deepbom 1.97.0 → 1.97.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepbom",
-  "version": "1.97.0",
+  "version": "1.97.3",
   "mcpName": "io.github.JunHwan-Kwon/deepbom",
   "description": "Local multi-format deployment-artifact analysis for on-device AI models",
   "type": "module",
@@ -45,6 +45,8 @@
     "sarif",
     "static-analysis",
     "agent-skills",
-    "model-context-protocol"
+    "model-context-protocol",
+    "mcp",
+    "chatgpt"
   ]
 }

package/pkg/release-manifest.json

@@ -1,8 +1,8 @@
 {
   "schema": "deepbom.npm_release.v1",
-  "version": "1.97.0",
+  "version": "1.97.3",
   "source": {
-    "git_commit": "95b2218267ba6eeaf54945344aa3d7c945ef7fdd",
+    "git_commit": "307cd74253fad40892828040abac2280ba3adfe0",
     "git_state": "clean",
     "distribution": "public_channel"
   },

package/skills/deepbom/SKILL.md

@@ -12,7 +12,7 @@ Run DEEPBOM locally. Never upload artifact bytes or invent a hosted DEEPBOM endp
 Use the release pinned by this skill:
 
 ```bash
-npx -y deepbom@1.97.0 capabilities --format agent-json
+npx -y deepbom@1.97.3 capabilities --format agent-json
 ```
 
 Treat that machine document as authoritative for commands, supported inputs, scan modes, targets, outputs, and exit codes. Read `references/capability-selection.md` when deciding whether the task belongs to DEEPBOM.
@@ -22,15 +22,15 @@ Treat that machine document as authoritative for commands, supported inputs, sca
 Start with the bounded human result:
 
 ```bash
-npx -y deepbom@1.97.0 audit "./model.onnx" --summary
+npx -y deepbom@1.97.3 audit "./model.onnx" --summary
 ```
 
 Then request only the evidence needed by the question:
 
 ```bash
-npx -y deepbom@1.97.0 audit "./model.onnx" --section quantization --json
-npx -y deepbom@1.97.0 audit "./model.onnx" --pointer /mac_assessment --json
-npx -y deepbom@1.97.0 audit "./model.onnx" --output-format envelope
+npx -y deepbom@1.97.3 audit "./model.onnx" --section quantization --json
+npx -y deepbom@1.97.3 audit "./model.onnx" --pointer /mac_assessment --json
+npx -y deepbom@1.97.3 audit "./model.onnx" --output-format envelope
 ```
 
 For a large GGUF or SafeTensors artifact, use `--scan structure` for inventory questions. Use `integrity` or `full` only when payload evidence is necessary.
@@ -38,15 +38,15 @@ For a large GGUF or SafeTensors artifact, use `--scan structure` for inventory q
 For a concise GGUF tensor table without nested numerical-integrity ledgers, use the bounded projection (it defaults to a structure scan):
 
 ```bash
-npx -y deepbom@1.97.0 gguf "./model.gguf" --tensors
-npx -y deepbom@1.97.0 gguf "./model.gguf" --tensors --compact
-npx -y deepbom@1.97.0 gguf "./model.gguf" --tensors --compact --tensor-offset 100 --tensor-limit 100
+npx -y deepbom@1.97.3 gguf "./model.gguf" --tensors
+npx -y deepbom@1.97.3 gguf "./model.gguf" --tensors --compact
+npx -y deepbom@1.97.3 gguf "./model.gguf" --tensors --compact --tensor-offset 100 --tensor-limit 100
 ```
 
 Before relying on a newly fetched package, run:
 
 ```bash
-npx -y deepbom@1.97.0 self-test --compact
+npx -y deepbom@1.97.3 self-test --compact
 ```
 
 ## Interpret the result
@@ -68,12 +68,12 @@ Never infer actual accelerator assignment, latency, energy, thermal behavior, ta
 ## Compare or explain
 
 ```bash
-npx -y deepbom@1.97.0 diff "./baseline.onnx" "./candidate.onnx" --summary
-npx -y deepbom@1.97.0 diff "./baseline.gguf" "./candidate.gguf" --tensors --render markdown
-npx -y deepbom@1.97.0 verify "./model.onnx" --bom "./supplied.cdx.json" --render markdown
-npx -y deepbom@1.97.0 contract capture "./model.onnx" -o "./baseline.interface-contract.json"
-npx -y deepbom@1.97.0 explain-rule <rule-id> --json
-npx -y deepbom@1.97.0 graph "./model.onnx" --view structure --format svg -o graph.svg
+npx -y deepbom@1.97.3 diff "./baseline.onnx" "./candidate.onnx" --summary
+npx -y deepbom@1.97.3 diff "./baseline.gguf" "./candidate.gguf" --tensors --render markdown
+npx -y deepbom@1.97.3 verify "./model.onnx" --bom "./supplied.cdx.json" --render markdown
+npx -y deepbom@1.97.3 contract capture "./model.onnx" -o "./baseline.interface-contract.json"
+npx -y deepbom@1.97.3 explain-rule <rule-id> --json
+npx -y deepbom@1.97.3 graph "./model.onnx" --view structure --format svg -o graph.svg
 ```
 
 Use matching serialized deployment formats for diff. Treat `verify --bom` as a reconciliation of the selected component with artifact-observable facts, not a complete BOM or compliance verdict. An automatically captured contract is an artifact-derived baseline until it is separately reviewed and approved. Do not deserialize `.pth`, `.pt`, or `.h5`; bind a conversion receipt to the deployed artifact instead.

package/skills/deepbom/scripts/verify-deepbom.mjs

@@ -2,7 +2,7 @@
 
 import { spawnSync } from "node:child_process";
 
-const VERSION = "1.97.0";
+const VERSION = "1.97.3";
 const executable = process.platform === "win32" ? process.env.ComSpec || "cmd.exe" : "npx";
 const args = process.platform === "win32"
   ? ["/d", "/s", "/c", "npx.cmd", "-y", `deepbom@${VERSION}`, "self-test", "--compact"]