@mriekki/lean 0.2.0 → 0.2.1

package/README.md

@@ -8,10 +8,10 @@ Canonical engineering remains in the private platform repositories. Before publi
 
 The current profile bundles:
 
-- Lean Agentic Core `1.11.0` from commit `5b2f13bb188f74fa0d7b6b8d7985fe3abfc543f9`, distribution `greenfield-workspace`;
+- Lean Agentic Core `1.11.1` from commit `e3a8a994d1e95923d629af7640d3b3a0a4f098d4`, distribution `greenfield-workspace`;
 - Lean POC Deployment Kit commit `4c23140576b39608a3ef285cad4abe53dccb9c47`, distribution `greenfield-poc`.
 
-Core `1.11.0` adds the package-aware `/lean-update` workflow for `LEAN_BASELINE.json` consumers, keeps `/core-sync` as a compatibility/router path for component-only Core consumers, and aligns `/upstream-fix` and `/deploy` with the package and generated Deployment Kit boundaries.
+Core `1.11.1` tightens `/lean-update` for Bootstrap-generated package-managed consumers: it keeps `POC_BOOTSTRAP.json`, umbrella/component baselines, exact registry integrity, and generated package-verification surfaces coherent while retaining `/core-sync` as the compatibility/router path for component-only Core consumers.
 
 ## Developer experience
 

package/assets/components.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@mriekki/lean",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "defaultProfile": "greenfield-poc",
   "profiles": {
     "greenfield-poc": {
@@ -14,8 +14,8 @@
   "components": {
     "core": {
       "repository": "mriekki/lean-agentic-core",
-      "commit": "5b2f13bb188f74fa0d7b6b8d7985fe3abfc543f9",
-      "version": "1.11.0",
+      "commit": "e3a8a994d1e95923d629af7640d3b3a0a4f098d4",
+      "version": "1.11.1",
       "distribution": "greenfield-workspace",
       "descriptor": "assets/core/distribution.json",
       "sourceRoot": "assets/generated/core",

package/assets/generated/ASSEMBLY.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
   "package": "@mriekki/lean",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "components": {
     "core": {
       "repository": "mriekki/lean-agentic-core",
-      "commit": "5b2f13bb188f74fa0d7b6b8d7985fe3abfc543f9",
-      "version": "1.11.0",
+      "commit": "e3a8a994d1e95923d629af7640d3b3a0a4f098d4",
+      "version": "1.11.1",
       "distribution": "greenfield-workspace",
       "files": [
         {
@@ -82,7 +82,7 @@
         {
           "source": "core/skills/lean-update/SKILL.md",
           "destination": ".github/skills/lean-update/SKILL.md",
-          "sha256": "b9534533c2b612f2787ce4b9d40494bd5a3554ccb646f500610fb899be8113d2"
+          "sha256": "8b4bce53b109a5959e862924b0a4afd931233a5094a1aef43c2f3672199108bb"
         },
         {
           "source": "core/skills/core-sync/SKILL.md",

package/assets/generated/core/core/skills/lean-update/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lean-update
-description: Guided whole-profile update for package-managed Lean consumers using the exact published @mriekki/lean artifact while preserving Core, Deployment, and umbrella baseline integrity.
+description: Guided whole-profile update for package-managed Lean consumers using the exact published @mriekki/lean artifact while preserving Core, Deployment, umbrella, and generated-consumer provenance integrity.
 argument-hint: "[optional exact package version]"
 user-invocable: true
 disable-model-invocation: true
@@ -16,11 +16,12 @@ The governing rule is:
 package-managed consumer
 → update the whole Lean profile through the published package
 → keep LEAN_BASELINE.json + component baselines coherent
+→ when the consumer is Bootstrap-generated, keep approved generation metadata and generated package-verification surfaces coherent too
 ```
 
 Do not replace this with direct Core-only or Deployment-Kit-only synchronization when `LEAN_BASELINE.json` is present.
 
-Invocation starts read-only. One explicit update choice may authorize safe branch setup plus the exact package apply and verification. `/deliver`, merge, release publication, and production deployment remain separate.
+Invocation starts read-only. One explicit update choice may authorize safe branch setup plus the exact package apply, generated-consumer companion metadata updates when applicable, and verification. `/deliver`, merge, release publication, and production deployment remain separate.
 
 ## 1. Establish package-managed provenance
 
@@ -29,6 +30,7 @@ From the consumer root read:
 - `LEAN_BASELINE.json`;
 - `CORE_BASELINE.json` when present;
 - `DEPLOYMENT_BASELINE.json` when present;
+- `POC_BOOTSTRAP.json` when present;
 - current Git status, branch, remotes, and default branch when observable.
 
 Require `LEAN_BASELINE.json` to identify:
@@ -43,6 +45,16 @@ If `LEAN_BASELINE.json` is absent, report `NOT A PACKAGE-MANAGED LEAN CONSUMER`
 
 Do not synthesize or repair missing umbrella provenance by hand.
 
+### Bootstrap-generated consumers
+
+If `POC_BOOTSTRAP.json` exists, treat it as approved generated-consumer provenance, not unrelated product data.
+
+Before planning an update, require `generation.lean.package`, `generation.lean.version`, and `generation.lean.profile` to agree exactly with the installed `LEAN_BASELINE.json`. Require `generation.lean.integrity` to be a non-empty exact registry integrity value for that installed package/version. Verify that integrity read-only from the registry when registry access is available.
+
+If those values disagree before the update, report `GENERATED LEAN METADATA DRIFT` and stop. Do not use `/lean-update` to silently reconcile an already-incoherent generated consumer.
+
+Also inspect generated package-verification surfaces such as `.github/workflows/ci.yml` when present. If they duplicate the approved package version/integrity literally, record that current shape as companion generated metadata that must remain coherent with `POC_BOOTSTRAP.json` during the update. Do not rewrite locally customized or unrecognized generated surfaces by guesswork.
+
 ## 2. Verify the installed package baseline first
 
 Before planning an update, verify that the current managed state still matches the exact installed package version recorded in `LEAN_BASELINE.json`.
@@ -70,6 +82,8 @@ npm view @mriekki/lean@latest version --json
 npm view @mriekki/lean@<resolved-version> dist.integrity --json
 ```
 
+Capture the target package's full exact `dist.integrity` together with the resolved version. For a Bootstrap-generated consumer, that exact integrity is part of the reviewed companion metadata update.
+
 Do not use a moving `@latest` reference for the modifying apply after preview. Use the same exact package version for preview, apply, and final check.
 
 If the resolved version equals the installed version and the exact-version check passes, report `LEAN ALREADY CURRENT` and stop without creating a branch or commit.
@@ -99,18 +113,27 @@ Stop on unsafe states such as:
 
 Core retired paths are an ownership-transfer decision. Never auto-add `--accept-retired core:<path>` merely to make the update pass. Explain the retired path and require a separate explicit ownership decision before re-previewing it.
 
+For a Bootstrap-generated consumer, also preview the companion generated-consumer changes:
+
+- `POC_BOOTSTRAP.json` keeps the same package/profile but changes `generation.lean.version` and `generation.lean.integrity` to the exact reviewed target;
+- generated package-verification surfaces should consume `POC_BOOTSTRAP.json` dynamically when the accepted Bootstrap contract supports that form;
+- a recognized older Bootstrap-generated verification block may be migrated only when its embedded old package/version/integrity exactly match the currently approved manifest metadata;
+- an unrecognized or locally modified generated verification surface is a stop condition, not permission to reconstruct Bootstrap output by hand.
+
 ## 5. Present one bounded update choice
 
-When the exact target package plan is safe, present:
+When the exact target package plan and any generated-consumer companion plan are safe, present:
 
 ```text
 LEAN UPDATE READY
 
 Installed: <package>@<installed-version>
 Target: <package>@<target-version>
+Target integrity: <exact dist.integrity>
 Profile: <profile>
 Core: <old> → <new>
 Deployment: <old> → <new> / unchanged
+Generated consumer metadata: <not present / coherent update planned>
 Managed drift/conflicts: NONE
 
 1. Apply the exact Lean package update [GIT + FILE WRITE] — recommended
@@ -122,10 +145,12 @@ Choosing option 1 authorizes only:
 
 - creation/switch to one repository-appropriate short-lived update branch when needed;
 - exact target package apply;
-- package/baseline verification;
+- when `POC_BOOTSTRAP.json` is present, update of its exact `generation.lean.version` and `generation.lean.integrity` to the reviewed target while preserving package/profile;
+- migration of a recognized Bootstrap-generated package-verification block from duplicated current literals to the accepted manifest-driven form, only when the existing block still exactly matches the current approved metadata;
+- package/baseline/generated-consumer verification;
 - inspection of the resulting meaningful diff.
 
-It does not authorize `/deliver`, merge, npm/Core/Deployment release publication, or deployment.
+It does not authorize `/deliver`, merge, npm/Core/Deployment/Bootstrap release publication, arbitrary regeneration, or deployment.
 
 ## 6. Apply only the exact previewed package
 
@@ -145,9 +170,11 @@ npx --yes @mriekki/lean@<target-version> update --apply
 
 If explicit Core retired-path ownership transfer was separately approved, pass only the exact reviewed paths using the package's `--accept-retired core:<path>` contract. Never widen that set implicitly.
 
+For a Bootstrap-generated consumer, complete the reviewed companion metadata changes in the same bounded update before declaring success. Preserve every unrelated `POC_BOOTSTRAP.json` field. Never change package identity or profile as an incidental version update.
+
 Do not run direct `tools/package/sync.py`, Deployment Kit sync, or a remote `[sync-core]` request as part of a package-managed update.
 
-## 7. Verify all baselines and the diff
+## 7. Verify all baselines, generated metadata, and the diff
 
 After apply, run the exact target package check:
 
@@ -160,7 +187,7 @@ Then inspect:
 ```text
 git status --short --branch
 git diff --stat
-git diff -- LEAN_BASELINE.json CORE_BASELINE.json DEPLOYMENT_BASELINE.json
+git diff -- LEAN_BASELINE.json CORE_BASELINE.json DEPLOYMENT_BASELINE.json POC_BOOTSTRAP.json .github/workflows/ci.yml
 ```
 
 Confirm:
@@ -168,8 +195,13 @@ Confirm:
 - `LEAN_BASELINE.json` records the exact target package/version/profile;
 - component baseline commits/distributions match the umbrella baseline;
 - package check passes for the whole profile;
+- when `POC_BOOTSTRAP.json` exists, its package/version/profile agree with `LEAN_BASELINE.json` and its integrity equals the exact reviewed target registry integrity;
+- when the repository contains `tools/lean-package/check-managed-baselines.py`, that generated baseline checker passes after all companion metadata changes;
+- generated package-verification surfaces no longer contradict the approved manifest metadata;
 - consumer-owned content was not overwritten;
-- only intended package-managed changes and reviewed ownership transfers occurred.
+- only intended package-managed changes, reviewed generated-consumer companion changes, and reviewed ownership transfers occurred.
+
+If generated CI still embeds a different package version/integrity after the update, report `GENERATED LEAN VERIFICATION DRIFT` and stop before delivery.
 
 Present the meaningful diff for human review. After acceptance, recommend `/deliver` for normal commit/push/PR/CI mechanics.
 
@@ -182,7 +214,10 @@ Present the meaningful diff for human review. After acceptance, recommend `/deli
 - performs a downgrade/rollback as an ordinary update;
 - overwrites unexplained managed drift;
 - auto-accepts Core retired-path ownership transfer;
-- publishes npm/Core/Deployment releases or tags;
+- silently repairs a pre-existing mismatch between `POC_BOOTSTRAP.json` and `LEAN_BASELINE.json`;
+- changes a generated consumer's package identity/profile or regenerates the repository as an incidental version update;
+- guesses at locally modified/unrecognized Bootstrap-generated verification logic;
+- publishes npm/Core/Deployment/Bootstrap releases or tags;
 - merges the consumer PR;
 - deploys an environment.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/lean",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Public consumer distribution and updater for Lean engineering assets.",
   "type": "module",
   "bin": {