@plasius/asset-contracts 0.4.4 → 0.4.6

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 ## Unreleased
 
+- **Added**
+  - (placeholder)
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
+## [0.4.6] - 2026-10-23
+
+- **Added**
+  - (placeholder)
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - Route npm support links and README guidance to the enabled package issue
+    tracker, with a Feature-linked model resource contract task map.
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
+## [0.4.5] - 2026-10-18
+
+- Refresh npm dependency lockfile to current supported stable versions (weekly maintenance, 2026-10-18). Refresh published Plasius package baselines after upstream releases.
+
 - **Added**
   - (placeholder)
 
@@ -273,3 +305,5 @@
 [0.4.2]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.4.2
 [0.4.3]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.4.3
 [0.4.4]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.4.4
+[0.4.5]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.4.5
+[0.4.6]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.4.6

package/README.md

@@ -526,7 +526,43 @@ npm run pack:check
 
 ## Support
 
-`Plasius-LTD/asset-contracts` keeps GitHub Issues disabled. File package bugs and support requests in [`Plasius-LTD/plasius-ltd-site`](https://github.com/Plasius-LTD/plasius-ltd-site/issues) and include `asset-contracts` in the title or body so package work can be routed correctly.
+File package bugs, support requests, and implementation Tasks in
+[`Plasius-LTD/asset-contracts` Issues](https://github.com/Plasius-LTD/asset-contracts/issues),
+which are enabled. Report vulnerabilities privately through
+[SECURITY.md](./SECURITY.md).
+
+The organisation [Plasius-LTD-site Project](https://github.com/orgs/Plasius-LTD/projects/1)
+remains the source of truth for acceptance criteria, ownership, and status.
+Epics, Features, and Stories remain in the site repository; package Tasks belong
+here and link to their parent Feature. Existing site issues retain their history
+and links; they do not need to be moved or duplicated.
+
+### Model resource contract follow-ups
+
+[Feature 1153](https://github.com/Plasius-LTD/plasius-ltd-site/issues/1153) owns the
+following package Tasks created by
+[tracker coordination 1169](https://github.com/Plasius-LTD/plasius-ltd-site/issues/1169):
+
+| Contract concern | Package Task |
+| --- | --- |
+| Model resource descriptors | [#48](https://github.com/Plasius-LTD/asset-contracts/issues/48) |
+| Conversion diagnostics | [#49](https://github.com/Plasius-LTD/asset-contracts/issues/49) |
+| Texture and resource roles | [#50](https://github.com/Plasius-LTD/asset-contracts/issues/50) |
+| Promotion manifest resource closure | [#51](https://github.com/Plasius-LTD/asset-contracts/issues/51) |
+
+These are follow-up qualification and implementation scopes, not new API promises
+or completed functionality. Reuse the existing file descriptors, manifests,
+roles, promotion records, GPU contracts, and model-resolution contracts; identify
+remaining gaps before changing exports. Separate animation and shader ABI work
+remains in its existing Tasks. Claim and start an active Project Task before any
+implementation.
+
+The Tasks inherit `gpu.model.conversion.enabled`, the backend remote rollout
+control for canonical model adapter adoption. This tracker correction does not
+change its evaluator or state. Future runtime adoption must test disabled,
+enabled, and rollback paths under that Feature.
+See [ADR 0008](./docs/adrs/adr-0008-package-owned-issue-tracking.md) for the tracker
+decision and release implications.
 
 ## License
 

package/docs/adrs/adr-0008-package-owned-issue-tracking.md

@@ -0,0 +1,62 @@
+# ADR 0008: Package-Owned Issue Tracking
+
+- Status: Accepted
+- Date: 2026-10-23
+- Tracking: site Task 1169; package Task 47; parent Feature 1153 / Epic 1147
+
+## Context
+
+GitHub Issues are enabled in `Plasius-LTD/asset-contracts`, but the README says
+otherwise and `package.json` directs npm bug reports to the site repository.
+That stale routing obscures package ownership. Feature 1153 also needs explicit
+package Tasks for model resource contracts before implementation begins.
+
+## Decision
+
+Use this repository's enabled Issues for package bugs, support, and implementation
+Tasks. Set `bugs.url` to `https://github.com/Plasius-LTD/asset-contracts/issues`
+and document the same route in the published README. Confidential vulnerability
+reports continue through `SECURITY.md`.
+
+The organisation `Plasius-LTD-site` Project governs work definition, acceptance,
+ownership, priority, and status. Epics, Features, and Stories remain in the site
+repository. Package implementation Tasks are native children of their owning
+Feature and Project members. Preserve historical issues and their links rather
+than migrating or duplicating them.
+
+Feature 1153 owns four follow-ups: package Tasks 48 (resource descriptors), 49
+(conversion diagnostics), 50 (texture/resource roles), and 51 (promotion manifest
+resource closure). The README links each exact Task. They begin as unassigned
+Backlog/P2/M Project work; their live Project fields remain authoritative.
+They must reuse and qualify existing public contracts and implement only
+evidenced gaps. Completed GPU/model-resolution contracts and separate animation
+and shader ABI Tasks retain their own scope.
+
+These Tasks inherit `gpu.model.conversion.enabled`, evaluated by the backend
+remote control plane for canonical adapter adoption. This documentation and
+metadata change adds no runtime evaluation, capability, or flag mutation. Future
+runtime Tasks must document enabled, disabled, and rollback behavior.
+
+## Alternatives
+
+Continuing the alternate site tracker would preserve stale routing and conflict
+with the repository-owned implementation Task policy. Disabling package Issues
+would unnecessarily change an already working tracker. Migrating historical
+issues would break continuity without helping the requested follow-up work.
+
+## Test and release implications
+
+Regression tests compare npm bug metadata with the owning repository, verify
+active README support/security links, and require all four follow-up links.
+Verify Issues remain enabled and read back each Project field and native parent.
+Run the existing frozen-install, tests, coverage, lint, types, build, package,
+privacy, and dependency gates; no source/API or dependency-version change is
+needed. npm's lockfile does not store `bugs.url`, so it need not change for this
+metadata correction.
+
+The support URL is public package metadata. Use a patch release through the
+existing PR, exact-main push CI, and hosted `cd.yml` / `production` npm OIDC path
+from ADR 0007. Verify registry support metadata, published documentation, package
+integrity/provenance, and ESM/CJS/declarations. Do not assume a documentation-only
+release exemption. A routing rollback is an ordinary reviewed metadata release;
+it must not remove existing issues or reopen the disabled-tracker claim.

package/docs/adrs/index.md

@@ -7,3 +7,4 @@
 - [ADR 0005: Path-Only Private-Artifact Prevention Gates](./adr-0005-path-only-private-artifact-prevention-gates.md)
 - [ADR 0006: Additive PVOX Model-Resolution Contracts](./adr-0006-pvox-model-resolution-contracts.md)
 - [ADR 0007: Hosted OIDC Package Publication](./adr-0007-hosted-oidc-package-publication.md)
+- [ADR 0008: Package-Owned Issue Tracking](./adr-0008-package-owned-issue-tracking.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plasius/asset-contracts",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Canonical contracts for Plasius asset jobs, model resolution, immutable WGSL shader assets, reviews, and promotion records.",
   "type": "module",
   "sideEffects": false,
@@ -66,7 +66,7 @@
     "url": "git+https://github.com/Plasius-LTD/asset-contracts.git"
   },
   "bugs": {
-    "url": "https://github.com/Plasius-LTD/plasius-ltd-site/issues"
+    "url": "https://github.com/Plasius-LTD/asset-contracts/issues"
   },
   "homepage": "https://github.com/Plasius-LTD/asset-contracts#readme",
   "devDependencies": {
@@ -109,6 +109,6 @@
     "postcss": "8.5.26"
   },
   "dependencies": {
-    "@plasius/gpu-shader": "^0.1.9"
+    "@plasius/gpu-shader": "^0.1.10"
   }
 }