@mnstry/atelier 0.2.0-alpha.5 → 0.2.0-alpha.6

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.2.0-alpha.6
+
+- Add Deliverable Zero for Atelier Sync: explicit single-repository
+  enrollment, a pinned direct-process Git adapter, executable repository
+  completeness observations, fast-forward-only reconciliation, per-repository
+  locking, hash-chained local operation traces, pause/resume control, and a
+  two-phase user-confirmed commit-and-publish path. No desktop shell, watcher
+  dependency, semantic conflict resolution, force operation, browser apply
+  endpoint, telemetry, or hidden upload is introduced.
+- Raise the Sync Git floor to 2.40 so default global and system attributes can
+  be observed, bind publication to the single resolved push URL, refuse URL
+  rewrite ambiguity, strip every inherited `GIT_*` process control, keep
+  read-only commands mutation-free, and return non-zero exits for paused status
+  and failed publication.
+
 ## 0.2.0-alpha.5
 
 - Harden boundary enforcement so path globs use segment-aware matching, an

package/README.md

@@ -48,7 +48,7 @@ governed projections
 You can see the complete loop in a disposable sample workspace:
 
 ```bash
-npm install --save-dev @mnstry/atelier@0.2.0-alpha.5
+npm install --save-dev @mnstry/atelier@0.2.0-alpha.6
 npx mnstry-atelier init --fixture=sample-workspace --target ./sample
 npx mnstry-atelier graph --project ./sample/atelier.project.json
 npx mnstry-atelier project --project ./sample/atelier.project.json
@@ -187,6 +187,12 @@ session context, capability envelopes, and proposed changes, but it does not
 apply those proposals or grant direct write access. It is a local context and
 control layer that another interface can build on, not an autonomous editor.
 
+The separate headless repository supervisor can observe one explicitly
+enrolled Git repository, fetch and fast-forward it, and prepare a bounded
+commit plan. A commit still requires an exact user confirmation and an
+unchanged re-observation; the loopback browser receives no apply endpoint.
+See [Atelier Sync: Deliverable Zero](docs/atelier-sync.md).
+
 ### 5. The repository can power another product
 
 The CLI is one interface. The package is also a library, and its contracts are
@@ -251,24 +257,29 @@ trust boundary.
 This package makes three promises. None of them asks for your trust — each
 one names the command that proves it.
 
-**Nothing leaves your machine, with one exception you can see.** There is no
-telemetry, no update check, no crash reporting, and no send path anywhere in
-the package. The exceptions are explicit: `boundary check` may invoke `gh api
-user` after no declared actor matches an explicit `--actor`,
+**There is no silent egress; every network path is named.** There is no
+telemetry, update check, crash reporting, managed-runtime upload, or model
+provider path in the package. The exceptions are explicit: `boundary check`
+may invoke `gh api user` after no declared actor matches an explicit `--actor`,
 `MNSTRY_ATELIER_ACTOR`, `GITHUB_ACTOR`, or a configured Git email; repository
 identity checks may invoke `gh api repos/...` to resolve a canonical GitHub
 identity. Those authenticated requests use your own `gh` credentials. A
 recognized explicit actor prevents the boundary actor fallback; recorded
 repository identities let identity checks keep working when the provider is
-unavailable. The only network client
-refuses non-loopback URLs, the served pages carry a policy that authorizes no
-external origin, and release audit scans every executable or markup file in
-the exact `npm pack` inventory for egress primitives. The standalone gate also
-scans executable and markup files under `src/`, `bin/`, `scripts/`,
-`templates/`, `examples/`, and `skills/`. Two limits worth stating plainly:
-the egress control does not interpret data-only `.json` or `.md` files, and it
-does not model `child_process`; the two reviewed `gh` paths above are therefore
-documented exceptions rather than scanner detections:
+unavailable. Explicitly enrolled Atelier Sync may also run bounded Git fetches
+for observation/reconciliation and one non-force push only when the exact
+reviewed commit plan requested and confirmed it, no earlier local commit is
+waiting to be published, and HEAD still names the verified commit object. Sync
+never uses the network actor fallback, follows tags, or recursively publishes
+submodule refs. The package's HTTP client
+refuses non-loopback URLs, the served pages authorize no external origin, and
+release audit scans every executable or markup file in the exact `npm pack`
+inventory for egress primitives. The standalone gate also scans executable and
+markup files under `src/`, `bin/`, `scripts/`, `templates/`, `examples/`, and
+`skills/`. Two limits worth stating plainly: the egress control does not
+interpret data-only `.json` or `.md` files, and it does not model
+`child_process`; the reviewed `gh` and enrolled Git paths above are documented
+subprocess exceptions rather than scanner detections:
 
 ```bash
 npm run egress:check
@@ -305,9 +316,15 @@ receive.
 
 <!-- atelier:block:will-not-do:start -->
 - It does not write to a MNSTRY runtime database.
-- It does not import, provision, publish, or send anything.
-- Except for the documented `gh` actor-resolution fallback, it initiates no
-  external network requests.
+- It does not import, provision, publish, or send project content to a MNSTRY
+  managed runtime.
+- Conformance remains offline. Network access is limited to the documented
+  `gh` actor-resolution fallback and explicitly enrolled Atelier Sync Git
+  operations: bounded fetch for observation/reconciliation, and non-force push
+  only when the exact reviewed commit plan requested and confirmed it, no
+  earlier local commit remains unpublished, and HEAD still names the verified
+  commit object; Sync does not use network actor fallback, follow tags, or
+  recursively publish submodule refs.
 - It does not execute model-assisted analysis or any model provider.
 - It does not include client project content.
 
@@ -341,7 +358,7 @@ Node.js `>=22.18.0 <23` is required. Pin the prerelease while the package
 remains in alpha:
 
 ```bash
-npm install --save-dev @mnstry/atelier@0.2.0-alpha.5
+npm install --save-dev @mnstry/atelier@0.2.0-alpha.6
 ```
 
 Then choose the path that matches what you are building:
@@ -358,7 +375,7 @@ Then choose the path that matches what you are building:
 
 ## Status and command reference
 
-Current package: `@mnstry/atelier@0.2.0-alpha.5`.
+Current package: `@mnstry/atelier@0.2.0-alpha.6`.
 
 The alpha package is usable and contract-tested, but its library API may still
 change before a stable release. Pin the exact version in production toolchains.

package/contracts/atelier-repository-observation.v1.schema.json

@@ -0,0 +1,163 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mnstry.ai/schemas/atelier/atelier-repository-observation.v1.schema.json",
+  "$comment": "contract revision 1.0.0 (contract-stability epoch)",
+  "title": "atelier-repository-observation@v1",
+  "description": "Full-state evidence for one explicitly enrolled local Git repository. A complete observation cannot conceal a partial clone, sparse checkout, missing submodule or LFS content, custom filter, or unsupported filesystem root.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "observedAt",
+    "complete",
+    "root",
+    "filesystem",
+    "blockers",
+    "warnings"
+  ],
+  "properties": {
+    "schema": {
+      "const": "atelier-repository-observation@v1"
+    },
+    "contractVersion": {
+      "type": "string",
+      "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+    },
+    "observedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "complete": {
+      "type": "boolean"
+    },
+    "root": {
+      "type": ["string", "null"]
+    },
+    "filesystem": {
+      "type": "object"
+    },
+    "git": {
+      "type": "object"
+    },
+    "bare": {
+      "type": "boolean"
+    },
+    "branch": {
+      "type": "object"
+    },
+    "remotes": {
+      "type": "array",
+      "items": {
+        "type": "object"
+      }
+    },
+    "features": {
+      "type": "object"
+    },
+    "submodules": {
+      "type": "object"
+    },
+    "lfs": {
+      "type": "object"
+    },
+    "status": {
+      "type": "object"
+    },
+    "blockers": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/finding"
+      }
+    },
+    "warnings": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/finding"
+      }
+    },
+    "ext": {
+      "type": "object",
+      "description": "Reserved extension container. Producers MAY add namespaced members; consumers MUST ignore members they do not recognize."
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "complete": {
+            "const": true
+          }
+        },
+        "required": ["complete"]
+      },
+      "then": {
+        "required": ["git", "bare", "branch", "remotes", "features", "submodules", "lfs", "status"],
+        "properties": {
+          "filesystem": {
+            "required": ["supported"],
+            "properties": {
+              "supported": { "const": true }
+            }
+          },
+          "git": {
+            "required": ["executable", "version", "supported", "minimum"],
+            "properties": {
+              "supported": { "const": true }
+            }
+          },
+          "bare": { "const": false },
+          "features": {
+            "required": ["sparseCheckout", "partialClone", "customFilters"],
+            "properties": {
+              "sparseCheckout": { "const": false },
+              "partialClone": { "type": "array", "maxItems": 0 },
+              "customFilters": { "type": "array", "maxItems": 0 }
+            }
+          },
+          "submodules": {
+            "required": ["complete"],
+            "properties": {
+              "complete": { "const": true }
+            }
+          },
+          "lfs": {
+            "required": ["complete"],
+            "properties": {
+              "complete": { "const": true }
+            }
+          },
+          "status": {
+            "required": ["clean", "digest", "entries", "fingerprints", "stagedCount", "unstagedCount", "conflictCount"]
+          },
+          "blockers": {
+            "maxItems": 0
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "message", "details"],
+      "properties": {
+        "code": {
+          "type": "string",
+          "minLength": 1
+        },
+        "message": {
+          "type": "string",
+          "minLength": 1
+        },
+        "details": {
+          "type": "object"
+        },
+        "ext": {
+          "type": "object",
+          "description": "Reserved extension container. Producers MAY add namespaced members; consumers MUST ignore members they do not recognize."
+        }
+      }
+    }
+  }
+}

package/docs/assurance-controls.md

@@ -8,9 +8,11 @@ commit and packed-tarball digest.
 | Claim | Enforcing control | Defensive evidence | Stated limit |
 | --- | --- | --- | --- |
 | Boundary rules cannot silently switch themselves off | `src/boundary/policy.mjs`, `src/boundary/content-rules.mjs`, and generated Git hooks | `boundary:test`; boundary case in `assurance:mutation-smoke` | Repository access remains the source read boundary; an audience label is not encryption |
-| A clean boundary verdict uses complete evidence | Typed Git reads with diff and binary budgets; incomplete reads become blocking diagnostics | `test/boundary-content-rules.test.mjs` | Budgets intentionally refuse evidence too large to inspect rather than claiming it is clean |
+| A clean boundary verdict uses complete evidence | Typed Git reads with diff and binary budgets; incomplete reads become blocking diagnostics; Sync requires the enrolled root to be scanned, uses its digest-bound Git for actor and staged evidence, and disables network actor fallback | `test/boundary-content-rules.test.mjs`; Sync boundary-scope, pinned-Git, and no-network actor refusal cases | Budgets intentionally refuse evidence too large to inspect rather than claiming it is clean |
 | Graph classification has one meaning | `src/graph/knowledge-graph.mjs` is canonical; `src/graph/graph.mjs` adapts its result | `graph:test`; graph case in `assurance:mutation-smoke` | Unclassified Markdown is retained as private diagnostic material, not admitted as governed content |
-| The package has no undisclosed runtime egress path | Canonical forbidden-egress scanner plus exact packed-file inventory in `release:audit` | egress tests, marker-inventory test, and egress case in `assurance:mutation-smoke` | Data-only files are not interpreted; reviewed `gh` subprocess fallbacks are documented exceptions |
+| The package has no undisclosed runtime egress path | Canonical forbidden-egress scanner plus exact packed-file inventory in `release:audit`; Atelier Sync confines network Git to bounded fetch and an exact-plan, non-force push | egress tests, marker-inventory test, runtime fetch/push refusal tests, and egress case in `assurance:mutation-smoke` | Data-only files are not interpreted; reviewed `gh` actor resolution and explicitly enrolled Git fetch/push are documented subprocess exceptions |
+| User-confirmed repository writes match what was reviewed | Content-bound, expiring plan identifiers; fresh complete observations; exact staged and written-tree blob/mode manifests; post-hook tree, single-parent, and message verification with compare-and-swap rollback; refusal of prior unpublished commits; and an exact verified-object push after HEAD/target revalidation with tag following and recursive submodule publication disabled | `sync:test` plan, expiry, hook/index, late-HEAD, ahead-branch, remote-ref, remote-drift, and evidence-failure cases | Ordinary Git hooks may run, but a hook cannot substitute a different commit object for publication |
+| Resident Sync state cannot escape or grow without bound | Contained private directories, no-follow/identity-checked leaves, a 4,096-entry observation ceiling, bounded state projection, nonce-bound locks with aged abandoned-claim recovery, lock-directory identity validation and an ambiguous live-PID maximum age, consumed plans under age/file/byte ceilings, and corruption-recovering hash-chained traces with per-event/resident ceilings | `sync:test` observation/state ceilings, redirected-state/lock, plan lifecycle, concurrent enrollment/recovery, corruption, and trace ceilings | Machine-local state is diagnostic convenience; Git and readable repository files remain authoritative |
 | Local review serves only generated publication output | Loopback-only bind, required `atelier.manifest.json`, realpath containment, enrolled safe types, POSIX no-follow plus cross-platform leaf type/identity validation for local state, and host/fetch-site/origin/method/nonce checks | `server:security:test`; sidecar case in `assurance:mutation-smoke` | The sidecar is a local review tool, not user authentication or runtime authorization |
 | Collaboration cannot become a hidden apply path | Proposal authority is capability-derived; records are typed; POSIX ledger and snapshot leaves are no-follow, while every platform rejects redirected leaves and validates opened file identity when available; ledger reads are bounded, one-pass for lists, and corrupt tails fail closed | `collaboration:test` and ledger ceiling/performance tests | Collaboration remains copy-only proposal metadata; snapshots are rebuildable projections and Git review owns source changes |
 | Expected operator failures are actionable without leaking internals | Typed project/JSON diagnostics and the CLI execution wrapper | `test/cli-brand.test.mjs` | Unexpected stacks require the operator to opt in with `ATELIER_DEBUG=1` |

package/docs/atelier-runtime.md

@@ -14,6 +14,8 @@ The package owns reusable mechanics:
 - proposal-only collaboration metadata;
 - support-bundle dry runs with no send path;
 - export dry-run validation for `atelier-export@v1`.
+- explicit single-repository enrollment and full-state Git observation;
+- fast-forward-only reconciliation and two-phase user-confirmed commits.
 
 Project adapters own project facts: repo roster, source roots, read-boundary
 config, extension packs, brand language, and generated project outputs.
@@ -28,8 +30,11 @@ runtime authority.
 
 ## Safety Posture
 
-The default package posture is no telemetry, no external network egress, no
-runtime mutation, no browser apply endpoint, and no model-assisted analysis execution.
+The default package posture is no telemetry, no MNSTRY runtime mutation, no
+browser apply endpoint, and no model-assisted analysis execution. Conformance
+is offline. The only documented subprocess network paths are the bounded `gh`
+actor-resolution fallback and explicitly enrolled Atelier Sync Git fetch and
+user-confirmed non-force push operations.
 Provider analysis output may only enter as proposed `atelier-claim@v1` records
 until explicitly reviewed by the project owner.
 
@@ -47,3 +52,9 @@ capabilities and apply endpoints, never inferred from action-like prose. A
 partially corrupt ledger returns typed incomplete evidence and blocks a clean
 claim. Ledger reads and records are bounded, appends are locked, and retention
 changes happen only through explicit compaction.
+
+The local Git supervisor is a separate mechanical authority surface. It may
+create a repository commit only from an unchanged, bounded plan after the user
+repeats its exact operation id. That repository write is not a MNSTRY runtime
+mutation and does not grant proposal apply authority to the browser sidecar.
+See [Atelier Sync: Deliverable Zero](./atelier-sync.md).

package/docs/atelier-sync.md

@@ -0,0 +1,171 @@
+# Atelier Sync: Deliverable Zero
+
+Atelier Sync is the collaborator-facing name for the resident repository
+supervisor. Deliverable Zero is deliberately headless: it proves the Git,
+filesystem, state-machine, recovery, and user-authority boundaries before a
+tray shell or installer is allowed to make the product feel finished.
+
+This is repository mechanics, not MNSTRY runtime authority. A Git commit
+changes the enrolled repository. It does not mutate MNSTRY identity, consent,
+visibility, provisioning, commerce, sessions, audit, or any other managed
+runtime object.
+
+## Authority contract
+
+- Enrollment names exactly one repository. Atelier never scans a home folder.
+- One resolved absolute system Git executable, version, and executable digest
+  owns Git semantics for the enrollment. Every inherited `GIT_*` variable is
+  stripped from supervised Git calls before Atelier adds its small fixed
+  safety environment. Custom SSH transport belongs in the user's SSH config;
+  credentials continue through ordinary Git credential helpers. Git `2.40.0`
+  or newer is required so global and system attribute provenance is observable.
+- Every cycle observes the full repository. There is no watcher correctness
+  dependency in Deliverable Zero.
+- Fetch and fast-forward-only reconciliation are mechanical operations.
+- Commit creation is a two-phase, user-confirmed operation. Planning records
+  the head, branch, complete status digest, exact file paths, commit message,
+  reviewed blob/mode manifest, diff summary, and exact optional upstream push
+  identity. The push identity digest covers the single resolved, normalized,
+  credential-free execution destination; persisted display evidence likewise
+  strips authentication material, query strings, and fragments. Multiple push
+  URLs and `url.*.insteadOf`/`pushInsteadOf` rewrites are refused as ambiguous.
+  Every authoritative field is bound into the operation id.
+  Execution requires that exact id and refuses if the plan, repository,
+  staged bytes/modes, written tree, commit parent/message, or publish target
+  changed. A publish plan is refused while any earlier local commit remains
+  unpublished, and publication names the exact verified commit object rather
+  than a movable `HEAD` ref. Plans expire after 24 hours, are consumed by a
+  definitive execution attempt, and are held under resident file/count
+  ceilings. Expired, malformed, or oversized retained plan files are removed
+  under the repository lock before those ceilings are enforced; redirected
+  plan state remains a hard refusal.
+- A commit plan cannot absorb pre-existing staged work. It stages only literal,
+  explicitly reviewed paths.
+- Configured Atelier boundary policy is checked against the staged change set
+  before commit creation using the enrolled Git executable. When that policy
+  declares private-domain ownership, actor verification is blocking even in
+  legacy-warning mode. The Sync path disables the boundary command's optional
+  network `gh api user` fallback and fails closed when local actor evidence is
+  insufficient. Commit history is provenance, not current-user identity, and
+  is not accepted as actor evidence on this path. Policies without a declared private-domain owner do not invent
+  an actor requirement. Ordinary Git hooks still run; the resulting commit tree,
+  single parent, and message must equal the reviewed authority or the local
+  commit is rolled back and publication is refused.
+- Push is present only when the reviewed plan requested it, the branch had no
+  prior unpublished commits, and HEAD still names the exact verified commit.
+  Atelier re-resolves the single push URL immediately before publication and
+  pushes the exact commit object directly to that reviewed destination. Push is
+  never forced, never follows tags, and never recursively publishes submodule
+  refs. When fetch and push resolve to the same credential-free identity,
+  Atelier refreshes the exact remote-tracking branch and re-observes before it
+  reports `committed-and-published`. A distinct configured push URL is honored,
+  but remains an explicit attention state because it cannot prove the fetch
+  upstream synchronized. A failed push or post-push tracking refresh preserves
+  the local commit, creates one stable attention state, and returns a non-zero
+  command exit.
+- Semantic conflict resolution, merge commits, rebase, reset, force push,
+  browser apply, broad path scans, telemetry, and hidden upload are absent.
+
+## Repository completeness
+
+`atelier sync status` emits a supervisor envelope whose `state.observation`
+contains the current `atelier-repository-observation@v1` document. That
+observation cannot report `complete: true` when any of these are unresolved:
+
+- lexically identifiable provider-managed, UNC/network, WSL-cross-boundary, or
+  unclassified external filesystem roots (mapped-drive classification remains
+  an operating-system integration concern for the signed beta);
+- an unsupported Git engine or bare repository;
+- sparse checkout, partial clone, or shallow repository state;
+- tracked paths carrying `assume-unchanged` or `skip-worktree` index flags;
+- missing or unhealthy submodules;
+- required Git LFS content without a working LFS integration, including LFS
+  semantics declared by tracked or untracked worktree attributes, repository
+  info attributes, and default global or system attributes;
+- an unclassified custom clean, smudge, or process filter;
+- a configured `core.hooksPath` whose executable behavior is outside the
+  reviewed repository contract;
+- a remote URL whose authentication shape cannot be classified;
+- multiple push destinations or any configured Git URL rewrite rule;
+- any required Git evidence read that fails, times out, exceeds its budget, or
+  cannot be parsed.
+- a change set above the 4,096-entry resident observation ceiling; or
+- a `core.attributesFile` outside the repository-owned/tracked attributes
+  boundary whose filter semantics have not been classified.
+
+HTTPS through Git Credential Manager, SSH through the user's existing SSH
+configuration, and local test remotes are classified explicitly. Atelier does
+not collect or store provider credentials.
+
+## Local operation state
+
+Ignored `.atelier-local/runtime/` contains:
+
+- `enrollment.json` — exact repository and Git engine;
+- `state.json` — a bounded projection of healthy, attention, or paused state;
+- `control.json` — user pause/freeze state;
+- `plans/` — expiring, consumed reviewed commit plans under count/byte ceilings;
+- `operations.ndjson` — sequence- and hash-chained resident trace with explicit
+  hash-bound checkpoints before its byte or record ceiling, with a fresh
+  digest-linked generation after a torn or corrupt chain; and
+- an atomic per-repository operation lock.
+
+Every directory component is containment-checked and every state leaf is
+opened without following redirects where the platform supports it, with leaf
+type and identity checks on every platform. Stale-lock recovery uses an
+exclusive recovery claim, ages out an abandoned recovery claim after the owner
+grace interval, identity-checks the lock directory before and after quarantine,
+and quarantines only the claimed stale directory; it never recursively deletes
+a newly acquired lock. A live PID without durable process identity cannot wedge
+the repository forever: its owner record becomes recoverable after the 24-hour
+maximum operation age. Enrollment takes the same lock as every other
+authoritative state mutation.
+
+Deleting this directory removes convenience and diagnostics. It cannot change
+repository meaning. Git plus readable files remain authoritative.
+
+## Engineering commands
+
+```bash
+atelier sync enroll --repo /absolute/path/to/repository
+atelier sync status --repo /absolute/path/to/repository
+atelier sync reconcile --repo /absolute/path/to/repository
+atelier sync run --repo /absolute/path/to/repository --once
+
+atelier sync plan \
+  --repo /absolute/path/to/repository \
+  --path docs/decision.md \
+  --message "docs: record decision" \
+  --publish
+
+# Repeat the exact operation id printed by plan:
+atelier sync commit \
+  --repo /absolute/path/to/repository \
+  --operation operation-... \
+  --confirm operation-...
+```
+
+`status`, `audit`, `reconcile`, `run --once`, and `commit` return a non-zero
+process exit when their result is not healthy, so automation cannot treat a
+paused state, attention state, or failed publication as success merely because
+JSON was emitted.
+
+The future native shell may label the final two commands **Commit & sync**.
+It must not bypass either phase.
+
+The repeated operation id is a visible user-intent confirmation gate, not an
+authorization secret. Local software able to read and modify the repository is
+inside the same operating-system trust domain; the control prevents implicit
+or stale execution, not a hostile process with the user's filesystem access.
+
+## Evidence boundary
+
+Deliverable Zero proves the headless supervisor contract on Linux and macOS,
+with Windows CI covering the portable observation, state, and direct-process
+contract. POSIX executable-wrapper substitution is explicitly skipped on
+Windows; native Windows wrapper-injection proof, signed installation,
+background launch at user login, Windows Home/Pro device behavior, macOS
+notarization, and a nontechnical-user workflow belong to the signed
+collaborator beta. Repositories without an initial commit are not supported by
+this deliverable. A Git executable upgrade changes enrolled identity and
+requires re-enrollment.

package/docs/blocks/claims.md

@@ -1,24 +1,29 @@
 This package makes three promises. None of them asks for your trust — each
 one names the command that proves it.
 
-**Nothing leaves your machine, with one exception you can see.** There is no
-telemetry, no update check, no crash reporting, and no send path anywhere in
-the package. The exceptions are explicit: `boundary check` may invoke `gh api
-user` after no declared actor matches an explicit `--actor`,
+**There is no silent egress; every network path is named.** There is no
+telemetry, update check, crash reporting, managed-runtime upload, or model
+provider path in the package. The exceptions are explicit: `boundary check`
+may invoke `gh api user` after no declared actor matches an explicit `--actor`,
 `MNSTRY_ATELIER_ACTOR`, `GITHUB_ACTOR`, or a configured Git email; repository
 identity checks may invoke `gh api repos/...` to resolve a canonical GitHub
 identity. Those authenticated requests use your own `gh` credentials. A
 recognized explicit actor prevents the boundary actor fallback; recorded
 repository identities let identity checks keep working when the provider is
-unavailable. The only network client
-refuses non-loopback URLs, the served pages carry a policy that authorizes no
-external origin, and release audit scans every executable or markup file in
-the exact `npm pack` inventory for egress primitives. The standalone gate also
-scans executable and markup files under `src/`, `bin/`, `scripts/`,
-`templates/`, `examples/`, and `skills/`. Two limits worth stating plainly:
-the egress control does not interpret data-only `.json` or `.md` files, and it
-does not model `child_process`; the two reviewed `gh` paths above are therefore
-documented exceptions rather than scanner detections:
+unavailable. Explicitly enrolled Atelier Sync may also run bounded Git fetches
+for observation/reconciliation and one non-force push only when the exact
+reviewed commit plan requested and confirmed it, no earlier local commit is
+waiting to be published, and HEAD still names the verified commit object. Sync
+never uses the network actor fallback, follows tags, or recursively publishes
+submodule refs. The package's HTTP client
+refuses non-loopback URLs, the served pages authorize no external origin, and
+release audit scans every executable or markup file in the exact `npm pack`
+inventory for egress primitives. The standalone gate also scans executable and
+markup files under `src/`, `bin/`, `scripts/`, `templates/`, `examples/`, and
+`skills/`. Two limits worth stating plainly: the egress control does not
+interpret data-only `.json` or `.md` files, and it does not model
+`child_process`; the reviewed `gh` and enrolled Git paths above are documented
+subprocess exceptions rather than scanner detections:
 
 ```bash
 npm run egress:check

package/docs/blocks/will-not-do.md

@@ -1,7 +1,13 @@
 - It does not write to a MNSTRY runtime database.
-- It does not import, provision, publish, or send anything.
-- Except for the documented `gh` actor-resolution fallback, it initiates no
-  external network requests.
+- It does not import, provision, publish, or send project content to a MNSTRY
+  managed runtime.
+- Conformance remains offline. Network access is limited to the documented
+  `gh` actor-resolution fallback and explicitly enrolled Atelier Sync Git
+  operations: bounded fetch for observation/reconciliation, and non-force push
+  only when the exact reviewed commit plan requested and confirmed it, no
+  earlier local commit remains unpublished, and HEAD still names the verified
+  commit object; Sync does not use network actor fallback, follow tags, or
+  recursively publish submodule refs.
 - It does not execute model-assisted analysis or any model provider.
 - It does not include client project content.
 

package/docs/install.md

@@ -30,19 +30,19 @@ The registry is the distribution channel of record, as `docs/continuity.md`
 commits:
 
 ```bash
-npm install --save-dev @mnstry/atelier@0.2.0-alpha.5
+npm install --save-dev @mnstry/atelier@0.2.0-alpha.6
 ```
 
 Installing from the matching Git tag resolves to the same reviewed commit:
 
 ```bash
-npm install --save-dev "git+https://github.com/MNSTRY/atelier.git#v0.2.0-alpha.5"
+npm install --save-dev "git+https://github.com/MNSTRY/atelier.git#v0.2.0-alpha.6"
 ```
 
 Or over SSH:
 
 ```bash
-npm install --save-dev "git+ssh://git@github.com/MNSTRY/atelier.git#v0.2.0-alpha.5"
+npm install --save-dev "git+ssh://git@github.com/MNSTRY/atelier.git#v0.2.0-alpha.6"
 ```
 
 Keep the `@mnstry/` scope — see the command-form note above for why the

package/docs/release-engineering.md

@@ -116,8 +116,17 @@ function signatures, types, or behavior.
 ### egress:check
 
 `npm run egress:check` (`atelier egress check`) scans package runtime paths for
-forbidden non-localhost egress. The package claims no network egress in runtime
-paths; this gate is the mechanical check behind that claim.
+forbidden non-localhost HTTP egress primitives. The package claims no silent or
+undocumented runtime egress; this gate is one mechanical check behind that
+claim. It does not interpret data-only Markdown/JSON and does not model
+`child_process`, so the reviewed `gh` identity-resolution subprocesses and the
+explicitly enrolled Atelier Sync Git fetch/non-force-push subprocesses are
+documented exceptions backed by dedicated refusal tests. Sync refuses fetch on
+an incomplete observation, refuses publish while prior local commits are
+unpublished, strips repository/config retargeting environment variables, and
+pushes the exact post-hook-verified commit object without following tags or
+recursively publishing submodule refs. Its boundary check also suppresses the
+optional network actor fallback.
 
 ### consumer:smoke