(layer.parts)]);
+}
+/** Sort JSON objects recursively without changing array order or interpreting extension keys as prototypes. */
+function orderedValue(value) {
+    if (Array.isArray(value))
+        return value.map(orderedValue);
+    if (value === null || typeof value !== 'object')
+        return value;
+    const ordered = Object.create(null);
+    for (const key of Object.keys(value).sort())
+        ordered[key] = orderedValue(value[key]);
+    return ordered;
 }

package/dist/schema/src/common.d.ts

@@ -33,12 +33,12 @@ export declare const EVENT_KINDS: readonly ["user", "system", "time", "hand-off"
  * Zod schema for an `EVENT_KINDS` value that first rewrites the legacy value `member` to `user`, so specs written
  * before the kinds were renamed still parse.
  */
-export declare const EventKindSchema: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodEnum<{
+export declare const EventKindSchema: z.ZodPreprocess<z.ZodEnum<{
     time: "time";
     user: "user";
     system: "system";
     "hand-off": "hand-off";
-}>>;
+}>, unknown>;
 /** One of `EVENT_KINDS`. */
 export type EventKind = z.infer<typeof EventKindSchema>;
 /**

package/dist/schema/src/manifest.d.ts

@@ -258,12 +258,12 @@ export declare const MapEdgeSchema: z.ZodObject<{
     source: z.ZodString;
     target: z.ZodString;
     event: z.ZodString;
-    kind: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodEnum<{
+    kind: z.ZodPreprocess<z.ZodEnum<{
         time: "time";
         user: "user";
         system: "system";
         "hand-off": "hand-off";
-    }>>;
+    }>, unknown>;
     inScope: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /**
@@ -380,12 +380,12 @@ export declare const TransitionRecordSchema: z.ZodObject<{
     source: z.ZodString;
     target: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     event: z.ZodString;
-    kind: z.ZodOptional<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodEnum<{
+    kind: z.ZodOptional<z.ZodPreprocess<z.ZodEnum<{
         time: "time";
         user: "user";
         system: "system";
         "hand-off": "hand-off";
-    }>>>;
+    }>, unknown>>;
     how: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     client: z.ZodOptional<z.ZodString>;
     status: z.ZodEnum<{

package/dist/schema/src/spec.d.ts

@@ -90,12 +90,12 @@ export declare const StateMetaShape: {
         label: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     readonly hints: z.ZodArray<z.ZodString>;
-    readonly eventKinds: z.ZodRecord<z.ZodString, z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodEnum<{
+    readonly eventKinds: z.ZodRecord<z.ZodString, z.ZodPreprocess<z.ZodEnum<{
         time: "time";
         user: "user";
         system: "system";
         "hand-off": "hand-off";
-    }>>>;
+    }>, unknown>>;
     readonly timeEvents: z.ZodRecord<z.ZodString, z.ZodString>;
 };
 /** `StateMetaShape` with every field optional: the `meta` of a state or of a whole chart. */
@@ -134,12 +134,12 @@ export declare const StateMetaSchema: z.ZodObject<{
         label: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     hints: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    eventKinds: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodEnum<{
+    eventKinds: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodPreprocess<z.ZodEnum<{
         time: "time";
         user: "user";
         system: "system";
         "hand-off": "hand-off";
-    }>>>>;
+    }>, unknown>>>;
     timeEvents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strip>;
 /** A parsed `StateMetaSchema` value. */
@@ -216,12 +216,12 @@ export declare const MachineSchema: z.ZodObject<{
             label: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
         hints: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        eventKinds: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodEnum<{
+        eventKinds: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodPreprocess<z.ZodEnum<{
             time: "time";
             user: "user";
             system: "system";
             "hand-off": "hand-off";
-        }>>>>;
+        }>, unknown>>>;
         timeEvents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, z.core.$strip>>;
     states: z.ZodRecord<z.ZodString, z.ZodUnknown>;

package/docs/agents.md

@@ -13,6 +13,7 @@ commands provide JSON results with published schemas; the HTTP API is described
 - [Standards used](#standards-used)
 - [Where the documentation comes from](#where-the-documentation-comes-from)
 - [An integration brief you can give an agent](#an-integration-brief-you-can-give-an-agent)
+- [Resolve this repository's open issues](#resolve-this-repositorys-open-issues)
 
 ## Given only this repository link
 
@@ -287,3 +288,27 @@ docs/reporting-issues.md; do not edit node_modules or vendor Atlas into this pro
 If server access or CI secrets are unavailable, finish the local integration and report exactly which shared
 server/CI checks remain unverified. A synthetic pass, a generated plan, or an unavailable backend is not proof
 that the product's real suites are integrated.
+
+## Resolve this repository's open issues
+
+For contributors working in this Atlas checkout, the
+[resolve-open-issues skill](https://github.com/crvouga/atlas/blob/main/.agents/skills/resolve-open-issues/SKILL.md)
+handles the entire open GitHub issue inventory in one PR, branch and worktree. It uses the
+[Agent Skills format](https://agentskills.io/specification) in the
+[shared `.agents/skills/` location](https://agentskills.io/integrate-skills#where-to-scan).
+Discovery varies by agent; any coding agent with repository file access and GitHub access can use
+the same instructions by reading the file directly:
+
+```text
+Read .agents/skills/resolve-open-issues/SKILL.md and follow it to resolve all open GitHub issues
+in this repository in a single PR, using one branch and the current worktree. Continue through
+implementation, validation and PR checks. Track evidence for every issue, handle attestations
+autonomously, and report precise blockers without claiming unresolved issues are fixed.
+```
+
+Use the agent's native skill invocation when it discovers `resolve-open-issues`; the file-reading
+prompt is the portable fallback. The skill can also be copied as a whole directory into another
+repository's skill location; it reads that repository's instructions and validation requirements.
+Keep this workflow in the repository being fixed. Atlas consumer integrations still follow the
+playbook above and report Atlas defects as issues. The contributor skill lives in the Git checkout;
+it is not part of the npm package.

package/docs/reference/reports.md

@@ -3340,6 +3340,8 @@ export function layerExecutionKey(layer: LayerSummary): string
 ```
 
 A string equal for the mutable and the archived address of one execution: its producer, sha, time and parts.
+Object key order is ignored at every depth, including check evidence and extensions; array order is preserved.
+This is an advisory execution identity, not the content digest that addresses an immutable layer in storage.
 
 ### Archiving a recorded run as a layer
 

package/docs/report-contract.md

@@ -178,6 +178,9 @@ Consequences you can rely on:
   was removed keeps its evidence, outside the outline.
 - An immutable layer held by several backends is **one** layer, reported by the backend whose id sorts
   first.
+- The mutable address of an execution already held as an immutable layer is suppressed by the
+  de-duplication helpers and static export. Execution identity compares producer, commit, time and
+  parts; object key order at any depth does not matter, while array order does.
 
 Leaving a layer, backend, environment, branch or version out of the input is how earlier outcomes are
 inspected.

package/llms-full.txt

@@ -22,6 +22,7 @@ commands provide JSON results with published schemas; the HTTP API is described
 - [Standards used](#standards-used)
 - [Where the documentation comes from](#where-the-documentation-comes-from)
 - [An integration brief you can give an agent](#an-integration-brief-you-can-give-an-agent)
+- [Resolve this repository's open issues](#resolve-this-repositorys-open-issues)
 
 ## Given only this repository link
 
@@ -296,6 +297,30 @@ docs/reporting-issues.md; do not edit node_modules or vendor Atlas into this pro
 If server access or CI secrets are unavailable, finish the local integration and report exactly which shared
 server/CI checks remain unverified. A synthetic pass, a generated plan, or an unavailable backend is not proof
 that the product's real suites are integrated.
+
+## Resolve this repository's open issues
+
+For contributors working in this Atlas checkout, the
+[resolve-open-issues skill](https://github.com/crvouga/atlas/blob/main/.agents/skills/resolve-open-issues/SKILL.md)
+handles the entire open GitHub issue inventory in one PR, branch and worktree. It uses the
+[Agent Skills format](https://agentskills.io/specification) in the
+[shared `.agents/skills/` location](https://agentskills.io/integrate-skills#where-to-scan).
+Discovery varies by agent; any coding agent with repository file access and GitHub access can use
+the same instructions by reading the file directly:
+
+```text
+Read .agents/skills/resolve-open-issues/SKILL.md and follow it to resolve all open GitHub issues
+in this repository in a single PR, using one branch and the current worktree. Continue through
+implementation, validation and PR checks. Track evidence for every issue, handle attestations
+autonomously, and report precise blockers without claiming unresolved issues are fixed.
+```
+
+Use the agent's native skill invocation when it discovers `resolve-open-issues`; the file-reading
+prompt is the portable fallback. The skill can also be copied as a whole directory into another
+repository's skill location; it reads that repository's instructions and validation requirements.
+Keep this workflow in the repository being fixed. Atlas consumer integrations still follow the
+playbook above and report Atlas defects as issues. The contributor skill lives in the Git checkout;
+it is not part of the npm package.
 </doc>
 
 <doc path="docs/quickstart.md">
@@ -2235,6 +2260,9 @@ Consequences you can rely on:
   was removed keeps its evidence, outside the outline.
 - An immutable layer held by several backends is **one** layer, reported by the backend whose id sorts
   first.
+- The mutable address of an execution already held as an immutable layer is suppressed by the
+  de-duplication helpers and static export. Execution identity compares producer, commit, time and
+  parts; object key order at any depth does not matter, while array order does.
 
 Leaving a layer, backend, environment, branch or version out of the input is how earlier outcomes are
 inspected.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crvouga/atlas",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "Atlas: specs of any kind, reported as layered evidence. Publish checks from any runner (JUnit, CTRF, a script), combine them across nodes, branches, environments and backends, gate CI on the result, and run statecharts against the real app.",
   "license": "MIT",
   "type": "module",
@@ -207,10 +207,10 @@
     "react-dom": "^19.3.0",
     "solid-js": "^1.9.15",
     "tsx": "4.23.13",
-    "vite": "7.3.6",
+    "vite": "7.3.7",
     "xstate": "5.33.2",
     "yaml": "^2.9.0",
-    "zod": "^3.25.76",
+    "zod": "^4.6.7",
     "zustand": "^5.0.15"
   },
   "peerDependencies": {

package/packages/schema/schemas/check-detail.schema.json

@@ -13,9 +13,9 @@
       "type": "object",
       "properties": {
         "id": {
-          "description": "The check's stable identity within its producer. The same check must keep the same id in every layer, or layers cannot replace one another",
           "type": "string",
-          "minLength": 1
+          "minLength": 1,
+          "description": "The check's stable identity within its producer. The same check must keep the same id in every layer, or layers cannot replace one another"
         },
         "title": {
           "type": "string"
@@ -30,8 +30,8 @@
           ]
         },
         "detail": {
-          "description": "Why it failed, or what was measured",
           "default": "",
+          "description": "Why it failed, or what was measured",
           "type": "string"
         },
         "specPath": {
@@ -49,8 +49,8 @@
                 "minLength": 1
               },
               "value": {
-                "description": "A finite number",
-                "type": "number"
+                "type": "number",
+                "description": "A finite number"
               },
               "unit": {
                 "type": "string"
@@ -215,9 +215,9 @@
             "type": "object",
             "properties": {
               "type": {
-                "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…",
                 "type": "string",
-                "minLength": 1
+                "minLength": 1,
+                "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…"
               },
               "message": {
                 "type": "string"
@@ -443,9 +443,9 @@
                   "type": "object",
                   "properties": {
                     "type": {
-                      "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…",
                       "type": "string",
-                      "minLength": 1
+                      "minLength": 1,
+                      "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…"
                     },
                     "message": {
                       "type": "string"
@@ -708,9 +708,9 @@
                         "type": "object",
                         "properties": {
                           "type": {
-                            "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…",
                             "type": "string",
-                            "minLength": 1
+                            "minLength": 1,
+                            "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…"
                           },
                           "message": {
                             "type": "string"
@@ -908,9 +908,9 @@
                   "type": "object",
                   "properties": {
                     "type": {
-                      "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…",
                       "type": "string",
-                      "minLength": 1
+                      "minLength": 1,
+                      "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…"
                     },
                     "message": {
                       "type": "string"
@@ -1016,10 +1016,10 @@
       "additionalProperties": {}
     },
     "run": {
-      "description": "What the run as a whole carries: its logs, links, labels, annotations and extensions",
       "type": "object",
       "properties": {},
-      "additionalProperties": {}
+      "additionalProperties": {},
+      "description": "What the run as a whole carries: its logs, links, labels, annotations and extensions"
     }
   },
   "required": [

package/packages/schema/schemas/checks-result.schema.json

@@ -8,8 +8,8 @@
       "const": true
     },
     "id": {
-      "description": "The layer id",
-      "type": "string"
+      "type": "string",
+      "description": "The layer id"
     },
     "checks": {
       "type": "integer",

package/packages/schema/schemas/command-error.schema.json

@@ -11,13 +11,13 @@
       "type": "object",
       "properties": {
         "message": {
-          "description": "What is wrong, and usually what to do about it",
-          "type": "string"
+          "type": "string",
+          "description": "What is wrong, and usually what to do about it"
         },
         "code": {
-          "description": "`usage`: the command or its inputs were wrong. Nothing was written",
           "type": "string",
-          "const": "usage"
+          "const": "usage",
+          "description": "`usage`: the command or its inputs were wrong. Nothing was written"
         }
       },
       "required": [

package/packages/schema/schemas/doctor-result.schema.json

@@ -4,8 +4,8 @@
   "type": "object",
   "properties": {
     "ok": {
-      "description": "True when every check of every store passed (otherwise the exit code is 1)",
-      "type": "boolean"
+      "type": "boolean",
+      "description": "True when every check of every store passed (otherwise the exit code is 1)"
     },
     "stores": {
       "type": "array",
@@ -21,8 +21,8 @@
               "type": "object",
               "properties": {
                 "name": {
-                  "description": "`store`, `list`, `contents`, `write`, …",
-                  "type": "string"
+                  "type": "string",
+                  "description": "`store`, `list`, `contents`, `write`, …"
                 },
                 "ok": {
                   "type": "boolean"