artifact-graph 0.7.0 → 0.8.0

package/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,26 @@
+name: Bug report
+description: Report a reproducible problem
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What happened?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction
+      description: Steps to reproduce the issue.
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Node.js version, package version, OS, and package manager.
+    validations:
+      required: false

package/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,19 @@
+name: Feature request
+description: Suggest an improvement
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem should this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What would a good solution look like?
+    validations:
+      required: true

package/.github/pull_request_template.md

@@ -0,0 +1,14 @@
+## Summary
+
+- 
+
+## Validation
+
+- [ ] `pnpm build`
+- [ ] `pnpm test`
+- [ ] `pnpm typecheck --if-present`
+
+## Checklist
+
+- [ ] README / CHANGELOG updated when user-facing behavior changed
+- [ ] No private parent-repository files or local machine paths included

package/.github/workflows/ci.yml

@@ -0,0 +1,23 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.17.1
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: pnpm install
+      - run: pnpm test:ci
+      - run: pnpm typecheck
+      - run: pnpm build
+      - run: git diff --exit-code

package/CHANGELOG.md

@@ -1,6 +1,31 @@
 # Changelog
 
-## Unreleased
+## 0.8.0
+
+### Added
+
+- **Artifact relation version locks**: `version-lock refresh` and `bootstrap` now generate
+  `artifactRelations` entries for artifact-to-artifact edges (for example, skill→skill_family and
+  feature→scenario). The `audit` command checks for missing relation locks, content hash mismatches,
+  and path drift.
+
+### Changed
+
+- **Strict local artifact-relation refresh**: `version-lock refresh --changed-only` updates or adds
+  only relation locks whose endpoints are reached by the current worktree or staged change set. It
+  no longer fills unrelated missing relation locks while processing a local change; use
+  `version-lock refresh --all` only when intentionally establishing a complete relation baseline.
+- **Deterministic, reproducible relation locks**: relation lock output uses deterministic sorting and
+  carries no timestamps, so identical artifact content produces byte-identical lock files across
+  environments and runs.
+- **Old 1.0 lock read boundary**: lock files written before artifact relations existed (no
+  `artifactRelations` key) are read as an empty relation list instead of failing; run
+  `version-lock refresh --all` once to establish the complete relation baseline.
+- **Non-software domain isolation via `baselinePolicy: false`**: when a project explicitly disables
+  the universal baseline (`baselinePolicy: false` in the context/packet manifest), packet assembly
+  and validation no longer inject the software-development defaults — baseline constraints, the risk
+  checklist, and blueprint non-goals are required to be empty (PKT-005 / PKT-010), so non-software
+  skill-family domains are not forced through software-specific packet rules.
 
 ## 0.7.0
 

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,11 @@
+# Code of Conduct
+
+This project follows a simple contributor covenant:
+
+- Be respectful and constructive.
+- Assume good intent, but accept responsibility for impact.
+- Keep technical discussion focused on the work.
+- Do not harass, insult, or discriminate.
+
+Maintainers may remove comments, issues, pull requests, or other contributions that violate these
+expectations.

package/CONTRIBUTING.md

@@ -0,0 +1,24 @@
+# Contributing
+
+Thanks for your interest in contributing.
+
+## Development
+
+Use Node.js `>=22.0.0`.
+
+```bash
+pnpm install
+pnpm build
+pnpm test
+```
+
+## Pull Requests
+
+- Keep changes focused.
+- Update README, CHANGELOG, and tests when behavior changes.
+- Run the package validation commands before opening a pull request.
+- Do not include private parent-repository artifacts or local machine paths.
+
+## License
+
+By contributing, you agree that your contribution is licensed under Apache-2.0.

package/README.md

@@ -8,6 +8,25 @@ Git-native Markdown artifact graph scanner and validator for agentic coding work
 and version-lock metadata connected. It is designed for deterministic local use before an AI coding
 agent claims implementation work is complete.
 
+<!-- release-skill:capability:external-write-boundary -->
+> **External-write boundary:** Installing `artifact-graph` does not modify a project or write to
+> remote systems. Read-only commands such as `--help`, `doctor`, `validate`, `query`, and `audit`
+> do not change project files. Commands including `init`, `version-lock refresh`, and
+> `hooks install-git` write locally only when explicitly invoked.
+
+<!-- release-skill:capability:safe-first-command -->
+> **Safe first command:** Inspect the installed CLI and project health before authorizing any
+> initialization, version-lock refresh, or hook installation.
+
+```bash
+pnpm exec artifact-graph --help
+pnpm exec artifact-graph doctor --root .
+```
+
+If either read-only command fails, confirm that Node.js `>=22.0.0` is active and reinstall the
+package using the precise instructions in [INSTALL.md](INSTALL.md). Do not run a write command
+until the CLI resolves successfully and doctor reports an actionable diagnosis.
+
 ## Install
 
 ```bash
@@ -49,6 +68,9 @@ npx artifact-graph version-lock audit --root . --strict-missing-lock
 - Validate Review Result Protocol v1.0 documents with `artifact-graph validate-review-result --file <path>`.
 - Build implementation context with `artifact-graph context` or `artifact-graph packet`.
 - Keep traceability freshness with `artifact-graph version-lock refresh` and `audit`.
+- Version lock covers both implementation/verification edges (`locks`) and artifact-to-artifact
+  relations (`artifactRelations`). Old 1.0 lock files without `artifactRelations` are treated as
+  having an empty relation list; run `refresh --all` once to establish the complete relation baseline.
 - Install opt-in Git hooks with `artifact-graph hooks install-git --hook all`.
 
 ## Review Result Protocol

package/README.zh-CN.md

@@ -7,6 +7,24 @@
 它把项目里的需求、场景、设计、源码、测试和 version-lock 元数据连成一张图，
 供 AI agent 在宣称实现完成之前，用确定性的本地命令检查上下文和追溯关系。
 
+<!-- release-skill:capability:external-write-boundary -->
+> **外部写入边界：** 安装 `artifact-graph` 不会修改项目或写入远端。`--help`、`doctor`、
+> `validate`、`query` 和 `audit` 等只读命令不会更改项目文件。只有显式执行 `init`、
+> `version-lock refresh` 或 `hooks install-git` 等命令时才会发生本地写入。
+
+<!-- release-skill:capability:safe-first-command -->
+> **安全的第一步：** 在授权初始化、刷新版本锁或安装 hook 前，先检查已安装的命令行工具
+> 和项目健康状态。
+
+```bash
+pnpm exec artifact-graph --help
+pnpm exec artifact-graph doctor --root .
+```
+
+如果任一只读命令失败，先确认当前 Node.js 版本不低于 `22.0.0`，再按照
+[INSTALL.md](INSTALL.md) 中的精确说明重新安装；命令行工具能够正常解析且 doctor
+给出可处理的诊断前，不要运行写入命令。
+
 ## 安装
 
 ```bash
@@ -47,6 +65,8 @@ npx artifact-graph version-lock audit --root . --strict-missing-lock
 - 用 `artifact-graph validate-review-result --file <path>` 校验 Review Result Protocol v1.0 文档。
 - 用 `artifact-graph context` 或 `artifact-graph packet` 构建实现上下文。
 - 用 `artifact-graph version-lock refresh` 和 `audit` 保持追溯关系及时更新。
+- 版本锁覆盖实现/验证边（`locks`）和制品间关系（`artifactRelations`）。旧版 1.0 锁文件缺少
+  `artifactRelations` 时视为空数组；首次启用时执行一次 `refresh --all` 建立完整关系基线。
 - 用 `artifact-graph hooks install-git --hook all` 安装可选 Git hooks。
 
 ## Review Result Protocol

package/SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy
+
+## Reporting A Vulnerability
+
+Please do not open a public issue for sensitive security reports.
+
+Send a private report to the repository owner through GitHub's private vulnerability reporting when
+available, or contact the maintainer directly.
+
+Include:
+
+- affected package and version;
+- reproduction steps;
+- impact;
+- suggested fix, if known.
+
+## Supported Versions
+
+Security fixes target the latest released version.

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "artifact-graph",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Git-native Markdown artifact graph scanner and validator",
   "license": "Apache-2.0",
   "type": "module",
+  "packageManager": "pnpm@10.17.1",
   "keywords": [
     "artifact-graph",
     "traceability",
@@ -34,6 +35,17 @@
   "engines": {
     "node": ">=22.0.0"
   },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --splitting false && tsup src/cli.ts --format esm --dts --splitting false",
+    "test": "vitest run --config vitest.config.ts",
+    "test:ci": "ARTIFACT_GRAPH_PUBLIC_REPO=1 vitest run --config vitest.config.ts && pnpm test:npm-consumer",
+    "test:npm-consumer": "node test/npm-bin-install.test.mjs",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist coverage",
+    "packet:audit": "node scripts/run-packet-audit.mjs",
+    "packet:prompt-audit": "node scripts/run-packet-prompt-audit.mjs"
+  },
   "dependencies": {
     "ajv": "^8.20.0",
     "better-sqlite3": "^11.9.0",
@@ -56,6 +68,10 @@
     "LICENSE",
     "NOTICE",
     "INSTALL.md",
+    "CONTRIBUTING.md",
+    "CODE_OF_CONDUCT.md",
+    "SECURITY.md",
+    ".github",
     "dist",
     "schemas",
     "contracts",
@@ -74,15 +90,10 @@
   "contributors": [
     "mzdbxqh"
   ],
-  "scripts": {
-    "build": "tsup src/index.ts --format esm,cjs --dts --splitting false && tsup src/cli.ts --format esm --dts --splitting false",
-    "test": "vitest run --config vitest.config.ts",
-    "test:ci": "ARTIFACT_GRAPH_PUBLIC_REPO=1 vitest run --config vitest.config.ts && pnpm test:npm-consumer",
-    "test:npm-consumer": "node test/npm-bin-install.test.mjs",
-    "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "clean": "rm -rf dist coverage",
-    "packet:audit": "node scripts/run-packet-audit.mjs",
-    "packet:prompt-audit": "node scripts/run-packet-prompt-audit.mjs"
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3",
+      "esbuild"
+    ]
   }
-}
+}

package/contracts/e2e-test/schema.json

@@ -1,315 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "artifact.e2e-test@1",
-  "title": "Artifact Contract: E2E Test Specification",
-  "description": "Minimal schema for E2E test specification artifacts",
-  "version": "1.0.0",
-  "contractIdentity": {
-    "major": "artifact.e2e-test@1",
-    "authority": "artifact",
-    "namespace": "artifact",
-    "revisionDigest": "sha256:374b99424519e42b40b621774fb602d62dfa23f48f792095f717bbabbe9e3f2a",
-    "relationRules": {
-      "derives_from": {
-        "allowedTargetTypes": ["scenario", "design", "decision"],
-        "min": 1,
-        "max": 10,
-        "anchorPolicy": "optional"
-      },
-      "verifies": {
-        "allowedTargetTypes": ["feature", "scenario"],
-        "min": 1,
-        "max": 5,
-        "anchorPolicy": "required"
-      },
-      "implemented_by": {
-        "allowedTargetTypes": ["code"],
-        "min": 0,
-        "max": 5,
-        "anchorPolicy": "optional"
-      },
-      "references": {
-        "allowedTargetTypes": ["feature", "scenario", "decision", "design", "e2e_test", "test"],
-        "min": 0,
-        "max": 20,
-        "anchorPolicy": "optional"
-      },
-      "covers": {
-        "allowedTargetTypes": ["feature", "scenario"],
-        "min": 0,
-        "max": 10,
-        "anchorPolicy": "optional"
-      }
-    },
-    "semanticMarkers": {
-      "scope": {
-        "jsonPointer": "/scope",
-        "markdownMarker": "scope",
-        "required": true
-      },
-      "system_boundary": {
-        "jsonPointer": "/system_boundary",
-        "markdownMarker": "system-boundary",
-        "required": true
-      },
-      "coverage": {
-        "jsonPointer": "/coverage",
-        "markdownMarker": "coverage",
-        "required": true
-      },
-      "environment_data": {
-        "jsonPointer": "/environment_data",
-        "markdownMarker": "environment-data",
-        "required": true
-      },
-      "test_cases": {
-        "jsonPointer": "/test_cases",
-        "markdownMarker": "test-cases",
-        "required": true
-      },
-      "evidence_contract": {
-        "jsonPointer": "/evidence_contract",
-        "markdownMarker": "evidence-contract",
-        "required": true
-      }
-    }
-  },
-  "type": "object",
-  "required": ["metadata", "scope", "system_boundary", "coverage", "environment_data", "relations", "test_cases", "evidence_contract"],
-  "properties": {
-    "metadata": {
-      "type": "object",
-      "required": ["id", "title", "status"],
-      "properties": {
-        "id": {
-          "type": "string",
-          "pattern": "^[A-Za-z0-9._-]+:(TC-\\d+[a-z]?|FILE)$"
-        },
-        "title": {
-          "type": "string",
-          "minLength": 1
-        },
-        "status": {
-          "type": "string",
-          "enum": ["planned", "active", "done", "deprecated"]
-        },
-        "test_batch": {
-          "type": "string"
-        }
-      },
-      "additionalProperties": false
-    },
-    "scope": {
-      "type": "object",
-      "required": ["business_goal", "actors"],
-      "properties": {
-        "business_goal": {
-          "type": "string",
-          "minLength": 1
-        },
-        "actors": {
-          "type": "array",
-          "items": { "type": "string" },
-          "minItems": 1
-        },
-        "system_boundaries": {
-          "type": "array",
-          "items": { "type": "string" }
-        },
-        "non_goals": {
-          "type": "array",
-          "items": { "type": "string" }
-        }
-      },
-      "additionalProperties": false
-    },
-    "system_boundary": {
-      "type": "object",
-      "required": ["components"],
-      "properties": {
-        "components": {
-          "type": "array",
-          "items": { "type": "string" },
-          "minItems": 1
-        },
-        "external_dependencies": {
-          "type": "array",
-          "items": { "type": "string" }
-        },
-        "trust_boundaries": {
-          "type": "array",
-          "items": { "type": "string" }
-        }
-      },
-      "additionalProperties": false
-    },
-    "coverage": {
-      "type": "object",
-      "required": [],
-      "properties": {
-        "ac_coverage": {
-          "type": "object",
-          "additionalProperties": {
-            "type": "array",
-            "items": { "type": "string" }
-          }
-        },
-        "related_scenarios": {
-          "type": "array",
-          "items": { "type": "string" }
-        },
-        "related_features": {
-          "type": "array",
-          "items": { "type": "string" }
-        },
-        "related_decisions": {
-          "type": "array",
-          "items": { "type": "string" }
-        }
-      },
-      "additionalProperties": false
-    },
-    "environment_data": {
-      "type": "object",
-      "properties": {
-        "topology": {
-          "type": "string"
-        },
-        "fixtures": {
-          "type": "array",
-          "items": { "type": "string" }
-        },
-        "identities": {
-          "type": "array",
-          "items": { "type": "string" }
-        },
-        "isolation_strategy": {
-          "type": "string"
-        }
-      },
-      "additionalProperties": false
-    },
-    "relations": {
-      "type": "array",
-      "description": "Machine-readable relation declarations: kind, target type/id, optional anchor, and contract-level cardinality rules",
-      "minItems": 2,
-      "items": {
-        "type": "object",
-        "required": ["kind", "target_type", "target_id"],
-        "properties": {
-          "kind": {
-            "type": "string",
-            "enum": ["derives_from", "verifies", "implemented_by", "references", "covers"]
-          },
-          "target_type": {
-            "type": "string",
-            "enum": ["feature", "scenario", "decision", "design", "e2e_test", "test", "code"]
-          },
-          "target_id": {
-            "type": "string",
-            "minLength": 1
-          },
-          "anchor": {
-            "type": "string",
-            "description": "Optional anchor point (e.g., section marker, line reference)"
-          }
-        },
-        "additionalProperties": false
-      }
-    },
-    "test_cases": {
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/testCase"
-      },
-      "minItems": 1
-    },
-    "evidence_contract": {
-      "type": "object",
-      "required": ["required_artifacts"],
-      "properties": {
-        "required_artifacts": {
-          "type": "array",
-          "items": { "type": "string" },
-          "minItems": 1
-        },
-        "runner_binding": {
-          "type": "string"
-        },
-        "proof_requirements": {
-          "type": "array",
-          "items": { "type": "string" }
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "additionalProperties": false,
-  "definitions": {
-    "testCase": {
-      "type": "object",
-      "required": ["case_id", "goal", "preconditions", "actions", "oracles", "cleanup", "priority", "trace_targets"],
-      "properties": {
-        "case_id": {
-          "type": "string",
-          "pattern": "^TC-\\d+[a-z]?$"
-        },
-        "goal": {
-          "type": "string",
-          "minLength": 1
-        },
-        "preconditions": {
-          "type": "array",
-          "items": { "type": "string" },
-          "minItems": 1
-        },
-        "actions": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "required": ["step", "action"],
-            "properties": {
-              "step": { "type": "integer", "minimum": 1 },
-              "action": { "type": "string", "minLength": 1 },
-              "expected_result": { "type": "string" }
-            },
-            "additionalProperties": false
-          },
-          "minItems": 1
-        },
-        "oracles": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "required": ["observable", "criterion"],
-            "properties": {
-              "observable": { "type": "string", "minLength": 1 },
-              "criterion": { "type": "string", "minLength": 1 },
-              "timeout_ms": { "type": "integer", "minimum": 0 }
-            },
-            "additionalProperties": false
-          },
-          "minItems": 1
-        },
-        "cleanup": {
-          "type": "array",
-          "items": { "type": "string" }
-        },
-        "priority": {
-          "type": "string",
-          "enum": ["critical", "high", "medium", "low"]
-        },
-        "trace_targets": {
-          "type": "array",
-          "items": { "type": "string" },
-          "minItems": 1
-        },
-        "path_class": {
-          "type": "string",
-          "enum": ["happy", "error", "recovery", "edge", "security", "performance"]
-        }
-      },
-      "additionalProperties": false
-    }
-  }
-}

package/dist/cli.d.ts

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-interface CliIo {
-    cwd?: string;
-    stdout?: (chunk: string) => void;
-    stderr?: (chunk: string) => void;
-}
-declare function runCli(argv: string[], io?: CliIo): Promise<number>;
-
-export { type CliIo, runCli };