deepbom 1.97.4 → 1.98.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepbom",
-  "version": "1.97.4",
+  "version": "1.98.0",
   "mcpName": "io.github.JunHwan-Kwon/deepbom",
   "description": "Local multi-format deployment-artifact analysis for on-device AI models",
   "type": "module",

package/pkg/release-manifest.json

@@ -1,14 +1,14 @@
 {
   "schema": "deepbom.npm_release.v1",
-  "version": "1.97.4",
+  "version": "1.98.0",
   "source": {
-    "git_commit": "859274046529f75f7af1f322075191e27330b119",
+    "git_commit": "46636ebe3cfdd43fcd782178862073ecbdd5c760",
     "git_state": "clean",
     "distribution": "public_channel"
   },
   "runtime": {
     "node": ">=20",
-    "tflite_wasm_sha256": "0a7d0622cda3c71b4b875c9a93d6dc4260b3c53298b19b5df6d609d97cce845b",
+    "tflite_wasm_sha256": "bcc9e81d9d7929d29b6e510328eb840af3c0e66387c350dc02b7282271dded87",
     "self_test": {
       "file": "bin/deepbom-self-test.onnx",
       "sha256": "82a2feef00eb6ab03d82f2b30cd17f4d826e2d8307cb059eccd6a0f3120059b2"
@@ -18,7 +18,7 @@
     "spdx": "Apache-2.0",
     "file": "LICENSE"
   },
-  "public_bundle_input_count": 157,
+  "public_bundle_input_count": 169,
   "supported_inputs": [
     "tflite",
     "onnx",

package/skills/deepbom/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: deepbom
-description: Statically audit serialized AI deployment artifacts with the local DEEPBOM CLI. Use for TFLite, ONNX, Core ML, ExecuTorch, GGUF, or SafeTensors deployment review; MAC and symbolic-shape coverage; quantization contracts; memory feasibility; accelerator eligibility; artifact diff; graph export; SARIF; or CycloneDX 1.7 ML-BOM generation. Do not use for training checkpoints, measured latency, task accuracy, or claims about actual runtime placement without imported evidence.
+description: Statically audit serialized AI model artifacts with the local DEEPBOM CLI. Use for TFLite, ONNX, Core ML, ExecuTorch, GGUF, or SafeTensors deployment review; bounded GraphDef, SavedModel, Keras-config, or PT2 declarative structure; HDF5 or PyTorch-checkpoint safe-envelope inspection; quantization, memory, diff, verification, graph, Model IR, monochrome document views, SARIF, or CycloneDX 1.7 output. Do not treat checkpoint envelopes as executable graphs or claim measured latency, task accuracy, safety, regulatory approval, standards conformance, or actual runtime placement without the required external evidence.
 ---
 
 # Audit deployment artifacts with DEEPBOM
@@ -17,7 +17,7 @@ If no exact local installation is available, ask before running:
 node "<skill-root>/scripts/verify-deepbom.mjs" --allow-download
 ```
 
-That explicit fallback may download `deepbom@1.97.4` through npm. Use the returned `invocation.command` and `invocation.prefix_args` for subsequent commands. Do not silently replace a version mismatch or network failure with an unverified executable.
+That explicit fallback may download `deepbom@1.98.0` through npm. Use the returned `invocation.command` and `invocation.prefix_args` for subsequent commands. Do not silently replace a version mismatch or network failure with an unverified executable.
 
 ## Start with discovery
 
@@ -86,9 +86,11 @@ deepbom verify "./model.onnx" --bom "./supplied.cdx.json" --render markdown
 deepbom contract capture "./model.onnx" -o "./baseline.interface-contract.json"
 deepbom explain-rule <rule-id> --json
 deepbom graph "./model.onnx" --view structure --format svg -o graph.svg
+deepbom audit "./model.onnx" --section model_ir --compact
+deepbom visualize "./model.onnx" --view all --orientation portrait -o model-views.zip
 ```
 
-Use matching serialized deployment formats for diff. Treat `verify --bom` as a reconciliation of the selected component with artifact-observable facts, not a complete BOM or compliance verdict. An automatically captured contract is an artifact-derived baseline until it is separately reviewed and approved. Do not deserialize `.pth`, `.pt`, or `.h5`; bind a conversion receipt to the deployed artifact instead.
+Use matching serialized deployment formats for diff. Treat `verify --bom` as a reconciliation of the selected component with artifact-observable facts, not a complete BOM or compliance verdict. An automatically captured contract is an artifact-derived baseline until it is separately reviewed and approved. `model_ir` and `visualize` are preview engineering projections whose loss ledger and evidence classes must be preserved. Do not deserialize `.pth`, `.pt`, or `.h5`; use only the safe envelope and bind a conversion receipt to the deployed artifact when lineage is needed.
 
 ## Handle failure
 

package/skills/deepbom/references/capability-selection.md

@@ -6,11 +6,14 @@ Use DEEPBOM when the subject is a serialized deployment artifact and the questio
 | --- | --- | --- |
 | TFLite, ONNX, Core ML, or ExecuTorch graph and tensor audit | Yes | Static artifact evidence only |
 | GGUF or SafeTensors storage, quantization, architecture, or memory lower bound | Yes | No executable graph is invented |
+| GraphDef, first-MetaGraph SavedModel, Keras config, or PT2 declarative dependency review | Yes, preview | Only serialized bounded relationships; no framework construction or runtime-order claim |
+| HDF5 or PyTorch checkpoint identity/archive/risk envelope | Yes, preview | No HDF5 object graph, checkpoint objects, tensor semantics, or executable graph claimed |
+| Common Model IR or monochrome A4 engineering views | Yes, preview | Preserve source refs, evidence class, applicability, and loss ledger; no conformance or regulatory verdict |
 | MAC and symbolic shape coverage | Yes | Preserve partial or symbolic status |
 | Quantization contract review | Yes | Do not infer task accuracy |
 | Accelerator eligibility or selected-build evidence | Yes | Eligibility is not observed assignment |
 | Artifact version diff | Yes | Inputs must use the same supported format |
-| PyTorch or HDF5 training checkpoint execution | No | Convert safely and bind a conversion receipt |
+| PyTorch or HDF5 training checkpoint execution or full model interpretation | No | Convert safely and bind a conversion receipt |
 | Measured latency, energy, temperature, or accuracy | No | Import runtime evidence or use the appropriate benchmark system |
 
 Prefer `summary` first. Request an envelope for cross-format automation, format-specific JSON for a narrow field, SARIF for CI findings, or CycloneDX 1.7 for supply-chain exchange.

package/skills/deepbom/references/failure-recovery.md

@@ -7,4 +7,4 @@
 5. For remote input, require an immutable identity: a full Hugging Face commit, GCS object generation, or HTTPS SHA-256 fragment.
 6. Do not raise download, response, or memory limits without explaining the cost and obtaining user approval.
 7. If no shell, local MCP, or local file access exists, explain that actual analysis cannot run in that client and provide the pinned `npx` command.
-8. Registry download is opt-in. Prefer a verified exact-version installation; use `npx -y deepbom@1.97.4` only after network and installation permission is clear.
+8. Registry download is opt-in. Prefer a verified exact-version installation; use `npx -y deepbom@1.98.0` only after network and installation permission is clear.

package/skills/deepbom/scripts/verify-deepbom.mjs

@@ -6,7 +6,7 @@ import path from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 
-const VERSION = "1.97.4";
+const VERSION = "1.98.0";
 const allowDownload = process.argv.slice(2).includes("--allow-download");
 const attempts = [];
 const candidates = localCandidates();