artifact-graph 0.7.0 → 0.8.1

package/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,26 @@
+name: Bug report
+description: Report a reproducible problem
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What happened?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction
+      description: Steps to reproduce the issue.
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Node.js version, package version, OS, and package manager.
+    validations:
+      required: false

package/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,19 @@
+name: Feature request
+description: Suggest an improvement
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem should this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What would a good solution look like?
+    validations:
+      required: true

package/.github/pull_request_template.md

@@ -0,0 +1,14 @@
+## Summary
+
+- 
+
+## Validation
+
+- [ ] `pnpm build`
+- [ ] `pnpm test`
+- [ ] `pnpm typecheck --if-present`
+
+## Checklist
+
+- [ ] README / CHANGELOG updated when user-facing behavior changed
+- [ ] No private parent-repository files or local machine paths included

package/.github/workflows/ci.yml

@@ -0,0 +1,23 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.17.1
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: pnpm install
+      - run: pnpm test:ci
+      - run: pnpm typecheck
+      - run: pnpm build
+      - run: git diff --exit-code

package/CHANGELOG.md

@@ -1,6 +1,39 @@
 # Changelog
 
-## Unreleased
+## 0.8.1
+
+### Changed
+
+- **Version bump for dual-repo synchronization with `artifact-chain-assistant@0.8.1`**. Includes README
+  documentation polish, three new entry skills (`help`, `setup`, `quickstart`), external marketplace
+  (`ifoohoo/artifact-skill-set`) installation support, and release gate fixes.
+
+## 0.8.0
+
+### Added
+
+- **Artifact relation version locks**: `version-lock refresh` and `bootstrap` now generate
+  `artifactRelations` entries for artifact-to-artifact edges (for example, skill→skill_family and
+  feature→scenario). The `audit` command checks for missing relation locks, content hash mismatches,
+  and path drift.
+
+### Changed
+
+- **Strict local artifact-relation refresh**: `version-lock refresh --changed-only` updates or adds
+  only relation locks whose endpoints are reached by the current worktree or staged change set. It
+  no longer fills unrelated missing relation locks while processing a local change; use
+  `version-lock refresh --all` only when intentionally establishing a complete relation baseline.
+- **Deterministic, reproducible relation locks**: relation lock output uses deterministic sorting and
+  carries no timestamps, so identical artifact content produces byte-identical lock files across
+  environments and runs.
+- **Old 1.0 lock read boundary**: lock files written before artifact relations existed (no
+  `artifactRelations` key) are read as an empty relation list instead of failing; run
+  `version-lock refresh --all` once to establish the complete relation baseline.
+- **Non-software domain isolation via `baselinePolicy: false`**: when a project explicitly disables
+  the universal baseline (`baselinePolicy: false` in the context/packet manifest), packet assembly
+  and validation no longer inject the software-development defaults — baseline constraints, the risk
+  checklist, and blueprint non-goals are required to be empty (PKT-005 / PKT-010), so non-software
+  skill-family domains are not forced through software-specific packet rules.
 
 ## 0.7.0
 

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,11 @@
+# Code of Conduct
+
+This project follows a simple contributor covenant:
+
+- Be respectful and constructive.
+- Assume good intent, but accept responsibility for impact.
+- Keep technical discussion focused on the work.
+- Do not harass, insult, or discriminate.
+
+Maintainers may remove comments, issues, pull requests, or other contributions that violate these
+expectations.

package/CONTRIBUTING.md

@@ -0,0 +1,29 @@
+# Contributing
+
+Thanks for your interest in contributing.
+
+> **This repository is a release snapshot.** Documentation (README, CHANGELOG, INSTALL,
+> NOTICE) and shared files are rendered from a private workspace. Direct pull requests
+> against these files will be overwritten by the next render — please open an issue
+> instead, and the maintainers will make the change at the source.
+
+## Development
+
+Use Node.js `>=22.0.0`.
+
+```bash
+pnpm install
+pnpm build
+pnpm test
+```
+
+## Pull Requests
+
+- Keep changes focused.
+- Documentation changes should be proposed as issues (see above); code changes should update tests when behavior changes.
+- Run the package validation commands before opening a pull request.
+- Do not include private parent-repository artifacts or local machine paths.
+
+## License
+
+By contributing, you agree that your contribution is licensed under Apache-2.0.

package/README.md

@@ -8,6 +8,25 @@ Git-native Markdown artifact graph scanner and validator for agentic coding work
 and version-lock metadata connected. It is designed for deterministic local use before an AI coding
 agent claims implementation work is complete.
 
+<!-- release-skill:capability:external-write-boundary -->
+> **External-write boundary:** Installing `artifact-graph` does not modify a project or write to
+> remote systems. Read-only commands such as `--help`, `doctor`, `validate`, `query`, and `audit`
+> do not change project files. Commands including `init`, `version-lock refresh`, and
+> `hooks install-git` write locally only when explicitly invoked.
+
+<!-- release-skill:capability:safe-first-command -->
+> **Safe first command:** Inspect the installed CLI and project health before authorizing any
+> initialization, version-lock refresh, or hook installation.
+
+```bash
+pnpm exec artifact-graph --help
+pnpm exec artifact-graph doctor --root .
+```
+
+If either read-only command fails, confirm that Node.js `>=22.0.0` is active and reinstall the
+package using the precise instructions in [INSTALL.md](INSTALL.md). Do not run a write command
+until the CLI resolves successfully and doctor reports an actionable diagnosis.
+
 ## Install
 
 ```bash
@@ -49,19 +68,33 @@ npx artifact-graph version-lock audit --root . --strict-missing-lock
 - Validate Review Result Protocol v1.0 documents with `artifact-graph validate-review-result --file <path>`.
 - Build implementation context with `artifact-graph context` or `artifact-graph packet`.
 - Keep traceability freshness with `artifact-graph version-lock refresh` and `audit`.
+- Version lock covers both implementation/verification edges (`locks`) and artifact-to-artifact
+  relations (`artifactRelations`). Old 1.0 lock files without `artifactRelations` are treated as
+  having an empty relation list; run `refresh --all` once to establish the complete relation baseline.
 - Install opt-in Git hooks with `artifact-graph hooks install-git --hook all`.
 
 ## Review Result Protocol
 
-The package publishes `schemas/review-result.schema.json` and a matching TypeScript types + validateReviewResult validator API.
-The protocol is project-neutral and supports review, repair, batch evidence, findings, metrics, and
-fail-closed decisions. Unknown top-level fields are rejected; `attempt` is limited to 1–3;
-successful acceptance requires `producer`; and `PASS`/`PASS_WITH_RESIDUAL_MINOR` cannot contain an
-open `block` finding. Independent repair re-review can record `acceptance.reviewer` and
-`acceptance.source_result`; the validator rejects self-acceptance by the repair producer. Invalid
-fields and semantic violations are reported with stable JSON paths. JSON Schema cannot compare
-cross-object field values, so callers must also run the semantic validator; stable identity is
-`executor + name`, while `skill` is only metadata and cannot establish independence.
+The package publishes `schemas/review-result.schema.json`, plus matching TypeScript types and a
+`validateReviewResult` validator API. The protocol is project-neutral: it covers review, repair,
+batch evidence, findings, metrics, and fail-closed decisions.
+
+Unknown top-level fields are rejected; `attempt` is limited to 1–3; successful acceptance requires
+a `producer`; and `PASS`/`PASS_WITH_RESIDUAL_MINOR` cannot contain an open `block` finding. An
+independent repair re-review may record `acceptance.reviewer` and `acceptance.source_result`; the
+validator rejects self-acceptance by the repair producer. Invalid fields and semantic violations
+are reported with stable JSON paths.
+
+Because JSON Schema cannot compare values across objects, callers must also run the semantic
+validator. Stable identity is `executor + name`; `skill` is only metadata and cannot establish
+independence.
+
+## Documentation
+
+- [INSTALL.md](INSTALL.md) — detailed installation and pnpm 10+ setup guide
+- [CHANGELOG.md](CHANGELOG.md) — release history
+- [CONTRIBUTING.md](CONTRIBUTING.md) — contribution guidelines
+- [SECURITY.md](SECURITY.md) — security policy
 
 ## Related Project
 

package/README.zh-CN.md

@@ -7,6 +7,24 @@
 它把项目里的需求、场景、设计、源码、测试和 version-lock 元数据连成一张图，
 供 AI agent 在宣称实现完成之前，用确定性的本地命令检查上下文和追溯关系。
 
+<!-- release-skill:capability:external-write-boundary -->
+> **外部写入边界：** 安装 `artifact-graph` 不会修改项目或写入远端。`--help`、`doctor`、
+> `validate`、`query` 和 `audit` 等只读命令不会更改项目文件。只有显式执行 `init`、
+> `version-lock refresh` 或 `hooks install-git` 等命令时才会发生本地写入。
+
+<!-- release-skill:capability:safe-first-command -->
+> **安全的第一步：** 在授权初始化、刷新版本锁或安装 hook 前，先检查已安装的命令行工具
+> 和项目健康状态。
+
+```bash
+pnpm exec artifact-graph --help
+pnpm exec artifact-graph doctor --root .
+```
+
+如果任一只读命令失败，先确认当前 Node.js 版本不低于 `22.0.0`，再按照
+[INSTALL.md](INSTALL.md) 中的精确说明重新安装；命令行工具能够正常解析且 doctor
+给出可处理的诊断前，不要运行写入命令。
+
 ## 安装
 
 ```bash
@@ -47,6 +65,8 @@ npx artifact-graph version-lock audit --root . --strict-missing-lock
 - 用 `artifact-graph validate-review-result --file <path>` 校验 Review Result Protocol v1.0 文档。
 - 用 `artifact-graph context` 或 `artifact-graph packet` 构建实现上下文。
 - 用 `artifact-graph version-lock refresh` 和 `audit` 保持追溯关系及时更新。
+- 版本锁覆盖实现/验证边（`locks`）和制品间关系（`artifactRelations`）。旧版 1.0 锁文件缺少
+  `artifactRelations` 时视为空数组；首次启用时执行一次 `refresh --all` 建立完整关系基线。
 - 用 `artifact-graph hooks install-git --hook all` 安装可选 Git hooks。
 
 ## Review Result Protocol
@@ -60,6 +80,13 @@ fail-closed decision；非法字段和语义违规都会以稳定的 JSON path
 JSON Schema 无法比较跨对象的字段值，因此调用方还必须运行语义 validator；稳定身份由
 `executor + name` 构成，`skill` 只是附加元数据，不能用来证明独立性。
 
+## 文档导航
+
+- [INSTALL.md](INSTALL.md) — 详细安装指南与 pnpm 10+ 配置
+- [CHANGELOG.md](CHANGELOG.md) — 版本发布历史
+- [CONTRIBUTING.md](CONTRIBUTING.md) — 贡献指南
+- [SECURITY.md](SECURITY.md) — 安全策略
+
 ## 相关项目
 
 如果需要 Codex / Claude Code 技能来引导制品链的接入、初始化和日常维护，请使用

package/SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy
+
+## Reporting A Vulnerability
+
+Please do not open a public issue for sensitive security reports.
+
+Send a private report to the repository owner through GitHub's private vulnerability reporting when
+available, or contact the maintainer directly.
+
+Include:
+
+- affected package and version;
+- reproduction steps;
+- impact;
+- suggested fix, if known.
+
+## Supported Versions
+
+Security fixes target the latest released version.

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "artifact-graph",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "Git-native Markdown artifact graph scanner and validator",
   "license": "Apache-2.0",
   "type": "module",
+  "packageManager": "pnpm@10.17.1",
   "keywords": [
     "artifact-graph",
     "traceability",
@@ -34,6 +35,17 @@
   "engines": {
     "node": ">=22.0.0"
   },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --splitting false && tsup src/cli.ts --format esm --dts --splitting false",
+    "test": "vitest run --config vitest.config.ts",
+    "test:ci": "ARTIFACT_GRAPH_PUBLIC_REPO=1 vitest run --config vitest.config.ts && pnpm test:npm-consumer",
+    "test:npm-consumer": "node test/npm-bin-install.test.mjs",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist coverage",
+    "packet:audit": "node scripts/run-packet-audit.mjs",
+    "packet:prompt-audit": "node scripts/run-packet-prompt-audit.mjs"
+  },
   "dependencies": {
     "ajv": "^8.20.0",
     "better-sqlite3": "^11.9.0",
@@ -56,6 +68,10 @@
     "LICENSE",
     "NOTICE",
     "INSTALL.md",
+    "CONTRIBUTING.md",
+    "CODE_OF_CONDUCT.md",
+    "SECURITY.md",
+    ".github",
     "dist",
     "schemas",
     "contracts",
@@ -74,15 +90,10 @@
   "contributors": [
     "mzdbxqh"
   ],
-  "scripts": {
-    "build": "tsup src/index.ts --format esm,cjs --dts --splitting false && tsup src/cli.ts --format esm --dts --splitting false",
-    "test": "vitest run --config vitest.config.ts",
-    "test:ci": "ARTIFACT_GRAPH_PUBLIC_REPO=1 vitest run --config vitest.config.ts && pnpm test:npm-consumer",
-    "test:npm-consumer": "node test/npm-bin-install.test.mjs",
-    "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "clean": "rm -rf dist coverage",
-    "packet:audit": "node scripts/run-packet-audit.mjs",
-    "packet:prompt-audit": "node scripts/run-packet-prompt-audit.mjs"
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3",
+      "esbuild"
+    ]
   }
-}
+}