@mnstry/atelier 0.2.0-alpha.4 → 0.2.0-alpha.6

package/CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## 0.2.0-alpha.6
+
+- Add Deliverable Zero for Atelier Sync: explicit single-repository
+  enrollment, a pinned direct-process Git adapter, executable repository
+  completeness observations, fast-forward-only reconciliation, per-repository
+  locking, hash-chained local operation traces, pause/resume control, and a
+  two-phase user-confirmed commit-and-publish path. No desktop shell, watcher
+  dependency, semantic conflict resolution, force operation, browser apply
+  endpoint, telemetry, or hidden upload is introduced.
+- Raise the Sync Git floor to 2.40 so default global and system attributes can
+  be observed, bind publication to the single resolved push URL, refuse URL
+  rewrite ambiguity, strip every inherited `GIT_*` process control, keep
+  read-only commands mutation-free, and return non-zero exits for paused status
+  and failed publication.
+
+## 0.2.0-alpha.5
+
+- Harden boundary enforcement so path globs use segment-aware matching, an
+  explicitly empty or malformed content-rule policy is invalid, staged and
+  pushed binary evidence is scanned within bounded budgets, incomplete Git
+  reads fail closed, linked worktrees install hooks in the correct Git common
+  directory, and `boundary audit` defaults to the current working tree with an
+  explicit `--head` snapshot mode.
+- Consolidate graph classification in one canonical engine. Markdown without a
+  `kg` block is now represented as `unclassified` with a private audience and
+  diagnostics; empty, partial, or malformed declarations remain blocking.
+  Generated projection directories remain derived from the file-class manifest
+  so graph validation and generated-only upgrade recovery cannot drift apart.
+- Bind release egress verification to the exact `npm pack` inventory, including
+  test-shaped paths that are actually published, and make the legacy egress
+  checker a thin delegate to the canonical scanner. Packed fixture-suppression
+  markers are refused and reviewed local-computed suppressions are counted.
+- Harden `atelier dev` so it binds only to loopback, requires a generated
+  `atelier.manifest.json`, serves only enrolled safe static files after
+  realpath validation, and applies host, fetch-site, origin, method, and nonce
+  checks to the relevant read and mutation routes.
+- Make collaboration records fail closed with typed corrupt-record results,
+  bounded ledger reads, POSIX no-follow and cross-platform state-leaf identity
+  validation, content-bound event identifiers, write locking, explicit
+  compaction, and one-pass proposal-list materialization. Compatibility
+  snapshots are best-effort projections of committed events rather than a
+  second authority. Proposal authority now follows declared capabilities and
+  apply endpoints rather than action-like words, and the never-released
+  provider-analysis experiment was removed before it became part of a
+  published API.
+- Render expected project and JSON failures as typed, actionable CLI messages
+  without stacks by default; set `ATELIER_DEBUG=1` to include diagnostic stacks.
+- Strengthen release proof with negative-control mutations and a bare consumer
+  that installs without publisher overrides, validates its dependency tree,
+  and imports every declared package export. A candidate is packed once, bound
+  by SHA-256, and passed unchanged through tarball audit, consumer, and branded
+  distribution gates. The trusted-publishing workflow publishes that same
+  retained, audited tarball rather than repacking the source directory.
+- Pin every JavaScript subpath and named export from `v0.2.0-alpha.4` in a
+  registry-verified compatibility baseline with immutable tag-commit and
+  public-artifact provenance. Release tooling refuses removals, provenance
+  drift, and binding modified source to an already-tagged package version.
+- Add a portable `atelier disclosure check` command that scans tracked or
+  staged consumer content, requires private denylist coverage by default, and
+  refuses tracked repository-local denylist files. Portable and repository
+  sweeps now detect the full bounded family of private-key headers and refuse
+  binary or invalid-UTF-8 evidence instead of omitting it. Fork sweeps require
+  the trusted denylist secret and cannot fall back to the untrusted checkout.
+  Repository release sweeps also inspect every bounded blob introduced by the
+  commit range, so content added and deleted before the final tree cannot
+  become public history unseen.
+- Add public agent instructions and mirrored skills for extracting reusable
+  mechanisms from private implementations without carrying tenant material
+  into Atelier, plus a managed local-service contract for durable loopback
+  authoring and review tools.
+- Document the client-zero adapter rule that exact package identity, installed
+  dependency resolution, CLI version, and `atelier.lock.json` must agree. This
+  prevents a stale sibling checkout from satisfying a current adapter proof.
+- Declare the audited `fast-uri` pin as a direct runtime dependency so packed
+  offline consumer installs resolve the same dependency closure as the source
+  checkout.
+
 ## 0.2.0-alpha.4
 
 Presentation release. No contract changes and no runtime behaviour changes:

package/README.md

@@ -48,7 +48,7 @@ governed projections
 You can see the complete loop in a disposable sample workspace:
 
 ```bash
-npm install --save-dev @mnstry/atelier@0.2.0-alpha.4
+npm install --save-dev @mnstry/atelier@0.2.0-alpha.6
 npx mnstry-atelier init --fixture=sample-workspace --target ./sample
 npx mnstry-atelier graph --project ./sample/atelier.project.json
 npx mnstry-atelier project --project ./sample/atelier.project.json
@@ -146,6 +146,20 @@ best-effort publication.
 Because the checks are local and versioned with the work, the repository can
 prove its state in CI, on a laptop, or inside a larger toolchain.
 
+Repositories that may contribute to a public or shared surface can add a
+private, ignored disclosure denylist and scan either the tracked tree or the
+exact staged index:
+
+```bash
+npx mnstry-atelier disclosure check --staged
+```
+
+The built-in structural pass catches machine-local paths, key material, and
+secret-shaped assignments. A client-aware verdict additionally requires the
+private denylist; the command fails closed when it is absent unless
+`--structural-only` is chosen explicitly. Denylist patterns and matched text
+never belong in the shared repository.
+
 ### 3. Collaboration becomes governed disclosure
 
 Collaboration is not equivalent to giving every participant every file. The
@@ -163,11 +177,22 @@ boundary; it does not silently make access decisions on your behalf.
 graph. The library exposes the same project, graph, validation, and projection
 primitives to code.
 
+Consumer-owned authoring or review services that need a separate durable
+lifecycle follow [the managed local-service contract](./docs/local-services.md).
+That contract standardizes process ownership, private local state, and browser
+recovery without putting a tenant's service details into Atelier.
+
 The shipped agent model is intentionally bounded: the Atelier can assemble
 session context, capability envelopes, and proposed changes, but it does not
 apply those proposals or grant direct write access. It is a local context and
 control layer that another interface can build on, not an autonomous editor.
 
+The separate headless repository supervisor can observe one explicitly
+enrolled Git repository, fetch and fast-forward it, and prepare a bounded
+commit plan. A commit still requires an exact user confirmation and an
+unchanged re-observation; the loopback browser receives no apply endpoint.
+See [Atelier Sync: Deliverable Zero](docs/atelier-sync.md).
+
 ### 5. The repository can power another product
 
 The CLI is one interface. The package is also a library, and its contracts are
@@ -232,18 +257,29 @@ trust boundary.
 This package makes three promises. None of them asks for your trust — each
 one names the command that proves it.
 
-**Nothing leaves your machine, with one exception you can see.** There is no
-telemetry, no update check, no crash reporting, and no send path anywhere in
-the package. The exception: when no actor is configured, `boundary check` and
-`doctor` fall back to the `gh` CLI to resolve your GitHub login, which is an
-authenticated request to GitHub made with your own credentials. Set
-`MNSTRY_ATELIER_ACTOR` and that path is never taken. The only network client
-refuses non-loopback URLs, the served pages carry a policy that authorizes no
-external origin, and a fail-closed gate scans the executable and markup files
-under `src/`, `bin/`, `scripts/`, and `examples/` for egress primitives. Two
-limits worth stating plainly: the gate does not read the `.json` and `.md`
-files under `templates/` and `skills/`, and it does not model
-`child_process`, which is why the `gh` fallback above does not trip it:
+**There is no silent egress; every network path is named.** There is no
+telemetry, update check, crash reporting, managed-runtime upload, or model
+provider path in the package. The exceptions are explicit: `boundary check`
+may invoke `gh api user` after no declared actor matches an explicit `--actor`,
+`MNSTRY_ATELIER_ACTOR`, `GITHUB_ACTOR`, or a configured Git email; repository
+identity checks may invoke `gh api repos/...` to resolve a canonical GitHub
+identity. Those authenticated requests use your own `gh` credentials. A
+recognized explicit actor prevents the boundary actor fallback; recorded
+repository identities let identity checks keep working when the provider is
+unavailable. Explicitly enrolled Atelier Sync may also run bounded Git fetches
+for observation/reconciliation and one non-force push only when the exact
+reviewed commit plan requested and confirmed it, no earlier local commit is
+waiting to be published, and HEAD still names the verified commit object. Sync
+never uses the network actor fallback, follows tags, or recursively publishes
+submodule refs. The package's HTTP client
+refuses non-loopback URLs, the served pages authorize no external origin, and
+release audit scans every executable or markup file in the exact `npm pack`
+inventory for egress primitives. The standalone gate also scans executable and
+markup files under `src/`, `bin/`, `scripts/`, `templates/`, `examples/`, and
+`skills/`. Two limits worth stating plainly: the egress control does not
+interpret data-only `.json` or `.md` files, and it does not model
+`child_process`; the reviewed `gh` and enrolled Git paths above are documented
+subprocess exceptions rather than scanner detections:
 
 ```bash
 npm run egress:check
@@ -280,9 +316,15 @@ receive.
 
 <!-- atelier:block:will-not-do:start -->
 - It does not write to a MNSTRY runtime database.
-- It does not import, provision, publish, or send anything.
-- Except for the documented `gh` actor-resolution fallback, it initiates no
-  external network requests.
+- It does not import, provision, publish, or send project content to a MNSTRY
+  managed runtime.
+- Conformance remains offline. Network access is limited to the documented
+  `gh` actor-resolution fallback and explicitly enrolled Atelier Sync Git
+  operations: bounded fetch for observation/reconciliation, and non-force push
+  only when the exact reviewed commit plan requested and confirmed it, no
+  earlier local commit remains unpublished, and HEAD still names the verified
+  commit object; Sync does not use network actor fallback, follow tags, or
+  recursively publish submodule refs.
 - It does not execute model-assisted analysis or any model provider.
 - It does not include client project content.
 
@@ -316,7 +358,7 @@ Node.js `>=22.18.0 <23` is required. Pin the prerelease while the package
 remains in alpha:
 
 ```bash
-npm install --save-dev @mnstry/atelier@0.2.0-alpha.4
+npm install --save-dev @mnstry/atelier@0.2.0-alpha.6
 ```
 
 Then choose the path that matches what you are building:
@@ -328,11 +370,12 @@ Then choose the path that matches what you are building:
 - [Distribution contracts](./docs/distributions.md)
 - [Conformance and attestation](./docs/attestation.md)
 - [Continuity commitments](./docs/continuity.md)
+- [Assurance controls and evidence map](./docs/assurance-controls.md)
 - [Upgrade notes](./docs/upgrade.md)
 
 ## Status and command reference
 
-Current package: `@mnstry/atelier@0.2.0-alpha.4`.
+Current package: `@mnstry/atelier@0.2.0-alpha.6`.
 
 The alpha package is usable and contract-tested, but its library API may still
 change before a stable release. Pin the exact version in production toolchains.

package/contracts/atelier-repository-observation.v1.schema.json

@@ -0,0 +1,163 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mnstry.ai/schemas/atelier/atelier-repository-observation.v1.schema.json",
+  "$comment": "contract revision 1.0.0 (contract-stability epoch)",
+  "title": "atelier-repository-observation@v1",
+  "description": "Full-state evidence for one explicitly enrolled local Git repository. A complete observation cannot conceal a partial clone, sparse checkout, missing submodule or LFS content, custom filter, or unsupported filesystem root.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "observedAt",
+    "complete",
+    "root",
+    "filesystem",
+    "blockers",
+    "warnings"
+  ],
+  "properties": {
+    "schema": {
+      "const": "atelier-repository-observation@v1"
+    },
+    "contractVersion": {
+      "type": "string",
+      "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+    },
+    "observedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "complete": {
+      "type": "boolean"
+    },
+    "root": {
+      "type": ["string", "null"]
+    },
+    "filesystem": {
+      "type": "object"
+    },
+    "git": {
+      "type": "object"
+    },
+    "bare": {
+      "type": "boolean"
+    },
+    "branch": {
+      "type": "object"
+    },
+    "remotes": {
+      "type": "array",
+      "items": {
+        "type": "object"
+      }
+    },
+    "features": {
+      "type": "object"
+    },
+    "submodules": {
+      "type": "object"
+    },
+    "lfs": {
+      "type": "object"
+    },
+    "status": {
+      "type": "object"
+    },
+    "blockers": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/finding"
+      }
+    },
+    "warnings": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/finding"
+      }
+    },
+    "ext": {
+      "type": "object",
+      "description": "Reserved extension container. Producers MAY add namespaced members; consumers MUST ignore members they do not recognize."
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "complete": {
+            "const": true
+          }
+        },
+        "required": ["complete"]
+      },
+      "then": {
+        "required": ["git", "bare", "branch", "remotes", "features", "submodules", "lfs", "status"],
+        "properties": {
+          "filesystem": {
+            "required": ["supported"],
+            "properties": {
+              "supported": { "const": true }
+            }
+          },
+          "git": {
+            "required": ["executable", "version", "supported", "minimum"],
+            "properties": {
+              "supported": { "const": true }
+            }
+          },
+          "bare": { "const": false },
+          "features": {
+            "required": ["sparseCheckout", "partialClone", "customFilters"],
+            "properties": {
+              "sparseCheckout": { "const": false },
+              "partialClone": { "type": "array", "maxItems": 0 },
+              "customFilters": { "type": "array", "maxItems": 0 }
+            }
+          },
+          "submodules": {
+            "required": ["complete"],
+            "properties": {
+              "complete": { "const": true }
+            }
+          },
+          "lfs": {
+            "required": ["complete"],
+            "properties": {
+              "complete": { "const": true }
+            }
+          },
+          "status": {
+            "required": ["clean", "digest", "entries", "fingerprints", "stagedCount", "unstagedCount", "conflictCount"]
+          },
+          "blockers": {
+            "maxItems": 0
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "message", "details"],
+      "properties": {
+        "code": {
+          "type": "string",
+          "minLength": 1
+        },
+        "message": {
+          "type": "string",
+          "minLength": 1
+        },
+        "details": {
+          "type": "object"
+        },
+        "ext": {
+          "type": "object",
+          "description": "Reserved extension container. Producers MAY add namespaced members; consumers MUST ignore members they do not recognize."
+        }
+      }
+    }
+  }
+}

package/contracts/public-api-baseline.json

@@ -0,0 +1,57 @@
+{
+  "schema": "mnstry.atelier-public-api-baseline@v1",
+  "baselineTag": "v0.2.0-alpha.4",
+  "baselineCommit": "6fed5b9e1077b361e26b2b581ea67a55e7634963",
+  "baselineVersion": "0.2.0-alpha.4",
+  "publishedRegistryArtifact": {
+    "package": "@mnstry/atelier",
+    "version": "0.2.0-alpha.4",
+    "shasum": "9f67f5b7fabc748ec235bbe85587a71b5ad639c8",
+    "integrity": "sha512-mt2vWnFZtBAc8C+bzjcgrIPYRGgVOhFHm4SPDrnXvWgcdDY/G2aUY5KP6YPmjkRCMvewGMsH7Wg+8i63f1/onQ==",
+    "sha256": "a032971977d9fbd3b7adc94f204739d4202b1754d72a77cbc79f4c473850e531",
+    "entryCount": 265,
+    "verifiedAt": "2026-08-25"
+  },
+  "requiredSubpaths": [
+    ".",
+    "./cli",
+    "./project",
+    "./graph",
+    "./projection",
+    "./readiness",
+    "./readiness-protocols",
+    "./server",
+    "./harness",
+    "./support",
+    "./egress",
+    "./boundary",
+    "./upgrade",
+    "./attestation",
+    "./extension-packs",
+    "./analysis/adapter",
+    "./export-contract",
+    "./dry-run",
+    "./contracts/atelier-export.v1.schema.json",
+    "./fixtures/atelier-export/sample-studio-offer.v1.json"
+  ],
+  "requiredModuleExports": {
+    ".": ["ALLOWED_RUNTIME_TARGETS", "ATELIER_LOCK_SCHEMA", "ATELIER_MIGRATION_SCHEMA", "ATELIER_READINESS_SCHEMA", "BASE_MIGRATIONS", "BOUNDARY_POLICY_SCHEMA", "LOCAL_AUDIENCES", "MNSTRY_READINESS_PACK_SCHEMA", "OBJECT_CLASSES", "PROJECT_CONFIG_SCHEMA", "READINESS_PROTOCOL_IDS", "READINESS_PROTOCOL_SLUGS", "RUNTIME_OWNERS", "RUNTIME_VISIBILITIES", "analysisAdapterDryRun", "applyUpgrade", "buildAtelierLock", "buildGraph", "buildProjectProjection", "buildReadiness", "buildSupportBundlePreview", "bundledMnstryReadinessPackV1", "bundledReadinessPack", "bundledReadinessProtocols", "checkAtelierLock", "checkBoundaryPolicy", "checkForbiddenEgress", "contextEnvelope", "createAtelierSidecarServer", "createPromoteEvent", "getBundledReadinessProtocol", "installBoundaryHooks", "loadAtelierLock", "loadBoundaryPolicy", "planUpgrade", "protocolById", "resolveProjectConfig", "validateAtelierExportContract", "validateAtelierExportDryRun", "validateAtelierExportDryRunFile", "validateBoundaryPolicy", "validateJsonSchema", "validateMigrationRecord", "validateProjectConfigDoc", "validateSchemaShape", "validateSupportBundlePayload", "writeAtelierLock"],
+    "./cli": ["DEFAULT_BRAND", "buildCommandHelpText", "buildHelpText", "buildVersionText", "commandMap", "runCli"],
+    "./project": ["EXTERNAL_REPO_KIND", "LOCAL_OVERLAY_ENV", "LOCAL_OVERLAY_FILES", "LOCAL_OVERLAY_SCHEMA", "LOCAL_STATE_DIR", "PROJECT_CONFIG_ARG_PREFIX", "PROJECT_CONFIG_ENV", "PROJECT_CONFIG_SCHEMA", "SUPPORTED_IDENTITY_PROVIDERS", "asObject", "commandProject", "ensureLocalState", "firstString", "gitRemoteUrl", "isExternalRepo", "loadRepoAccess", "localOverlayCandidatePaths", "localStateRoot", "parseArgs", "parseRepoPathOverrides", "projectConfigArg", "readJson", "readLocalOverlay", "readProjectConfig", "remoteHost", "resolvePathValue", "resolveProjectConfig", "stripProjectConfigArgs", "validateProjectConfigDoc", "writeJson"],
+    "./graph": ["VALID_AUDIENCES", "VALID_RELATIONS", "buildGraph", "ignoredSidecarWarnings", "parseFrontmatterYaml", "runGraphCommand"],
+    "./projection": ["buildProjectProjection", "runProjectCommand"],
+    "./readiness": ["ATELIER_READINESS_SCHEMA", "buildReadiness", "runReadinessCommand", "stableReadinessForCheck", "summarizeGraph", "summarizeProjection"],
+    "./readiness-protocols": ["MNSTRY_READINESS_PACK_SCHEMA", "READINESS_PROTOCOL_IDS", "READINESS_PROTOCOL_SCHEMA", "READINESS_PROTOCOL_SLUGS", "READINESS_RUN_SCHEMA", "bundledMnstryReadinessPackV1", "bundledReadinessPack", "bundledReadinessProtocols", "getBundledReadinessProtocol", "protocolById"],
+    "./server": ["ATELIER_CAPABILITIES_SCHEMA", "ATELIER_CONTEXT_SCHEMA", "ATELIER_DOCTOR_SCHEMA", "ATELIER_PRESENCE_SCHEMA", "ATELIER_RESOLVE_SCHEMA", "ATELIER_SESSION_AUTH_SCHEMA", "createAtelierSidecarServer"],
+    "./harness": ["contextEnvelope", "runContextCommand"],
+    "./support": ["BANNED_KEY_PATTERNS", "BANNED_VALUE_PATTERNS", "DEFAULT_SUPPORT_FIELDS", "SUPPORT_BUNDLE_PREVIEW_SCHEMA", "buildSupportBundlePreview", "parseSupportBundleArgs", "readSupportBundleJson", "runSupportCommand", "supportBundlePreview", "validateSupportBundlePayload", "writeOrPrintSupportBundle"],
+    "./egress": ["DEFAULT_EGRESS_SCAN_PATHS", "LOCAL_COMPUTED_ALLOW_MARKER", "TEST_FIXTURE_ALLOW_MARKER", "checkForbiddenEgress", "discoverForbiddenEgressScanFiles", "forbiddenEgressFindingsForText"],
+    "./boundary": ["BOUNDARY_POLICY_SCHEMA", "DEFAULT_FORBIDDEN_PATHS", "LEGACY_PROMOTE_EVENT_SCHEMAS", "PRIVATE_AUDIENCES", "PROMOTE_EVENT_SCHEMA", "SEMANTIC_INITIALIZATION_DEFAULTS", "VALID_AUDIENCES", "VALID_AUTOCOMMIT", "VALID_BOUNDARY_MODES", "VALID_REPO_KINDS", "auditContentRules", "checkBoundaryPolicy", "checkPushContent", "createPromoteEvent", "diffFileSections", "installBoundaryHooks", "loadBoundaryPolicy", "projectBoundaryPolicyPath", "projectGovernanceLedgerPath", "resolveCurrentActor", "runBoundaryAuditCommand", "runBoundaryCheckCommand", "runBoundaryInstallHooksCommand", "runBoundaryPushCheckCommand", "runPromoteCommand", "semanticChangesInFile", "semanticFieldOnLine", "stagedPathsForProject", "validateBoundaryPolicy"],
+    "./upgrade": ["ATELIER_LOCK_SCHEMA", "ATELIER_MIGRATION_SCHEMA", "BASE_MIGRATIONS", "LOCK_FILE", "MIGRATION_CLASSES", "applyMigration", "applyUpgrade", "buildAtelierLock", "checkAtelierLock", "loadAtelierLock", "lockPathForProject", "planUpgrade", "runLockCommand", "runUpgradeCommand", "validateMigrationRecord", "writeAtelierLock"],
+    "./attestation": ["KEY_ENV_VAR", "LOCAL_KEY_FILE", "canonicalize", "generateKeyPair", "loadSigningKey", "payloadHashOf", "safeLabel", "signAttestation", "signDocument", "signingInput", "verifyAttestation", "verifyDocument", "verifyPayloadBinding"],
+    "./extension-packs": ["ATELIER_EXT_NAMESPACE", "EXTENSION_PACK_SCHEMA", "PROTOCOL_POSTURE_POINTS", "RESERVED_NAMESPACE", "RESERVED_NAMESPACE_PATTERN", "computePackDigest", "createProtocolRegistry", "loadExtensionPacks"],
+    "./analysis/adapter": ["analysisAdapterDryRun", "runAnalysisAdapterCommand"],
+    "./export-contract": ["ALLOWED_RUNTIME_TARGETS", "LOCAL_AUDIENCES", "OBJECT_CLASSES", "RUNTIME_OWNERS", "RUNTIME_VISIBILITIES", "validateAtelierExportContract", "validateJsonSchema", "validateSchemaShape"],
+    "./dry-run": ["main", "validateAtelierExportDryRun", "validateAtelierExportDryRunFile"]
+  }
+}

package/docs/assurance-controls.md

@@ -0,0 +1,41 @@
+# Assurance controls and evidence map
+
+This ledger maps public trust claims to the control that enforces them, the
+test that challenges the control, and the limit that remains. It describes the
+source tree; a release decision must additionally record the exact candidate
+commit and packed-tarball digest.
+
+| Claim | Enforcing control | Defensive evidence | Stated limit |
+| --- | --- | --- | --- |
+| Boundary rules cannot silently switch themselves off | `src/boundary/policy.mjs`, `src/boundary/content-rules.mjs`, and generated Git hooks | `boundary:test`; boundary case in `assurance:mutation-smoke` | Repository access remains the source read boundary; an audience label is not encryption |
+| A clean boundary verdict uses complete evidence | Typed Git reads with diff and binary budgets; incomplete reads become blocking diagnostics; Sync requires the enrolled root to be scanned, uses its digest-bound Git for actor and staged evidence, and disables network actor fallback | `test/boundary-content-rules.test.mjs`; Sync boundary-scope, pinned-Git, and no-network actor refusal cases | Budgets intentionally refuse evidence too large to inspect rather than claiming it is clean |
+| Graph classification has one meaning | `src/graph/knowledge-graph.mjs` is canonical; `src/graph/graph.mjs` adapts its result | `graph:test`; graph case in `assurance:mutation-smoke` | Unclassified Markdown is retained as private diagnostic material, not admitted as governed content |
+| The package has no undisclosed runtime egress path | Canonical forbidden-egress scanner plus exact packed-file inventory in `release:audit`; Atelier Sync confines network Git to bounded fetch and an exact-plan, non-force push | egress tests, marker-inventory test, runtime fetch/push refusal tests, and egress case in `assurance:mutation-smoke` | Data-only files are not interpreted; reviewed `gh` actor resolution and explicitly enrolled Git fetch/push are documented subprocess exceptions |
+| User-confirmed repository writes match what was reviewed | Content-bound, expiring plan identifiers; fresh complete observations; exact staged and written-tree blob/mode manifests; post-hook tree, single-parent, and message verification with compare-and-swap rollback; refusal of prior unpublished commits; and an exact verified-object push after HEAD/target revalidation with tag following and recursive submodule publication disabled | `sync:test` plan, expiry, hook/index, late-HEAD, ahead-branch, remote-ref, remote-drift, and evidence-failure cases | Ordinary Git hooks may run, but a hook cannot substitute a different commit object for publication |
+| Resident Sync state cannot escape or grow without bound | Contained private directories, no-follow/identity-checked leaves, a 4,096-entry observation ceiling, bounded state projection, nonce-bound locks with aged abandoned-claim recovery, lock-directory identity validation and an ambiguous live-PID maximum age, consumed plans under age/file/byte ceilings, and corruption-recovering hash-chained traces with per-event/resident ceilings | `sync:test` observation/state ceilings, redirected-state/lock, plan lifecycle, concurrent enrollment/recovery, corruption, and trace ceilings | Machine-local state is diagnostic convenience; Git and readable repository files remain authoritative |
+| Local review serves only generated publication output | Loopback-only bind, required `atelier.manifest.json`, realpath containment, enrolled safe types, POSIX no-follow plus cross-platform leaf type/identity validation for local state, and host/fetch-site/origin/method/nonce checks | `server:security:test`; sidecar case in `assurance:mutation-smoke` | The sidecar is a local review tool, not user authentication or runtime authorization |
+| Collaboration cannot become a hidden apply path | Proposal authority is capability-derived; records are typed; POSIX ledger and snapshot leaves are no-follow, while every platform rejects redirected leaves and validates opened file identity when available; ledger reads are bounded, one-pass for lists, and corrupt tails fail closed | `collaboration:test` and ledger ceiling/performance tests | Collaboration remains copy-only proposal metadata; snapshots are rebuildable projections and Git review owns source changes |
+| Expected operator failures are actionable without leaking internals | Typed project/JSON diagnostics and the CLI execution wrapper | `test/cli-brand.test.mjs` | Unexpected stacks require the operator to opt in with `ATELIER_DEBUG=1` |
+| Published APIs do not disappear silently | Tag-derived subpath and named-export baseline plus version/tag identity refusal | `public-api:compat`; `test/public-api-compat.test.mjs` | Additive API checks do not decide whether a new version number is appropriate |
+| The published artifact is the artifact tested | `release:candidate` packs once, binds SHA-256, sends that exact archive through allowlist/content audit, bare-consumer install, all-export import, and branded distribution smoke, then the trusted-publishing workflow retains and publishes that same tarball path | `release:audit`, `consumer:smoke`, `distribution:smoke`, `assurance:mutation-smoke`, `publish-workflow.test.mjs` | Passing gates does not publish, deploy, or constitute an external reviewer’s approval |
+
+The release-blocking command is `npm run prepublishOnly`. It includes positive
+regression suites and deliberately broken local fixtures. The latter prove
+that boundary, graph, egress, sidecar, and distribution controls still refuse
+their named failure modes; they do not exercise a live abuse path.
+
+## Exact-candidate evidence
+
+At candidate cut, retain all of the following together:
+
+1. the Git commit SHA and a clean working-tree check;
+2. the `npm pack --json` inventory and tarball SHA-256;
+3. outputs from syntax, contracts, public-API compatibility, migrations, repository disclosure,
+   release audit, full tests, mutation smoke, bare consumer, and distribution
+   smoke;
+4. a defensive review tied to that same commit and digest; and
+5. explicit human decisions for versioning, publication, deployment, or any
+   external communication.
+
+Evidence for a different commit or a dirty tree is not evidence for the
+candidate.

package/docs/atelier-runtime.md

@@ -14,6 +14,8 @@ The package owns reusable mechanics:
 - proposal-only collaboration metadata;
 - support-bundle dry runs with no send path;
 - export dry-run validation for `atelier-export@v1`.
+- explicit single-repository enrollment and full-state Git observation;
+- fast-forward-only reconciliation and two-phase user-confirmed commits.
 
 Project adapters own project facts: repo roster, source roots, read-boundary
 config, extension packs, brand language, and generated project outputs.
@@ -28,7 +30,31 @@ runtime authority.
 
 ## Safety Posture
 
-The default package posture is no telemetry, no external network egress, no
-runtime mutation, no browser apply endpoint, and no model-assisted analysis execution.
+The default package posture is no telemetry, no MNSTRY runtime mutation, no
+browser apply endpoint, and no model-assisted analysis execution. Conformance
+is offline. The only documented subprocess network paths are the bounded `gh`
+actor-resolution fallback and explicitly enrolled Atelier Sync Git fetch and
+user-confirmed non-force push operations.
 Provider analysis output may only enter as proposed `atelier-claim@v1` records
 until explicitly reviewed by the project owner.
+
+`atelier dev` is narrower than a general static server. It refuses non-loopback
+bind hosts, requires a generated `atelier.manifest.json`, and publishes only
+manifest-enrolled HTML, script, style, and image files that remain inside the
+workspace after realpath resolution. Hidden paths, local state, secret-shaped
+names, symlinks, unknown file types, and unenrolled files are unavailable.
+Reads validate the loopback host and fetch metadata; mutations additionally
+require an allowed method, exact same origin, and the session nonce.
+
+Collaboration endpoints are copy-only: they create or review proposal records;
+they do not apply source changes. Authority is derived from declared
+capabilities and apply endpoints, never inferred from action-like prose. A
+partially corrupt ledger returns typed incomplete evidence and blocks a clean
+claim. Ledger reads and records are bounded, appends are locked, and retention
+changes happen only through explicit compaction.
+
+The local Git supervisor is a separate mechanical authority surface. It may
+create a repository commit only from an unchanged, bounded plan after the user
+repeats its exact operation id. That repository write is not a MNSTRY runtime
+mutation and does not grant proposal apply authority to the browser sidecar.
+See [Atelier Sync: Deliverable Zero](./atelier-sync.md).