@ontrails/warden 1.0.0-beta.42 → 1.0.0-beta.45

package/CHANGELOG.md

@@ -1,5 +1,74 @@
 # @ontrails/warden
 
+## 1.0.0-beta.45
+
+### Patch Changes
+
+- [`f1bd093`](https://github.com/outfitter-dev/trails/commit/f1bd09395fcf81db0bcb8657030288877c2e26e6): Recognize conditional, aliased, and parenthesized Result provenance while invalidating provenance after reassignment across the implementation-return and redundant-error-wrap rules.
+
+## 1.0.0-beta.44
+
+### Patch Changes
+
+- [`b1fbe57`](https://github.com/outfitter-dev/trails/commit/b1fbe574e6f44d1fecb5e3a000270955c0a77b7b): Publish Bun-validated package tarballs through an npm trusted-publishing adapter
+  binding, add exact repository metadata for each public workspace package, and
+  correct the native Bun release descriptor to its pack-only runtime boundary.
+
+## 1.0.0-beta.43
+
+### Minor Changes
+
+- [`4fb20a6`](https://github.com/outfitter-dev/trails/commit/4fb20a68e1ed98972d99fed8b2df96bfa6804bd3): Derive deterministic, provenance-bearing vocabulary plan proposals from a minimal `from`/`to` seed, including morphology, public and compound identifier review, filename and reference-closure candidates, namespace census, and validated live-topo API preserves. Classified governed transitions retain their registry identity while routing every governed form to review instead of inventing a single safe successor.
+- [`8fde0a6`](https://github.com/outfitter-dev/trails/commit/8fde0a6c66a7f64f0c27909df7db2731fa4b10f4): Add an advisory project-static rule that reports unknown governed vocabulary permutations from the latest committed Regrade history until they are classified.
+- [`d3215b0`](https://github.com/outfitter-dev/trails/commit/d3215b0966f13af2a72ece9adbcc2c68c70f81b6): Add governed file renames to vocabulary Regrade plans, with move-first derived reference closure and persisted policy-aware evidence across CLI and MCP.
+- [`5a7d22a`](https://github.com/outfitter-dev/trails/commit/5a7d22ab9d674f86b28758f23c3e94a17efb5be1): Add three-tier vocabulary migration scope. Protected historical paths remain
+  scanned and counted as `historical-by-policy` without being rewritten, while
+  reports expose scope-tier totals and census-expected teaching-surface coverage
+  through equivalent CLI and MCP plan schemas. Applied vocabulary occurrences
+  remain auditable in history with an `applied` verdict, while policy-only
+  evidence does not make an active plan stale merely by being recorded.
+- [`88a6a62`](https://github.com/outfitter-dev/trails/commit/88a6a62a9e9e230ca6d368fa78dc3ece6c816204): Complete the v1 classification-first cutover from projection/project vocabulary
+  to derive/derived for contract-owned fact production and render/rendered for
+  surface presentation. Public type, helper, rule, relation, and report names move
+  without compatibility aliases; ordinary repository/project nouns remain
+  explicit preserves or structured review inventory.
+- [`bd1bd96`](https://github.com/outfitter-dev/trails/commit/bd1bd96b90cd8b55f73061e4078a14cd75bed745): Require committed Regrade provenance for governed vocabulary transitions.
+
+  Applied governed plans now expose deterministic transition, plan, source,
+  safe-apply, and review-follow-up evidence through history results. Warden loads
+  committed history into project context, cites it for reintroduced symbols, and
+  rejects invalid or missing provenance for transitions that require Regrade in
+  the workspace that owns the governed registry, without making downstream apps
+  prove the framework's own migrations.
+  Portable validation accepts the authoritative numeric file-rename counters
+  persisted by Regrade history.
+
+### Patch Changes
+
+- [`53014a4`](https://github.com/outfitter-dev/trails/commit/53014a4593170edd5adfbaa2c94c895c67a320d1): Exclude immutable Regrade history artifacts from downstream migration source scans while preserving active plan and other policy-classified evidence. Warden continues to validate committed history through its dedicated provenance loader.
+- [`9f0842e`](https://github.com/outfitter-dev/trails/commit/9f0842ee9d7c7155d86a4fd023760ac0a5636f5d): Retire the temporary root vocabulary-cutover toolchain now that Regrade owns
+  structured migration plans, safe rewrites, classification, census, CLI/MCP
+  reports, and immutable history. Remove the obsolete source exemptions so
+  Oxlint and Warden enforce the durable transition contract directly, and add a
+  history-driven Regrade audit surface for current-tree regression checks.
+- [`9f0842e`](https://github.com/outfitter-dev/trails/commit/9f0842ee9d7c7155d86a4fd023760ac0a5636f5d): Allow source rules to opt into documentation and text-file scanning so durable repository vocabulary guards cover every declared source kind.
+- [`113aed6`](https://github.com/outfitter-dev/trails/commit/113aed62d20041e35b0cf9d6c1b1a18df4b88f57): Rename the dependency-light observability owner from `@ontrails/observe` to
+  `@ontrails/observability` as a pre-v1 hard cut. Update dependent packages,
+  documentation, package discovery, and the governed Regrade route; no
+  compatibility package or old import route is retained.
+- [`0938e7b`](https://github.com/outfitter-dev/trails/commit/0938e7badc0c5470d194139d642b673658d099e0): Fold the removed `@ontrails/tracing` package into the truthful existing
+  owners: intrinsic trace contracts remain in core, developer-state tooling now
+  lives at `@ontrails/observability/dev`, and the dependency-light OTel adapter
+  lives at `@ontrails/observability/otel`. There is intentionally no root-package
+  compatibility redirect because the former root had more than one owner.
+- [`50e2779`](https://github.com/outfitter-dev/trails/commit/50e27796d074851bccd57d7df009db749757b457): Extract the real `@ontrails/logtape` and `@ontrails/pino` adapters from the
+  temporary observability subpaths. The new packages own their namesake foreign
+  dependencies and preserve Trails record metadata, levels, redaction boundaries,
+  and lifecycle behavior; the old subpaths are removed in the pre-v1 hard cut.
+
+  Add governed Regrade transitions for both exact import replacements and expose
+  the observability adapter target through the shared adapter readiness check.
+
 ## 1.0.0-beta.42
 
 ## 1.0.0-beta.41

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@ontrails/warden",
-  "version": "1.0.0-beta.42",
+  "version": "1.0.0-beta.45",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/outfitter-dev/trails.git",
+    "directory": "packages/warden"
+  },
   "bin": {
     "warden": "./bin/warden.ts"
   },
@@ -27,20 +32,20 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@ontrails/adapter-kit": "^1.0.0-beta.42",
-    "@ontrails/cli": "^1.0.0-beta.42",
-    "@ontrails/config": "^1.0.0-beta.42",
-    "@ontrails/permits": "^1.0.0-beta.42",
-    "@ontrails/source": "^1.0.0-beta.42",
-    "@ontrails/store": "^1.0.0-beta.42",
+    "@ontrails/adapter-kit": "^1.0.0-beta.45",
+    "@ontrails/cli": "^1.0.0-beta.45",
+    "@ontrails/config": "^1.0.0-beta.45",
+    "@ontrails/permits": "^1.0.0-beta.45",
+    "@ontrails/source": "^1.0.0-beta.45",
+    "@ontrails/store": "^1.0.0-beta.45",
     "oxc-resolver": "11.19.1",
     "zod": "^4.3.5"
   },
   "devDependencies": {
-    "@ontrails/testing": "^1.0.0-beta.42"
+    "@ontrails/testing": "^1.0.0-beta.45"
   },
   "peerDependencies": {
-    "@ontrails/core": "^1.0.0-beta.42",
-    "@ontrails/topography": "^1.0.0-beta.42"
+    "@ontrails/core": "^1.0.0-beta.45",
+    "@ontrails/topography": "^1.0.0-beta.45"
   }
 }

package/src/adapter-check.ts

@@ -1,5 +1,5 @@
 /**
- * Warden projection for shared adapter readiness checks.
+ * Warden rendering for shared adapter readiness checks.
  *
  * Adapter facts stay in @ontrails/adapter-kit. Warden only maps those facts
  * into governance diagnostics and severity.

package/src/cli.ts

@@ -39,6 +39,7 @@ import type { DriftResult } from './drift.js';
 import { checkDrift, staleDriftMessage } from './drift.js';
 import { loadProjectWardenRules } from './project-rules.js';
 import type { ProjectWardenRules } from './project-rules.js';
+import { loadGovernedVocabularyHistory } from './regrade-history.js';
 import {
   collectProjectDocumentationImportResolutions,
   collectProjectExportedSymbolDefinitions,
@@ -332,21 +333,36 @@ const collectTextScanFiles = (dir: string): readonly string[] => [
   ...collectFilesMatching(dir, '**/*.zsh', true),
   ...collectFilesMatching(dir, '**/*.yml', true),
   ...collectFilesMatching(dir, '**/*.yaml', true),
+  ...collectFilesMatching(dir, 'plugin/**/*.json', true),
+  ...collectFilesMatching(dir, 'plugin/**/*.jsonc', true),
+  ...collectFilesMatching(dir, 'plugin/**/*.toml', true),
+  ...collectFilesMatching(dir, 'plugin/**/*.cjs', true),
+  ...collectFilesMatching(dir, 'plugin/**/*.mjs', true),
+  ...collectFilesMatching(dir, 'scripts/**/*.json', true),
+  ...collectFilesMatching(dir, 'scripts/**/*.jsonc', true),
+  ...collectFilesMatching(dir, 'scripts/**/*.toml', true),
+  ...collectFilesMatching(dir, 'scripts/**/*.cjs', true),
+  ...collectFilesMatching(dir, 'scripts/**/*.mjs', true),
   ...collectFilesMatching(dir, '**/package.json', true),
 ];
 
 const isDocumentationScanTarget = (match: string): boolean => {
-  if (match === 'README.md') {
+  if (
+    match === 'AGENTS.md' ||
+    match === 'README.md' ||
+    /^(?:packages|adapters|apps)(?:\/[^/]+)*\/AGENTS\.md$/.test(match)
+  ) {
     return true;
   }
   if (/^(?:packages|adapters|apps)\/[^/]+\/README\.md$/.test(match)) {
     return true;
   }
   return (
-    match.startsWith('docs/') &&
-    !match.startsWith('docs/adr/') &&
-    !match.startsWith('docs/migration/') &&
-    !match.startsWith('docs/releases/') &&
+    (match.startsWith('plugin/') ||
+      (match.startsWith('docs/') &&
+        !match.startsWith('docs/adr/') &&
+        !match.startsWith('docs/migration/') &&
+        !match.startsWith('docs/releases/'))) &&
     match.endsWith('.md')
   );
 };
@@ -393,6 +409,9 @@ interface MutableProjectContext {
     string,
     readonly WardenExportedSymbolDefinition[]
   >;
+  governedVocabularyHistoryByTransitionId: ProjectContext['governedVocabularyHistoryByTransitionId'];
+  governedVocabularyHistoryIssues: ProjectContext['governedVocabularyHistoryIssues'];
+  governedVocabularyHistoryRequired: ProjectContext['governedVocabularyHistoryRequired'];
   documentedImportResolutionsByFile: Map<
     string,
     readonly WardenImportResolution[]
@@ -414,6 +433,9 @@ const createMutableProjectContext = (): MutableProjectContext => ({
   >(),
   entityReferencesByName: new Map<string, Set<string>>(),
   exportedSymbolDefinitionsByName: new Map(),
+  governedVocabularyHistoryByTransitionId: undefined,
+  governedVocabularyHistoryIssues: undefined,
+  governedVocabularyHistoryRequired: undefined,
   importResolutionsByFile: new Map<string, readonly WardenImportResolution[]>(),
   knownEntityIds: new Set<string>(),
   knownResourceIds: new Set<string>(),
@@ -471,6 +493,24 @@ const toProjectContext = (context: MutableProjectContext): ProjectContext => ({
       }
     : {}),
   composeTargetTrailIds: context.composeTargetTrailIds,
+  ...(context.governedVocabularyHistoryByTransitionId === undefined
+    ? {}
+    : {
+        governedVocabularyHistoryByTransitionId:
+          context.governedVocabularyHistoryByTransitionId,
+      }),
+  ...(context.governedVocabularyHistoryIssues === undefined
+    ? {}
+    : {
+        governedVocabularyHistoryIssues:
+          context.governedVocabularyHistoryIssues,
+      }),
+  ...(context.governedVocabularyHistoryRequired === undefined
+    ? {}
+    : {
+        governedVocabularyHistoryRequired:
+          context.governedVocabularyHistoryRequired,
+      }),
   knownEntityIds: context.knownEntityIds,
   knownResourceIds: context.knownResourceIds,
   knownSignalIds: context.knownSignalIds,
@@ -951,6 +991,10 @@ const buildProjectContext = (
     | undefined = undefined
 ): ProjectContext => {
   const context = createMutableProjectContext();
+  const governedHistory = loadGovernedVocabularyHistory(rootDir);
+  context.governedVocabularyHistoryByTransitionId =
+    governedHistory.byTransitionId;
+  context.governedVocabularyHistoryIssues = governedHistory.issues;
   context.authoredMcpSurfaceBindingSets = authoredMcpSurfaceBindingSets;
   const typeScriptSourceFiles = sourceFiles.filter(
     (sourceFile) => sourceFile.kind === 'typescript'
@@ -961,6 +1005,8 @@ const buildProjectContext = (
   context.publicWorkspaces = collectPublicWorkspaces(rootDir, {
     exclude: scope.exclude,
   });
+  context.governedVocabularyHistoryRequired =
+    context.publicWorkspaces.has('@ontrails/warden');
 
   if (appTopos.length > 0) {
     for (const appTopo of appTopos) {
@@ -1095,6 +1141,25 @@ const isSelectedRule = (
     : ruleMatchesDepth(metadata, selector.depth);
 };
 
+const selectorIncludesProjectChecks = (
+  selector: WardenRuleSelector
+): boolean => {
+  if (selector.tier !== undefined) {
+    return selector.tier !== 'source-static';
+  }
+  return (
+    selector.depth === undefined ||
+    depthIncludesTier(selector.depth, 'project-static')
+  );
+};
+
+const isSelectedProjectRule = (
+  rule: WardenRule,
+  selector: WardenRuleSelector
+): boolean =>
+  selectorIncludesProjectChecks(selector) &&
+  (selector.tier === 'project-static' || isSelectedRule(rule, selector));
+
 const isSelectedTopoRule = (
   rule: TopoAwareWardenRule,
   selector: WardenRuleSelector
@@ -1182,10 +1247,20 @@ const lintSourceFiles = (
 ): readonly WardenDiagnostic[] => {
   const diagnostics: WardenDiagnostic[] = [];
   const rules = [...wardenRules.values(), ...extraSourceRules];
+  for (const rule of rules) {
+    if (
+      isSelectedProjectRule(rule, selector) &&
+      isProjectAwareRule(rule) &&
+      rule.checkProject !== undefined
+    ) {
+      diagnostics.push(...rule.checkProject(context));
+    }
+  }
   for (const sourceFile of sourceFiles) {
     for (const rule of rules) {
       if (
         sourceFile.kind === 'text' &&
+        !rule.sourceKinds?.includes('text') &&
         rule.name !== 'no-dev-permit-in-source' &&
         rule.name !== 'public-internal-deep-imports'
       ) {
@@ -1194,6 +1269,7 @@ const lintSourceFiles = (
 
       if (
         sourceFile.kind === 'documentation' &&
+        !rule.sourceKinds?.includes('documentation') &&
         rule.name !== 'public-internal-deep-imports'
       ) {
         continue;

package/src/index.ts

@@ -10,6 +10,9 @@
 // Rule types
 export type {
   BuiltinWardenRuleName,
+  GovernedVocabularyHistoryEvidence,
+  GovernedVocabularyHistoryFormObservation,
+  GovernedVocabularyHistoryIssue,
   ProjectAwareWardenRule,
   ProjectContext,
   TopoAwareWardenRule,
@@ -39,7 +42,10 @@ export {
   formatGovernedVocabularyTransitionGuide,
   getGovernedVocabularyTransition,
   governedVocabularyLiteralRenameSchema,
+  governedVocabularyFileRenameSchema,
+  governedVocabularyHistoryProvenanceSchema,
   governedVocabularyPreserveRuleSchema,
+  governedVocabularyProvenancePolicySchema,
   governedVocabularyRegistrySchema,
   governedVocabularyScopeSchema,
   governedVocabularySymbolRenameSchema,
@@ -62,7 +68,9 @@ export {
 } from './rules/index.js';
 export type {
   GovernedVocabularyLiteralRename,
+  GovernedVocabularyHistoryProvenance,
   GovernedVocabularyPreserveRule,
+  GovernedVocabularyProvenancePolicy,
   GovernedVocabularyScope,
   GovernedVocabularySymbolRename,
   GovernedVocabularyTarget,
@@ -148,7 +156,7 @@ export { checkDrift } from './drift.js';
 export type { ProjectWardenRules } from './project-rules.js';
 export { loadProjectWardenRules } from './project-rules.js';
 
-// Guide projection
+// Guide rendering
 export type {
   WardenGuideFormat,
   WardenGuideManifest,
@@ -187,7 +195,11 @@ export {
 
 // Trail layer
 export { wardenTopo } from './trails/topo.js';
-export { runTopoAwareWardenTrails, runWardenTrails } from './trails/run.js';
+export {
+  runProjectWardenRules,
+  runTopoAwareWardenTrails,
+  runWardenTrails,
+} from './trails/run.js';
 export {
   activationOrphanTrail,
   capturedKernelTrail,
@@ -209,12 +221,13 @@ export {
   firesDeclarationsTrail,
   forkWithoutPreservedImplementationTrail,
   governedSymbolResidueTrail,
+  governedVocabularyPermutationWatchTrail,
   implementationReturnsResultTrail,
   incompleteAccessorForStandardOpTrail,
   incompleteCrudTrail,
   intentPropagationTrail,
   layerFieldNameDriftTrail,
-  libraryProjectionCoherenceTrail,
+  libraryRenderCoherenceTrail,
   markerSchemaUnsupportedTrail,
   missingVisibilityTrail,
   missingReconcileTrail,
@@ -232,7 +245,7 @@ export {
   noTopLevelSurfaceTrail,
   onReferencesExistTrail,
   orphanedSignalTrail,
-  ownerProjectionParityTrail,
+  ownerRenderParityTrail,
   pendingForceTrail,
   permitGovernanceTrail,
   preferSchemaInferenceTrail,