deepbom 1.98.0 → 1.99.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepbom",
-  "version": "1.98.0",
+  "version": "1.99.2",
   "mcpName": "io.github.JunHwan-Kwon/deepbom",
   "description": "Local multi-format deployment-artifact analysis for on-device AI models",
   "type": "module",

package/pkg/release-manifest.json

@@ -1,8 +1,8 @@
 {
   "schema": "deepbom.npm_release.v1",
-  "version": "1.98.0",
+  "version": "1.99.2",
   "source": {
-    "git_commit": "46636ebe3cfdd43fcd782178862073ecbdd5c760",
+    "git_commit": "d5bd6ab2e7b2e599ac4a82cf1deb7cfa4d7a8cac",
     "git_state": "clean",
     "distribution": "public_channel"
   },
@@ -18,7 +18,7 @@
     "spdx": "Apache-2.0",
     "file": "LICENSE"
   },
-  "public_bundle_input_count": 169,
+  "public_bundle_input_count": 170,
   "supported_inputs": [
     "tflite",
     "onnx",

package/skills/deepbom/SKILL.md

@@ -9,19 +9,19 @@ Run DEEPBOM locally for files in the workspace. Never upload artifact bytes or i
 
 ## Resolve a verified runtime first
 
-Run `scripts/verify-deepbom.mjs` from this Skill directory before choosing an invocation. It checks, in order, `DEEPBOM_BIN`, the analyzer bundled with an npm installation, and an exact-version `deepbom` already on `PATH`. It does not access a package registry by default.
+Run `scripts/verify-deepbom.mjs` from this Skill directory before choosing an invocation. It checks, in order, `DEEPBOM_BIN`, the analyzer bundled with an npm installation, and a contract-compatible `deepbom` already on `PATH`. It does not access a package registry by default.
 
-If no exact local installation is available, ask before running:
+If no compatible local installation is available, ask before running:
 
 ```bash
 node "<skill-root>/scripts/verify-deepbom.mjs" --allow-download
 ```
 
-That explicit fallback may download `deepbom@1.98.0` through npm. Use the returned `invocation.command` and `invocation.prefix_args` for subsequent commands. Do not silently replace a version mismatch or network failure with an unverified executable.
+That explicit fallback may download `deepbom@latest` through npm. The resolver accepts it only when it declares Agent contract `deepbom.agent_contract.v1` version `1.0.0` and evidence contract `deepbom.artifact_evidence_envelope.v1` version `1.0.0`. Use the returned `invocation.command` and `invocation.prefix_args` for subsequent commands. Do not silently replace a contract mismatch or network failure with an unverified executable.
 
 ## Start with discovery
 
-After resolving the exact release pinned by this Skill, discover its machine contract:
+After resolving an engine compatible with the contract pinned by this Skill, discover its machine contract:
 
 ```bash
 deepbom capabilities --format agent-json

package/skills/deepbom/references/failure-recovery.md

@@ -6,5 +6,5 @@
 4. For a large GGUF or SafeTensors file, retry with `--scan structure` when the question does not require payload integrity.
 5. For remote input, require an immutable identity: a full Hugging Face commit, GCS object generation, or HTTPS SHA-256 fragment.
 6. Do not raise download, response, or memory limits without explaining the cost and obtaining user approval.
-7. If no shell, local MCP, or local file access exists, explain that actual analysis cannot run in that client and provide the pinned `npx` command.
-8. Registry download is opt-in. Prefer a verified exact-version installation; use `npx -y deepbom@1.98.0` only after network and installation permission is clear.
+7. If no shell, local MCP, or local file access exists, explain that actual analysis cannot run in that client and provide the contract-checked `npx` command.
+8. Registry download is opt-in. Prefer a verified contract-compatible installation; use `npx -y deepbom@latest` only after network and installation permission is clear. Record the resolved engine version in the answer.

package/skills/deepbom/scripts/verify-deepbom.mjs

@@ -6,30 +6,42 @@ import path from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 
-const VERSION = "1.98.0";
+const AGENT_CONTRACT = {"id":"deepbom.agent_contract.v1","version":"1.0.0","compatibility":"backward_compatible_within_v1"};
+const EVIDENCE_CONTRACT = {"id":"deepbom.artifact_evidence_envelope.v1","version":"1.0.0","compatibility":"additive_fields_only_within_v1","required_top_level_fields":["schema","generated_at","identity","artifact_set","conversion_receipt","cpu_cost_target_binding","accelerator_profile_binding","accelerator_bindings","policy_identity","capabilities","interfaces","graph","external_files","metadata","findings","format_extensions","provenance","evidence_boundary","envelope_sha256"],"conditional_top_level_fields":["llm_token_budget_scenario","structured_details"],"semantic_boundaries":["artifact_defects_cautions_and_evidence_gaps_remain_distinct","static_predictions_are_not_runtime_observations","unknown_and_not_assessable_are_not_coerced_to_absence_or_zero"]};
+const REGISTRY_PACKAGE = "deepbom@latest";
 const allowDownload = process.argv.slice(2).includes("--allow-download");
 const attempts = [];
 const candidates = localCandidates();
-if (allowDownload) candidates.push({ source: "npm_exact_version", command: process.platform === "win32" ? "npx.cmd" : "npx", prefix_args: ["-y", `deepbom@${VERSION}`], network: true });
+if (allowDownload) candidates.push({ source: "npm_contract_candidate", command: process.platform === "win32" ? "npx.cmd" : "npx", prefix_args: ["-y", REGISTRY_PACKAGE], network: true });
 
 for (const candidate of candidates) {
   const versionRun = invoke(candidate, ["--version"]);
-  if (versionRun.status !== 0 || versionRun.stdout.trim() !== VERSION) {
-    attempts.push({ source: candidate.source, status: versionRun.status, observed_version: versionRun.stdout.trim() || null, error: bounded(versionRun.stderr) });
+  const observedVersion = versionRun.stdout.trim();
+  if (versionRun.status !== 0 || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(observedVersion)) {
+    attempts.push({ source: candidate.source, status: versionRun.status, observed_version: observedVersion || null, error: bounded(versionRun.stderr) });
+    continue;
+  }
+  const capabilitiesRun = invoke(candidate, ["capabilities", "--format", "agent-json", "--compact"]);
+  let capabilities;
+  try { capabilities = JSON.parse(capabilitiesRun.stdout); } catch {}
+  if (capabilitiesRun.status !== 0 || capabilities?.schema !== "deepbom.agent_capabilities.v1"
+    || capabilities?.agent_contract?.id !== AGENT_CONTRACT.id || capabilities?.agent_contract?.version !== AGENT_CONTRACT.version
+    || capabilities?.evidence_schema_contract?.id !== EVIDENCE_CONTRACT.id || capabilities?.evidence_schema_contract?.version !== EVIDENCE_CONTRACT.version) {
+    attempts.push({ source: candidate.source, status: capabilitiesRun.status, observed_version: observedVersion, observed_agent_contract: capabilities?.agent_contract || null, observed_evidence_contract: capabilities?.evidence_schema_contract || null, error: bounded(capabilitiesRun.stderr || capabilitiesRun.stdout || "public contract mismatch") });
     continue;
   }
   const selfTest = invoke(candidate, ["self-test", "--compact"]);
   try {
     const document = JSON.parse(selfTest.stdout);
-    if (selfTest.status !== 0 || document.schema !== "deepbom.cli_self_test.v1" || document.status !== "pass" || document.version !== VERSION) throw new Error("self-test contract mismatch");
-    process.stdout.write(`${JSON.stringify({ schema: "deepbom.skill_runtime_resolution.v1", version: VERSION, status: "pass", source: candidate.source, network_used: candidate.network, invocation: { command: candidate.command, prefix_args: candidate.prefix_args }, self_test: document })}\n`);
+    if (selfTest.status !== 0 || document.schema !== "deepbom.cli_self_test.v1" || document.status !== "pass" || document.version !== observedVersion || capabilities.version !== observedVersion) throw new Error("self-test or analyzer identity mismatch");
+    process.stdout.write(`${JSON.stringify({ schema: "deepbom.skill_runtime_resolution.v1", version: observedVersion, agent_contract: AGENT_CONTRACT, evidence_contract: EVIDENCE_CONTRACT, status: "pass", source: candidate.source, network_used: candidate.network, invocation: { command: candidate.command, prefix_args: candidate.prefix_args }, self_test: document })}\n`);
     process.exit(0);
   } catch (error) {
-    attempts.push({ source: candidate.source, status: selfTest.status, error: bounded(selfTest.stderr || selfTest.stdout || error.message) });
+    attempts.push({ source: candidate.source, status: selfTest.status, observed_version: observedVersion, error: bounded(selfTest.stderr || selfTest.stdout || error.message) });
   }
 }
 
-process.stderr.write(`${JSON.stringify({ schema: "deepbom.skill_runtime_resolution.v1", version: VERSION, status: "unavailable", registry_download_attempted: allowDownload, attempts, suggested_action: allowDownload ? "Review the recorded installation or network error; do not claim an analysis ran." : "Install the exact release or rerun with --allow-download only after registry access is authorized." })}\n`);
+process.stderr.write(`${JSON.stringify({ schema: "deepbom.skill_runtime_resolution.v1", agent_contract: AGENT_CONTRACT, evidence_contract: EVIDENCE_CONTRACT, status: "unavailable", registry_download_attempted: allowDownload, attempts, suggested_action: allowDownload ? "Review the recorded installation, compatibility, or network error; do not claim an analysis ran." : "Install a contract-compatible release or rerun with --allow-download only after registry access is authorized." })}\n`);
 process.exit(3);
 
 function localCandidates() {