artifact-graph 0.6.1 → 0.8.0

package/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,26 @@
+name: Bug report
+description: Report a reproducible problem
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What happened?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction
+      description: Steps to reproduce the issue.
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Node.js version, package version, OS, and package manager.
+    validations:
+      required: false

package/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,19 @@
+name: Feature request
+description: Suggest an improvement
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem should this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What would a good solution look like?
+    validations:
+      required: true

package/.github/pull_request_template.md

@@ -0,0 +1,14 @@
+## Summary
+
+- 
+
+## Validation
+
+- [ ] `pnpm build`
+- [ ] `pnpm test`
+- [ ] `pnpm typecheck --if-present`
+
+## Checklist
+
+- [ ] README / CHANGELOG updated when user-facing behavior changed
+- [ ] No private parent-repository files or local machine paths included

package/.github/workflows/ci.yml

@@ -0,0 +1,23 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.17.1
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: pnpm install
+      - run: pnpm test:ci
+      - run: pnpm typecheck
+      - run: pnpm build
+      - run: git diff --exit-code

package/CHANGELOG.md

@@ -1,6 +1,51 @@
 # Changelog
 
-## Unreleased
+## 0.8.0
+
+### Added
+
+- **Artifact relation version locks**: `version-lock refresh` and `bootstrap` now generate
+  `artifactRelations` entries for artifact-to-artifact edges (for example, skill→skill_family and
+  feature→scenario). The `audit` command checks for missing relation locks, content hash mismatches,
+  and path drift.
+
+### Changed
+
+- **Strict local artifact-relation refresh**: `version-lock refresh --changed-only` updates or adds
+  only relation locks whose endpoints are reached by the current worktree or staged change set. It
+  no longer fills unrelated missing relation locks while processing a local change; use
+  `version-lock refresh --all` only when intentionally establishing a complete relation baseline.
+- **Deterministic, reproducible relation locks**: relation lock output uses deterministic sorting and
+  carries no timestamps, so identical artifact content produces byte-identical lock files across
+  environments and runs.
+- **Old 1.0 lock read boundary**: lock files written before artifact relations existed (no
+  `artifactRelations` key) are read as an empty relation list instead of failing; run
+  `version-lock refresh --all` once to establish the complete relation baseline.
+- **Non-software domain isolation via `baselinePolicy: false`**: when a project explicitly disables
+  the universal baseline (`baselinePolicy: false` in the context/packet manifest), packet assembly
+  and validation no longer inject the software-development defaults — baseline constraints, the risk
+  checklist, and blueprint non-goals are required to be empty (PKT-005 / PKT-010), so non-software
+  skill-family domains are not forced through software-specific packet rules.
+
+## 0.7.0
+
+### Added
+
+- **Contract kernel**: new deterministic contract kernel providing contract identity, a contract
+  registry, canonical IR normalization, revision digests, and policy compatibility checks. Exposed
+  through the new `artifact-graph contract` CLI subcommand group and public library exports.
+
+### Changed
+
+- **Version-lock changed-only collects untracked paths**: `version-lock refresh --changed-only`
+  (worktree and staged modes) now also collects untracked files, so newly added artifacts can no
+  longer silently bypass lock refresh.
+- **Organization migration to `ifoohoo`**: the public repository transferred to the `ifoohoo`
+  GitHub organization (`ifoohoo/artifact-graph`, name unchanged). Copyright is now held by
+  广州市风荷科技有限公司 (Guangzhou Fenghe Technology Co., Ltd.) together with the project
+  contributors; the NOTICE file states that the organization transfer is an administrative hosting
+  change, not a copyright assignment. Package metadata, installation docs, and repository
+  references were updated accordingly; the npm package name `artifact-graph` is unchanged.
 
 ## 0.6.1
 

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,11 @@
+# Code of Conduct
+
+This project follows a simple contributor covenant:
+
+- Be respectful and constructive.
+- Assume good intent, but accept responsibility for impact.
+- Keep technical discussion focused on the work.
+- Do not harass, insult, or discriminate.
+
+Maintainers may remove comments, issues, pull requests, or other contributions that violate these
+expectations.

package/CONTRIBUTING.md

@@ -0,0 +1,24 @@
+# Contributing
+
+Thanks for your interest in contributing.
+
+## Development
+
+Use Node.js `>=22.0.0`.
+
+```bash
+pnpm install
+pnpm build
+pnpm test
+```
+
+## Pull Requests
+
+- Keep changes focused.
+- Update README, CHANGELOG, and tests when behavior changes.
+- Run the package validation commands before opening a pull request.
+- Do not include private parent-repository artifacts or local machine paths.
+
+## License
+
+By contributing, you agree that your contribution is licensed under Apache-2.0.

package/INSTALL.md

@@ -21,13 +21,13 @@ npm install --save-dev artifact-graph
 ### From GitHub
 
 ```bash
-npm install --save-dev github:mzdbxqh/artifact-graph
+npm install --save-dev github:ifoohoo/artifact-graph
 ```
 
 Or with pnpm:
 
 ```bash
-pnpm add -D github:mzdbxqh/artifact-graph
+pnpm add -D github:ifoohoo/artifact-graph
 ```
 
 After installation, verify the CLI is available:
@@ -171,5 +171,5 @@ packet validation (`validatePacket`) correctly allows `requiredBaseline.total=0`
 
 ## Related Project
 
-Use [`artifact-chain-assistant`](https://github.com/mzdbxqh/artifact-chain-assistant) for Codex and
+Use [`artifact-chain-assistant`](https://github.com/ifoohoo/artifact-chain-assistant) for Codex and
 Claude Code skills that guide artifact-chain intake, setup, and maintenance.

package/LICENSE

@@ -171,7 +171,7 @@ recommend that a file or class name and description of purpose be included on
 the same "printed page" as the copyright notice for easier identification
 within third-party archives.
 
-Copyright 2026 xqh
+Copyright 2026 广州市风荷科技有限公司 (Guangzhou Fenghe Technology Co., Ltd.)
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

package/NOTICE

@@ -1,4 +1,18 @@
-artifact-graph
-Copyright 2026 xqh
+# Notice
 
-This product includes software developed for the artifact-chain project.
+artifact-graph is an open-source project released under the Apache License 2.0.
+
+## Maintenance
+
+artifact-graph is maintained by 广州市风荷科技有限公司 (Guangzhou Fenghe
+Technology Co., Ltd.), together with the artifact-graph contributors. Copyright
+in the project is held by the artifact-graph contributors and 广州市风荷科技
+有限公司 as stated in the LICENSE file. The transfer of the public GitHub
+repository to the `ifoohoo` organization is an administrative change of the
+hosting location and maintenance identity; it does not by itself constitute a
+copyright assignment or transfer.
+
+## Third-Party Dependencies
+
+This project is built on Node.js and the npm ecosystem. See `package.json`
+for the full list of dependencies.

package/README.md

@@ -8,6 +8,25 @@ Git-native Markdown artifact graph scanner and validator for agentic coding work
 and version-lock metadata connected. It is designed for deterministic local use before an AI coding
 agent claims implementation work is complete.
 
+<!-- release-skill:capability:external-write-boundary -->
+> **External-write boundary:** Installing `artifact-graph` does not modify a project or write to
+> remote systems. Read-only commands such as `--help`, `doctor`, `validate`, `query`, and `audit`
+> do not change project files. Commands including `init`, `version-lock refresh`, and
+> `hooks install-git` write locally only when explicitly invoked.
+
+<!-- release-skill:capability:safe-first-command -->
+> **Safe first command:** Inspect the installed CLI and project health before authorizing any
+> initialization, version-lock refresh, or hook installation.
+
+```bash
+pnpm exec artifact-graph --help
+pnpm exec artifact-graph doctor --root .
+```
+
+If either read-only command fails, confirm that Node.js `>=22.0.0` is active and reinstall the
+package using the precise instructions in [INSTALL.md](INSTALL.md). Do not run a write command
+until the CLI resolves successfully and doctor reports an actionable diagnosis.
+
 ## Install
 
 ```bash
@@ -17,7 +36,7 @@ pnpm add -D artifact-graph
 Or install from GitHub:
 
 ```bash
-npm install --save-dev github:mzdbxqh/artifact-graph
+npm install --save-dev github:ifoohoo/artifact-graph
 ```
 
 Node.js `>=22.0.0` is required. For pnpm 10+, see [INSTALL.md](INSTALL.md) for the native build
@@ -49,6 +68,9 @@ npx artifact-graph version-lock audit --root . --strict-missing-lock
 - Validate Review Result Protocol v1.0 documents with `artifact-graph validate-review-result --file <path>`.
 - Build implementation context with `artifact-graph context` or `artifact-graph packet`.
 - Keep traceability freshness with `artifact-graph version-lock refresh` and `audit`.
+- Version lock covers both implementation/verification edges (`locks`) and artifact-to-artifact
+  relations (`artifactRelations`). Old 1.0 lock files without `artifactRelations` are treated as
+  having an empty relation list; run `refresh --all` once to establish the complete relation baseline.
 - Install opt-in Git hooks with `artifact-graph hooks install-git --hook all`.
 
 ## Review Result Protocol
@@ -65,7 +87,7 @@ cross-object field values, so callers must also run the semantic validator; stab
 
 ## Related Project
 
-Use [`artifact-chain-assistant`](https://github.com/mzdbxqh/artifact-chain-assistant) for Codex and
+Use [`artifact-chain-assistant`](https://github.com/ifoohoo/artifact-chain-assistant) for Codex and
 Claude Code skills that guide artifact-chain intake, setup, and maintenance.
 
 ## License

package/README.zh-CN.md

@@ -2,10 +2,28 @@
 
 [English](README.md)
 
-`artifact-graph` 是面向 AI 编程工作流的 Git-native Markdown 制品图扫描和校验工具。
+`artifact-graph` 是一个 Git 原生的 Markdown 制品图扫描与校验工具，面向 AI 编程工作流。
 
-它帮助项目把需求、场景、设计、源码、测试和 version-lock 元数据连接起来，在 AI agent
-声称实现完成之前，用确定性本地命令检查上下文和追溯关系。
+它把项目里的需求、场景、设计、源码、测试和 version-lock 元数据连成一张图，
+供 AI agent 在宣称实现完成之前，用确定性的本地命令检查上下文和追溯关系。
+
+<!-- release-skill:capability:external-write-boundary -->
+> **外部写入边界：** 安装 `artifact-graph` 不会修改项目或写入远端。`--help`、`doctor`、
+> `validate`、`query` 和 `audit` 等只读命令不会更改项目文件。只有显式执行 `init`、
+> `version-lock refresh` 或 `hooks install-git` 等命令时才会发生本地写入。
+
+<!-- release-skill:capability:safe-first-command -->
+> **安全的第一步：** 在授权初始化、刷新版本锁或安装 hook 前，先检查已安装的命令行工具
+> 和项目健康状态。
+
+```bash
+pnpm exec artifact-graph --help
+pnpm exec artifact-graph doctor --root .
+```
+
+如果任一只读命令失败，先确认当前 Node.js 版本不低于 `22.0.0`，再按照
+[INSTALL.md](INSTALL.md) 中的精确说明重新安装；命令行工具能够正常解析且 doctor
+给出可处理的诊断前，不要运行写入命令。
 
 ## 安装
 
@@ -16,7 +34,7 @@ pnpm add -D artifact-graph
 或从 GitHub 安装：
 
 ```bash
-npm install --save-dev github:mzdbxqh/artifact-graph
+npm install --save-dev github:ifoohoo/artifact-graph
 ```
 
 需要 Node.js `>=22.0.0`。pnpm 10+ 需要配置原生构建白名单，详见 [INSTALL.md](INSTALL.md)。
@@ -46,24 +64,26 @@ npx artifact-graph version-lock audit --root . --strict-missing-lock
 - 用 `artifact-graph validate` 校验制品之间的链接。
 - 用 `artifact-graph validate-review-result --file <path>` 校验 Review Result Protocol v1.0 文档。
 - 用 `artifact-graph context` 或 `artifact-graph packet` 构建实现上下文。
-- 用 `artifact-graph version-lock refresh` 和 `audit` 维护追溯新鲜度。
+- 用 `artifact-graph version-lock refresh` 和 `audit` 保持追溯关系及时更新。
+- 版本锁覆盖实现/验证边（`locks`）和制品间关系（`artifactRelations`）。旧版 1.0 锁文件缺少
+  `artifactRelations` 时视为空数组；首次启用时执行一次 `refresh --all` 建立完整关系基线。
 - 用 `artifact-graph hooks install-git --hook all` 安装可选 Git hooks。
 
 ## Review Result Protocol
 
-包内发布 `schemas/review-result.schema.json` 和等价的 TypeScript 类型与 validateReviewResult 校验 API。该协议不绑定具体
-项目，覆盖 review、repair、批次证据、findings、metrics 与 fail-closed decision；非法字段
-会返回稳定的 JSON path 诊断。协议拒绝未知顶层字段，`attempt` 仅允许 1–3；成功接受必须包含
-`producer`，`PASS`/`PASS_WITH_RESIDUAL_MINOR` 不能伴随 open `block` finding。独立 repair
-re-review 可记录 `acceptance.reviewer` 与 `acceptance.source_result`，validator 会拒绝 repair
-producer 自行接受。
-JSON Schema 无法比较跨对象字段值，因此调用方还必须运行 semantic validator；稳定身份是
-`executor + name`，`skill` 只是附加元数据，不能用于证明独立性。
+包内发布了 `schemas/review-result.schema.json`，以及配套的 TypeScript 类型和 `validateReviewResult`
+校验 API。该协议与具体项目无关，覆盖 review、repair、批次证据、findings、metrics 和
+fail-closed decision；非法字段和语义违规都会以稳定的 JSON path 报告。协议拒绝未知顶层字段；
+`attempt` 取值仅限 1–3；成功接受必须带 `producer`；`PASS`/`PASS_WITH_RESIDUAL_MINOR` 不允许
+存在未关闭的 `block` finding。独立的 repair 复审可以记录 `acceptance.reviewer` 和
+`acceptance.source_result`，validator 会拒绝 repair producer 自我接受。
+JSON Schema 无法比较跨对象的字段值，因此调用方还必须运行语义 validator；稳定身份由
+`executor + name` 构成，`skill` 只是附加元数据，不能用来证明独立性。
 
 ## 相关项目
 
-如果需要 Codex / Claude Code 的技能、初始化引导和维护流程，请使用
-[`artifact-chain-assistant`](https://github.com/mzdbxqh/artifact-chain-assistant)。
+如果需要 Codex / Claude Code 技能来引导制品链的接入、初始化和日常维护，请使用
+[`artifact-chain-assistant`](https://github.com/ifoohoo/artifact-chain-assistant)。
 
 ## 开源协议
 

package/SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy
+
+## Reporting A Vulnerability
+
+Please do not open a public issue for sensitive security reports.
+
+Send a private report to the repository owner through GitHub's private vulnerability reporting when
+available, or contact the maintainer directly.
+
+Include:
+
+- affected package and version;
+- reproduction steps;
+- impact;
+- suggested fix, if known.
+
+## Supported Versions
+
+Security fixes target the latest released version.

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "artifact-graph",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "description": "Git-native Markdown artifact graph scanner and validator",
   "license": "Apache-2.0",
   "type": "module",
+  "packageManager": "pnpm@10.17.1",
   "keywords": [
     "artifact-graph",
     "traceability",
@@ -28,12 +29,25 @@
         "default": "./dist/index.cjs"
       }
     },
-    "./schemas/review-result.schema.json": "./schemas/review-result.schema.json"
+    "./schemas/review-result.schema.json": "./schemas/review-result.schema.json",
+    "./contracts/e2e-test/schema.json": "./contracts/e2e-test/schema.json"
   },
   "engines": {
     "node": ">=22.0.0"
   },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --splitting false && tsup src/cli.ts --format esm --dts --splitting false",
+    "test": "vitest run --config vitest.config.ts",
+    "test:ci": "ARTIFACT_GRAPH_PUBLIC_REPO=1 vitest run --config vitest.config.ts && pnpm test:npm-consumer",
+    "test:npm-consumer": "node test/npm-bin-install.test.mjs",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist coverage",
+    "packet:audit": "node scripts/run-packet-audit.mjs",
+    "packet:prompt-audit": "node scripts/run-packet-prompt-audit.mjs"
+  },
   "dependencies": {
+    "ajv": "^8.20.0",
     "better-sqlite3": "^11.9.0",
     "commander": "^13.1.0",
     "gray-matter": "^4.0.3",
@@ -43,7 +57,6 @@
     "@types/better-sqlite3": "^7.6.12",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.19.20",
-    "ajv": "^8.20.0",
     "tsup": "^8.4.0",
     "typescript": "^5.7.0",
     "vitest": "^3.1.0"
@@ -55,28 +68,32 @@
     "LICENSE",
     "NOTICE",
     "INSTALL.md",
+    "CONTRIBUTING.md",
+    "CODE_OF_CONDUCT.md",
+    "SECURITY.md",
+    ".github",
     "dist",
     "schemas",
+    "contracts",
     "scripts",
     "templates"
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/mzdbxqh/artifact-graph.git"
+    "url": "git+https://github.com/ifoohoo/artifact-graph.git"
   },
   "bugs": {
-    "url": "https://github.com/mzdbxqh/artifact-graph/issues"
+    "url": "https://github.com/ifoohoo/artifact-graph/issues"
   },
-  "homepage": "https://github.com/mzdbxqh/artifact-graph#readme",
-  "scripts": {
-    "build": "tsup src/index.ts --format esm,cjs --dts --splitting false && tsup src/cli.ts --format esm --dts --splitting false",
-    "test": "vitest run --config vitest.config.ts",
-    "test:ci": "ARTIFACT_GRAPH_PUBLIC_REPO=1 vitest run --config vitest.config.ts && pnpm test:npm-consumer",
-    "test:npm-consumer": "node test/npm-bin-install.test.mjs",
-    "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "clean": "rm -rf dist coverage",
-    "packet:audit": "node scripts/run-packet-audit.mjs",
-    "packet:prompt-audit": "node scripts/run-packet-prompt-audit.mjs"
+  "homepage": "https://github.com/ifoohoo/artifact-graph#readme",
+  "author": "广州市风荷科技有限公司",
+  "contributors": [
+    "mzdbxqh"
+  ],
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3",
+      "esbuild"
+    ]
   }
-}
+}

package/dist/cli.d.ts

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-interface CliIo {
-    cwd?: string;
-    stdout?: (chunk: string) => void;
-    stderr?: (chunk: string) => void;
-}
-declare function runCli(argv: string[], io?: CliIo): Promise<number>;
-
-export { type CliIo, runCli };