@mnstry/atelier 0.2.0-alpha.6 → 0.2.0-alpha.8

package/contracts/atelier-upgrade-plan.v2.schema.json

@@ -0,0 +1,398 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mnstry.ai/schemas/atelier/atelier-upgrade-plan.v2.schema.json",
+  "$comment": "contract revision 2.0.0",
+  "title": "mnstry.atelier-upgrade-plan@v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "digest",
+    "operation",
+    "workspace",
+    "repositoryId",
+    "configPath",
+    "baseHead",
+    "baseTree",
+    "branch",
+    "createdAt",
+    "expiresAt",
+    "policy",
+    "policyDigest",
+    "executorDigest",
+    "gitDigest",
+    "gitConfigDigest",
+    "hooksDigest",
+    "hooksPath",
+    "readSet",
+    "migration",
+    "writes",
+    "releaseEvidence",
+    "dependencyInstallation",
+    "mode",
+    "recoveryCoverage",
+    "message",
+    "gitAuxDigest"
+  ],
+  "properties": {
+    "schema": {
+      "const": "mnstry.atelier-upgrade-plan@v2"
+    },
+    "digest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "operation": {
+      "const": "prepare-local-candidate"
+    },
+    "workspace": {
+      "type": "string",
+      "minLength": 1
+    },
+    "repositoryId": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "configPath": {
+      "type": "string",
+      "minLength": 1
+    },
+    "baseHead": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{40,64}$"
+    },
+    "baseTree": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{40,64}$"
+    },
+    "branch": {
+      "type": "string",
+      "minLength": 1
+    },
+    "createdAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "expiresAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "policy": {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://mnstry.ai/schemas/atelier/atelier-adoption-policy.v1.schema.json",
+      "$comment": "contract revision 1.0.0",
+      "title": "mnstry.atelier-adoption-policy@v1",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema",
+        "enabled",
+        "mode",
+        "maxAgeSeconds",
+        "recoveryCoverage",
+        "allowedEffects"
+      ],
+      "properties": {
+        "schema": {
+          "const": "mnstry.atelier-adoption-policy@v1"
+        },
+        "enabled": {
+          "type": "boolean"
+        },
+        "mode": {
+          "const": "manual-exact-plan"
+        },
+        "maxAgeSeconds": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 86400
+        },
+        "recoveryCoverage": {
+          "const": "local-only"
+        },
+        "allowedEffects": {
+          "const": [
+            "lock-and-projections",
+            "git-commit"
+          ]
+        },
+        "ext": {
+          "type": "object",
+          "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+        },
+        "contractVersion": {
+          "type": "string",
+          "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+        }
+      }
+    },
+    "policyDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "executorDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "gitDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "gitConfigDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "hooksDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "hooksPath": {
+      "type": "string",
+      "minLength": 1
+    },
+    "readSet": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "path",
+          "state"
+        ],
+        "properties": {
+          "path": {
+            "type": "string",
+            "minLength": 1
+          },
+          "state": {
+            "anyOf": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "digest",
+                  "mode"
+                ],
+                "properties": {
+                  "digest": {
+                    "type": "string",
+                    "pattern": "^sha256:[a-f0-9]{64}$"
+                  },
+                  "mode": {
+                    "enum": [
+                      "100644",
+                      "100755"
+                    ]
+                  },
+                  "ext": {
+                    "type": "object",
+                    "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+                  }
+                }
+              }
+            ]
+          },
+          "ext": {
+            "type": "object",
+            "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+          }
+        }
+      }
+    },
+    "migration": {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://mnstry.ai/schemas/atelier/atelier-migration.v2.schema.json",
+      "$comment": "contract revision 2.0.0",
+      "title": "mnstry.atelier-migration@v2",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema",
+        "id",
+        "executorDigest",
+        "readScope",
+        "allowedWrites",
+        "sideEffects",
+        "postChecks"
+      ],
+      "properties": {
+        "schema": {
+          "const": "mnstry.atelier-migration@v2"
+        },
+        "id": {
+          "const": "local-lock-projections@1"
+        },
+        "executorDigest": {
+          "type": "string",
+          "pattern": "^sha256:[a-f0-9]{64}$"
+        },
+        "readScope": {
+          "const": "whole-enrolled-repository"
+        },
+        "allowedWrites": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "sideEffects": {
+          "const": [
+            "git-index",
+            "git-commit"
+          ]
+        },
+        "postChecks": {
+          "const": [
+            "exact-inventory",
+            "lock-schema",
+            "exact-index",
+            "commit-parent-tree-message"
+          ]
+        },
+        "ext": {
+          "type": "object",
+          "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+        },
+        "contractVersion": {
+          "type": "string",
+          "pattern": "^2\\.[0-9]+\\.[0-9]+$"
+        }
+      }
+    },
+    "writes": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "path",
+          "owner",
+          "action",
+          "before",
+          "after",
+          "content"
+        ],
+        "properties": {
+          "path": {
+            "type": "string",
+            "minLength": 1
+          },
+          "owner": {
+            "enum": [
+              "lock",
+              "generated"
+            ]
+          },
+          "action": {
+            "enum": [
+              "create",
+              "update"
+            ]
+          },
+          "before": {
+            "anyOf": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "digest",
+                  "mode"
+                ],
+                "properties": {
+                  "digest": {
+                    "type": "string",
+                    "pattern": "^sha256:[a-f0-9]{64}$"
+                  },
+                  "mode": {
+                    "enum": [
+                      "100644",
+                      "100755"
+                    ]
+                  },
+                  "ext": {
+                    "type": "object",
+                    "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+                  }
+                }
+              }
+            ]
+          },
+          "after": {
+            "anyOf": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "digest",
+                  "mode"
+                ],
+                "properties": {
+                  "digest": {
+                    "type": "string",
+                    "pattern": "^sha256:[a-f0-9]{64}$"
+                  },
+                  "mode": {
+                    "enum": [
+                      "100644",
+                      "100755"
+                    ]
+                  },
+                  "ext": {
+                    "type": "object",
+                    "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+                  }
+                }
+              }
+            ]
+          },
+          "content": {
+            "type": "string",
+            "maxLength": 16777216
+          },
+          "ext": {
+            "type": "object",
+            "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+          }
+        }
+      }
+    },
+    "releaseEvidence": {
+      "type": "null"
+    },
+    "dependencyInstallation": {
+      "const": "excluded"
+    },
+    "mode": {
+      "const": "manual-exact-plan"
+    },
+    "recoveryCoverage": {
+      "const": "local-only"
+    },
+    "message": {
+      "type": "string",
+      "minLength": 1
+    },
+    "ext": {
+      "type": "object",
+      "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+    },
+    "contractVersion": {
+      "type": "string",
+      "pattern": "^2\\.[0-9]+\\.[0-9]+$"
+    },
+    "gitAuxDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    }
+  }
+}

package/contracts/atelier-upgrade-receipt.v1.schema.json

@@ -0,0 +1,99 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mnstry.ai/schemas/atelier/atelier-upgrade-receipt.v1.schema.json",
+  "$comment": "contract revision 1.0.0",
+  "title": "mnstry.atelier-upgrade-receipt@v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "kind",
+    "operationId",
+    "planDigest",
+    "sequence",
+    "previous",
+    "time",
+    "phase",
+    "step",
+    "expected",
+    "observed",
+    "confirmation"
+  ],
+  "properties": {
+    "schema": {
+      "const": "mnstry.atelier-upgrade-receipt@v1"
+    },
+    "kind": {
+      "const": "private-event"
+    },
+    "operationId": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "planDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "sequence": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "previous": {
+      "anyOf": [
+        {
+          "type": "string",
+          "pattern": "^sha256:[a-f0-9]{64}$"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "time": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "phase": {
+      "enum": [
+        "accepted",
+        "write-intent",
+        "write-complete",
+        "stage-intent",
+        "commit-intent",
+        "completed",
+        "commit-refused",
+        "recovery-required"
+      ]
+    },
+    "step": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "expected": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "observed": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "confirmation": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "ext": {
+      "type": "object",
+      "description": "Namespaced annotations only. Unknown members MUST be ignored and convey no authority."
+    },
+    "contractVersion": {
+      "type": "string",
+      "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+    }
+  }
+}

package/contracts/atelier-vault-publication.v1.schema.json

@@ -0,0 +1,58 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mnstry.ai/schemas/atelier/atelier-vault-publication.v1.schema.json",
+  "title": "Private vault publication request",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "expectedRevision",
+    "files"
+  ],
+  "properties": {
+    "schema": {
+      "const": "atelier-vault-publication/v1"
+    },
+    "expectedRevision": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 9007199254740990
+    },
+    "files": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 100,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "path",
+          "base64"
+        ],
+        "properties": {
+          "path": {
+            "type": "string",
+            "maxLength": 512,
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*(/[A-Za-z0-9][A-Za-z0-9._-]*)*$"
+          },
+          "base64": {
+            "type": "string",
+            "maxLength": 4194304,
+            "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"
+          },
+          "ext": {
+            "type": "object"
+          }
+        }
+      }
+    },
+    "contractVersion": {
+      "type": "string",
+      "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+    },
+    "ext": {
+      "type": "object"
+    }
+  },
+  "$comment": "contract revision 1.0.0; explicit host-bound private artifact publication."
+}

package/docs/assurance-controls.md

@@ -10,11 +10,19 @@ commit and packed-tarball digest.
 | Boundary rules cannot silently switch themselves off | `src/boundary/policy.mjs`, `src/boundary/content-rules.mjs`, and generated Git hooks | `boundary:test`; boundary case in `assurance:mutation-smoke` | Repository access remains the source read boundary; an audience label is not encryption |
 | A clean boundary verdict uses complete evidence | Typed Git reads with diff and binary budgets; incomplete reads become blocking diagnostics; Sync requires the enrolled root to be scanned, uses its digest-bound Git for actor and staged evidence, and disables network actor fallback | `test/boundary-content-rules.test.mjs`; Sync boundary-scope, pinned-Git, and no-network actor refusal cases | Budgets intentionally refuse evidence too large to inspect rather than claiming it is clean |
 | Graph classification has one meaning | `src/graph/knowledge-graph.mjs` is canonical; `src/graph/graph.mjs` adapts its result | `graph:test`; graph case in `assurance:mutation-smoke` | Unclassified Markdown is retained as private diagnostic material, not admitted as governed content |
-| The package has no undisclosed runtime egress path | Canonical forbidden-egress scanner plus exact packed-file inventory in `release:audit`; Atelier Sync confines network Git to bounded fetch and an exact-plan, non-force push | egress tests, marker-inventory test, runtime fetch/push refusal tests, and egress case in `assurance:mutation-smoke` | Data-only files are not interpreted; reviewed `gh` actor resolution and explicitly enrolled Git fetch/push are documented subprocess exceptions |
+| The package has no undisclosed runtime egress path | Canonical forbidden-egress scanner plus exact packed-file inventory in `release:audit`; Atelier Sync confines network Git to bounded fetch and an exact-plan, non-force push | egress tests, marker-inventory test, runtime fetch/push refusal tests, and egress case in `assurance:mutation-smoke` | Data-only files are not interpreted; reviewed `gh` actor resolution and explicitly enrolled Git fetch/push are documented subprocess exceptions. Optional host-bound vault SDK and transport I/O is outside the lexical scanner model; trusted provider configuration, denial probes and hosted qualification are separate controls. |
 | User-confirmed repository writes match what was reviewed | Content-bound, expiring plan identifiers; fresh complete observations; exact staged and written-tree blob/mode manifests; post-hook tree, single-parent, and message verification with compare-and-swap rollback; refusal of prior unpublished commits; and an exact verified-object push after HEAD/target revalidation with tag following and recursive submodule publication disabled | `sync:test` plan, expiry, hook/index, late-HEAD, ahead-branch, remote-ref, remote-drift, and evidence-failure cases | Ordinary Git hooks may run, but a hook cannot substitute a different commit object for publication |
 | Resident Sync state cannot escape or grow without bound | Contained private directories, no-follow/identity-checked leaves, a 4,096-entry observation ceiling, bounded state projection, nonce-bound locks with aged abandoned-claim recovery, lock-directory identity validation and an ambiguous live-PID maximum age, consumed plans under age/file/byte ceilings, and corruption-recovering hash-chained traces with per-event/resident ceilings | `sync:test` observation/state ceilings, redirected-state/lock, plan lifecycle, concurrent enrollment/recovery, corruption, and trace ceilings | Machine-local state is diagnostic convenience; Git and readable repository files remain authoritative |
 | Local review serves only generated publication output | Loopback-only bind, required `atelier.manifest.json`, realpath containment, enrolled safe types, POSIX no-follow plus cross-platform leaf type/identity validation for local state, and host/fetch-site/origin/method/nonce checks | `server:security:test`; sidecar case in `assurance:mutation-smoke` | The sidecar is a local review tool, not user authentication or runtime authorization |
 | Collaboration cannot become a hidden apply path | Proposal authority is capability-derived; records are typed; POSIX ledger and snapshot leaves are no-follow, while every platform rejects redirected leaves and validates opened file identity when available; ledger reads are bounded, one-pass for lists, and corrupt tails fail closed | `collaboration:test` and ledger ceiling/performance tests | Collaboration remains copy-only proposal metadata; snapshots are rebuildable projections and Git review owns source changes |
+| The Obsidian maintenance service is reachable from this machine only, and only by its owner | Bind and client are restricted to the literal `127.0.0.1` or `::1`; `Host` must be the exact bound authority; cross-site `Origin` and `Sec-Fetch-Site` are refused; four fixed operations with exact paths and methods; status, tick and stop need a per-runtime random bearer kept only in the mode-0600 record; payloads are bounded and name their runtime; health carries no path or title | `test/obsidian-maintenance.test.mjs` listener, disclosure and unauthorised-request cases, each with a deliberately broken listener that must fail | A local process running as the same user can read the record; the bearer is ownership proof between local processes, not user authentication |
+| A maintenance service is stopped or reported as running only when it is proven to be this workspace's own | Record and health must agree on service name, workspace, runtime identifier, PID, executable digest and loopback address; anything else on the port is `occupied`; a reused PID is never signalled; a malformed or foreign record refuses; `start` stops only the child it created, by handle | Unowned and silent listener, wrong-identity, PID-reuse, stale-record, malformed-record, idempotent and concurrent start, and launcher-survival cases, with mutation controls | Status probes have a deadline: a service busy in a long synchronous tick can be reported `occupied` until it answers |
+| Maintenance never sweeps recovery or staging, and one workspace has one ticking engine | The service deletes only its generated record; the engine and the publisher own every other write; a hard kill is settled by the publisher's journaled restart recovery; each tick holds a private per-workspace lock taken from a holder only with proof of abandonment | Directory-listing oracles across start, ticks, stop, hard kill and stale record; hard kill between exchange and manifest commit; lock exclusion and takeover cases; each with a mutation control | A live lock holder that recorded no health address needs a person; a tick that outlasts the shutdown grace period ends with the process and is settled on the next start |
+| Source application policy is re-read before every automatic apply | The engine authorizes from disk immediately before each dispatch; manual mode never reaches the apply operation; the service keeps this on every tick; the apply operation reads the installed policy again at its decision and immediately before the write, recomputes its digest and evaluates its selector over the current canonical graph; `policy install` verifies that digest and names the expected one; whether this machine may see the object is asked before anything else, so an absent and a withheld object get one answer | Revocation, manual-mode and apply-unavailable cases in `test/obsidian-maintenance.test.mjs`; policy, refusal-table and late-revocation cases in `test/obsidian-edits.test.mjs`, each with a deliberately broken rule that must fail | A policy is private configuration of one machine; whoever can write that private state can install one |
+| Applying an edit to a source file cannot lose another program's bytes | One operation for a person and for a policy: exact identity, path and digest checks at commit; the write is an atomic exchange, never a check followed by a rename; displaced bytes that are not the base are exchanged back and retained; the old source stays as a backup that is looked at again for late writers; write-ahead record and intent before the exchange; restart recovery decides from digests only, and so does an exchange that reports a failure; generated regions never reach a source: the tail is intact, or removed with the end of the authored text proven, and anything else refuses; every git directory is refused, nested, respelled or relocated; the hold on an edited note lifts only on a read of the note at that moment; no git command that writes | `test/obsidian-edits.test.mjs`: end to end through the real engine, a refusal table with a whole-project byte and `git status` oracle, a real second process writing in three styles and four timings with both outcomes asserted, a crash at every durable step, a disclosure walk, a generated tail cut at every byte offset from both sides and a fuzz over the whole note; every oracle has a mutation control | macOS arm64 on APFS only; refuses where no atomic exchange exists; the source becomes a new file (permission bits kept, hard links refused); a late writer's bytes are retained and surfaced, never merged; a hard link made after the path check is not detected; a fragment of generated text shorter than eight bytes left inside an edited body cannot be told from typing |
+| A structural edit made in a vault becomes one copy-only proposal and never a source change | The proposal adapter routes by whole identity to the existing store of the enrolled repository or refuses typed and writes nothing; it records the operation in private immutable state first, looks in the persisted store for its operation identity before creating, under a private per-repository lock taken over only with proof; it preflights the ledger limits, defers `ledger-full`, refuses `proposal-too-large` and `ledger-corrupt`, bounds batches and retries, and never compacts; a proposal holds codes, offsets and digests and no note text; acceptance is shown and never acted on | `test/obsidian-proposals.test.mjs`: routing table with a whole-project byte and `git status` oracle, identity survival against the real store, a crash at every step, two real processes, generated ledgers at 256 KiB, 16 MiB and 10,000 events and an invalid line, a no-busy-loop count of store reads, a disclosure walk; engine cases in `test/obsidian-maintenance.test.mjs`; every oracle has a mutation control | In manual mode an operation exists only after apply has looked at the edit; a refused or exhausted operation waits for a person; the store directory lives in the repository and must be git-ignored; two workspaces that enrol one repository create one proposal each |
+| Opening a view reports `current` only for the exact, verified, present generation and a qualified app | `open` needs a tick of the proven service after the request, a persisted `current`, an independent read-back of the trusted pointer and every note, and an app at or above the minimum version that answers for that vault; every other outcome is typed, distinct and exits non-zero; the app and the operating system are reached only through injected seams, and the production ones only behind `--adapter=obsidian-cli` | `test/obsidian-open.test.mjs`: outcome table, read-back, app-floor, busy and read-only cases, each with a deliberately broken rule that must fail; a spawn guard and a production-seam import check | The production probe and launcher are not exercised against a real app here; `indexing` relies on an undocumented readiness field until acceptance qualifies it |
+| Operating-system startup is never installed implicitly | `buildStartupAdapter` is pure text generation; Windows refuses typed; the service refuses `--startup` without a consent that covers startup | Builder purity oracle (no filesystem, process or home-directory access; no machine path beyond its inputs) and startup-consent refusal | Generated units have not been qualified against real launchd or systemd hosts |
 | Expected operator failures are actionable without leaking internals | Typed project/JSON diagnostics and the CLI execution wrapper | `test/cli-brand.test.mjs` | Unexpected stacks require the operator to opt in with `ATELIER_DEBUG=1` |
 | Published APIs do not disappear silently | Tag-derived subpath and named-export baseline plus version/tag identity refusal | `public-api:compat`; `test/public-api-compat.test.mjs` | Additive API checks do not decide whether a new version number is appropriate |
 | The published artifact is the artifact tested | `release:candidate` packs once, binds SHA-256, sends that exact archive through allowlist/content audit, bare-consumer install, all-export import, and branded distribution smoke, then the trusted-publishing workflow retains and publishes that same tarball path | `release:audit`, `consumer:smoke`, `distribution:smoke`, `assurance:mutation-smoke`, `publish-workflow.test.mjs` | Passing gates does not publish, deploy, or constitute an external reviewer’s approval |

package/docs/atelier-sync.md

@@ -42,13 +42,14 @@ runtime object.
 - A commit plan cannot absorb pre-existing staged work. It stages only literal,
   explicitly reviewed paths.
 - Configured Atelier boundary policy is checked against the staged change set
-  before commit creation using the enrolled Git executable. When that policy
-  declares private-domain ownership, actor verification is blocking even in
+  before commit creation using the enrolled Git executable. When the enrolled project
+  operates a private-domain repository with a declared owner, actor verification is blocking even in
   legacy-warning mode. The Sync path disables the boundary command's optional
   network `gh api user` fallback and fails closed when local actor evidence is
   insufficient. Commit history is provenance, not current-user identity, and
-  is not accepted as actor evidence on this path. Policies without a declared private-domain owner do not invent
-  an actor requirement. Ordinary Git hooks still run; the resulting commit tree,
+  is not accepted as actor evidence on this path. Shared-only checks skip derived actor lookup, including ambient platform
+  identities. Invalid explicit selectors are still refused. Ownership is scoped
+  to configured repository names; it does not authenticate repository identity. Ordinary Git hooks still run; the resulting commit tree,
   single parent, and message must equal the reviewed authority or the local
   commit is rolled back and publication is refused.
 - Push is present only when the reviewed plan requested it, the branch had no

package/docs/blocks/claims.md

@@ -2,20 +2,25 @@ This package makes three promises. None of them asks for your trust — each
 one names the command that proves it.
 
 **There is no silent egress; every network path is named.** There is no
-telemetry, update check, crash reporting, managed-runtime upload, or model
-provider path in the package. The exceptions are explicit: `boundary check`
-may invoke `gh api user` after no declared actor matches an explicit `--actor`,
-`MNSTRY_ATELIER_ACTOR`, `GITHUB_ACTOR`, or a configured Git email; repository
-identity checks may invoke `gh api repos/...` to resolve a canonical GitHub
-identity. Those authenticated requests use your own `gh` credentials. A
-recognized explicit actor prevents the boundary actor fallback; recorded
-repository identities let identity checks keep working when the provider is
-unavailable. Explicitly enrolled Atelier Sync may also run bounded Git fetches
+telemetry, update check, crash reporting, or model provider path in the package.
+The optional vault API adds explicit host-bound artifact uploads and reads; it
+is never activated by local authoring commands. Its injected storage, database
+and identity SDKs may use the network and require separate hosted qualification. The exceptions are explicit: `boundary check` and
+`upgrade` (including `--dry-run` and `--apply`) may invoke `gh api user` only when
+an operated private-domain repository needs owner attribution, no explicit selector or `GITHUB_ACTOR` was supplied, and no
+configured Git email maps to an actor. Shared-only boundary checks skip derived
+identity lookup. Invalid explicit selectors are refused without fallback;
+platform logins must uniquely match declared login mappings. Repository identity
+checks may invoke `gh api repos/...` to resolve a canonical GitHub identity.
+Those authenticated requests use your own `gh` credentials. Recorded repository
+identities let identity checks keep working when the provider is unavailable.
+See `docs/install.md` for the full attribution precedence and mode semantics.
+Explicitly enrolled Atelier Sync may also run bounded Git fetches
 for observation/reconciliation and one non-force push only when the exact
 reviewed commit plan requested and confirmed it, no earlier local commit is
 waiting to be published, and HEAD still names the verified commit object. Sync
 never uses the network actor fallback, follows tags, or recursively publishes
-submodule refs. The package's HTTP client
+submodule refs. The local authoring HTTP client
 refuses non-loopback URLs, the served pages authorize no external origin, and
 release audit scans every executable or markup file in the exact `npm pack`
 inventory for egress primitives. The standalone gate also scans executable and

package/docs/blocks/will-not-do.md

@@ -1,13 +1,16 @@
 - It does not write to a MNSTRY runtime database.
 - It does not import, provision, publish, or send project content to a MNSTRY
   managed runtime.
-- Conformance remains offline. Network access is limited to the documented
+- Conformance remains offline. Local CLI network access is limited to the documented
   `gh` actor-resolution fallback and explicitly enrolled Atelier Sync Git
   operations: bounded fetch for observation/reconciliation, and non-force push
   only when the exact reviewed commit plan requested and confirmed it, no
   earlier local commit remains unpublished, and HEAD still names the verified
   commit object; Sync does not use network actor fallback, follow tags, or
   recursively publish submodule refs.
+- Optional vault adapters use explicitly injected host SDKs and transports. The
+  host owns their network access, authentication and infrastructure; importing
+  the kit does not create a service or make a network request.
 - It does not execute model-assisted analysis or any model provider.
 - It does not include client project content.