@thomasminh1995/depverdict 0.6.0-alpha.1

package/docs/releases/v0.5.0-technical-preview.md

@@ -0,0 +1,114 @@
+# UpgradeLens v0.5.0 — Public Technical Preview / Alpha
+
+UpgradeLens v0.5.0 is a decision-first CLI for evidence-bounded dependency upgrade
+analysis. This release is a Technical Preview: its contracts may change, support is
+best effort, and every result requires developer judgment.
+
+## Preview installation
+
+The recommended publication strategy is the npm `preview` dist-tag. After the
+maintainer completes that separate release action, install without moving npm
+`latest`:
+
+```sh
+npm install -g upgradelens@preview
+upgradelens --version
+upgradelens --help
+```
+
+Before publication, or when evaluating the exact repository source:
+
+```sh
+git clone https://github.com/thomasMinh1995/UpgradeLens.git
+cd UpgradeLens
+npm install
+node ./bin/upgradelens.js --version
+```
+
+## Try the zero-secret sample
+
+The repository contains a public-safe Node sample with an exact declared dependency,
+a lockfile-installed baseline, and real source usage:
+
+```sh
+upgradelens discover examples/technical-preview-node --stdout
+upgradelens analyze examples/technical-preview-node --offline --stdout
+```
+
+No provider credential is needed. With no fresh local knowledge cache, the expected
+offline completion is `INSUFFICIENT_DATA`: UpgradeLens retains the installed
+baseline and refuses to invent a registry target or evidence. Read the
+[sample guide](../../examples/technical-preview-node/README.md) before trying the
+optional provider-configured workflow.
+
+## What v0.5.0 provides
+
+- deterministic Node and Python project/dependency discovery;
+- npm/PyPI research with bounded source provenance;
+- installed npm baseline resolution from package-lock v2/v3 and limited v1 roots;
+- AI-assisted, schema-validated Version Analysis behind a provider-neutral boundary;
+- JavaScript/TypeScript source-usage and coverage-aware impact analysis;
+- occurrence-scoped deterministic Upgrade Decisions;
+- copy/paste-ready selectors for duplicate dependency occurrences;
+- decision-first completion states and stable CLI exit semantics;
+- an experimental, opt-in, qualification-bound, human-reviewed Migration
+  Checklist handoff.
+
+A registry-latest version is candidate discovery, not a recommendation driver.
+A caller can select an exact target and occurrence, but UpgradeLens still requires
+sufficient evidence and review before producing an actionable handoff.
+
+## Supported scope and known limitations
+
+The primary supported path is Node projects and workspaces using npm lockfiles.
+Python requirements discovery, PyPI research, and bounded PEP 440 comparison are
+available, but Python installed environments and source usage are not resolved.
+pnpm and Yarn installed baselines are unsupported. JavaScript/TypeScript is the only
+source-usage analyzer. Other detected ecosystems fail closed and should not be
+interpreted as fully supported.
+
+Offline mode uses only valid local, cached, and persisted facts. It may produce
+`INSUFFICIENT_DATA` or a review-required result. Provider/model quality is not
+identical across runtimes, and a Migration Checklist qualification applies only to
+the exact machine-readable identity recorded.
+
+UpgradeLens is not production-stable, a security scanner, a safety certification,
+or an autonomous migration tool. It does not modify source, install dependency
+upgrades, execute suggested verification commands, or synthesize recovery steps
+without structured evidence.
+
+## Human-review boundary
+
+Developers own target selection, approval, source changes, command execution,
+verification, and recovery. Migration Checklist actions are evidence-bounded
+proposals, are disabled by default, and always require human review. A generated
+artifact is not permission to patch a repository or proof that migration succeeded.
+
+## Validation summary
+
+The qualification snapshot passed hosted GitHub Actions on Node 20, 22, and 24,
+including canonical tests, package guard, and Node 24 package smoke. An isolated
+clean checkout passed 632 tests with one unchanged sandbox-loopback skip. Repeated
+actual packs were byte-identical; clean tarball installation, CLI version/help, ESM
+import, and 438 public exports passed. No provider secret or uploaded CI artifact
+was used.
+
+## Tell us what works and what does not
+
+Please evaluate:
+
+1. Are decisions understandable and actionable?
+2. Is `INVESTIGATE` too frequent or too rare?
+3. Are installed baselines correct in real npm workspaces and monorepos?
+4. Is duplicate-occurrence ambiguity and copy/paste selector UX usable?
+5. Are coverage limitations clear enough to prevent false confidence?
+6. Does the migration handoff reduce re-research for developers or Coding Agents?
+7. Are completion states and exit codes useful in CI?
+8. Which artifacts help code review and team planning?
+
+Use the repository bug or feature forms described in
+[Support](../../SUPPORT.md). Report vulnerabilities only through
+[GitHub Private Vulnerability Reporting](../../SECURITY.md), and report sensitive
+conduct concerns through the private contact in the
+[Code of Conduct](../../CODE_OF_CONDUCT.md). Never post credentials, private source,
+full private artifacts, or raw provider payloads.

package/docs/releases/v0.6.0-alpha.1-depverdict-preview.md

@@ -0,0 +1,101 @@
+# DepVerdict v0.6.0-alpha.1 — Technical Preview / Alpha
+
+> Release draft — not yet published status is not asserted by this source.
+> Verify live npm and GitHub Release availability independently.
+
+DepVerdict is a decision-first CLI for evidence-bounded dependency upgrade
+analysis. This preview adopts a clearer identity for a product that evaluates
+whether and why an upgrade should proceed, instead of treating the existence of a
+newer registry version as a recommendation.
+
+## Planned installation
+
+When registry metadata confirms availability under the `preview` dist-tag,
+install with:
+
+```sh
+npm install -g @thomasminh1995/depverdict@preview
+```
+
+This release note does not claim that the preview package is currently available
+and does not use or promise the npm `latest` tag.
+
+The canonical executable is:
+
+```sh
+depverdict analyze .
+```
+
+## Identity transition
+
+| Surface | Canonical | `0.6.x` preview compatibility |
+| --- | --- | --- |
+| npm package | `@thomasminh1995/depverdict` | The old npm package was never successfully published. |
+| CLI | `depverdict` | `upgradelens` remains as a warning alias for one `0.6.x` preview window. |
+| Artifact root | `.depverdict/` | `.upgradelens/` is a complete-chain read fallback; new writes use the canonical root. |
+| Environment | `DEPVERDICT_*` | `UPGRADELENS_*` remains a warning fallback; canonical keys win. |
+
+The GitHub repository rename is complete. Repository, issue, and private security
+links use the canonical `thomasMinh1995/DepVerdict` repository directly.
+
+## Why the rebrand
+
+The DepVerdict name emphasizes the product's actual boundary: it produces a
+deterministic, inspectable decision and an optional evidence-bounded handoff. It is
+not merely an available-update detector and does not claim autonomous migration.
+
+## Key capabilities
+
+- declared, installed, and target versions remain separate facts;
+- npm and PyPI target knowledge and evidence research;
+- exact dependency-occurrence selection for ambiguous repositories;
+- deterministic Upgrade Decision with structured reason codes;
+- coverage-aware JavaScript/TypeScript usage and impact analysis;
+- explicit completion states and CI exit behavior;
+- offline research with honest missing-evidence limitations;
+- experimental, opt-in Migration Checklist v2 for reviewed handoff to a developer
+  or Coding Agent.
+
+Registry latest is target discovery, not a recommendation driver. Decisions fail
+closed when target intent, installed baseline, evidence, version comparison, or
+analyzer coverage is insufficient.
+
+## Supported scope
+
+The preview supports Node `package.json` projects and workspaces, Python
+`requirements.txt` discovery, npm and PyPI research, npm lockfile v2/v3 installed
+baselines, a bounded Python version subset, and JavaScript/TypeScript source usage
+analysis. Detector presence for another ecosystem does not imply end-to-end
+support.
+
+## Human-review boundary
+
+DepVerdict does not modify manifests, install dependencies, patch source, execute
+suggested verification commands, approve a migration, or certify safety. Migration
+Checklist remains experimental and opt-in. Every proposed action and target
+requires authoritative human review, and a Coding Agent must reopen current source
+before proposing changes.
+
+## Known limitations
+
+- pnpm and Yarn installed-version baselines are not resolved;
+- Python environment and lockfile installed versions are not resolved;
+- source usage coverage is JavaScript/TypeScript-focused;
+- partial or unavailable coverage cannot prove a dependency is unaffected;
+- provider/model qualification is bound to exact runtime and evaluation identity;
+- offline mode cannot invent a target, evidence, confidence, or recommendation;
+- recovery and rollback plans are not synthesized;
+- npm availability and dist-tag state must be verified from the registry.
+
+## Community and private reporting
+
+- Security: use the verified GitHub Private Vulnerability Reporting route in
+  [SECURITY.md](../../SECURITY.md). It points directly to the canonical DepVerdict
+  repository.
+- Conduct: use the verified private address in
+  [CODE_OF_CONDUCT.md](../../CODE_OF_CONDUCT.md). The legacy-named address remains
+  the active DepVerdict channel for this preview transition.
+- Support: follow [SUPPORT.md](../../SUPPORT.md) for best-effort preview routing.
+
+Do not post credentials, private source, complete private artifacts, provider
+payloads, vulnerability details, or sensitive conduct reports publicly.

package/docs/reviews/diff-02-identity-contract-compatibility.md

@@ -0,0 +1,413 @@
+# DIFF-02 — Identity Contract and Compatibility Review
+
+## 1. Executive verdict
+
+Verdict: `DEPVERDICT_IDENTITY_COMPATIBILITY_READY`
+
+Gate: `PROCEED_TO_DIFF_03_REPOSITORY_DOCS_AND_COMMUNITY_MIGRATION`
+
+DepVerdict is now the canonical runtime and package identity. The preview keeps
+one bounded compatibility window for the `upgradelens` executable,
+`UPGRADELENS_*` environment variables, and read-only `.upgradelens/` artifact
+discovery. No schema, provider-qualification identity, historical tag, or
+evidence protocol was generalized or rewritten.
+
+## 2. Brand availability preflight
+
+The final read-only preflight ran at `2026-07-19T08:05:34Z`, before runtime
+implementation.
+
+- npm returned not-found for exact `depverdict` and
+  `@thomasminh1995/depverdict`.
+- The exact future GitHub repository identity returned not-found, and GitHub
+  repository search returned zero exact repositories.
+- PyPI and RubyGems returned not-found.
+- No `depverdict` executable was found on the local command path.
+- Exact general-web software, product, company, trademark-signal, and GitHub
+  queries returned no material collision.
+- Crates.io returned access denied and unauthenticated GitHub code search
+  returned unauthorized, so those two checks are unverified.
+- Domain RDAP not-found responses were treated only as weak signals.
+
+Classification: `BRAND_PREFLIGHT_CLEAR_WITH_LOW_RISK`.
+
+Availability is time-sensitive, does not reserve any identity, and is not legal
+or trademark advice.
+
+## 3. Identity architecture decision
+
+The pre-code decision is
+`docs/decisions/diff-02-identity-compatibility-contract.md`.
+
+It separates runtime identity from persisted protocol identity:
+
+- runtime presentation: DepVerdict;
+- package: `@thomasminh1995/depverdict`;
+- canonical CLI: `depverdict`;
+- persisted `generator.name`: historical protocol literal `"UpgradeLens"`;
+- structured-output and Migration Planning task/schema identities: unchanged.
+
+It also defines whole-chain artifact selection, environment precedence,
+stderr-only diagnostics, explicit-path authority, qualification behavior, and
+criteria for eventually removing compatibility.
+
+## 4. Package and version transition
+
+Authoritative metadata now declares:
+
+```text
+@thomasminh1995/depverdict@0.6.0-alpha.1
+```
+
+The lockfile root name, version, and bin map were synchronized without
+dependency, resolved URL, integrity, or transitive lock drift. Repository,
+homepage, and issue URLs still point at the current UpgradeLens repository
+because repository rename is outside DIFF-02.
+
+The package remains public-capable and has no embedded publish credential,
+publish hook, or `private` flag. No `publishConfig` was added: public access and
+the non-default `preview` tag are kept as explicit future publish-command
+controls instead of encoding a misleading substitute for dist-tag policy.
+
+The description now exposes DepVerdict's decision-first positioning.
+
+## 5. Canonical and legacy CLI contract
+
+The package has two executable entries sharing one dispatcher:
+
+```text
+depverdict  -> bin/depverdict.js
+upgradelens -> bin/upgradelens.js
+```
+
+Both files have a valid Node shebang and executable mode. The canonical wrapper
+injects canonical invocation identity. The thin legacy wrapper injects only
+legacy invocation identity and does not duplicate or recursively invoke command
+logic.
+
+The legacy command emits one warning per process state to stderr. It names both
+commands and the `0.6.x` preview removal window. It does not change stdout or
+exit status. Programmatic `runCli` use is canonical unless legacy invocation is
+explicitly requested.
+
+Help, progress heading, console outcome, new Markdown report title, failure
+presentation, error guidance, and user agent now present DepVerdict. Historical
+files and provider prompt/task identities were not rewritten.
+
+## 6. Artifact-root compatibility
+
+Every implicit write now uses `.depverdict/`, including manifests, evidence,
+analysis, usage, impact, decision, checklist, report, log, cache, governance,
+conformance, and default qualification paths. Artifact filenames are unchanged.
+Discovery ignores both generated roots.
+
+The centralized read resolver implements:
+
+1. complete canonical chain wins;
+2. complete canonical plus any legacy data emits
+   `LEGACY_ARTIFACT_ROOT_IGNORED`;
+3. complete legacy with no canonical member emits
+   `LEGACY_ARTIFACT_ROOT_USED`;
+4. partial or split availability fails with `ARTIFACT_ROOT_CONFLICT`;
+5. no artifacts preserves the established canonical missing-input behavior.
+
+The resolver never merges, copies, moves, deletes, or timestamp-selects
+artifacts. Explicit CLI/API paths bypass automatic discovery and remain exact,
+including an explicitly selected `.upgradelens/` output.
+
+The bounded fallback is applied to Project Manifest research input, the
+three-artifact Version Analysis input chain, the seven-artifact decision and
+Migration Checklist chain, and default Migration Planning qualification.
+
+## 7. Environment compatibility and precedence
+
+One resolver owns the complete discovered mapping:
+
+| Canonical | Deprecated fallback | Secret-sensitive |
+| --- | --- | --- |
+| `DEPVERDICT_AI_PROVIDER` | `UPGRADELENS_AI_PROVIDER` | No |
+| `DEPVERDICT_AI_ENDPOINT` | `UPGRADELENS_AI_ENDPOINT` | No |
+| `DEPVERDICT_AI_MODEL` | `UPGRADELENS_AI_MODEL` | No |
+| `DEPVERDICT_AI_AUTHORIZATION` | `UPGRADELENS_AI_AUTHORIZATION` | Yes |
+| `DEPVERDICT_AI_TIMEOUT_MS` | `UPGRADELENS_AI_TIMEOUT_MS` | No |
+| `DEPVERDICT_AI_TIMEOUT_SECONDS` | `UPGRADELENS_AI_TIMEOUT_SECONDS` | No |
+| `DEPVERDICT_AI_MAX_RESPONSE_BYTES` | `UPGRADELENS_AI_MAX_RESPONSE_BYTES` | No |
+| `DEPVERDICT_AI_DEBUG` | `UPGRADELENS_AI_DEBUG` | No |
+
+Precedence is explicit override, canonical environment, legacy environment,
+then established default. Canonical wins conflicts. Diagnostics name keys only,
+are once-per-key bounded, and never contain values. Unknown identity-prefixed
+variables are discarded. Passing an explicit empty environment remains isolated
+from the host environment.
+
+Provider request count, timeout parsing, runtime selection, and debug-output
+contracts remain unchanged after resolution.
+
+## 8. Qualification compatibility
+
+Package and product name do not participate in Migration Planning qualification
+identity. Provider, endpoint/adapter, model, dataset, task, prompt, policy,
+schema, and presentation identities remain authoritative and unchanged.
+
+The default qualification path moved to `.depverdict/`. A valid legacy record is
+selected intact only when canonical storage is absent. When both exist,
+canonical is selected and legacy is visibly ignored. Explicit paths never fall
+back. Corrupted, tampered, runtime-mismatched, fake-runtime, and matching
+`NOT_QUALIFIED` records retain their fail-closed behavior.
+
+No external provider requalification was required or performed.
+
+## 9. Schema and public API preservation
+
+Schema versions, filenames, schema IDs, prompt versions, policy versions, task
+IDs, status/reason codes, occurrence identities, evidence IDs, digests, and
+lineage checks did not change.
+
+New artifacts still write `generator.name: "UpgradeLens"` because current
+schemas validate that literal. Generator version advances from package metadata
+to `0.6.0-alpha.1`, as already permitted by the schemas. Old fixtures remain
+schema-valid in the full suite.
+
+The root ESM API remains 438 exports. No redundant identity helper was promoted
+to the public surface.
+
+## 10. Package guard and CI updates
+
+The package guard now requires:
+
+- both executable files;
+- both compatibility resolver modules;
+- the DIFF-02 decision and this review;
+- the established runtime, schemas, datasets, and user-facing assets.
+
+An untracked protected implementation file is accepted only when it is on this
+exact authoritative required list; other protected untracked files still fail.
+Both `.depverdict/` and `.upgradelens/` runtime output trees are explicitly
+forbidden from the package. Capture, duplicate/copy, credential, environment,
+qualification-record, and local-artifact protections remain active.
+
+CI remains read-only and fork-safe on Node 20, 22, and 24. It clears both complete
+environment-prefix sets and runs install, tests, actual-tarball guard, and
+clean-install package smoke. There is no publish, tag, release, writeback, or
+provider-secret step.
+
+Package smoke installs the scoped tarball into an isolated consumer, exercises
+the npm-generated canonical and legacy command shims, checks canonical
+help/version with clean stderr and legacy version with its warning, imports the
+scoped ESM package, and verifies 438 exports.
+
+## 11. Focused and adversarial tests
+
+Focused coverage proves:
+
+- exact canonical name/version/help and clean canonical stderr;
+- bounded legacy command warning, unchanged exit status, and JSON-only
+  `--stdout`;
+- canonical/alias artifact equivalence after normalizing only generation time;
+- explicit legacy output authority;
+- canonical, legacy, conflict, and explicit environment precedence without
+  secret disclosure or host inheritance;
+- complete canonical/legacy artifact selection and split-chain rejection;
+- no fallback-side file rewrite;
+- valid legacy qualification fallback and canonical qualification precedence;
+- tamper and identity mismatch rejection;
+- exact package metadata and dual-bin tarball/install behavior.
+
+The full schema, lineage, tamper, deterministic replay, provider request
+isolation, historical-fixture, and package-policy suites also passed.
+
+## 12. Canonical validation
+
+Final source validation:
+
+```text
+npm run check
+tests: 640
+passed: 639
+failed: 0
+skipped: 1
+package guard: passed
+```
+
+The single skip is the established sandbox limitation for a local loopback
+keep-alive test. The related scoped HTTP lifecycle tests and real child-process
+natural-exit test passed.
+
+`git diff --check` passed. Lockfile review found only root identity/version and
+the added canonical bin mapping. No dependency integrity changed.
+
+## 13. Actual tarball and clean-install results
+
+The qualified filename is:
+
+```text
+thomasminh1995-depverdict-0.6.0-alpha.1.tgz
+```
+
+The final actual-tarball guard reports zero suspicious artifacts and all 25
+required assets. Isolated clean install/extraction succeeds, both executable
+files are mode `0755`, canonical help/version are clean, the alias warns on
+stderr, and scoped import exposes 438 public exports.
+
+Repeated `npm pack --dry-run --json --ignore-scripts` runs produce identical
+metadata and integrity for the same source state. No tarball is retained in the
+repository.
+
+## 14. npm publish dry-run and bin normalization
+
+An initial npm 11.12.1 dry-run exposed publish normalization of `./bin/...`
+values. This was treated as a real metadata defect, not ignored. The bin values
+were changed to equivalent portable `bin/...` paths.
+
+The final command:
+
+```text
+npm publish --dry-run --access public --tag preview --json --ignore-scripts --offline
+```
+
+completed with no auto-correction warning, kept both executable entries and
+files, retained the exact scoped name/version, selected `preview` with public
+access, and performed no registry mutation. No `npm pkg fix` was run.
+
+## 15. Provider-call count
+
+External provider calls: `0`.
+
+Tests used deterministic fake or local fixture runtimes only. npm registry access
+during isolated consumer installation is package transport, not an AI provider
+call.
+
+## 16. Blocked and skipped checks
+
+- Crates.io exact-name availability: unverified because the service returned
+  access denied.
+- Unauthenticated GitHub code search: unverified because the API returned
+  unauthorized.
+- Hosted CI was not dispatched because DIFF-02 forbids commit and push. The
+  workflow contract and local CI-equivalent commands passed.
+- Node 20/22/24 were not separately installed in the local environment; the
+  existing matrix remains configured. Validation ran on Node 26.0.0, which
+  satisfies the package's `>=20` engine contract.
+- No repository rename, identity reservation, publish, tag, release, or external
+  provider qualification was attempted.
+
+These are non-critical availability/platform follow-ups and do not undermine
+the implemented compatibility invariants.
+
+## 17. Defects and remaining limitations
+
+Resolved defect:
+
+- npm publish normalization warned on `./bin/...` and would normalize those
+  paths. Using `bin/...` removes the warning and retains both bins.
+
+Open Blocker defects: none.
+
+Open High defects: none.
+
+Remaining Medium limitations:
+
+- broad repository, community, historical documentation, and release-text
+  migration remains intentionally deferred to DIFF-03;
+- brand availability and legal-risk signals remain time-sensitive;
+- automatic legacy compatibility is preview-bounded and must not be removed
+  without satisfying the decision's removal criteria;
+- hosted Node-matrix execution awaits an authorized pushed change.
+
+## 18. Exact files changed or created
+
+Package, CLI, CI, and current-use documentation:
+
+```text
+.github/workflows/ci.yml
+README.md
+bin/depverdict.js
+bin/upgradelens.js
+package-lock.json
+package.json
+scripts/ci-package-smoke.mjs
+scripts/package-content-guard.mjs
+```
+
+Runtime:
+
+```text
+src/ai-runtime-debug.js
+src/ai-scorecard.js
+src/artifact-root-compatibility.js
+src/benchmark-report.js
+src/cli.js
+src/conformance-report.js
+src/constants.js
+src/discovery.js
+src/environment-compatibility.js
+src/evaluation-report.js
+src/impact-evidence/repository-impact-evidence.js
+src/impact/repository-impact.js
+src/knowledge-cache.js
+src/knowledge-evidence-producer.js
+src/knowledge-manifest-builder.js
+src/metrics-engine.js
+src/migration-checklist/input-loader.js
+src/migration-checklist/migration-checklist.js
+src/migration-checklist/qualification-resolution.js
+src/migration-checklist/runtime.js
+src/orchestration/failure-log.js
+src/orchestration/progress-reporter.js
+src/renderers/console.js
+src/renderers/markdown.js
+src/upgrade-decision/runtime.js
+src/upgrade-decision/upgrade-decision.js
+src/usage/usage-index.js
+src/version-analysis-loader.js
+src/version-analysis-manifest.js
+```
+
+Tests:
+
+```text
+test/analysis-orchestration.test.js
+test/ci-workflow-metadata.test.js
+test/cli.test.js
+test/discovery.test.js
+test/governance-metadata.test.js
+test/http-lifecycle-cli.test.js
+test/identity-compatibility.test.js
+test/knowledge-manifest-generation.test.js
+test/migration-checklist-contract.test.js
+test/migration-checklist-orchestration.test.js
+test/migration-qualification-resolution.test.js
+test/package-content-guard.test.js
+test/product-completion-cli.test.js
+test/research-plan.test.js
+test/runtime-conformance.test.js
+test/version-analysis-manifest.test.js
+test/version-source.test.js
+test-support/environment.mjs
+```
+
+Decision and review:
+
+```text
+docs/decisions/diff-02-identity-compatibility-contract.md
+docs/reviews/diff-02-identity-contract-compatibility.md
+```
+
+## 19. Pre-existing changes preserved
+
+The task began on `main` at
+`c91fbb0032b0e2f6209cb4a14aeeb68d9cf0c28d`. The origin still points to the
+UpgradeLens repository, and public tags through `v0.5.0` are unchanged.
+
+Pre-existing untracked DIFF-01/source-comparison documents, RR02 capture trees,
+and duplicate capture files were left intact. They were not cleaned, rewritten,
+staged, or used as provider input.
+
+No commit, merge, tag, push, repository rename, release, or publish was
+performed.
+
+## 20. Final verdict and next gate
+
+Verdict: `DEPVERDICT_IDENTITY_COMPATIBILITY_READY`
+
+Gate: `PROCEED_TO_DIFF_03_REPOSITORY_DOCS_AND_COMMUNITY_MIGRATION`