@mnstry/atelier 0.2.0-alpha.5 → 0.2.0-alpha.6

package/docs/upgrade.md

@@ -5,6 +5,21 @@ workspace between Atelier package releases. The flow is local-only: it does not
 provision repositories, contact a Git host, mutate the MNSTRY runtime, or write
 through a browser view.
 
+## Upgrading to 0.2.0-alpha.6
+
+This release adds Atelier Sync Deliverable Zero: a headless, local repository
+supervisor with explicit enrollment, complete repository observations,
+fast-forward-only reconciliation, pause/resume control, hash-chained local
+operation traces, and two-phase user-confirmed commit and publication. It does
+not add a desktop shell, semantic conflict resolution, force operations,
+telemetry, or unattended semantic writes.
+
+Consumers that adopt the new runtime should enroll one repository explicitly,
+treat watchers as hints rather than truth, require a fresh complete observation
+before each confirmed mutation, and keep commit and publication as separate
+user decisions. Existing consumers that do not import the runtime subpaths are
+contract-compatible and need only update their pinned dependency.
+
 ## Upgrading to 0.2.0-alpha.5
 
 This release hardens public/private boundary enforcement, local serving,
@@ -117,7 +132,7 @@ For registry installs, pin the exact version and record the resolved version
 in the lockfile:
 
 ```bash
-npm install --save-dev @mnstry/atelier@0.2.0-alpha.5
+npm install --save-dev @mnstry/atelier@0.2.0-alpha.6
 npx mnstry-atelier lock write --project ./atelier.project.json
 ```
 
@@ -125,7 +140,7 @@ For Git installs, pin the release tag rather than a branch, so the lock file
 records exactly what was reviewed:
 
 ```bash
-npm install --save-dev "git+https://github.com/MNSTRY/atelier.git#v0.2.0-alpha.5"
+npm install --save-dev "git+https://github.com/MNSTRY/atelier.git#v0.2.0-alpha.6"
 npx mnstry-atelier lock write --project ./atelier.project.json
 ```
 

package/fixtures/atelier-repository-observation/invalid/complete-with-blocker.v1.json

@@ -0,0 +1,18 @@
+{
+  "schema": "atelier-repository-observation@v1",
+  "observedAt": "2026-08-25T00:00:00.000Z",
+  "complete": true,
+  "root": "/workspace/project",
+  "filesystem": {
+    "supported": true,
+    "code": "local-filesystem"
+  },
+  "blockers": [
+    {
+      "code": "partial-clone-unsupported",
+      "message": "partial clones may omit required Git objects",
+      "details": {}
+    }
+  ],
+  "warnings": []
+}

package/fixtures/atelier-repository-observation/valid/complete-local.v1.json

@@ -0,0 +1,48 @@
+{
+  "schema": "atelier-repository-observation@v1",
+  "observedAt": "2026-08-25T00:00:00.000Z",
+  "complete": true,
+  "root": "/workspace/project",
+  "filesystem": {
+    "supported": true,
+    "code": "local-filesystem"
+  },
+  "git": {
+    "executable": "/usr/bin/git",
+    "version": "2.40.0",
+    "supported": true,
+    "minimum": "2.40.0"
+  },
+  "bare": false,
+  "branch": {
+    "branch": "main",
+    "detached": false,
+    "head": "1111111111111111111111111111111111111111",
+    "upstream": "origin/main",
+    "ahead": 0,
+    "behind": 0
+  },
+  "remotes": [],
+  "features": {
+    "sparseCheckout": false,
+    "partialClone": [],
+    "customFilters": []
+  },
+  "submodules": {
+    "complete": true
+  },
+  "lfs": {
+    "complete": true
+  },
+  "status": {
+    "clean": true,
+    "digest": "2222222222222222222222222222222222222222222222222222222222222222",
+    "entries": [],
+    "fingerprints": [],
+    "stagedCount": 0,
+    "unstagedCount": 0,
+    "conflictCount": 0
+  },
+  "blockers": [],
+  "warnings": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnstry/atelier",
-  "version": "0.2.0-alpha.5",
+  "version": "0.2.0-alpha.6",
   "private": false,
   "description": "Local toolkit that turns a Git repository into an ontology-governed knowledge graph, enforcement layer, and runtime for people, agents, and tools. No telemetry, service, or account.",
   "keywords": [
@@ -41,6 +41,9 @@
     "./attestation": "./src/attestation/sign.mjs",
     "./extension-packs": "./src/extension-packs/loader.mjs",
     "./analysis/adapter": "./src/analysis/adapter.mjs",
+    "./runtime": "./src/runtime/supervisor.mjs",
+    "./runtime/git": "./src/runtime/git-adapter.mjs",
+    "./runtime/observation": "./src/runtime/repository-observation.mjs",
     "./export-contract": "./src/export/atelier-export-contract.mjs",
     "./dry-run": "./src/validate-atelier-export-dry-run.mjs",
     "./contracts/atelier-export.v1.schema.json": "./contracts/atelier-export.v1.schema.json",
@@ -60,6 +63,7 @@
     "readiness:test": "node --test test/readiness.test.mjs test/readiness-summary.test.mjs test/readiness-protocol-contract.test.mjs test/readiness-protocols.test.mjs test/readiness-protocol-runtime.test.mjs",
     "harness:test": "node --test test/harness.test.mjs test/harness-context.test.mjs",
     "collaboration:test": "node --test test/collaboration-ledger.test.mjs test/server-proposals.test.mjs",
+    "sync:test": "node --test test/runtime-git-adapter.test.mjs test/runtime-observation.test.mjs test/runtime-supervisor.test.mjs",
     "boundary:test": "node --test test/boundary-policy-contract.test.mjs test/boundary-content-rules.test.mjs test/boundary-guard.test.mjs",
     "upgrade:test": "node --test test/upgrade-contract.test.mjs test/upgrade.test.mjs",
     "release:audit": "node scripts/check-release-tarball.mjs",

package/src/boundary/content-rules.mjs

@@ -2,6 +2,7 @@ import { spawnSync } from 'node:child_process'
 import fs from 'node:fs'
 import path from 'node:path'
 import { matchesPathPattern, normalizeRelPath } from '../project/path-match.mjs'
+import { sanitizedGitEnvironment } from '../runtime/git-adapter.mjs'
 
 export const EMPTY_TREE = '4b825dc642cb6eb9a060e54bf8d69288fbee4904'
 export const ZERO_SHA_RE = /^0{40,}$/
@@ -252,12 +253,13 @@ export function parsePushRefInput(text) {
 
 export function gitOutputResult(repoRoot, args, {
   encoding = 'utf8',
+  gitExecutable = 'git',
   maxBuffer = DIFF_RESULT_MAX_BYTES,
   runner = spawnSync,
 } = {}) {
   let result
   try {
-    result = runner('git', ['-C', repoRoot, ...args], { encoding, maxBuffer })
+    result = runner(gitExecutable, ['-C', repoRoot, ...args], { encoding, maxBuffer, env: sanitizedGitEnvironment() })
   } catch (error) {
     return { ok: false, code: 'git-command-failed', error: error instanceof Error ? error.message : String(error), stdout: null }
   }
@@ -355,7 +357,7 @@ function scanBinaryBuffer({ buffer, filePath, rules, exceptions, repo }) {
   return findings
 }
 
-function readBinaryChanges({ repoRoot, revision, diff, rules, exceptions, repo }) {
+function readBinaryChanges({ repoRoot, revision, diff, rules, exceptions, repo, gitExecutable, gitRunner }) {
   const findings = []
   const diagnostics = []
   let totalBytes = 0
@@ -363,7 +365,9 @@ function readBinaryChanges({ repoRoot, revision, diff, rules, exceptions, repo }
     const spec = revision === ':' ? `:${filePath}` : `${revision}:${filePath}`
     const result = gitOutputResult(repoRoot, ['show', spec], {
       encoding: 'buffer',
+      gitExecutable,
       maxBuffer: BINARY_FILE_MAX_BYTES + 1,
+      runner: gitRunner,
     })
     if (!result.ok) {
       diagnostics.push(incompleteDiagnostic({
@@ -403,9 +407,10 @@ export function scanStagedRepository({
   rules = DEFAULT_CONTENT_RULES,
   exceptions = [],
   repo = null,
+  gitExecutable = 'git',
   gitRunner = spawnSync,
 } = {}) {
-  const acquired = stagedDiff(repoRoot, { runner: gitRunner })
+  const acquired = stagedDiff(repoRoot, { gitExecutable, runner: gitRunner })
   if (!acquired.ok) {
     return {
       findings: [],
@@ -414,7 +419,7 @@ export function scanStagedRepository({
     }
   }
   const files = parseAddedContent(acquired.diff)
-  const binary = readBinaryChanges({ repoRoot, revision: ':', diff: acquired.diff, rules, exceptions, repo })
+  const binary = readBinaryChanges({ repoRoot, revision: ':', diff: acquired.diff, rules, exceptions, repo, gitExecutable, gitRunner })
   return {
     findings: [...scanAddedContent({ files, rules, exceptions, repo }), ...binary.findings],
     diagnostics: binary.diagnostics,

package/src/boundary/policy.mjs

@@ -4,6 +4,7 @@ import path from 'node:path'
 import { buildGraph } from '../graph/graph.mjs'
 import { commandProject, firstString, parseArgs, readJson, resolvePathValue, writeJson } from '../project/config.mjs'
 import { matchesPathPattern } from '../project/path-match.mjs'
+import { sanitizedGitEnvironment } from '../runtime/git-adapter.mjs'
 import {
   CHECK_AGGREGATE_MAX_BYTES,
   parsePushRefInput,
@@ -206,16 +207,16 @@ export function validateBoundaryPolicy(policy, project = null) {
   return errors
 }
 
-export function resolveCurrentActor({ policy, project, actor = null, env = process.env } = {}) {
+export function resolveCurrentActor({ policy, project, actor = null, env = process.env, gitExecutable = 'git', allowNetworkActorResolution = true, allowHistoryActorResolution = true } = {}) {
   const actors = policy?.actors ?? {}
   const explicit = actor || env.MNSTRY_ATELIER_ACTOR || env.GITHUB_ACTOR
   if (explicit && actors[explicit]) return { actorId: explicit, source: 'explicit' }
-  const gitEmails = gitEmailsForProject(project)
+  const gitEmails = gitEmailsForProject(project, { gitExecutable, env, allowHistoryActorResolution })
   for (const [actorId, info] of Object.entries(actors)) {
     const actorEmails = new Set(asArray(info.gitEmails).map((email) => email.toLowerCase()))
     if (gitEmails.some((email) => actorEmails.has(email.toLowerCase()))) return { actorId, source: 'git-email', gitEmails }
   }
-  const login = env.GITHUB_ACTOR || ghLogin()
+  const login = env.GITHUB_ACTOR || (allowNetworkActorResolution ? ghLogin() : null)
   if (login) {
     for (const [actorId, info] of Object.entries(actors)) {
       if (String(info.githubLogin || '').toLowerCase() === String(login).toLowerCase()) return { actorId, source: 'github-login', githubLogin: login }
@@ -224,16 +225,15 @@ export function resolveCurrentActor({ policy, project, actor = null, env = proce
   return { actorId: null, source: 'unverified', gitEmails, githubLogin: login || null }
 }
 
-function gitEmailsForProject(project) {
+function gitEmailsForProject(project, { gitExecutable = 'git', env = process.env, allowHistoryActorResolution = true } = {}) {
   const roots = unique([project?.repoOpsRoot, project?.workspaceRoot, ...managedRepos(project).map((repo) => repo.path)])
   const emails = []
   for (const root of roots) {
     if (!root || !fs.existsSync(root)) continue
-    for (const args of [
-      ['config', 'user.email'],
-      ['log', '-1', '--format=%ae'],
-    ]) {
-      const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' })
+    const probes = [['config', 'user.email']]
+    if (allowHistoryActorResolution) probes.push(['log', '-1', '--format=%ae'])
+    for (const args of probes) {
+      const result = spawnSync(gitExecutable, ['-C', root, ...args], { encoding: 'utf8', env: sanitizedGitEnvironment(env) })
       if (result.status === 0 && result.stdout.trim()) emails.push(result.stdout.trim())
     }
   }
@@ -280,10 +280,10 @@ function nodePlacementFindings({ node, policy }) {
   return findings
 }
 
-function actorFindings({ policy, project, actor }) {
+function actorFindings({ policy, project, actor, gitExecutable, allowNetworkActorResolution, allowHistoryActorResolution, forceActorErrors }) {
   const findings = []
-  const current = resolveCurrentActor({ policy, project, actor })
-  const severity = severityFor(policy)
+  const current = resolveCurrentActor({ policy, project, actor, gitExecutable, allowNetworkActorResolution, allowHistoryActorResolution })
+  const severity = forceActorErrors ? 'error' : severityFor(policy)
   for (const [repoName, repo] of Object.entries(policy.repos ?? {})) {
     if (repo.kind !== 'private_domain') continue
     if (!repo.ownerActor) continue
@@ -296,11 +296,11 @@ function actorFindings({ policy, project, actor }) {
   return findings
 }
 
-export function stagedPathsForProject(project) {
+export function stagedPathsForProject(project, { gitExecutable = 'git' } = {}) {
   const paths = []
   for (const repo of managedRepos(project)) {
     if (!repo.path || !fs.existsSync(path.join(repo.path, '.git'))) continue
-    const result = spawnSync('git', ['-C', repo.path, 'diff', '--cached', '--name-only', '--diff-filter=ACMR'], { encoding: 'utf8' })
+    const result = spawnSync(gitExecutable, ['-C', repo.path, 'diff', '--cached', '--name-only', '--diff-filter=ACMR'], { encoding: 'utf8', env: sanitizedGitEnvironment() })
     if (result.status !== 0) continue
     for (const rel of result.stdout.split('\n').map((line) => line.trim()).filter(Boolean)) {
       paths.push({ repo: repo.name, repoRoot: repo.path, path: normalize(rel) })
@@ -394,7 +394,7 @@ export function semanticChangesInFile(file) {
   return changes
 }
 
-function semanticDiffFindings({ policy, project }) {
+function semanticDiffFindings({ policy, project, gitExecutable = 'git' }) {
   const findings = []
   const severity = 'error'
   for (const repo of managedRepos(project)) {
@@ -402,7 +402,7 @@ function semanticDiffFindings({ policy, project }) {
       findings.push(unscannableRepoFinding(repo, 'configured path is absent or is not a Git checkout'))
       continue
     }
-    const result = spawnSync('git', ['-C', repo.path, 'diff', '--cached', '--unified=0', '--', '*.md', '*.kg.json'], { encoding: 'utf8' })
+    const result = spawnSync(gitExecutable, ['-C', repo.path, 'diff', '--cached', '--unified=0', '--', '*.md', '*.kg.json'], { encoding: 'utf8', env: sanitizedGitEnvironment() })
     if (result.status !== 0) {
       findings.push(unscannableRepoFinding(repo, 'git diff --cached failed'))
       continue
@@ -430,7 +430,7 @@ function semanticDiffFindings({ policy, project }) {
   return findings
 }
 
-function stagedContentFindings({ policy, project }) {
+function stagedContentFindings({ policy, project, gitExecutable = 'git' }) {
   const rules = resolveContentRules(policy)
   const exceptions = asArray(policy?.contentRuleExceptions)
   const findings = []
@@ -440,7 +440,7 @@ function stagedContentFindings({ policy, project }) {
       findings.push(unscannableRepoFinding(repo, 'configured path is absent or is not a Git checkout'))
       continue
     }
-    const result = scanStagedRepository({ repoRoot: repo.path, rules, exceptions, repo: repo.name })
+    const result = scanStagedRepository({ repoRoot: repo.path, rules, exceptions, repo: repo.name, gitExecutable })
     findings.push(...result.findings, ...result.diagnostics)
     totalBytes += result.bytes
     if (totalBytes > CHECK_AGGREGATE_MAX_BYTES) {
@@ -603,7 +603,7 @@ function promotionFindings({ policy, project, graph }) {
   return findings
 }
 
-export function checkBoundaryPolicy({ project, policy, staged = false, stagedOnly = false, actor = null } = {}) {
+export function checkBoundaryPolicy({ project, policy, staged = false, stagedOnly = false, actor = null, gitExecutable = 'git', allowNetworkActorResolution = true, allowHistoryActorResolution = true, forceActorErrors = false } = {}) {
   const validationErrors = validateBoundaryPolicy(policy, project)
   let graph = null
   const findings = validationErrors.map((message) => finding({ severity: 'error', code: 'boundary-policy-invalid', message }))
@@ -613,12 +613,12 @@ export function checkBoundaryPolicy({ project, policy, staged = false, stagedOnl
     for (const node of graph.nodes ?? []) findings.push(...nodePlacementFindings({ node, policy }))
     findings.push(...promotionFindings({ policy, project, graph }))
   }
-  findings.push(...actorFindings({ policy, project, actor }))
+  findings.push(...actorFindings({ policy, project, actor, gitExecutable, allowNetworkActorResolution, allowHistoryActorResolution, forceActorErrors }))
   if (staged) {
-    const stagedPaths = stagedPathsForProject(project)
+    const stagedPaths = stagedPathsForProject(project, { gitExecutable })
     findings.push(...forbiddenPathFindings({ policy, stagedPaths }))
-    findings.push(...semanticDiffFindings({ policy, project }))
-    findings.push(...stagedContentFindings({ policy, project }))
+    findings.push(...semanticDiffFindings({ policy, project, gitExecutable }))
+    findings.push(...stagedContentFindings({ policy, project, gitExecutable }))
   }
   const errors = findings.filter((item) => item.severity === 'error')
   const warnings = findings.filter((item) => item.severity !== 'error')

package/src/cli/run.mjs

@@ -58,6 +58,7 @@ export const commandMap = new Map([
   ['feedback:check', ['src/commands/feedback.mjs', 'check']],
   ['announcements', ['src/commands/announcements.mjs']],
   ['announcements:list', ['src/commands/announcements.mjs', 'list']],
+  ['sync', ['src/commands/sync.mjs']],
 ])
 
 function isDefaultBrand(brand) {
@@ -115,6 +116,12 @@ Core commands:
   support bundle --dry-run        Preview a no-send support bundle.
   feedback --message TEXT         Write a local, never-sent feedback report.
   announcements list              List and verify MNSTRY announcements.
+  sync enroll                     Explicitly enroll one repository for supervision.
+  sync status                     Fully observe the enrolled repository.
+  sync reconcile                  Fetch and perform only proven fast-forwards.
+  sync plan                       Prepare one bounded, reviewable commit plan.
+  sync commit                     Execute an exactly confirmed commit plan.
+  sync run --once                 Run one full-state supervisor cycle.
   egress check                    Check extracted Atelier paths for forbidden egress.
   boundary check                  Enforce private/shared repo placement rules.
   boundary audit                  Report content-rule matches tree-wide without blocking.
@@ -198,6 +205,17 @@ Assembles a local feedback report under ignored .atelier-local/feedback/ (mode 0
     announcements: `Usage: ${c} announcements list [--dir DIR] [--public-key FILE] | verify <file> [--public-key FILE] [--json] | show <file> [--public-key FILE]
 
 MNSTRY announcements are a pull-only channel: signed JSON documents under announcements/ in the repository. The trust anchor is always the committed MNSTRY key, or one you pass explicitly with --public-key; --dir changes only where documents are read from and never which key verifies them. Every run names the key and keyId it used. The kit never fetches anything — receiving announcements is the git pull you chose to run, and show refuses to print a body whose signature does not verify.`,
+    sync: `Usage:
+  ${c} sync enroll --repo DIR [--project atelier.project.json] [--git ABSOLUTE_PATH]
+  ${c} sync status --repo DIR
+  ${c} sync reconcile --repo DIR [--retries 3]
+  ${c} sync run --repo DIR [--once] [--interval 30]
+  ${c} sync plan --repo DIR --path FILE [--path FILE] --message TEXT [--publish]
+  ${c} sync commit --repo DIR --operation ID --confirm ID
+  ${c} sync pause|freeze|resume --repo DIR
+  ${c} sync trace --repo DIR
+
+Enrolls exactly one repository and keeps Git plus readable files authoritative. Reconciliation observes the complete repository every cycle and performs only fast-forward updates. Commit creation is a two-phase user-confirmed operation: plan shows one bounded change set, and commit refuses unless the repository is unchanged and --confirm exactly repeats the operation id. No semantic conflict resolution, force operation, browser apply endpoint, telemetry, or desktop shell is present.`,
   }
   return help[command] || `Usage: ${c} ${command} [args]\n\nRun ${c} --help for the command list.`
 }

package/src/commands/sync.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+import {
+  enrollRepository,
+  executeUserConfirmedCommit,
+  operationTrace,
+  planUserConfirmedCommit,
+  reconcileRepository,
+  runtimeStatus,
+  setRepositoryPaused,
+} from '../runtime/supervisor.mjs'
+import { firstString, parseArgs } from '../project/config.mjs'
+
+function valuesFor(argv, name) {
+  const values = []
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index]
+    if (arg === `--${name}` && argv[index + 1] && !argv[index + 1].startsWith('--')) {
+      values.push(argv[index + 1])
+      index += 1
+    } else if (arg.startsWith(`--${name}=`)) {
+      values.push(arg.slice(name.length + 3))
+    }
+  }
+  return values
+}
+
+function integer(value, fallback) {
+  if (value == null || value === true) return fallback
+  const parsed = Number(value)
+  if (!Number.isInteger(parsed) || parsed < 1) throw new Error('interval and retry values must be positive integers')
+  return parsed
+}
+
+function print(value) {
+  console.log(JSON.stringify(value, null, 2))
+}
+
+async function runLoop({ repoPath, intervalMs, fetchAttempts, once }) {
+  do {
+    const result = reconcileRepository({ repoPath, fetchAttempts })
+    print(result)
+    if (once) return result.ok ? 0 : 1
+    await new Promise((resolve) => setTimeout(resolve, intervalMs))
+  } while (true)
+}
+
+const argv = process.argv.slice(2)
+const args = parseArgs(argv)
+const subcommand = args._[0] || 'status'
+const repoPath = firstString(args.repo) || process.cwd()
+
+try {
+  if (subcommand === 'enroll') {
+    const result = enrollRepository({ repoPath, projectConfig: firstString(args.project, args['project-config']), gitExecutable: firstString(args.git) })
+    print(result)
+    process.exitCode = result.ok ? 0 : 1
+  } else if (subcommand === 'status' || subcommand === 'audit') {
+    const result = runtimeStatus({ repoPath })
+    print(result)
+    process.exitCode = result.ok ? 0 : 1
+  } else if (subcommand === 'reconcile') {
+    const result = reconcileRepository({ repoPath, fetchAttempts: integer(args.retries, 3) })
+    print(result)
+    process.exitCode = result.ok ? 0 : 1
+  } else if (subcommand === 'run') {
+    process.exitCode = await runLoop({
+      repoPath,
+      intervalMs: integer(args.interval, 30) * 1000,
+      fetchAttempts: integer(args.retries, 3),
+      once: Boolean(args.once),
+    })
+  } else if (subcommand === 'plan') {
+    print(planUserConfirmedCommit({
+      repoPath,
+      paths: valuesFor(argv, 'path'),
+      message: firstString(args.message),
+      publish: Boolean(args.publish),
+      fetchAttempts: integer(args.retries, 3),
+    }))
+  } else if (subcommand === 'commit') {
+    const result = executeUserConfirmedCommit({
+      repoPath,
+      operationId: firstString(args.operation),
+      confirmation: firstString(args.confirm),
+    })
+    print(result)
+    process.exitCode = result.ok ? 0 : 1
+  } else if (subcommand === 'pause' || subcommand === 'freeze') {
+    print(setRepositoryPaused({ repoPath, paused: true, reason: firstString(args.reason) || (subcommand === 'freeze' ? 'frozen by user' : 'paused by user') }))
+  } else if (subcommand === 'resume') {
+    print(setRepositoryPaused({ repoPath, paused: false }))
+  } else if (subcommand === 'trace') {
+    print({ ok: true, operations: operationTrace({ repoPath }) })
+  } else {
+    throw new Error(`unknown sync command: ${subcommand}`)
+  }
+} catch (error) {
+  console.error(error.message)
+  process.exitCode = 1
+}

package/src/contracts/corpus.mjs

@@ -26,6 +26,12 @@ import { fileURLToPath } from 'node:url'
 // document, not a schema, and is deliberately absent.
 
 export const CONTRACT_CORPUS = [
+  {
+    name: 'atelier-repository-observation',
+    contractFile: 'contracts/atelier-repository-observation.v1.schema.json',
+    fixtureRoot: 'fixtures/atelier-repository-observation',
+    registry: true,
+  },
   {
     name: 'atelier-lock',
     contractFile: 'contracts/atelier-lock.v1.schema.json',

package/src/index.mjs

@@ -98,3 +98,32 @@ export {
 export {
   analysisAdapterDryRun,
 } from './analysis/adapter.mjs'
+
+export {
+  GitCommandError,
+  classifyRemoteAuthentication,
+  inspectGitEngine,
+  parseGitVersion,
+  resolveGitExecutable,
+  runGit,
+  sanitizeRemoteUrl,
+} from './runtime/git-adapter.mjs'
+
+export {
+  ATELIER_REPOSITORY_OBSERVATION_SCHEMA,
+  classifyFilesystemRoot,
+  observeRepository,
+  resolveRepositoryRoot,
+  validateRepositoryObservation,
+} from './runtime/repository-observation.mjs'
+
+export {
+  ATELIER_COMMIT_PLAN_SCHEMA,
+  enrollRepository,
+  executeUserConfirmedCommit,
+  operationTrace,
+  planUserConfirmedCommit,
+  reconcileRepository,
+  runtimeStatus,
+  setRepositoryPaused,
+} from './runtime/supervisor.mjs'