@mriekki/lean 0.3.1 → 0.3.2

package/README.md

@@ -6,12 +6,7 @@ Canonical engineering remains in the private platform repositories. Before publi
 
 ## Current `greenfield-poc` profile
 
-The current profile bundles:
-
-- Lean Agentic Core `1.11.1` from commit `e3a8a994d1e95923d629af7640d3b3a0a4f098d4`, distribution `greenfield-workspace`;
-- Lean POC Deployment Kit commit `4c23140576b39608a3ef285cad4abe53dccb9c47`, distribution `greenfield-poc`.
-
-Core `1.11.1` tightens `/lean-update` for Bootstrap-generated package-managed consumers: it keeps `POC_BOOTSTRAP.json`, umbrella/component baselines, exact registry integrity, and generated package-verification surfaces coherent while retaining `/core-sync` as the compatibility/router path for component-only Core consumers.
+The profile bundles Lean Agentic Core's `greenfield-workspace` distribution and the Lean POC Deployment Kit's `greenfield-poc` distribution. The package version and exact canonical component commits are recorded in [`assets/components.json`](./assets/components.json), which is the source of truth for each release.
 
 ## Developer experience
 
@@ -38,7 +33,7 @@ npx @mriekki/lean@latest status
 npx @mriekki/lean@latest check
 ```
 
-The umbrella package writes `LEAN_BASELINE.json` while preserving component-native `CORE_BASELINE.json` and `DEPLOYMENT_BASELINE.json` ledgers. Updates refuse managed drift/conflicts before modifying any component. Core retired paths require explicit ownership transfer with `--accept-retired core:<path>`; unchanged Deployment Kit retirements may be removed under its existing ownership contract.
+The umbrella package writes `LEAN_BASELINE.json` while preserving component-native `CORE_BASELINE.json` and `DEPLOYMENT_BASELINE.json` ledgers. Updates refuse managed drift/conflicts before modifying any component. An unchanged retired managed path can be removed safely; a locally modified retired Core path stops the update until the operator explicitly transfers ownership with `--accept-retired core:<path>`.
 
 ## Safety and ownership
 
@@ -58,16 +53,16 @@ The package currently starts with the `greenfield-poc` consumer profile. Existin
 For normal releases in the Lean Platform VS Code workspace, use:
 
 ```text
-/release-lean [version | patch | minor | major]
+/release-lean
 ```
 
-The repo-local skill resolves accepted component commits, prepares the version/pin/descriptor update, runs local verification, creates the release PR, waits for the package-PR merge gate, verifies post-merge `main` CI, then stops once at the exact npm publication gate.
+The repo-local skill resolves accepted component commits, automatically selects the package version from the observed consumer-visible changes, prepares the version/pin/descriptor update, runs local verification, creates the release PR, waits for the package-PR merge gate, verifies post-merge `main` CI, then stops once at the exact npm publication gate. Explicit bump or exact-version arguments remain available only as unusual overrides.
 
 After publication approval it triggers `.github/workflows/npm-publish.yml`. The workflow reconstructs the package from the exact private component pins, runs the deterministic release preparation, publishes the exact tarball directly with npm Trusted Publishing (OIDC), and automatically verifies the registry identity plus a neutral-directory `npx` smoke check.
 
 The normal flow does not use staged npm publication or a long-lived npm publish token. An existing stage-only trusted publisher must be migrated once to allow direct `npm publish` from `npm-publish.yml`; `/release-lean` guides that bounded one-time setup.
 
-Before merging a release PR, verify the local npm maintainer login and trusted-publisher relationship; the release skill explains npm's browser/2FA reauthorization if `npm trust list` returns `EOTP`. GitHub Actions publication uses OIDC, not a manually managed npm token. See `docs/RELEASE_PROCESS.md` for the operator setup.
+Routine releases do not require local npm authentication: GitHub Actions publishes through OIDC. npm login and trusted-publisher inspection are only needed for initial setup, migration, or troubleshooting a trust error. See `docs/RELEASE_PROCESS.md` for details.
 
 The underlying release-candidate command remains available for diagnostics:
 

package/assets/components.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@mriekki/lean",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "defaultProfile": "greenfield-poc",
   "profiles": {
     "greenfield-poc": {
@@ -14,8 +14,8 @@
   "components": {
     "core": {
       "repository": "mriekki/lean-agentic-core",
-      "commit": "009572aa4c61ad9a45ec5473b6affc984d6faac0",
-      "version": "1.12.0",
+      "commit": "bcc3836b50713504aea1dc47b8ad26bf483315dd",
+      "version": "1.12.1",
       "distribution": "greenfield-workspace",
       "descriptor": "assets/core/distribution.json",
       "sourceRoot": "assets/generated/core",

package/assets/generated/ASSEMBLY.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
   "package": "@mriekki/lean",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "components": {
     "core": {
       "repository": "mriekki/lean-agentic-core",
-      "commit": "009572aa4c61ad9a45ec5473b6affc984d6faac0",
-      "version": "1.12.0",
+      "commit": "bcc3836b50713504aea1dc47b8ad26bf483315dd",
+      "version": "1.12.1",
       "distribution": "greenfield-workspace",
       "files": [
         {
@@ -82,7 +82,7 @@
         {
           "source": "core/skills/lean-update/SKILL.md",
           "destination": ".github/skills/lean-update/SKILL.md",
-          "sha256": "8b4bce53b109a5959e862924b0a4afd931233a5094a1aef43c2f3672199108bb"
+          "sha256": "50bfa181bb9a6abc1d0bb6533ef0b29fe729a8a96924a34a7796c0cbb80061fc"
         },
         {
           "source": "core/skills/core-sync/SKILL.md",

package/assets/generated/core/core/skills/lean-update/SKILL.md

@@ -109,9 +109,11 @@ Stop on unsafe states such as:
 - `LOCAL_MISSING`;
 - `UNTRACKED_CONFLICT`;
 - path collisions/conflicts;
-- unaccepted Core `RETIRED_PATH`.
+- Core `RETIRED_DRIFT` when the retired file no longer matches its recorded managed hash.
 
-Core retired paths are an ownership-transfer decision. Never auto-add `--accept-retired core:<path>` merely to make the update pass. Explain the retired path and require a separate explicit ownership decision before re-previewing it.
+A package-managed retired path that is unchanged from its recorded baseline may be classified as `REMOVE` and deleted safely; an already-missing retired path may be classified as `RETIRED_MISSING`. These states do not require a separate ownership decision because the baseline proves there is no consumer edit to preserve.
+
+A modified retired Core path is different: never auto-add `--accept-retired core:<path>` merely to make the update pass. Explain that the file differs from its recorded Core-managed hash and require a separate explicit ownership-transfer decision before re-previewing it. When that exact transfer is accepted, the package updater preserves the file as consumer-owned content and drops it from the new Core baseline.
 
 For a Bootstrap-generated consumer, also preview the companion generated-consumer changes:
 
@@ -145,6 +147,7 @@ Choosing option 1 authorizes only:
 
 - creation/switch to one repository-appropriate short-lived update branch when needed;
 - exact target package apply;
+- removal of unchanged retired package-managed files that the reviewed preview classified as `REMOVE`;
 - when `POC_BOOTSTRAP.json` is present, update of its exact `generation.lean.version` and `generation.lean.integrity` to the reviewed target while preserving package/profile;
 - migration of a recognized Bootstrap-generated package-verification block from duplicated current literals to the accepted manifest-driven form, only when the existing block still exactly matches the current approved metadata;
 - package/baseline/generated-consumer verification;
@@ -168,7 +171,7 @@ Apply using the same exact package version that was previewed, for example:
 npx --yes @mriekki/lean@<target-version> update --apply
 ```
 
-If explicit Core retired-path ownership transfer was separately approved, pass only the exact reviewed paths using the package's `--accept-retired core:<path>` contract. Never widen that set implicitly.
+If explicit Core retired-path ownership transfer was separately approved, pass only the exact reviewed modified paths using the package's `--accept-retired core:<path>` contract. Never widen that set implicitly. Unchanged retired managed paths do not need this flag; the package updater removes them according to the reviewed `REMOVE` plan.
 
 For a Bootstrap-generated consumer, complete the reviewed companion metadata changes in the same bounded update before declaring success. Preserve every unrelated `POC_BOOTSTRAP.json` field. Never change package identity or profile as an incidental version update.
 
@@ -195,11 +198,12 @@ Confirm:
 - `LEAN_BASELINE.json` records the exact target package/version/profile;
 - component baseline commits/distributions match the umbrella baseline;
 - package check passes for the whole profile;
+- unchanged retired managed files shown as `REMOVE` in the preview are actually absent after apply, while any explicitly transferred modified retired Core file remains present and is no longer Core-managed;
 - when `POC_BOOTSTRAP.json` exists, its package/version/profile agree with `LEAN_BASELINE.json` and its integrity equals the exact reviewed target registry integrity;
 - when the repository contains `tools/lean-package/check-managed-baselines.py`, that generated baseline checker passes after all companion metadata changes;
 - generated package-verification surfaces no longer contradict the approved manifest metadata;
 - consumer-owned content was not overwritten;
-- only intended package-managed changes, reviewed generated-consumer companion changes, and reviewed ownership transfers occurred.
+- only intended package-managed changes, reviewed generated-consumer companion changes, reviewed removals, and reviewed ownership transfers occurred.
 
 If generated CI still embeds a different package version/integrity after the update, report `GENERATED LEAN VERIFICATION DRIFT` and stop before delivery.
 
@@ -213,7 +217,7 @@ Present the meaningful diff for human review. After acceptance, recommend `/deli
 - uses a different package version for apply than the reviewed preview;
 - performs a downgrade/rollback as an ordinary update;
 - overwrites unexplained managed drift;
-- auto-accepts Core retired-path ownership transfer;
+- auto-accepts Core retired-path ownership transfer for a modified retired file;
 - silently repairs a pre-existing mismatch between `POC_BOOTSTRAP.json` and `LEAN_BASELINE.json`;
 - changes a generated consumer's package identity/profile or regenerates the repository as an incidental version update;
 - guesses at locally modified/unrecognized Bootstrap-generated verification logic;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/lean",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Public consumer distribution and updater for Lean engineering assets.",
   "type": "module",
   "bin": {

package/src/engine.mjs

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { readJson } from './package-data.mjs';
 
-const CORE_SAFE = new Set(['SAME', 'ADD', 'CORE_UPDATE', 'UNTRACKED_MATCH', 'BASELINE_STALE']);
+const CORE_SAFE = new Set(['SAME', 'ADD', 'CORE_UPDATE', 'UNTRACKED_MATCH', 'BASELINE_STALE', 'REMOVE', 'RETIRED_MISSING']);
 const DEPLOYMENT_SAFE = new Set(['SAME', 'ADD', 'KIT_UPDATE', 'UNTRACKED_MATCH', 'BASELINE_STALE', 'REMOVE', 'RETIRED_MISSING']);
 
 export function safeRelative(value, label = 'path') {
@@ -123,22 +123,24 @@ export function planComponent(packageData, componentId, targetRoot, acceptedReti
   for (const [retiredPath, item] of [...baseMap.entries()].sort(([a], [b]) => a.localeCompare(b))) {
     if (desired.has(retiredPath)) continue;
     const dst = resolveUnder(targetRoot, retiredPath, 'retired destination');
-    if (componentId === 'core') {
-      retired.push({ path: retiredPath, item, state: acceptedRetired.has(retiredPath) ? 'RETIRED_ACCEPTED' : 'RETIRED_PATH' });
-      continue;
-    }
     if (!fs.existsSync(dst)) {
       retired.push({ path: retiredPath, item, state: 'RETIRED_MISSING' });
+      continue;
+    }
+    const stat = fs.lstatSync(dst);
+    const currentHash = stat.isFile() && !stat.isSymbolicLink() ? sha256File(dst) : null;
+    if (currentHash === item.sha256) {
+      retired.push({ path: retiredPath, item, currentHash, state: 'REMOVE' });
+    } else if (componentId === 'core' && acceptedRetired.has(retiredPath)) {
+      retired.push({ path: retiredPath, item, currentHash, state: 'RETIRED_ACCEPTED' });
     } else {
-      const stat = fs.lstatSync(dst);
-      const currentHash = stat.isFile() && !stat.isSymbolicLink() ? sha256File(dst) : null;
-      retired.push({ path: retiredPath, item, currentHash, state: currentHash === item.sha256 ? 'REMOVE' : 'RETIRED_DRIFT' });
+      retired.push({ path: retiredPath, item, currentHash, state: 'RETIRED_DRIFT' });
     }
   }
   const safe = componentId === 'core' ? CORE_SAFE : DEPLOYMENT_SAFE;
   const unsafe = rows.filter((row) => !safe.has(row.state)).map((row) => ({ state: row.state, path: row.path }));
   for (const item of retired) {
-    const isSafe = componentId === 'core' ? item.state === 'RETIRED_ACCEPTED' : safe.has(item.state);
+    const isSafe = item.state === 'RETIRED_ACCEPTED' || safe.has(item.state);
     if (!isSafe) unsafe.push({ state: item.state, path: item.path });
   }
   return {
@@ -202,10 +204,8 @@ export function applyProfile(packageData, profilePlan, targetRoot, consumer, con
       fs.mkdirSync(path.dirname(dst), { recursive: true });
       fs.copyFileSync(row.bundlePath, dst);
     }
-    if (plan.componentId === 'deployment') {
-      for (const retired of plan.retired) {
-        if (retired.state === 'REMOVE') fs.unlinkSync(resolveUnder(targetRoot, retired.path, 'retired destination'));
-      }
+    for (const retired of plan.retired) {
+      if (retired.state === 'REMOVE') fs.unlinkSync(resolveUnder(targetRoot, retired.path, 'retired destination'));
     }
   }
   for (const plan of profilePlan.plans) {