@mnstry/atelier 0.2.0-alpha.3 → 0.2.0-alpha.5

package/fixtures/projects/source-formats-workspace/content/data.json.kg.json

@@ -1,5 +1,6 @@
 {
-  "assetFilename": "data.json",
+  "schema": "mnstry.source-sidecar@v1",
+  "asset": "data.json",
   "title": "Sample dataset",
   "summary": "Neutral JSON dataset described entirely by its sidecar.",
   "tags": [
@@ -8,6 +9,8 @@
   "kg": {
     "id": "source-formats:data-json",
     "type": "source",
+    "domain": "sample",
+    "lifecycle": "source",
     "status": "active",
     "audience": "team",
     "relations": {}

package/fixtures/projects/source-formats-workspace/content/logo.png.kg.json

@@ -1,5 +1,6 @@
 {
-  "assetFilename": "logo.png",
+  "schema": "mnstry.source-sidecar@v1",
+  "asset": "logo.png",
   "title": "Sample binary asset",
   "summary": "Four-byte PNG-magic stub; the graph never reads the asset bytes.",
   "tags": [
@@ -8,6 +9,8 @@
   "kg": {
     "id": "source-formats:logo-png",
     "type": "artifact",
+    "domain": "sample",
+    "lifecycle": "source",
     "status": "active",
     "audience": "sensitive",
     "relations": {}

package/fixtures/projects/source-formats-workspace/content/metrics.csv.kg.json

@@ -1,5 +1,6 @@
 {
-  "assetFilename": "metrics.csv",
+  "schema": "mnstry.source-sidecar@v1",
+  "asset": "metrics.csv",
   "title": "Sample metrics",
   "summary": "Neutral CSV evidence table described by its sidecar.",
   "tags": [
@@ -8,6 +9,8 @@
   "kg": {
     "id": "source-formats:metrics-csv",
     "type": "evidence",
+    "domain": "sample",
+    "lifecycle": "source",
     "status": "active",
     "audience": "operator",
     "relations": {}

package/fixtures/projects/source-formats-workspace/content/pipeline.yaml.kg.json

@@ -1,5 +1,6 @@
 {
-  "assetFilename": "pipeline.yaml",
+  "schema": "mnstry.source-sidecar@v1",
+  "asset": "pipeline.yaml",
   "title": "Sample pipeline",
   "summary": "Neutral YAML file; atelier never parses it, the sidecar speaks for it.",
   "tags": [
@@ -8,6 +9,8 @@
   "kg": {
     "id": "source-formats:pipeline-yaml",
     "type": "source",
+    "domain": "sample",
+    "lifecycle": "source",
     "status": "active",
     "audience": "public",
     "relations": {}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@mnstry/atelier",
-  "version": "0.2.0-alpha.3",
+  "version": "0.2.0-alpha.5",
   "private": false,
-  "description": "Local CLI that compiles a Git repository into a validated knowledge graph — front-matter ontology, fail-closed audience boundaries, offline contract conformance. No telemetry, no service, no account.",
+  "description": "Local toolkit that turns a Git repository into an ontology-governed knowledge graph, enforcement layer, and runtime for people, agents, and tools. No telemetry, service, or account.",
   "keywords": [
     "knowledge-graph",
     "ontology",
@@ -32,8 +32,10 @@
     "./readiness-protocols": "./src/readiness-protocols/bundled-pack.mjs",
     "./server": "./src/server/local-sidecar.mjs",
     "./harness": "./src/harness/context.mjs",
+    "./collaboration": "./src/collaboration/index.mjs",
     "./support": "./src/support/support-bundle.mjs",
     "./egress": "./src/egress/forbidden-egress.mjs",
+    "./disclosure": "./src/disclosure/content-scan.mjs",
     "./boundary": "./src/boundary/policy.mjs",
     "./upgrade": "./src/upgrade/upgrade.mjs",
     "./attestation": "./src/attestation/sign.mjs",
@@ -48,7 +50,7 @@
     "contract": "node src/check-atelier-export-contract.mjs",
     "dry-run": "node src/validate-atelier-export-dry-run.mjs fixtures/atelier-export/sample-studio-offer.v1.json",
     "test": "node --test test/*.test.mjs",
-    "syntax:check": "find bin src -name '*.mjs' -print0 | xargs -0 -n1 node --check",
+    "syntax:check": "node scripts/check-syntax.mjs",
     "graph:test": "node --test test/graph.test.mjs test/graph-knowledge-graph.test.mjs test/graph-determinism.test.mjs test/graph-source-formats.test.mjs",
     "project:test": "node --test test/project.test.mjs test/project-config.test.mjs test/projection-policy.test.mjs test/projection-alignment.test.mjs",
     "server:security:test": "node --test test/server.test.mjs test/server-security.test.mjs test/server-proposals.test.mjs",
@@ -57,19 +59,24 @@
     "egress:check": "node bin/atelier.mjs egress check",
     "readiness:test": "node --test test/readiness.test.mjs test/readiness-summary.test.mjs test/readiness-protocol-contract.test.mjs test/readiness-protocols.test.mjs test/readiness-protocol-runtime.test.mjs",
     "harness:test": "node --test test/harness.test.mjs test/harness-context.test.mjs",
-    "boundary:test": "node --test test/boundary-policy-contract.test.mjs test/boundary-guard.test.mjs",
+    "collaboration:test": "node --test test/collaboration-ledger.test.mjs test/server-proposals.test.mjs",
+    "boundary:test": "node --test test/boundary-policy-contract.test.mjs test/boundary-content-rules.test.mjs test/boundary-guard.test.mjs",
     "upgrade:test": "node --test test/upgrade-contract.test.mjs test/upgrade.test.mjs",
     "release:audit": "node scripts/check-release-tarball.mjs",
+    "release:candidate": "node scripts/release-candidate.mjs",
     "repo:check": "node scripts/check-repo-disclosure.mjs",
     "migrations:check": "node scripts/check-breaking-migrations.mjs",
     "contract:compat": "node scripts/check-contract-compat.mjs",
+    "public-api:compat": "node scripts/check-public-api-compat.mjs",
+    "assurance:mutation-smoke": "node --test test/assurance-mutations.test.mjs",
     "consumer:smoke": "node scripts/consumer-smoke.mjs",
     "distribution:smoke": "node scripts/distribution-smoke.mjs",
-    "prepublishOnly": "npm run release:audit && npm run repo:check && npm run migrations:check && npm run contract:compat && npm run syntax:check && npm test && npm run consumer:smoke && npm run distribution:smoke"
+    "prepublishOnly": "npm run repo:check && npm run migrations:check && npm run contract:compat && npm run public-api:compat && npm run syntax:check && npm test && npm run assurance:mutation-smoke && npm run release:candidate"
   },
   "dependencies": {
     "ajv": "8.20.0",
-    "ajv-formats": "3.0.1"
+    "ajv-formats": "3.0.1",
+    "fast-uri": "3.1.5"
   },
   "devDependencies": {
     "@types/node": "^22.0.0"

package/skills/claude/atelier-local-service/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: atelier-local-service
+description: Build or repair a durable loopback-only authoring, review, or preview service in an Atelier-backed repository when local state must survive agent commands and fail safely.
+---
+
+# Atelier local service
+
+Use this skill for a consumer-owned service that persists repository-backed
+local state. Do not use it to change `atelier dev` itself or to install an
+operating-system service without explicit authorization.
+
+Read `docs/local-services.md` from the installed Atelier package or source
+checkout before changing lifecycle code.
+
+## Boundary first
+
+Separate the portable mechanism from the consumer adapter before editing:
+
+- Atelier invariants: loopback binding, proven ownership, exact stop, ignored
+  mode-0600 state, atomic writes, recoverable browser failure, and tests.
+- Consumer details: service identity, port, commands, paths, schema, content,
+  and user-facing language.
+
+Never promote consumer names, content, structures, examples, or local paths
+into Atelier. Public tests use invented fixtures.
+
+## Workflow
+
+1. Inspect the existing server, process owner, port, persistence file,
+   `.gitignore`, health route, save handler, and tests. Preserve the live draft
+   before restarting anything.
+2. Expose repository-owned `start`, `status`, and `stop` commands. Start may
+   detach only because the user needs continuity beyond the launching command.
+3. Bind to loopback. Pair a random runtime identifier with the PID in both the
+   private runtime record and health response. Refuse unowned listeners.
+4. Keep drafts, runtime metadata, and operational logs ignored and owner-only.
+   Do not commit live authoring state.
+5. Make the UI retain the draft when the service disappears. Show the exact
+   restart command, snapshot export, and Retry path instead of a generic error.
+6. Serialize writes without permanently rejecting the queue after one failed
+   operation. Keep conflicts and invalid state fail-closed.
+7. Prove lifecycle ownership, server-loss recovery, later-save recovery,
+   permissions, ignore coverage, and fresh-checkout discoverability.
+
+Do not claim durability from a passing request alone. Report separately:
+saved file truth, managed-process truth, browser recovery truth, and the
+remaining OS-restart boundary.

package/skills/claude/atelier-open/SKILL.md

@@ -25,14 +25,15 @@ name (`atelier`) and use the port the harness returns. The equivalent manual
 command is:
 
 ```
-./node_modules/.bin/atelier server
+./node_modules/.bin/atelier dev
 ```
 
-Use the local binary path. Do **not** run `npx atelier` — this package is not
-yet published to npm, and the unscoped name `atelier` belongs to an unrelated
-third-party package that `npx` would download and execute.
+Use the local binary path. Do **not** run unscoped `npx atelier`: the unscoped
+name belongs to an unrelated third-party package that `npx` would download and
+execute. From outside an installed workspace, install `@mnstry/atelier` first
+and use the branded `npx mnstry-atelier` command.
 
-`atelier server` resolves its port as **argv > `PORT` env > 8137**, so a
+`atelier dev` resolves its port as **argv > `PORT` env > 8137**, so a
 supervisor can hand it a free port without a config edit.
 
 ## Do not fight for the canonical port

package/skills/claude/atelier-public-boundary/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: atelier-public-boundary
+description: Generalize a lesson from a private or tenant implementation into the public Atelier repository without carrying proprietary material across the trust boundary.
+---
+
+# Atelier public boundary
+
+Use this skill whenever a public Atelier change is informed by work in a
+private, client, tenant, or internal repository.
+
+## Extract the invariant, not the source
+
+1. State the reusable failure mode or contract without client vocabulary.
+2. Identify every source-specific name, path, port, field, content structure,
+   example, and operational fact. Keep those in the source repository.
+3. Re-derive the public mechanism against an invented fixture. Neutral wording
+   is not enough if the fixture still reproduces a proprietary structure.
+4. Keep private disclosure patterns in the ignored denylist or CI secret. Do
+   not place them in code, tests, docs, branch names, or commit messages.
+5. Add a regression test for the general control and run an evidence-backed
+   defensive review when a guard changes.
+
+## Required gates
+
+Before staging, run the repository's disclosure check. After staging, scan the
+staged index with the private denylist, then inspect the exact diff and release
+tarball. A structural-only pass is useful on an untrusted fork but is not a
+complete maintainer verdict.
+
+If the private denylist is unavailable, stop short of claiming the public
+boundary is green. Do not replace it with remembered client names.

package/skills/codex/atelier-local-service/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: atelier-local-service
+description: Build or repair a durable loopback-only authoring, review, or preview service in an Atelier-backed repository when local state must survive agent commands and fail safely.
+---
+
+# Atelier local service
+
+Use this skill for a consumer-owned service that persists repository-backed
+local state. Do not use it to change `atelier dev` itself or to install an
+operating-system service without explicit authorization.
+
+Read `docs/local-services.md` from the installed Atelier package or source
+checkout before changing lifecycle code.
+
+## Boundary first
+
+Separate the portable mechanism from the consumer adapter before editing:
+
+- Atelier invariants: loopback binding, proven ownership, exact stop, ignored
+  mode-0600 state, atomic writes, recoverable browser failure, and tests.
+- Consumer details: service identity, port, commands, paths, schema, content,
+  and user-facing language.
+
+Never promote consumer names, content, structures, examples, or local paths
+into Atelier. Public tests use invented fixtures.
+
+## Workflow
+
+1. Inspect the existing server, process owner, port, persistence file,
+   `.gitignore`, health route, save handler, and tests. Preserve the live draft
+   before restarting anything.
+2. Expose repository-owned `start`, `status`, and `stop` commands. Start may
+   detach only because the user needs continuity beyond the launching command.
+3. Bind to loopback. Pair a random runtime identifier with the PID in both the
+   private runtime record and health response. Refuse unowned listeners.
+4. Keep drafts, runtime metadata, and operational logs ignored and owner-only.
+   Do not commit live authoring state.
+5. Make the UI retain the draft when the service disappears. Show the exact
+   restart command, snapshot export, and Retry path instead of a generic error.
+6. Serialize writes without permanently rejecting the queue after one failed
+   operation. Keep conflicts and invalid state fail-closed.
+7. Prove lifecycle ownership, server-loss recovery, later-save recovery,
+   permissions, ignore coverage, and fresh-checkout discoverability.
+
+Do not claim durability from a passing request alone. Report separately:
+saved file truth, managed-process truth, browser recovery truth, and the
+remaining OS-restart boundary.

package/skills/codex/atelier-open/SKILL.md

@@ -25,14 +25,15 @@ name (`atelier`) and use the port the harness returns. The equivalent manual
 command is:
 
 ```
-./node_modules/.bin/atelier server
+./node_modules/.bin/atelier dev
 ```
 
-Use the local binary path. Do **not** run `npx atelier` — this package is not
-yet published to npm, and the unscoped name `atelier` belongs to an unrelated
-third-party package that `npx` would download and execute.
+Use the local binary path. Do **not** run unscoped `npx atelier`: the unscoped
+name belongs to an unrelated third-party package that `npx` would download and
+execute. From outside an installed workspace, install `@mnstry/atelier` first
+and use the branded `npx mnstry-atelier` command.
 
-`atelier server` resolves its port as **argv > `PORT` env > 8137**, so a
+`atelier dev` resolves its port as **argv > `PORT` env > 8137**, so a
 supervisor can hand it a free port without a config edit.
 
 ## Do not fight for the canonical port

package/skills/codex/atelier-public-boundary/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: atelier-public-boundary
+description: Generalize a lesson from a private or tenant implementation into the public Atelier repository without carrying proprietary material across the trust boundary.
+---
+
+# Atelier public boundary
+
+Use this skill whenever a public Atelier change is informed by work in a
+private, client, tenant, or internal repository.
+
+## Extract the invariant, not the source
+
+1. State the reusable failure mode or contract without client vocabulary.
+2. Identify every source-specific name, path, port, field, content structure,
+   example, and operational fact. Keep those in the source repository.
+3. Re-derive the public mechanism against an invented fixture. Neutral wording
+   is not enough if the fixture still reproduces a proprietary structure.
+4. Keep private disclosure patterns in the ignored denylist or CI secret. Do
+   not place them in code, tests, docs, branch names, or commit messages.
+5. Add a regression test for the general control and run an evidence-backed
+   defensive review when a guard changes.
+
+## Required gates
+
+Before staging, run the repository's disclosure check. After staging, scan the
+staged index with the private denylist, then inspect the exact diff and release
+tarball. A structural-only pass is useful on an untrusted fork but is not a
+complete maintainer verdict.
+
+If the private denylist is unavailable, stop short of claiming the public
+boundary is green. Do not replace it with remembered client names.