@mnstry/atelier 0.2.0-alpha.5 → 0.2.0-alpha.8

package/contracts/atelier-upgrade-plan.v2.schema.json

@@ -0,0 +1,398 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mnstry.ai/schemas/atelier/atelier-upgrade-plan.v2.schema.json",
+  "$comment": "contract revision 2.0.0",
+  "title": "mnstry.atelier-upgrade-plan@v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "digest",
+    "operation",
+    "workspace",
+    "repositoryId",
+    "configPath",
+    "baseHead",
+    "baseTree",
+    "branch",
+    "createdAt",
+    "expiresAt",
+    "policy",
+    "policyDigest",
+    "executorDigest",
+    "gitDigest",
+    "gitConfigDigest",
+    "hooksDigest",
+    "hooksPath",
+    "readSet",
+    "migration",
+    "writes",
+    "releaseEvidence",
+    "dependencyInstallation",
+    "mode",
+    "recoveryCoverage",
+    "message",
+    "gitAuxDigest"
+  ],
+  "properties": {
+    "schema": {
+      "const": "mnstry.atelier-upgrade-plan@v2"
+    },
+    "digest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "operation": {
+      "const": "prepare-local-candidate"
+    },
+    "workspace": {
+      "type": "string",
+      "minLength": 1
+    },
+    "repositoryId": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "configPath": {
+      "type": "string",
+      "minLength": 1
+    },
+    "baseHead": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{40,64}$"
+    },
+    "baseTree": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{40,64}$"
+    },
+    "branch": {
+      "type": "string",
+      "minLength": 1
+    },
+    "createdAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "expiresAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "policy": {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://mnstry.ai/schemas/atelier/atelier-adoption-policy.v1.schema.json",
+      "$comment": "contract revision 1.0.0",
+      "title": "mnstry.atelier-adoption-policy@v1",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema",
+        "enabled",
+        "mode",
+        "maxAgeSeconds",
+        "recoveryCoverage",
+        "allowedEffects"
+      ],
+      "properties": {
+        "schema": {
+          "const": "mnstry.atelier-adoption-policy@v1"
+        },
+        "enabled": {
+          "type": "boolean"
+        },
+        "mode": {
+          "const": "manual-exact-plan"
+        },
+        "maxAgeSeconds": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 86400
+        },
+        "recoveryCoverage": {
+          "const": "local-only"
+        },
+        "allowedEffects": {
+          "const": [
+            "lock-and-projections",
+            "git-commit"
+          ]
+        },
+        "ext": {
+          "type": "object",
+          "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+        },
+        "contractVersion": {
+          "type": "string",
+          "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+        }
+      }
+    },
+    "policyDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "executorDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "gitDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "gitConfigDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "hooksDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "hooksPath": {
+      "type": "string",
+      "minLength": 1
+    },
+    "readSet": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "path",
+          "state"
+        ],
+        "properties": {
+          "path": {
+            "type": "string",
+            "minLength": 1
+          },
+          "state": {
+            "anyOf": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "digest",
+                  "mode"
+                ],
+                "properties": {
+                  "digest": {
+                    "type": "string",
+                    "pattern": "^sha256:[a-f0-9]{64}$"
+                  },
+                  "mode": {
+                    "enum": [
+                      "100644",
+                      "100755"
+                    ]
+                  },
+                  "ext": {
+                    "type": "object",
+                    "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+                  }
+                }
+              }
+            ]
+          },
+          "ext": {
+            "type": "object",
+            "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+          }
+        }
+      }
+    },
+    "migration": {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://mnstry.ai/schemas/atelier/atelier-migration.v2.schema.json",
+      "$comment": "contract revision 2.0.0",
+      "title": "mnstry.atelier-migration@v2",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema",
+        "id",
+        "executorDigest",
+        "readScope",
+        "allowedWrites",
+        "sideEffects",
+        "postChecks"
+      ],
+      "properties": {
+        "schema": {
+          "const": "mnstry.atelier-migration@v2"
+        },
+        "id": {
+          "const": "local-lock-projections@1"
+        },
+        "executorDigest": {
+          "type": "string",
+          "pattern": "^sha256:[a-f0-9]{64}$"
+        },
+        "readScope": {
+          "const": "whole-enrolled-repository"
+        },
+        "allowedWrites": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "sideEffects": {
+          "const": [
+            "git-index",
+            "git-commit"
+          ]
+        },
+        "postChecks": {
+          "const": [
+            "exact-inventory",
+            "lock-schema",
+            "exact-index",
+            "commit-parent-tree-message"
+          ]
+        },
+        "ext": {
+          "type": "object",
+          "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+        },
+        "contractVersion": {
+          "type": "string",
+          "pattern": "^2\\.[0-9]+\\.[0-9]+$"
+        }
+      }
+    },
+    "writes": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "path",
+          "owner",
+          "action",
+          "before",
+          "after",
+          "content"
+        ],
+        "properties": {
+          "path": {
+            "type": "string",
+            "minLength": 1
+          },
+          "owner": {
+            "enum": [
+              "lock",
+              "generated"
+            ]
+          },
+          "action": {
+            "enum": [
+              "create",
+              "update"
+            ]
+          },
+          "before": {
+            "anyOf": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "digest",
+                  "mode"
+                ],
+                "properties": {
+                  "digest": {
+                    "type": "string",
+                    "pattern": "^sha256:[a-f0-9]{64}$"
+                  },
+                  "mode": {
+                    "enum": [
+                      "100644",
+                      "100755"
+                    ]
+                  },
+                  "ext": {
+                    "type": "object",
+                    "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+                  }
+                }
+              }
+            ]
+          },
+          "after": {
+            "anyOf": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "digest",
+                  "mode"
+                ],
+                "properties": {
+                  "digest": {
+                    "type": "string",
+                    "pattern": "^sha256:[a-f0-9]{64}$"
+                  },
+                  "mode": {
+                    "enum": [
+                      "100644",
+                      "100755"
+                    ]
+                  },
+                  "ext": {
+                    "type": "object",
+                    "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+                  }
+                }
+              }
+            ]
+          },
+          "content": {
+            "type": "string",
+            "maxLength": 16777216
+          },
+          "ext": {
+            "type": "object",
+            "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+          }
+        }
+      }
+    },
+    "releaseEvidence": {
+      "type": "null"
+    },
+    "dependencyInstallation": {
+      "const": "excluded"
+    },
+    "mode": {
+      "const": "manual-exact-plan"
+    },
+    "recoveryCoverage": {
+      "const": "local-only"
+    },
+    "message": {
+      "type": "string",
+      "minLength": 1
+    },
+    "ext": {
+      "type": "object",
+      "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+    },
+    "contractVersion": {
+      "type": "string",
+      "pattern": "^2\\.[0-9]+\\.[0-9]+$"
+    },
+    "gitAuxDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    }
+  }
+}

package/contracts/atelier-upgrade-receipt.v1.schema.json

@@ -0,0 +1,99 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mnstry.ai/schemas/atelier/atelier-upgrade-receipt.v1.schema.json",
+  "$comment": "contract revision 1.0.0",
+  "title": "mnstry.atelier-upgrade-receipt@v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "kind",
+    "operationId",
+    "planDigest",
+    "sequence",
+    "previous",
+    "time",
+    "phase",
+    "step",
+    "expected",
+    "observed",
+    "confirmation"
+  ],
+  "properties": {
+    "schema": {
+      "const": "mnstry.atelier-upgrade-receipt@v1"
+    },
+    "kind": {
+      "const": "private-event"
+    },
+    "operationId": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "planDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "sequence": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "previous": {
+      "anyOf": [
+        {
+          "type": "string",
+          "pattern": "^sha256:[a-f0-9]{64}$"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "time": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "phase": {
+      "enum": [
+        "accepted",
+        "write-intent",
+        "write-complete",
+        "stage-intent",
+        "commit-intent",
+        "completed",
+        "commit-refused",
+        "recovery-required"
+      ]
+    },
+    "step": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "expected": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "observed": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "confirmation": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "ext": {
+      "type": "object",
+      "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+    },
+    "contractVersion": {
+      "type": "string",
+      "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+    }
+  }
+}

package/contracts/atelier-vault-publication.v1.schema.json

@@ -0,0 +1,58 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mnstry.ai/schemas/atelier/atelier-vault-publication.v1.schema.json",
+  "title": "Private vault publication request",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "expectedRevision",
+    "files"
+  ],
+  "properties": {
+    "schema": {
+      "const": "atelier-vault-publication/v1"
+    },
+    "expectedRevision": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 9007199254740990
+    },
+    "files": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 100,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "path",
+          "base64"
+        ],
+        "properties": {
+          "path": {
+            "type": "string",
+            "maxLength": 512,
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*(/[A-Za-z0-9][A-Za-z0-9._-]*)*$"
+          },
+          "base64": {
+            "type": "string",
+            "maxLength": 4194304,
+            "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"
+          },
+          "ext": {
+            "type": "object"
+          }
+        }
+      }
+    },
+    "contractVersion": {
+      "type": "string",
+      "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+    },
+    "ext": {
+      "type": "object"
+    }
+  },
+  "$comment": "contract revision 1.0.0; explicit host-bound private artifact publication."
+}

package/docs/assurance-controls.md

@@ -8,11 +8,21 @@ commit and packed-tarball digest.
 | Claim | Enforcing control | Defensive evidence | Stated limit |
 | --- | --- | --- | --- |
 | Boundary rules cannot silently switch themselves off | `src/boundary/policy.mjs`, `src/boundary/content-rules.mjs`, and generated Git hooks | `boundary:test`; boundary case in `assurance:mutation-smoke` | Repository access remains the source read boundary; an audience label is not encryption |
-| A clean boundary verdict uses complete evidence | Typed Git reads with diff and binary budgets; incomplete reads become blocking diagnostics | `test/boundary-content-rules.test.mjs` | Budgets intentionally refuse evidence too large to inspect rather than claiming it is clean |
+| A clean boundary verdict uses complete evidence | Typed Git reads with diff and binary budgets; incomplete reads become blocking diagnostics; Sync requires the enrolled root to be scanned, uses its digest-bound Git for actor and staged evidence, and disables network actor fallback | `test/boundary-content-rules.test.mjs`; Sync boundary-scope, pinned-Git, and no-network actor refusal cases | Budgets intentionally refuse evidence too large to inspect rather than claiming it is clean |
 | Graph classification has one meaning | `src/graph/knowledge-graph.mjs` is canonical; `src/graph/graph.mjs` adapts its result | `graph:test`; graph case in `assurance:mutation-smoke` | Unclassified Markdown is retained as private diagnostic material, not admitted as governed content |
-| The package has no undisclosed runtime egress path | Canonical forbidden-egress scanner plus exact packed-file inventory in `release:audit` | egress tests, marker-inventory test, and egress case in `assurance:mutation-smoke` | Data-only files are not interpreted; reviewed `gh` subprocess fallbacks are documented exceptions |
+| The package has no undisclosed runtime egress path | Canonical forbidden-egress scanner plus exact packed-file inventory in `release:audit`; Atelier Sync confines network Git to bounded fetch and an exact-plan, non-force push | egress tests, marker-inventory test, runtime fetch/push refusal tests, and egress case in `assurance:mutation-smoke` | Data-only files are not interpreted; reviewed `gh` actor resolution and explicitly enrolled Git fetch/push are documented subprocess exceptions. Optional host-bound vault SDK and transport I/O is outside the lexical scanner model; trusted provider configuration, denial probes and hosted qualification are separate controls. |
+| User-confirmed repository writes match what was reviewed | Content-bound, expiring plan identifiers; fresh complete observations; exact staged and written-tree blob/mode manifests; post-hook tree, single-parent, and message verification with compare-and-swap rollback; refusal of prior unpublished commits; and an exact verified-object push after HEAD/target revalidation with tag following and recursive submodule publication disabled | `sync:test` plan, expiry, hook/index, late-HEAD, ahead-branch, remote-ref, remote-drift, and evidence-failure cases | Ordinary Git hooks may run, but a hook cannot substitute a different commit object for publication |
+| Resident Sync state cannot escape or grow without bound | Contained private directories, no-follow/identity-checked leaves, a 4,096-entry observation ceiling, bounded state projection, nonce-bound locks with aged abandoned-claim recovery, lock-directory identity validation and an ambiguous live-PID maximum age, consumed plans under age/file/byte ceilings, and corruption-recovering hash-chained traces with per-event/resident ceilings | `sync:test` observation/state ceilings, redirected-state/lock, plan lifecycle, concurrent enrollment/recovery, corruption, and trace ceilings | Machine-local state is diagnostic convenience; Git and readable repository files remain authoritative |
 | Local review serves only generated publication output | Loopback-only bind, required `atelier.manifest.json`, realpath containment, enrolled safe types, POSIX no-follow plus cross-platform leaf type/identity validation for local state, and host/fetch-site/origin/method/nonce checks | `server:security:test`; sidecar case in `assurance:mutation-smoke` | The sidecar is a local review tool, not user authentication or runtime authorization |
 | Collaboration cannot become a hidden apply path | Proposal authority is capability-derived; records are typed; POSIX ledger and snapshot leaves are no-follow, while every platform rejects redirected leaves and validates opened file identity when available; ledger reads are bounded, one-pass for lists, and corrupt tails fail closed | `collaboration:test` and ledger ceiling/performance tests | Collaboration remains copy-only proposal metadata; snapshots are rebuildable projections and Git review owns source changes |
+| The Obsidian maintenance service is reachable from this machine only, and only by its owner | Bind and client are restricted to the literal `127.0.0.1` or `::1`; `Host` must be the exact bound authority; cross-site `Origin` and `Sec-Fetch-Site` are refused; four fixed operations with exact paths and methods; status, tick and stop need a per-runtime random bearer kept only in the mode-0600 record; payloads are bounded and name their runtime; health carries no path or title | `test/obsidian-maintenance.test.mjs` listener, disclosure and unauthorised-request cases, each with a deliberately broken listener that must fail | A local process running as the same user can read the record; the bearer is ownership proof between local processes, not user authentication |
+| A maintenance service is stopped or reported as running only when it is proven to be this workspace's own | Record and health must agree on service name, workspace, runtime identifier, PID, executable digest and loopback address; anything else on the port is `occupied`; a reused PID is never signalled; a malformed or foreign record refuses; `start` stops only the child it created, by handle | Unowned and silent listener, wrong-identity, PID-reuse, stale-record, malformed-record, idempotent and concurrent start, and launcher-survival cases, with mutation controls | Status probes have a deadline: a service busy in a long synchronous tick can be reported `occupied` until it answers |
+| Maintenance never sweeps recovery or staging, and one workspace has one ticking engine | The service deletes only its generated record; the engine and the publisher own every other write; a hard kill is settled by the publisher's journaled restart recovery; each tick holds a private per-workspace lock taken from a holder only with proof of abandonment | Directory-listing oracles across start, ticks, stop, hard kill and stale record; hard kill between exchange and manifest commit; lock exclusion and takeover cases; each with a mutation control | A live lock holder that recorded no health address needs a person; a tick that outlasts the shutdown grace period ends with the process and is settled on the next start |
+| Source application policy is re-read before every automatic apply | The engine authorizes from disk immediately before each dispatch; manual mode never reaches the apply operation; the service keeps this on every tick; the apply operation reads the installed policy again at its decision and immediately before the write, recomputes its digest and evaluates its selector over the current canonical graph; `policy install` verifies that digest and names the expected one; whether this machine may see the object is asked before anything else, so an absent and a withheld object get one answer | Revocation, manual-mode and apply-unavailable cases in `test/obsidian-maintenance.test.mjs`; policy, refusal-table and late-revocation cases in `test/obsidian-edits.test.mjs`, each with a deliberately broken rule that must fail | A policy is private configuration of one machine; whoever can write that private state can install one |
+| Applying an edit to a source file cannot lose another program's bytes | One operation for a person and for a policy: exact identity, path and digest checks at commit; the write is an atomic exchange, never a check followed by a rename; displaced bytes that are not the base are exchanged back and retained; the old source stays as a backup that is looked at again for late writers; write-ahead record and intent before the exchange; restart recovery decides from digests only, and so does an exchange that reports a failure; generated regions never reach a source: the tail is intact, or removed with the end of the authored text proven, and anything else refuses; every git directory is refused, nested, respelled or relocated; the hold on an edited note lifts only on a read of the note at that moment; no git command that writes | `test/obsidian-edits.test.mjs`: end to end through the real engine, a refusal table with a whole-project byte and `git status` oracle, a real second process writing in three styles and four timings with both outcomes asserted, a crash at every durable step, a disclosure walk, a generated tail cut at every byte offset from both sides and a fuzz over the whole note; every oracle has a mutation control | macOS arm64 on APFS only; refuses where no atomic exchange exists; the source becomes a new file (permission bits kept, hard links refused); a late writer's bytes are retained and surfaced, never merged; a hard link made after the path check is not detected; a fragment of generated text shorter than eight bytes left inside an edited body cannot be told from typing |
+| A structural edit made in a vault becomes one copy-only proposal and never a source change | The proposal adapter routes by whole identity to the existing store of the enrolled repository or refuses typed and writes nothing; it records the operation in private immutable state first, looks in the persisted store for its operation identity before creating, under a private per-repository lock taken over only with proof; it preflights the ledger limits, defers `ledger-full`, refuses `proposal-too-large` and `ledger-corrupt`, bounds batches and retries, and never compacts; a proposal holds codes, offsets and digests and no note text; acceptance is shown and never acted on | `test/obsidian-proposals.test.mjs`: routing table with a whole-project byte and `git status` oracle, identity survival against the real store, a crash at every step, two real processes, generated ledgers at 256 KiB, 16 MiB and 10,000 events and an invalid line, a no-busy-loop count of store reads, a disclosure walk; engine cases in `test/obsidian-maintenance.test.mjs`; every oracle has a mutation control | In manual mode an operation exists only after apply has looked at the edit; a refused or exhausted operation waits for a person; the store directory lives in the repository and must be git-ignored; two workspaces that enrol one repository create one proposal each |
+| Opening a view reports `current` only for the exact, verified, present generation and a qualified app | `open` needs a tick of the proven service after the request, a persisted `current`, an independent read-back of the trusted pointer and every note, and an app at or above the minimum version that answers for that vault; every other outcome is typed, distinct and exits non-zero; the app and the operating system are reached only through injected seams, and the production ones only behind `--adapter=obsidian-cli` | `test/obsidian-open.test.mjs`: outcome table, read-back, app-floor, busy and read-only cases, each with a deliberately broken rule that must fail; a spawn guard and a production-seam import check | The production probe and launcher are not exercised against a real app here; `indexing` relies on an undocumented readiness field until acceptance qualifies it |
+| Operating-system startup is never installed implicitly | `buildStartupAdapter` is pure text generation; Windows refuses typed; the service refuses `--startup` without a consent that covers startup | Builder purity oracle (no filesystem, process or home-directory access; no machine path beyond its inputs) and startup-consent refusal | Generated units have not been qualified against real launchd or systemd hosts |
 | Expected operator failures are actionable without leaking internals | Typed project/JSON diagnostics and the CLI execution wrapper | `test/cli-brand.test.mjs` | Unexpected stacks require the operator to opt in with `ATELIER_DEBUG=1` |
 | Published APIs do not disappear silently | Tag-derived subpath and named-export baseline plus version/tag identity refusal | `public-api:compat`; `test/public-api-compat.test.mjs` | Additive API checks do not decide whether a new version number is appropriate |
 | The published artifact is the artifact tested | `release:candidate` packs once, binds SHA-256, sends that exact archive through allowlist/content audit, bare-consumer install, all-export import, and branded distribution smoke, then the trusted-publishing workflow retains and publishes that same tarball path | `release:audit`, `consumer:smoke`, `distribution:smoke`, `assurance:mutation-smoke`, `publish-workflow.test.mjs` | Passing gates does not publish, deploy, or constitute an external reviewer’s approval |

package/docs/atelier-runtime.md

@@ -14,6 +14,8 @@ The package owns reusable mechanics:
 - proposal-only collaboration metadata;
 - support-bundle dry runs with no send path;
 - export dry-run validation for `atelier-export@v1`.
+- explicit single-repository enrollment and full-state Git observation;
+- fast-forward-only reconciliation and two-phase user-confirmed commits.
 
 Project adapters own project facts: repo roster, source roots, read-boundary
 config, extension packs, brand language, and generated project outputs.
@@ -28,8 +30,11 @@ runtime authority.
 
 ## Safety Posture
 
-The default package posture is no telemetry, no external network egress, no
-runtime mutation, no browser apply endpoint, and no model-assisted analysis execution.
+The default package posture is no telemetry, no MNSTRY runtime mutation, no
+browser apply endpoint, and no model-assisted analysis execution. Conformance
+is offline. The only documented subprocess network paths are the bounded `gh`
+actor-resolution fallback and explicitly enrolled Atelier Sync Git fetch and
+user-confirmed non-force push operations.
 Provider analysis output may only enter as proposed `atelier-claim@v1` records
 until explicitly reviewed by the project owner.
 
@@ -47,3 +52,9 @@ capabilities and apply endpoints, never inferred from action-like prose. A
 partially corrupt ledger returns typed incomplete evidence and blocks a clean
 claim. Ledger reads and records are bounded, appends are locked, and retention
 changes happen only through explicit compaction.
+
+The local Git supervisor is a separate mechanical authority surface. It may
+create a repository commit only from an unchanged, bounded plan after the user
+repeats its exact operation id. That repository write is not a MNSTRY runtime
+mutation and does not grant proposal apply authority to the browser sidecar.
+See [Atelier Sync: Deliverable Zero](./atelier-sync.md).