@massu/core 1.14.0 → 1.15.0

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.15.0] - 2026-06-02
+
+**Enterprise auto-learning governance + signed audit export (`plan-2026-06-01-enterprise-governance-audit-export`)**. Generalizes the Phase-3 per-rule two-operator review into an org-level governance policy enforced at the server promotion chokepoint + role-aware RLS, and adds a cryptographically-signed compliance export. Enterprise orgs (`plan='cloud_enterprise'`) can now set a promotion policy — minimum promoter role (rank-compared, never lexicographic), N-of-M distinct-approver requirement, allowed destinations, and a tighten-only hardened-review flag — that `promoted_rule_upsert` enforces before any promotion applies; a promotion below threshold is held `pending` and excluded from every seat's pull cursor until enough distinct operators (each other than the promoter) approve it. The new signed audit export streams the org's full governance history (policy, approvals, promotions, revocations) as a single Ed25519-signed FLAT envelope (records carried as a `records_json` STRING so the signature covers every record — no nested-array forgery hole), verifiable offline against the bundled public key. The `audit-export` edge function is the SOLE signer (single-signer, CR-46) for both the programmatic `ms_live_` path (admin-scoped) and the dashboard path (which calls it server-side via a service-role bearer and holds no key). Backwards-compatible additive feature — off the Enterprise path, behavior is unchanged (`approval_state` defaults to `applied`) — minor per semver.
+
+### Added
+
+- **`packages/core/src/security/governance-export-verifier.ts`** — Ed25519 verifier for the signed `/audit-export` envelope; a one-line wrapper over the consolidated `verifyEd25519SignedEnvelope` core (third signed-envelope artifact, no copy-pasted crypto), NO transition mode. Bundled pubkey via `scripts/bundle-audit-export-pubkey.mjs` (+ `generate-audit-export-keypair.mjs`), wired into `prepublishOnly`.
+- **`packages/core/src/rule-candidate-hardened.ts`** — `validateGovernanceGate(policy, approvals)` (generalized N-of-M gate) + `roleRank()` ladder; `validateHardenedApplyGate` now delegates as the N=2 special case (CR-10: symbol + refs + exact messages preserved).
+- **`packages/core/src/auto-learning-entitlement.ts`** — `ENTERPRISE_GOVERNANCE_MIN_TIER` + `entitledForEnterpriseGovernance` (reuses the existing `tierLevel` + `PLAN_TO_TIER_MAP`; no parallel tier scheme).
+- **`/massu-rule approvals`** subcommand — surfaces the org policy + pending N-of-M approval state.
+- **pattern-scanner Check 37** + `governance-gate-invariant.test.ts` — the client-gate ↔ server-RPC ↔ RLS drift-guard (vitest ↔ scanner parity).
+- **Website (massu_prod + massu.ai)**: migration 049 (`org_promotion_policy` + `promotion_approvals` ledger + `promoted_rules.approval_state` + the `promoted_rule_upsert` governance branch + `promotion_approval_record`/`promotion_policy_reconcile` RPCs + role-aware RLS + widened `activity_feed` CHECK), the `audit-export` Enterprise-gated Ed25519-signing edge function (CR-58 `verify_jwt=false`), and the `/dashboard/governance` admin page (policy editor + approvals + signed-export download).
+
+### Changed
+
+- `promoted_rule_upsert` re-defined (CREATE OR REPLACE of the 045 body + governance branch); `/sync` recognizes the new `pending_approval` status; `/promoted-rules` excludes `approval_state='pending'` rows from the differential-pull cursor.
+
 ## [1.14.0] - 2026-06-02
 
 **Curated Rule Packs — versioned, installable, actually-enforced (`plan-2026-06-01-curated-rule-packs`)**. Closes the inert-marketplace bug class: the rule-pack marketplace existed but enforced nothing — installing a pack flattened its rules into `org_rules`, which no core enforcement path ever read. Now an installed pack's rules materialize on the developer's machine as Ed25519-signed, provenance-tagged rule candidates that a human reviews and approves through `/massu-rule packs` (packs **propose**, humans **approve** — CR-39; no fake "active"/"enforced" state). Pack rules ride the existing `applyRuleCandidate()` chokepoint with the same Team-gated, signature-verified trust model as team-shared promotion (CR-54/55/57); executable destinations (`pattern-scanner`/`custom-destination`) route through the hardened two-operator review path and never auto-enforce. Ships the versioning + curation workflow (SemVer monotonicity, an immutable `rule_pack_versions` history, a `rule_pack_publish` SECURITY DEFINER RPC) the marketplace previously lacked. Backwards-compatible additive feature — new `/massu-rule packs` subcommand + `pack` provenance origin, zero breaking changes — minor per semver.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@massu/core",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "type": "module",
   "description": "AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 73 total), 56 workflow commands, 11 agents, 20+ patterns",
   "main": "./dist/cli.js",
@@ -29,7 +29,7 @@
     "build:bundle-adapters": "tsx scripts/bundle-adapters.ts",
     "build:cli": "esbuild --bundle --platform=node --format=esm --outfile=dist/cli.js src/cli.ts --external:better-sqlite3 --external:yaml --external:zod --external:chokidar --external:proper-lockfile --external:fsevents --external:web-tree-sitter --external:tweetnacl --external:tar --external:smol-toml --external:vscode-languageserver-protocol --external:@massu/adapter-rails --external:@massu/adapter-spring --banner:js='#!/usr/bin/env node\nimport{createRequire as __cr}from\"module\";const require=__cr(import.meta.url);'",
     "build:hooks": "esbuild --bundle --platform=node --format=esm --outdir=dist/hooks src/hooks/*.ts --external:better-sqlite3 --external:yaml --external:zod --external:chokidar --external:proper-lockfile --external:fsevents --external:web-tree-sitter --external:tweetnacl --external:tar --external:smol-toml --external:vscode-languageserver-protocol --external:@massu/adapter-rails --external:@massu/adapter-spring --banner:js='import{createRequire as __cr}from\"module\";const require=__cr(import.meta.url);'",
-    "prepublishOnly": "bash ../../scripts/prepublish-check.sh && node ../../scripts/bundle-pubkey.mjs && node ../../scripts/bundle-license-pubkey.mjs && node ../../scripts/bundle-promotion-pubkey.mjs && cp ../../CHANGELOG.md ./CHANGELOG.md && npm run build",
+    "prepublishOnly": "bash ../../scripts/prepublish-check.sh && node ../../scripts/bundle-pubkey.mjs && node ../../scripts/bundle-license-pubkey.mjs && node ../../scripts/bundle-promotion-pubkey.mjs && node ../../scripts/bundle-audit-export-pubkey.mjs && cp ../../CHANGELOG.md ./CHANGELOG.md && npm run build",
     "bench:watch": "tsx test/perf/watch-benchmark.ts"
   },
   "dependencies": {