@mnstry/atelier 0.2.0-alpha.6 → 0.2.0-alpha.8

package/CHANGELOG.md

@@ -1,7 +1,183 @@
 # Changelog
 
+## 0.2.0-alpha.8
+
+### Added
+
+- Add portable, typed advisory decision requests and results under
+  `@mnstry/atelier/decisions`, with versioned schemas, invented fixtures and
+  offline validation of evidence bindings, distributions and abstention.
+  Provider execution, credentials, budgets and authorization stay with the
+  host. See `docs/decisions.md`.
+- Add an experimental, opt-in Obsidian projection. A project that enables
+  `ext["mnstry.atelier.obsidian"]` and declares views (`full`, `scoped` or
+  `focus`, with an optional bounded expansion) gets readable, linked notes of
+  the enrolled workspace in a vault outside every repository, under private
+  per-workspace storage. Nothing is published for a project that does not
+  enable it. See `docs/obsidian.md`, `docs/obsidian-contract.md` and
+  `docs/local-services.md`.
+- Add eleven closed `atelier-obsidian-*.v1` schemas with valid and invalid
+  fixtures, each exported under its own `./contracts/` path.
+- Add deterministic materialization: note paths made of a readable title and a
+  stable identity suffix, exact byte regions that invert to their source,
+  embedded assets, and audience and eligibility rules that fail closed. No
+  audience is admitted by default, which publishes an empty view.
+- Add publication that coordinates with a running editor through conditional
+  operations, with journals, restart recovery and late-writer rechecks, so
+  that a concurrent write by a person or the app is retained rather than
+  overwritten. It depends on an atomic file exchange and is proven on macOS
+  arm64 with one app version; see the contract for what is open.
+- Add a per-workspace loopback maintenance service and the noninteractive
+  `atelier obsidian` command (`status`, `scope`, `audience`, `mode`, `policy`,
+  `service`, `open`, `apply`, `proposals`, `conflicts`, `apply-policy`,
+  `selection`). Reaching the installed app or the operating system is never a
+  default: it needs `--adapter=obsidian-cli`. The app must be version 1.13.7
+  or later.
+- Ship the selection contribution on the command: the one-line loader module
+  `src/runtime/obsidian/contributions/selection-ui.mjs` puts `selection`,
+  `conflicts` and `apply-policy` on `atelier obsidian`, beside `apply` and
+  `proposals`. The usage text names every contributed operation, and a
+  contributed operation declares under `options` which shared options it
+  takes, so `--actor` is refused everywhere but `apply run`.
+- Preserve every edit made in the vault before anything is republished. A
+  body replacement is applied to its source manually, or automatically under
+  a scoped policy the user installs and can revoke; revocation is read again
+  before every write. An edit that is not a body replacement becomes a
+  copy-only proposal in the owning repository's proposal store and is never
+  applied. Atelier makes no Git commit for any of it.
+- Add selection binding, apply-policy setup, a read-only conflict view and an
+  acceptance-receipt validator that is labelled schema validation only and
+  closes no gate.
+- Add the package subpaths `./obsidian`, `./obsidian/contracts`,
+  `./obsidian/materialize`, `./obsidian/publication`, `./obsidian/recovery`,
+  `./obsidian/edits`, `./obsidian/proposals` and `./obsidian/selection`. The
+  package root exports nothing of the projection. Names ending
+  `ForOracleTests` are test mutation controls, not a supported API.
+- `release:audit` now requires the Obsidian runtime, schemas and documents in
+  the tarball, requires every declared export to name a packed file, and
+  refuses scripts, tests, experiments, receipt directories, application
+  archives, receipts that name a real host or operator, and fixtures above 262,144
+  bytes. The path allowlist is unchanged. A package proof packs the tarball,
+  imports the subpaths from a bare consumer and publishes a synthetic
+  workspace into a temporary vault with no app.
+- Known limits: Windows refuses publication and source apply because no atomic
+  exchange is known; the real-app suite has not been run on Linux, and x86_64
+  has not been run anywhere; macOS publication needs the stock system perl;
+  the app version has a floor and no ceiling; a vault body edit to a note
+  whose source uses CRLF becomes a proposal rather than an apply. No adopter
+  acceptance is recorded.
+
+### Changed
+
+- The resolver that produces `links_to` edges is now shared by the graph and
+  the projection, and its behaviour changed in five classes. Graph artifacts a
+  consumer has committed may differ after upgrading in exactly these classes
+  and no others; each is pinned in `test/graph-knowledge-graph.test.mjs` and
+  listed in `docs/obsidian-contract.md`. Regenerate committed graph artifacts
+  after upgrading and review the difference.
+  1. Links inside fenced code (backtick or tilde, any info string, up to three
+     spaces of indent, CRLF, CommonMark fence-length rules), inside inline
+     code and inside front matter no longer produce edges. Two stray backticks
+     that happen to pair across a link count as inline code, and links after
+     an unbalanced fence that runs to the end of the file are inside code.
+  2. A link to a directory resolves to that directory's `README.md`, then
+     `index.md`, testing eligibility per candidate. A link to a parent
+     directory now resolves where the earlier reader missed it.
+  3. A link that climbs above its own repository root and re-enters through
+     the checkout's directory name is reported as leaving the enrolled roots,
+     as before. It is never turned into a repository-local edge.
+  4. Malformed percent-encoding in a link is a `link-href-malformed` finding.
+     It no longer throws out of the graph build.
+  5. The workspace graph, not repository artifacts, additionally carries
+     wikilink edges and cross-repository Markdown-link edges, de-duplicated.
+
+## 0.2.0-alpha.7
+
+- Add a guided owner-agent upgrade skill and read-only `upgrade explain`
+  reports derived from saved plans. Retain consent and provenance limits,
+  distinguish staged installation from adoption, and route unsupported
+  workspaces through their existing operator procedure.
+
+- Add explicit saved-plan local upgrade transactions with private receipts,
+  existing commit hooks and recovery inspection. Refuse unsupported Git
+  attributes before generated writes and explain abandoned preparation state.
+- `lock write` now preserves valid migration and template history and refuses
+  a malformed previous lock. Inspect and repair or separately archive the
+  invalid lock before retrying; history is no longer silently overwritten.
+
+- Add a source-only Astro reference consumer for build-time presentation tokens,
+  no-script reading/navigation, local-only form validation and cross-browser proof.
+  Keep public-page mechanics consumer-owned; add no Astro runtime dependency.
+- Patch the existing fast-uri dependency and override to 3.1.7. Clarify ordinary
+  web-link navigation versus native host navigation requests.
+
+- Validate proposed and retained adoption configurations together with their
+  policy before writing; refuse an existing default policy during blank init.
+  Compare manifests using their serialized JSON representation so omitted
+  optional fields do not make freshly generated output stale.
+- Migration: unset or correct globally exported `MNSTRY_ATELIER_ACTOR` values
+  that are not declared in the current policy. Invalid explicit selectors now
+  refuse even shared-only and legacy-warning checks.
+
+- Correct shared-only attribution so ambient platform identities cannot invent
+  an ownership requirement or trigger a network lookup. Preserve legacy-warning
+  semantics for derived identities; Sync remains strict. Match platform logins
+  only to declared logins, refuse prototype-name omissions and duplicate repos.
+- Share manifest generation between project and upgrade, store a relative graph
+  path, and compare parsed content independently of object-key order.
+- Resolve preview commands through the scoped package from root or parent installs;
+  qualify both layouts with installed health/page smoke tests. Existing preview
+  configs require an explicit user update.
+- Validate retained adoption policy/lock state before writing, refuse implicit
+  drift acceptance, detect null-digest policy drift, and refuse init collisions
+  so retries cannot overwrite authored files or reset the lock.
+
+- Repair starter document classifications, shared adoption policy validity and
+  initial adoption locks. Existing locks are retained so adoption cannot accept
+  managed-file drift implicitly.
+- Resolve template previews through the locally installed scoped package.
+- Refuse unknown or ambiguous actor declarations, prioritize platform login over
+  Git metadata, and never infer the current operator from commit history. Shared
+  policy declarations do not require ownership of private repos outside the
+  configured workspace. These checks remain attribution, not authentication.
+- Check the generated projection manifest as well as its HTML for staleness.
+
+- Add evidence-thresholded skill stewardship and exact-plan local projections;
+  refuse unmanaged collisions, managed drift and cross-workspace confirmations.
+- Add bounded immutable source copies and extraction attempt receipts, retaining
+  originals and separating byte integrity from semantic acceptance.
+- Add inert guide offers, revocable engagement and exact-payload consent contracts.
+  No remote execution, commercial authority or proprietary implementation ships.
+  See issues #33 and #34 and the skill stewardship and intake/guide documentation.
+
+- Add experimental source-bound coauthor sessions, a private draft store, JSON
+  stdin CLI and portable guided-coauthor skill. Preserve original answers,
+  confirmation, durable receipts, bounded recovery and source-change refusal;
+  no canonical source edits or publication authority are introduced.
+- Add an external-project adapter starter with declared source boundaries,
+  namespaced synthetic protocols, local-state exclusions and compatibility policy.
+- Add evidence-bound local review runs, per-claim decisions, source-owner
+  handoffs, passage responses and reading-position recovery. Current decisions
+  refuse changed evidence and stale versions; local typed names remain asserted
+  identities and no source edits are applied automatically.
+- Report installed provenance as declared origin, observed bytes or verified
+  checkout binding. Compare working bytes with commit objects, including Git
+  index hints, sanitize remote metadata, and fail exact-source checks when the
+  binding is unresolved. Piped provenance output is no longer truncated.
+- Remove unsupported numeric claim confidence and explain legacy readiness
+  scores as input completeness. Supply the required run import-safety field.
+- Add pack lifecycle qualification and dry-run migration guidance plus explicit,
+  disclosure-checked historical inspection bundles that never transfer approval.
+- Extend the existing installed consumer gate across moved source layouts,
+  durable contributions, stale refusal and inspection-only portability.
+
 ## 0.2.0-alpha.6
 
+- Share project-location parsing with extension-pack commands, including
+  repeated `--repo-path NAME=PATH` overrides and both argument forms. Malformed
+  shared options now fail before local-state creation. Add path-free resolution
+  diagnostics with `config check --explain`; read boundaries remain declared
+  by the project.
 - Add Deliverable Zero for Atelier Sync: explicit single-repository
   enrollment, a pinned direct-process Git adapter, executable repository
   completeness observations, fast-forward-only reconciliation, per-repository

package/README.md

@@ -12,7 +12,7 @@ The Atelier adds that missing layer without taking the work away from you. It
 turns a repository into an ontology-governed knowledge graph, gives rules the
 power to refuse invalid states, and produces bounded views for people, teams,
 agents, and tools. Git remains the source of record. Your files remain readable.
-The runtime remains local.
+The authoring runtime remains local; optional vault adapters run in an explicitly configured host.
 
 That makes the same repository useful at several levels:
 
@@ -33,6 +33,12 @@ its definition or ceiling.
 
 ## From files to a working system
 
+For local-harness authoring, see [durable coauthor sessions](docs/coauthor-session.md)
+and [skill stewardship and managed installation](docs/skill-steward.md).
+[Immutable intake and guide contracts](docs/intake-and-guides.md) extend existing
+processing and hosted-tool adapters without adding remote execution or publication
+authority. These alpha capabilities require explicit consumer integration.
+
 ```text
 files you own
     ↓ declare identity, type, audience, and relationships
@@ -48,7 +54,7 @@ governed projections
 You can see the complete loop in a disposable sample workspace:
 
 ```bash
-npm install --save-dev @mnstry/atelier@0.2.0-alpha.6
+npm install --save-dev @mnstry/atelier@0.2.0-alpha.8
 npx mnstry-atelier init --fixture=sample-workspace --target ./sample
 npx mnstry-atelier graph --project ./sample/atelier.project.json
 npx mnstry-atelier project --project ./sample/atelier.project.json
@@ -236,6 +242,12 @@ executable API reference. [Distribution contracts](./docs/distributions.md) expl
 how a governed subset can be packaged for another surface without widening its
 audience.
 
+The [advisory decision contract](./docs/decisions.md) gives hosts bounded
+choice, score and boolean questions with evidence references and recorded
+uncertainty. `@mnstry/atelier/decisions` validates these records offline.
+The host supplies optional provider execution and retains authorization;
+an assessment carries proposal-only authority.
+
 ## Where the Atelier stops
 
 The open package owns repository-side structure and proof. A managed runtime
@@ -258,20 +270,25 @@ This package makes three promises. None of them asks for your trust — each
 one names the command that proves it.
 
 **There is no silent egress; every network path is named.** There is no
-telemetry, update check, crash reporting, managed-runtime upload, or model
-provider path in the package. The exceptions are explicit: `boundary check`
-may invoke `gh api user` after no declared actor matches an explicit `--actor`,
-`MNSTRY_ATELIER_ACTOR`, `GITHUB_ACTOR`, or a configured Git email; repository
-identity checks may invoke `gh api repos/...` to resolve a canonical GitHub
-identity. Those authenticated requests use your own `gh` credentials. A
-recognized explicit actor prevents the boundary actor fallback; recorded
-repository identities let identity checks keep working when the provider is
-unavailable. Explicitly enrolled Atelier Sync may also run bounded Git fetches
+telemetry, update check, crash reporting, or model provider path in the package.
+The optional vault API adds explicit host-bound artifact uploads and reads; it
+is never activated by local authoring commands. Its injected storage, database
+and identity SDKs may use the network and require separate hosted qualification. The exceptions are explicit: `boundary check` and
+`upgrade` (including `--dry-run` and `--apply`) may invoke `gh api user` only when
+an operated private-domain repository needs owner attribution, no explicit selector or `GITHUB_ACTOR` was supplied, and no
+configured Git email maps to an actor. Shared-only boundary checks skip derived
+identity lookup. Invalid explicit selectors are refused without fallback;
+platform logins must uniquely match declared login mappings. Repository identity
+checks may invoke `gh api repos/...` to resolve a canonical GitHub identity.
+Those authenticated requests use your own `gh` credentials. Recorded repository
+identities let identity checks keep working when the provider is unavailable.
+See `docs/install.md` for the full attribution precedence and mode semantics.
+Explicitly enrolled Atelier Sync may also run bounded Git fetches
 for observation/reconciliation and one non-force push only when the exact
 reviewed commit plan requested and confirmed it, no earlier local commit is
 waiting to be published, and HEAD still names the verified commit object. Sync
 never uses the network actor fallback, follows tags, or recursively publishes
-submodule refs. The package's HTTP client
+submodule refs. The local authoring HTTP client
 refuses non-loopback URLs, the served pages authorize no external origin, and
 release audit scans every executable or markup file in the exact `npm pack`
 inventory for egress primitives. The standalone gate also scans executable and
@@ -318,13 +335,16 @@ receive.
 - It does not write to a MNSTRY runtime database.
 - It does not import, provision, publish, or send project content to a MNSTRY
   managed runtime.
-- Conformance remains offline. Network access is limited to the documented
+- Conformance remains offline. Local CLI network access is limited to the documented
   `gh` actor-resolution fallback and explicitly enrolled Atelier Sync Git
   operations: bounded fetch for observation/reconciliation, and non-force push
   only when the exact reviewed commit plan requested and confirmed it, no
   earlier local commit remains unpublished, and HEAD still names the verified
   commit object; Sync does not use network actor fallback, follow tags, or
   recursively publish submodule refs.
+- Optional vault adapters use explicitly injected host SDKs and transports. The
+  host owns their network access, authentication and infrastructure; importing
+  the kit does not create a service or make a network request.
 - It does not execute model-assisted analysis or any model provider.
 - It does not include client project content.
 
@@ -358,7 +378,7 @@ Node.js `>=22.18.0 <23` is required. Pin the prerelease while the package
 remains in alpha:
 
 ```bash
-npm install --save-dev @mnstry/atelier@0.2.0-alpha.6
+npm install --save-dev @mnstry/atelier@0.2.0-alpha.8
 ```
 
 Then choose the path that matches what you are building:
@@ -372,10 +392,12 @@ Then choose the path that matches what you are building:
 - [Continuity commitments](./docs/continuity.md)
 - [Assurance controls and evidence map](./docs/assurance-controls.md)
 - [Upgrade notes](./docs/upgrade.md)
+- [Upgrade with your agent](./docs/guided-upgrades.md)
+- [Obsidian projection](./docs/obsidian.md)
 
 ## Status and command reference
 
-Current package: `@mnstry/atelier@0.2.0-alpha.6`.
+Current package: `@mnstry/atelier@0.2.0-alpha.8`.
 
 The alpha package is usable and contract-tested, but its library API may still
 change before a stable release. Pin the exact version in production toolchains.
@@ -413,3 +435,25 @@ full command behavior is also covered by the package's executable tests.
 
 Contributions are welcome through [the contribution guide](./CONTRIBUTING.md).
 MNSTRY Atelier is released under [Apache-2.0](./LICENSE).
+
+## Experimental hosted vault contract
+
+An optional [private artifact vault service](docs/vault-service.md) supplies a
+provider-independent ownership boundary and explicit Vercel/Cloudflare storage
+bindings. It is not enabled by local CLI commands. Hosting adapters can perform
+network I/O only when explicitly installed and invoked by a consuming host.
+Browser identity integration and hosted acceptance remain unqualified.
+
+## Experimental Obsidian projection
+
+An opt-in projection publishes readable, linked notes of an enrolled workspace
+into a vault outside every repository, keeps them current, and preserves every
+edit made in the editor before anything is republished. A body edit is applied
+to its source manually or under a scoped policy the user installs; anything
+structural stays a copy-only proposal. Atelier never commits to Git for it.
+It is disabled unless a project enables it, and it is proven on one platform
+and one app version. Read [what it does and its known limits](docs/obsidian.md),
+the [contract](docs/obsidian-contract.md) and the
+[maintenance service](docs/local-services.md) before relying on it. The
+package subpaths are `@mnstry/atelier/obsidian` and
+`@mnstry/atelier/obsidian/*`.

package/SECURITY.md

@@ -42,9 +42,14 @@ you have to sign.
 These are the claims the package makes. Defeating any of them is a
 vulnerability, and the more quietly it can be defeated, the more severe:
 
-- **Egress.** Any network send path in first-party code, or any way to make
+- **Egress.** Any undocumented network send path, any vault SDK invocation
+  without explicit host integration, or any way to make
   the local sidecar reachable off loopback or serve a policy that authorizes
   an external origin.
+- **Vault ownership.** Any hosted artifact or asset served without a verified
+  owner identity, cross-vault credential use, or publication that bypasses the
+  atomic owner/revision check. The experimental contract still requires hosted
+  qualification; local conformance tests are not a production safety claim.
 - **Boundary guard.** Any way to get private or sensitive source into a
   shared repo, to stage a protected local file, or to promote private-domain
   material without the required disclosure record — while the guard reports

package/contracts/atelier-adoption-policy.v1.schema.json

@@ -0,0 +1,49 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mnstry.ai/schemas/atelier/atelier-adoption-policy.v1.schema.json",
+  "$comment": "contract revision 1.0.0",
+  "title": "mnstry.atelier-adoption-policy@v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "enabled",
+    "mode",
+    "maxAgeSeconds",
+    "recoveryCoverage",
+    "allowedEffects"
+  ],
+  "properties": {
+    "schema": {
+      "const": "mnstry.atelier-adoption-policy@v1"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "mode": {
+      "const": "manual-exact-plan"
+    },
+    "maxAgeSeconds": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 86400
+    },
+    "recoveryCoverage": {
+      "const": "local-only"
+    },
+    "allowedEffects": {
+      "const": [
+        "lock-and-projections",
+        "git-commit"
+      ]
+    },
+    "ext": {
+      "type": "object",
+      "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+    },
+    "contractVersion": {
+      "type": "string",
+      "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+    }
+  }
+}

package/contracts/atelier-coauthor.v1.schema.json

@@ -0,0 +1,163 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mnstry.ai/schemas/atelier/atelier-coauthor.v1.schema.json",
+  "$comment": "contract revision 1.0.0",
+  "title": "Private coauthor configuration and draft",
+  "oneOf": [
+    {
+      "$ref": "#/$defs/config"
+    },
+    {
+      "$ref": "#/$defs/draft"
+    }
+  ],
+  "$defs": {
+    "config": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 100000
+        },
+        "fields": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 1000,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 100000
+              },
+              "source": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                  "ref": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 100000
+                  },
+                  "digest": {
+                    "type": "string",
+                    "pattern": "^[a-f0-9]{64}$"
+                  },
+                  "ext": {
+                    "type": "object",
+                    "description": "Reserved inert metadata; does not grant authority."
+                  }
+                },
+                "required": [
+                  "ref",
+                  "digest"
+                ]
+              },
+              "ext": {
+                "type": "object",
+                "description": "Reserved inert metadata; does not grant authority."
+              }
+            },
+            "required": [
+              "id",
+              "source"
+            ]
+          }
+        },
+        "contractVersion": {
+          "type": "string",
+          "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+        },
+        "ext": {
+          "type": "object",
+          "description": "Reserved inert metadata; does not grant authority."
+        }
+      },
+      "required": [
+        "id",
+        "fields"
+      ]
+    },
+    "draft": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "schema": {
+          "const": "atelier-coauthor-draft@v1"
+        },
+        "status": {
+          "const": "draft"
+        },
+        "text": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 100000
+        },
+        "receipt": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 100000
+            },
+            "requestId": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 100000
+            },
+            "fieldId": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 100000
+            },
+            "sourceRef": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 100000
+            },
+            "sourceDigest": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            },
+            "valueDigest": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            },
+            "ext": {
+              "type": "object",
+              "description": "Reserved inert metadata; does not grant authority."
+            }
+          },
+          "required": [
+            "sessionId",
+            "requestId",
+            "fieldId",
+            "sourceRef",
+            "sourceDigest",
+            "valueDigest"
+          ]
+        },
+        "contractVersion": {
+          "type": "string",
+          "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+        },
+        "ext": {
+          "type": "object",
+          "description": "Reserved inert metadata; does not grant authority."
+        }
+      },
+      "required": [
+        "schema",
+        "status",
+        "text",
+        "receipt"
+      ]
+    }
+  }
+}