frontend-project-context 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -1,6 +1,13 @@
 # Changelog
 
-## 1.0.0 — release candidate
+## 1.0.1 — release candidate
+
+- 把 npm README 重写为面向使用者的中英双语安装、快速上手、工作流和命令入口。
+- 修正 `bin` 路径规范化警告，补充真实 npm 主页和检索关键词。
+- 从发布白名单移除仓库动态状态文件，避免包内固化发布前状态。
+- 未修改产品运行逻辑、Contract、CLI 命令或兼容面。
+
+## 1.0.0 — 2026-09-08
 
 - 冻结 model-neutral Project Contract、来源追溯、scope compiler、Context Bundle 和受管投影边界。
 - 提供通用来源登记、四类 item、三类 scope、显式批准和知识维护闭环。
@@ -11,4 +18,4 @@
 - 以 `Copyright 2026 Fushan` 采用 Apache License 2.0，并把 LICENSE/NOTICE 纳入发布包。
 - A-01 至 A-45、B0-01/B0-02 与 CLI 共 49 项本地验收通过。
 
-公开 npm 发布已获授权并固定为 public access；npmjs.org CLI 身份已验证，当前进入最终发布。
+已由 `fushanyx1` 发布到官方公共 npm；远端 `v1.0.0` 标签对应发布提交，registry tarball 完整性已独立核验。

package/README.md

@@ -1,148 +1,317 @@
 # Frontend Project Context
 
-Frontend Project Context 是位于前端项目与 AI 编程工具之间的模型无关上下文层。
+Keep AI coding guidance consistent with one human-approved, source-traceable project contract.
 
-[产品宪法](./docs/00-PRODUCT-CONSTITUTION.md)是产品身份、边界、完成条件和变更规则的唯一规范真源。
+用一份经过人工批准、来源可追溯的项目合同，让不同 AI 编程工具获得一致且不过期的项目上下文。
 
-它把分散在设计资料、文档、配置、代码和团队约定中的项目知识，整理成一份有来源、有人负责批准的 `Project Contract`，再为不同 Coding Agent 生成一致的项目上下文，并检查规则漂移。
+[English](#english) · [中文](#中文)
 
-```text
-项目事实与人工规范
-→ Project Contract（唯一真源）
-→ Context Compiler
-→ AGENTS.md / Ruler / Kiro / 其他 Agent
-→ Drift Check
+## English
+
+### Why use it?
+
+AI coding tools often read only part of a repository. Important conventions may be scattered across documentation, configuration, source code, and team decisions. Frontend Project Context turns those explicit sources into a project-local `Project Contract`, then:
+
+- selects the approved guidance that applies to a file or directory;
+- renders focused context for existing coding agents;
+- publishes managed Markdown, AGENTS, or Ruler-compatible projections;
+- reports source, contract, and projection drift;
+- keeps every persistent write and approval under explicit human control.
+
+It does **not** call an AI provider, edit business code, manage Git, install dependencies automatically, or approve rules on its own.
+
+### Requirements
+
+- Node.js 18 or newer
+- A project whose context should live in the repository
+
+### Install
+
+Pin it as a development dependency so local users and CI run the same version:
+
+```bash
+npm install --save-dev frontend-project-context@1.0.1
+```
+
+The package has zero runtime dependencies.
+
+### Quick start
+
+Initialize the three project-local stores:
+
+```bash
+npx project-context init \
+  --project . \
+  --id my-project \
+  --name "My Project" \
+  --write
+```
+
+Register an explicit source:
+
+```bash
+npx project-context register \
+  --project . \
+  --id source.package \
+  --kind file \
+  --path package.json \
+  --write
+```
+
+Propose a scoped contract item. This creates a reviewable proposal; it does not approve it:
+
+```bash
+npx project-context propose \
+  --project . \
+  --id policy.ui-copy \
+  --kind policy \
+  --subject ui.visible-copy \
+  --value required \
+  --statement "Use the approved visible-copy convention." \
+  --sources source.package \
+  --scope path-prefix \
+  --scope-path src \
+  --output .project-context/policy.ui-copy.proposal.json \
+  --write
 ```
 
-## 产品核心
+Approve only the item you reviewed:
+
+```bash
+npx project-context approve \
+  --project . \
+  --proposal .project-context/policy.ui-copy.proposal.json \
+  --ids policy.ui-copy \
+  --by YOUR_NAME \
+  --write
+```
 
-- **Register / Discover**：登记项目明确提供的来源；自动发现只负责保守地提出接入候选，不尝试理解所有前端技术。
-- **Govern**：人类确认哪些内容是事实、规范或参考样例；AI 不能自行批准长期规则。
-- **Compile**：按目录范围和任务目标生成最小、可追溯的 Context Bundle。
-- **Project**：把同一合同投影到现有 AI 工具，而不是为每个模型维护一套手写规则。
-- **Check**：发现来源变化、合同冲突和生成文件漂移。
+Compile context for a target and check for drift:
 
-## 与现成工具的关系
+```bash
+npx project-context context --project . --path src --locale en
+npx project-context check --project .
+```
 
-- [Ruler](https://github.com/intellectronica/ruler) 和 [Rulesync](https://github.com/dyoshikawa/rulesync) 已经覆盖多 Agent 规则分发，本项目不重建完整适配矩阵。
-- [Kiro Steering](https://kiro.dev/docs/steering/) 已经展示项目知识、规则和 Specs 的完整产品体验，本项目保持 Runtime 和模型中立。
-- [GitHub Spec Kit](https://github.com/github/spec-kit) 与 [OpenSpec](https://openspec.dev/) 负责规格驱动的功能开发流程，可以消费本项目上下文，但不属于本项目内核。
+Generate the read-only governance dashboard:
 
-本项目只在现有工具前面补一层：**从真实设计和代码中形成有来源、可审查、可按作用域编译的项目合同，并持续检查漂移。**
+```bash
+npx project-context dashboard --project . > project-context-dashboard.html
+```
 
-## 明确不做
+The dashboard is a self-contained offline HTML file. The command writes only to stdout and does not open a browser or change the contract.
 
-- 不调用模型 Provider，也不实现 Coding Agent Runtime。
-- 不执行真实开发任务或自动修复代码。
-- 不管理 Git 分支、commit、merge、push、PR 或部署。
-- 不自动安装依赖或访问外部系统。
-- 不保存 candidate、DecisionRecord 或 DeliveryRecord。
-- 不复制 Kiro、Spec Kit、Ruler 等工具已有的能力。
+### What is created?
 
-## 当前状态
+Initialization creates:
 
 ```text
-1.0.0-public-npm-release-ready
+.project-context/
+├── contract.json
+├── sources.lock.json
+└── projections.lock.json
 ```
 
-核心引擎、通用 authoring、knowledge maintenance、只读治理看板和来源生命周期闭环均已完成本地、零第三方依赖实现。`0.9.0` 在不扩大产品边界的前提下加固路径/合同安全，并压缩 Context、CLI JSON、Dashboard 和启动上下文的重复内容。团队维护验收已在隔离 fixture 完整走通来源变化、接受、修订、废弃、重新批准、重新投影和最终检查；加上 A-39 与 A-40 至 A-45，A-01 至 A-45、2 项 B0 回归和 CLI 端到端测试共 49 项均已通过。
+Commit these three stores. Also commit any managed projection your team intentionally publishes. Proposal files, temporary context output, dashboard HTML, caches, and tarballs should normally remain uncommitted.
 
-正式发布准备已经把上述能力冻结为 `frontend-project-context@1.0.0` 候选包，公共稳定面为 `project-context` CLI。后续重大调整审查发现并已关闭一个发布前缺口：已登记来源被删除、搬迁或永久退役时，现在可用稳定 CLI 完成替代、修订、重新批准、旧来源废弃、重新投影和 clean check，无需手改内部 JSON。
+### Core workflow
 
-[Source Lifecycle Closure 设计与实现记录](./docs/15-SOURCE-LIFECYCLE-CLOSURE-DESIGN.md) 已按冻结范围落地 Contract schema 2 的 active/deprecated source、显式 `deprecate-source` 命令和 A-40 至 A-45。schema 1 项目继续原样可读，只有首次成功废弃来源时才延迟升级。公开 npm 发布已经获得授权并固定到 `https://registry.npmjs.org/`，发布者 CLI 身份已验证，当前处于最终发布就态。
+```text
+Explicit project sources
+→ reviewable proposals
+→ human-approved Project Contract
+→ scoped Context Bundle
+→ AGENTS / Markdown / Ruler projections
+→ drift check
+```
+
+All commands are read-only unless that command explicitly includes `--write`. Source changes invalidate affected approvals; they are never accepted or reapproved automatically.
+
+### Common commands
+
+| Command | Purpose |
+| --- | --- |
+| `init` | Create an empty project contract safely |
+| `register` | Register a file, path, JSON pointer, or human decision |
+| `discover` | Conservatively propose bootstrap candidates |
+| `propose` | Author a fact, policy, reference, or validation description |
+| `approve` | Explicitly approve selected proposal IDs |
+| `context` | Compile approved context for one or more paths |
+| `publish` | Write an owned AGENTS, Markdown, or Ruler projection |
+| `check` | Detect stale sources, contracts, and projections |
+| `dashboard` | Render the read-only governance dashboard |
+| `review-source` | Review a changed source and its exact impact set |
+| `accept-source-change` | Accept a pinned source digest and revoke affected approvals |
+| `revise` / `deprecate` | Maintain contract items explicitly |
+| `deprecate-source` | Retire an unreferenced source with an audit record |
+
+Run `npx project-context --help` for the complete command syntax.
+
+### Documentation
+
+- [Product constitution](./docs/00-PRODUCT-CONSTITUTION.md)
+- [Program and CLI design](./docs/04-PROGRAM-DESIGN.md)
+- [Acceptance contract](./docs/05-ACCEPTANCE-CONTRACT.md)
+- [Installation and distribution](./docs/08-INSTALLATION-AND-DISTRIBUTION.md)
+- [Knowledge maintenance](./docs/12-KNOWLEDGE-MAINTENANCE-CLOSURE-ROADMAP.md)
+- [Read-only governance dashboard](./docs/13-READ-ONLY-GOVERNANCE-DASHBOARD-DESIGN.md)
+- [Source lifecycle](./docs/15-SOURCE-LIFECYCLE-CLOSURE-DESIGN.md)
+- [Upgrade notes](./UPGRADING.md)
 
-## 许可证
+## 中文
 
-本项目采用 [Apache License 2.0](./LICENSE)，版权声明见 [NOTICE](./NOTICE)：`Copyright 2026 Fushan`。
+### 它解决什么问题？
 
-本仓库已经使用同一 CLI 初始化 `.project-context/` 自托管真源。收录本次实现后，22 个精确来源和 20 个治理项均经显式批准，`check` 零 finding。根 `AGENTS.md` 继续由人维护，没有被生成投影接管。
+AI 编程工具通常只读取仓库的一部分，而项目约定分散在文档、配置、源码和团队决定中。Frontend Project Context 把这些明确来源治理成项目内的 `Project Contract`，然后：
 
-只读治理看板仍提供总览、知识、来源、scope、投影、finding 六个视图；默认输出确定性、自包含的离线 HTML，`--json` 输出短生命周期 View Model schema 3，并能双语解释 deprecated source 的负责人、时间与理由。HTML 只包含渲染所需内容，不再重复嵌入整份 View Model。
+- 按文件或目录选择真正生效的已批准规则；
+- 为现有 Coding Agent 生成精简且可追溯的上下文；
+- 从同一合同生成受管 Markdown、AGENTS 或 Ruler 兼容投影；
+- 检测来源、合同和投影是否过期；
+- 所有持久写入与批准都必须由人显式触发。
 
-`0.7.0 — Knowledge Maintenance Closure` 已实现来源变化 review/accept、影响集撤销旧批准、同 ID revision、deprecation、pending reapproval、projection stale 和并发失败封闭。两个真实项目 B0 仍只作为既有证据；本次实现没有访问真实项目。
+它**不会**调用大模型、修改业务代码、管理 Git、自动安装依赖，也不会替人批准规则。
 
-## 本地使用
+### 环境要求
+
+- Node.js 18 或更高版本
+- 希望把 AI 项目上下文随仓库共同维护的项目
+
+### 安装
+
+建议固定为开发依赖，让本地与 CI 使用同一版本：
 
 ```bash
-node bin/project-context.mjs init --project /path/to/project --id project-id --name "Project Name" --write
-node bin/project-context.mjs register --project /path/to/project --id source-package --kind file --path package.json --write
-node bin/project-context.mjs register --project /path/to/project --id source-src --kind path --path src --write
-node bin/project-context.mjs register --project /path/to/project --id source-team --kind human-decision --reference "decision:team" --write
-node bin/project-context.mjs propose --project /path/to/project --id policy-visible-copy --kind policy --subject ui.visible-copy --value required --statement "Use the approved visible-copy convention." --sources source-team --scope path-prefix --scope-path src --output .project-context/policy-visible-copy.proposal.json --write
-node bin/project-context.mjs approve --project /path/to/project --proposal .project-context/policy-visible-copy.proposal.json --ids policy-visible-copy --by NAME --write
-node bin/project-context.mjs discover --project /path/to/project
-node bin/project-context.mjs context --project /path/to/project --path src --locale zh-CN
-node bin/project-context.mjs publish --project /path/to/project --target agents --output AGENTS.md --write
-node bin/project-context.mjs check --project /path/to/project
-node bin/project-context.mjs dashboard --project /path/to/project > project-context-dashboard.html
-node bin/project-context.mjs dashboard --project /path/to/project --json
-```
-
-知识来源发生变化后的维护流程：
+npm install --save-dev frontend-project-context@1.0.1
+```
+
+本包没有运行时第三方依赖。
+
+### 快速开始
+
+初始化三个项目内存储文件：
 
 ```bash
-node bin/project-context.mjs review-source --project /path/to/project --id source-package --json
-node bin/project-context.mjs accept-source-change --project /path/to/project --id source-package --expected-digest SHA256_FROM_REVIEW --affected-items ITEM_ID... --write
-node bin/project-context.mjs revise --project /path/to/project --id ITEM_ID --kind policy --subject SUBJECT --value NEW_VALUE --statement "NEW STATEMENT" --sources source-package --scope project --json
-node bin/project-context.mjs revise --project /path/to/project --id ITEM_ID --expected-item-digest SHA256_FROM_PREVIEW --kind policy --subject SUBJECT --value NEW_VALUE --statement "NEW STATEMENT" --sources source-package --scope project --write
-node bin/project-context.mjs approve --project /path/to/project --pending --ids ITEM_ID... --by NAME --write
-node bin/project-context.mjs publish --project /path/to/project --target agents --output AGENTS.md --write
-node bin/project-context.mjs check --project /path/to/project
+npx project-context init \
+  --project . \
+  --id my-project \
+  --name "My Project" \
+  --write
 ```
 
-来源已经搬迁或永久退役时，先登记替代 source、用 `revise` 和 `approve --pending` 移走全部当前引用，再执行：
+登记一个明确来源：
 
 ```bash
-node bin/project-context.mjs deprecate-source --project /path/to/project --id source-old --by NAME --rationale "Replaced by source-new." --json
-node bin/project-context.mjs deprecate-source --project /path/to/project --id source-old --expected-source-digest SHA256_FROM_PREVIEW --by NAME --rationale "Replaced by source-new." --write
-node bin/project-context.mjs publish --project /path/to/project --target agents --output AGENTS.md --write
-node bin/project-context.mjs check --project /path/to/project
+npx project-context register \
+  --project . \
+  --id source.package \
+  --kind file \
+  --path package.json \
+  --write
 ```
 
-preview 中若 `blockingItems` 非空，必须先处理这些 proposed/approved 引用；命令不会级联改 item 或自动批准。需要退役 item 时，先运行 `deprecate` preview 取得 current item digest，再以同一命令增加 `--expected-item-digest ... --by NAME --rationale TEXT --write`。所有命令默认只读；`init`、`register`、保存 proposal、`accept-source-change`、`revise`、`deprecate`、`deprecate-source`、`approve` 和 `publish` 只有在自身显式包含 `--write` 时才会写文件。
+提出一条带作用域的合同项。这里只生成待审 proposal，不会自动批准：
 
-`context` 默认从 `[zh-CN] ...\n[en] ...` statement 中只选择中文主解释；可用 `--locale en` 选择英文，或 `--locale all` 保留双语原文。多条 `--path` 若得到相同知识集，只渲染一个 Targets 分组。`approve --json` 默认返回 digest 和 ID 摘要；只有确实需要完整 next Contract 时才使用 `--full-json`。
+```bash
+npx project-context propose \
+  --project . \
+  --id policy.ui-copy \
+  --kind policy \
+  --subject ui.visible-copy \
+  --value required \
+  --statement "使用团队已经批准的界面文案约定。" \
+  --sources source.package \
+  --scope path-prefix \
+  --scope-path src \
+  --output .project-context/policy.ui-copy.proposal.json \
+  --write
+```
 
-验证：
+人工审查后，只批准明确选中的 item：
 
 ```bash
-npm test
-npm run check
+npx project-context approve \
+  --project . \
+  --proposal .project-context/policy.ui-copy.proposal.json \
+  --ids policy.ui-copy \
+  --by YOUR_NAME \
+  --write
 ```
 
-发布候选与升级资料：
+为目标目录生成上下文，并检查漂移：
 
-- [正式发布准备](./docs/14-FORMAL-RELEASE-READINESS.md)
-- [变更记录](./CHANGELOG.md)
-- [升级说明](./UPGRADING.md)
-- [最小团队接入示例](./examples/README.md)
+```bash
+npx project-context context --project . --path src --locale zh-CN
+npx project-context check --project .
+```
 
-检查或读取本仓库自身治理上下文：
+生成只读治理看板：
 
 ```bash
-node bin/project-context.mjs check --project .
-node bin/project-context.mjs context --project . --path . --path src/project-context --path docs --locale zh-CN
-node bin/project-context.mjs dashboard --project . > /tmp/frontend-project-context-dashboard.html
+npx project-context dashboard --project . > project-context-dashboard.html
 ```
 
-现行文档按以下顺序阅读：
+看板是一个可离线打开的自包含 HTML。命令只输出到 stdout，不会自动打开浏览器，也不会修改合同。
 
-1. [产品宪法](./docs/00-PRODUCT-CONSTITUTION.md)
-2. [当前状态](./PROJECT_STATE.json)
-3. [产品核心](./docs/01-PRODUCT-CORE.md)
-4. [市场与自研边界](./docs/02-MARKET-BOUNDARY.md)
-5. [最终产品方案](./docs/03-FINAL-SOLUTION.md)
-6. [v1 程序设计](./docs/04-PROGRAM-DESIGN.md)
-7. [验收合同](./docs/05-ACCEPTANCE-CONTRACT.md)
-8. [v1 authoring closure 设计与实现结果](./docs/11-V1-AUTHORING-CLOSURE-DESIGN.md)
-9. [0.7.0 Knowledge Maintenance Closure 冻结设计与实现记录](./docs/12-KNOWLEDGE-MAINTENANCE-CLOSURE-ROADMAP.md)
-10. [0.8.0 Read-only Governance Dashboard 冻结设计与实现记录](./docs/13-READ-ONLY-GOVERNANCE-DASHBOARD-DESIGN.md)
-11. [1.0.0 正式发布准备](./docs/14-FORMAL-RELEASE-READINESS.md)
-12. [1.0.0 Source Lifecycle Closure 设计与实现记录](./docs/15-SOURCE-LIFECYCLE-CLOSURE-DESIGN.md)
+### 会生成什么？
+
+初始化只创建：
+
+```text
+.project-context/
+├── contract.json
+├── sources.lock.json
+└── projections.lock.json
+```
+
+这三个 store 应提交到仓库；团队明确生成的受管投影也应提交。proposal、临时上下文、看板 HTML、缓存和 tarball 通常不提交。
+
+### 核心流程
+
+```text
+项目明确提供的来源
+→ 可审查 proposal
+→ 人工批准的 Project Contract
+→ 按作用域编译的 Context Bundle
+→ AGENTS / Markdown / Ruler 投影
+→ 漂移检查
+```
+
+所有命令默认只读，只有当前命令显式包含 `--write` 才会持久写入。来源变化后，受影响的批准会失效，但工具不会自动接受变化或重新批准。
+
+### 常用命令
+
+| 命令 | 用途 |
+| --- | --- |
+| `init` | 安全创建空项目合同 |
+| `register` | 登记文件、路径、JSON Pointer 或人工决定 |
+| `discover` | 保守提出首次接入候选 |
+| `propose` | 创建 fact、policy、reference 或 validation-description |
+| `approve` | 显式批准选中的 proposal ID |
+| `context` | 为一个或多个路径编译已批准上下文 |
+| `publish` | 写入仍归工具所有的 AGENTS、Markdown 或 Ruler 投影 |
+| `check` | 检测来源、合同和投影漂移 |
+| `dashboard` | 生成只读治理看板 |
+| `review-source` | 查看来源变化及精确影响集 |
+| `accept-source-change` | 接受固定摘要并撤销受影响批准 |
+| `revise` / `deprecate` | 显式维护合同项 |
+| `deprecate-source` | 用审计记录退役已无引用的来源 |
+
+运行 `npx project-context --help` 查看完整命令语法。
+
+### 深入文档
+
+- [产品宪法](./docs/00-PRODUCT-CONSTITUTION.md)
+- [程序与 CLI 设计](./docs/04-PROGRAM-DESIGN.md)
+- [验收合同](./docs/05-ACCEPTANCE-CONTRACT.md)
+- [安装与分发](./docs/08-INSTALLATION-AND-DISTRIBUTION.md)
+- [知识维护闭环](./docs/12-KNOWLEDGE-MAINTENANCE-CLOSURE-ROADMAP.md)
+- [只读治理看板](./docs/13-READ-ONLY-GOVERNANCE-DASHBOARD-DESIGN.md)
+- [来源生命周期](./docs/15-SOURCE-LIFECYCLE-CLOSURE-DESIGN.md)
+- [升级说明](./UPGRADING.md)
 
-历史任务执行 Harness 的结论和第一次真实业务任务只作为反例与证据保留：
+## License / 许可证
 
-- [历史原型](./docs/06-HISTORICAL-PROTOTYPE.md)
-- [真实任务证据](./docs/07-REAL-TASK-EVIDENCE.md)
+Apache License 2.0 · `Copyright 2026 Fushan`
 
-当前实现不调用 Provider、网络、shell 或 Git，不执行项目验证，也不修改业务代码。历史 Harness 的源码、入口、测试和任务模板已从工作树清理，可通过 Git 历史追溯。真实项目报告只作为既有能力证据，不能自动产生新的内核需求。
+See [LICENSE](./LICENSE) and [NOTICE](./NOTICE).

package/UPGRADING.md

@@ -1,4 +1,10 @@
-# 升级到 1.0.0
+# 升级说明
+
+## `1.0.0 → 1.0.1`
+
+`1.0.1` 只修复 npm README、元数据和包文件白名单，不修改 CLI、Contract、lock、projection 或 Dashboard schema。更新依赖版本后无需迁移 `.project-context/`。
+
+## `0.9.0 → 1.0.0`
 
 从本地 `0.9.0` 升级到 `1.0.0` 不需要预先迁移 Project Contract、proposal、source lock 或 projection lock。Contract reader 同时接受 schema 1/2；既有 schema 1 项目保持原字节，只有首次成功执行 `deprecate-source --write` 时才把所有来源显式标为 active、目标标为 deprecated 并写成 schema 2。proposal、source lock 和 projection lock 继续使用 schema 1。Dashboard JSON 使用 schema 3，projection renderer 使用 3。
 

package/docs/05-ACCEPTANCE-CONTRACT.md

@@ -322,7 +322,7 @@
 
 ### A-39 发布候选边界
 
-- package name/version 固定为 `frontend-project-context@1.0.0`，bin 为 `project-context`，Node.js 下限为 18，第三方 runtime dependency 为零；
+- package name 固定为 `frontend-project-context`，当前 patch version 为 `1.0.1`，bin 为 `project-context`，Node.js 下限为 18，第三方 runtime dependency 为零；
 - package metadata 声明 Apache-2.0，发布包包含官方 LICENSE 和 `Copyright 2026 Fushan` NOTICE；
 - `files` 白名单包含保持文档链接完整所需的 PROJECT_STATE/RTK 和许可证文件，但不包含测试、自托管 `.project-context/` 或本地生成物；
 - `prepack` 必须运行全量检查，bin 保持可执行；

package/docs/08-INSTALLATION-AND-DISTRIBUTION.md

@@ -2,7 +2,7 @@
 
 > 权威说明：本文是支持性设计文档；当前唯一规范真源是 [00-PRODUCT-CONSTITUTION.md](./00-PRODUCT-CONSTITUTION.md)。
 
-状态：`frontend-project-context@1.0.0` 公开 npm 发布已授权、完成配置并验证发布者 CLI 身份
+状态：`frontend-project-context@1.0.1` README/metadata patch 已完成本地验证并获得发布授权
 适用项目：`dtg-frontend-delivery-agent`  
 本文只确定产品如何交付、安装、共享、升级和验证，不授权实现。
 
@@ -43,9 +43,9 @@ CI 安装项目锁定的依赖版本并执行只读检查。CI 不依赖机器
 面向 Node.js 前端项目，推荐支持包管理器的一次性运行方式，例如：
 
 ```bash
-npx frontend-project-context@1.0.0 init --project . --id PROJECT_ID --name "Project Name"
-pnpm dlx frontend-project-context@1.0.0 init --project . --id PROJECT_ID --name "Project Name"
-bunx frontend-project-context@1.0.0 init --project . --id PROJECT_ID --name "Project Name"
+npx frontend-project-context@1.0.1 init --project . --id PROJECT_ID --name "Project Name"
+pnpm dlx frontend-project-context@1.0.1 init --project . --id PROJECT_ID --name "Project Name"
+bunx frontend-project-context@1.0.1 init --project . --id PROJECT_ID --name "Project Name"
 ```
 
 以上命令只在包实际发布后可用；当前未访问 registry。包名冻结为 `frontend-project-context`，可执行文件名为 `project-context`，CLI 合同以 [04-PROGRAM-DESIGN.md](./04-PROGRAM-DESIGN.md) 为准。
@@ -65,7 +65,7 @@ bunx frontend-project-context@1.0.0 init --project . --id PROJECT_ID --name "Pro
 初始化后，DTG 应作为项目开发依赖被锁定，例如：
 
 ```bash
-pnpm add -D frontend-project-context@1.0.0
+pnpm add -D frontend-project-context@1.0.1
 ```
 
 选择项目内安装而不是全局安装，原因是：
@@ -187,13 +187,15 @@ IDE 插件可以在未来提供状态提示、冲突解释和可视化配置，
 
 ## 10. `1.0.0` 发布准备结论
 
-本地 `1.0.0` 候选采用 `.project-context/`、`project-context` 可执行文件、Contract schema 1/2 reader、proposal/source lock/projection lock schema 1、renderer version 3、Dashboard View Model schema 3、受管 marker 和 04 所列退出码；authoring、knowledge maintenance、只读治理看板与 source lifecycle 均已闭合。发布层冻结如下：
+已发布的 `1.0.0` 采用 `.project-context/`、`project-context` 可执行文件、Contract schema 1/2 reader、proposal/source lock/projection lock schema 1、renderer version 3、Dashboard View Model schema 3、受管 marker 和 04 所列退出码；authoring、knowledge maintenance、只读治理看板与 source lifecycle 均已闭合。发布层冻结如下：
 
-- 包名/版本为 `frontend-project-context@1.0.0`；公共 npm 查询确认该名称当前不存在，发布目标固定为 `https://registry.npmjs.org/`、public access；
+- 包名/版本为 `frontend-project-context@1.0.0`；已发布到 `https://registry.npmjs.org/`，保持 public access；
 - 开源许可证为 Apache-2.0，版权主体为 `Copyright 2026 Fushan`；LICENSE 与 NOTICE 必须随包分发；
 - `.project-context/contract.json`、两个 lock 和团队明确采用的受管投影应提交；proposal、dashboard HTML、tarball、node_modules 与临时 Context 不提交；
 - CI 模板只安装锁定依赖并运行项目脚本 `context:check`，不得写入、接受、批准或发布；
 - v1 不提供本地 MCP、IDE 插件、桌面应用或独立二进制；Node.js 18+ 是正式运行前提；
 - `0.9.0 → 1.0.0` 不预先迁移 store；Contract schema 1 只在首次成功 `deprecate-source --write` 时延迟升为 2，两个 lock 保持 1；renderer 1/2 仍可读并仅在显式 owned publish 时升级为 3。
 
-详细工件、验证与发布步骤见 [14-FORMAL-RELEASE-READINESS.md](./14-FORMAL-RELEASE-READINESS.md)。用户已经授权 public npm、解除 private 安全闩、release commit/tag/push 和实际 publish；npmjs.org CLI 身份已经验证。
+详细工件、验证与发布记录见 [14-FORMAL-RELEASE-READINESS.md](./14-FORMAL-RELEASE-READINESS.md)。public npm、private 安全闩解除、release commit/tag/push 和实际 publish 均已完成；本次发布授权已经消耗。
+
+`1.0.1` 是不改变运行逻辑的 patch：README 改为中英双语的用户向入口，包元数据移除 `bin` 规范化警告，并从发布白名单移除只属于源码仓库治理的 `PROJECT_STATE.json` 与 `RTK.md`。当前没有真实可公开访问的源码仓库，因此不伪造 `repository` 或 `bugs` URL。

package/docs/14-FORMAL-RELEASE-READINESS.md

@@ -1,6 +1,6 @@
 # 14 — `1.0.0` 正式发布准备
 
-> 状态：`public-npm-release-authorized-configured-authenticated-ready`
+> 状态：`public-npm-published-verified`
 
 ## 1. 冻结候选
 
@@ -15,7 +15,7 @@
 
 ## 2. 包内容
 
-发布白名单为 `bin/`、`src/`、`docs/`、`examples/`、README、CHANGELOG、UPGRADING、PROJECT_STATE、RTK、LICENSE、NOTICE 和 package metadata。PROJECT_STATE 与 RTK 只用于保持包内文档链接完整，不成为消费项目的 Contract。测试、本仓库自托管 `.project-context/`、Git 文件、本地 dashboard、proposal 和 tarball 不进入包。
+`1.0.0` 发布白名单为 `bin/`、`src/`、`docs/`、`examples/`、README、CHANGELOG、UPGRADING、PROJECT_STATE、RTK、LICENSE、NOTICE 和 package metadata。`1.0.1` 起移除只属于源码仓库动态治理的 PROJECT_STATE 与 RTK，避免把发布前状态固化到用户安装包；测试、本仓库自托管 `.project-context/`、Git 文件、本地 dashboard、proposal 和 tarball 仍不进入包。
 
 `prepack` 必须先运行 `npm run check`；bin 必须保持可执行。实际 pack 使用临时 cache 与输出目录验证，不修复用户全局 npm cache。
 
@@ -41,7 +41,7 @@ A-39 固定以下事实：package metadata 与文件白名单一致；Apache-2.0
 4. 使用解包后的 CLI 在临时项目完成 init 与 clean check；
 5. JSON、Markdown links 与 diff 校验。
 
-## 6. 已授权的公开发布与当前阻断
+## 6. 已完成的公开发布
 
 用户已明确要求完成发布，本次按先前推荐选择 public npm：
 
@@ -50,7 +50,7 @@ A-39 固定以下事实：package metadata 与文件白名单一致；Apache-2.0
 3. `publishConfig.access` 固定 `public`；
 4. release commit/tag/push 与 `npm publish` 纳入本次发布工作流。
 
-只读查询已确认 `frontend-project-context` 在公共 npm 返回 404，可作为首次发布名称；发布者随后在自己的终端完成认证，`npm whoami --registry=https://registry.npmjs.org/` 已验证为 `fushanyx1`。凭据、OTP 和 token 未由本项目或自动化读取。
+发布者在自己的终端完成认证与第二因素验证，凭据、OTP 和 token 未由本项目或自动化读取。`frontend-project-context@1.0.0` 于 `2026-09-08T11:02:04.396Z` 由 `fushanyx1` 发布到官方公共 npm；registry 返回的 tarball SHA-1 为 `20142d17bff43d238231da684e2f11c62a82ce32`，与最终本地 pack 完全一致。远端 `v1.0.0` 标签指向发布提交 `94bd5d5b47c1356ef264a825120c0cfaf772b2c5`。
 
 ## 7. 后续审查产生的发布保持条件
 
@@ -58,4 +58,10 @@ A-39 固定以下事实：package metadata 与文件白名单一致；Apache-2.0
 
 Source Lifecycle Closure 发布保持条件已经本地关闭。2026-09-08 使用隔离临时 npm cache 重新执行第 5 节：prepack 49/49 通过，tarball 白名单为 47 个文件；解包后的 CLI help、临时项目 init 和 clean check 通过。最初一次 pack 仅因用户级 npm cache 中历史 root-owned 文件产生 `EPERM`，未修改全局权限，改用临时 cache 后成功，产品验收不受影响。
 
-registry/可见性决策和发布者认证已经完成。Apache-2.0 和包名不变；当前进入最终 A-39/pack、release commit、`v1.0.0` tag/push 与 public `npm publish`。
+registry/可见性决策、发布者认证、A-39/pack、release commit、`v1.0.0` tag/push、public `npm publish` 和 registry 完整性复验均已完成。Apache-2.0、包名与冻结公共面不变；本次发布授权已经消耗。
+
+## 8. `1.0.1` README 与元数据修复
+
+首次发布后的 npm 页面审查确认，`1.0.0` README 把源码仓库治理记录放在安装入口之前，并保留 release-ready 候选状态；package metadata 还会触发 `bin[project-context]` 自动清理警告。用户已授权以 patch release 修复这些发布质量问题。
+
+`1.0.1` 只重写中英双语用户向 README、规范化 `bin` 路径、补充真实 npm homepage/关键词、更新示例与验收，并从 tarball 移除仓库动态状态文件。当前唯一 Git remote 为非公开公司仓库，且未授权创建公共仓库，因此不设置虚假的 `repository` 或 `bugs`。产品运行逻辑、命令、schema、依赖和兼容面均不改变。

package/docs/15-SOURCE-LIFECYCLE-CLOSURE-DESIGN.md

@@ -2,7 +2,7 @@
 
 > 权威说明：本文只冻结首次公开发布前的来源生命周期修补范围。产品身份、内核、永久边界和不变量仍以 [00-PRODUCT-CONSTITUTION.md](./00-PRODUCT-CONSTITUTION.md) 为准；当前事实与授权以 [PROJECT_STATE.json](../PROJECT_STATE.json) 为准。
 >
-> 状态：`implemented-local-verified; implementation-authority-consumed; public-publication-authorized-authenticated`
+> 状态：`implemented-local-verified; implementation-authority-consumed; public-publication-complete`
 >
 > 审查基线：产品宪法 `1.1.1`、PROJECT_STATE schema `39`、package `1.0.0`、Contract schema 1、A-01 至 A-39 加 B0/CLI 共 43 项本地通过。实现后 PROJECT_STATE schema 为 41，Contract reader 支持 1/2，A-01 至 A-45 加 B0/CLI 共 49 项本地通过。
 

package/docs/README.md

@@ -48,7 +48,7 @@
 
 10. [14-FORMAL-RELEASE-READINESS.md](./14-FORMAL-RELEASE-READINESS.md)
 
-    冻结 `frontend-project-context@1.0.0` 的包边界、项目接入、CI、迁移与 A-39；source lifecycle 保持条件已关闭，public npm 已授权、完成配置并验证发布者身份。
+    记录 `1.0.0` 正式发布与 `1.0.1` README/metadata patch：包边界、项目接入、CI、迁移、A-39、registry 完整性和不伪造公共仓库链接的决定。
 
 11. [15-SOURCE-LIFECYCLE-CLOSURE-DESIGN.md](./15-SOURCE-LIFECYCLE-CLOSURE-DESIGN.md)
 

package/examples/package.json

@@ -6,6 +6,6 @@
     "context:dashboard": "project-context dashboard --project ."
   },
   "devDependencies": {
-    "frontend-project-context": "1.0.0"
+    "frontend-project-context": "1.0.1"
   }
 }

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "frontend-project-context",
-  "version": "1.0.0",
-  "description": "Project-local, model-neutral context governance and compilation for AI coding tools.",
+  "version": "1.0.1",
+  "description": "Govern, compile, and verify project-local context for AI coding tools.",
   "private": false,
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
   "license": "Apache-2.0",
+  "homepage": "https://www.npmjs.com/package/frontend-project-context",
   "type": "module",
   "files": [
     "bin/",
@@ -16,13 +17,11 @@
     "examples/",
     "CHANGELOG.md",
     "UPGRADING.md",
-    "PROJECT_STATE.json",
-    "RTK.md",
     "LICENSE",
     "NOTICE"
   ],
   "bin": {
-    "project-context": "./bin/project-context.mjs"
+    "project-context": "bin/project-context.mjs"
   },
   "scripts": {
     "check": "node --check bin/project-context.mjs && node --test test/project-context test/release",
@@ -34,7 +33,10 @@
   },
   "keywords": [
     "ai-coding",
+    "coding-agent",
+    "agents-md",
     "context-governance",
-    "project-contract"
+    "project-contract",
+    "drift-detection"
   ]
 }

package/PROJECT_STATE.json

@@ -1,176 +0,0 @@
-{
-  "schemaVersion": 43,
-  "status": "1.0.0-public-npm-release-ready",
-  "product": {
-    "name": "Frontend Project Context",
-    "identity": "A project-local, model-neutral context governance and compilation layer between a repository and existing AI coding tools.",
-    "promise": "Maintain one human-approved project contract with provenance, compile scoped context for existing AI tools, and detect source, contract, and projection drift.",
-    "kernel": [
-      "source-registration-and-provenance",
-      "human-governed-project-contract",
-      "scope-aware-context-compiler",
-      "tool-projection-boundary",
-      "conflict-and-drift-checking"
-    ],
-    "discoveryRole": "Optional conservative bootstrap; never a requirement to understand every frontend technology or project convention."
-  },
-  "hardBoundaries": {
-    "humanAuthority": "Only an explicit human action may approve or change normative contract content.",
-    "runtime": "No model Provider or agent loop.",
-    "businessCode": "No user development task execution or application-code edits.",
-    "git": "No Git state management.",
-    "externalEffects": "No automatic dependency installation, network access, external mutation, or shell workflow execution.",
-    "generatedFiles": "Only explicitly managed and still-owned projections may be overwritten after an explicit write action.",
-    "conflicts": "Report stale sources and conflicts; never silently resolve or promote them.",
-    "taskContext": "Ephemeral task constraints cannot expand authority or rewrite the persistent Contract."
-  },
-  "implementation": {
-    "version": "1.0.0",
-    "license": "Apache-2.0",
-    "copyright": "Copyright 2026 Fushan",
-    "entrypoint": "bin/project-context.mjs",
-    "modules": "src/project-context/",
-    "tests": "test/project-context/",
-    "runtime": "node-standard-library-only",
-    "dependenciesAdded": 0,
-    "schemas": {
-      "contract": 2,
-      "contractReadable": [
-        1,
-        2
-      ],
-      "proposal": 1,
-      "sourceLock": 1,
-      "projectionLock": 1,
-      "projectionRenderer": 3,
-      "dashboardViewModel": 3
-    },
-    "closures": [
-      "v1-authoring",
-      "knowledge-maintenance",
-      "read-only-governance-dashboard",
-      "context-efficiency-and-governance-hardening",
-      "formal-release-readiness",
-      "source-lifecycle"
-    ],
-    "hardening": [
-      "symlink-safe-parent-creation",
-      "verification-kind-schema-semantics",
-      "proposal-create-only-same-id-revision-guard",
-      "strict-contract-value-json-compatibility",
-      "grouped-multipath-context-rendering",
-      "primary-locale-context-with-explicit-en-or-all",
-      "compact-approval-json-receipt",
-      "dashboard-derived-data-deduplication",
-      "deprecated-source-io-suppression",
-      "projection-lock-snapshot-precondition"
-    ],
-    "acceptance": {
-      "command": "npm run check",
-      "range": "A-01-through-A-45-plus-B0-01-B0-02-and-CLI",
-      "testCount": 49,
-      "status": "passed-source-lifecycle-closure-local",
-      "teamMaintenance": {
-        "date": "2026-09-08",
-        "fixture": "isolated-temporary-project",
-        "workflow": "source-change-review-accept-revise-deprecate-reapprove-republish-final-check",
-        "result": "passed"
-      },
-      "releaseReadiness": {
-        "date": "2026-09-08",
-        "package": "frontend-project-context@1.0.0",
-        "publicSurface": "project-context-cli",
-        "packagePrivate": false,
-        "registry": "https://registry.npmjs.org/",
-        "access": "public",
-        "license": "Apache-2.0",
-        "result": "public-release-configured-authenticated-ready"
-      }
-    },
-    "compatibility": "Contract schema 1 and 2 are readable. Existing schema-1 stores remain byte-stable until the first successful deprecate-source write lazily upgrades the Contract to schema 2; proposal and both locks remain schema 1. Renderer 1 and 2 projections remain readable and stale until explicit owned republish to renderer 3. Dashboard JSON consumers must opt into View Model schema 3; --full-json preserves the former verbose approval result on demand."
-  },
-  "planning": {
-    "releaseBlocker": {
-      "id": "source-lifecycle-closure",
-      "classification": "kernel-defect",
-      "targetPackageVersion": "1.0.0",
-      "status": "implemented-local-verified-release-hold-resolved",
-      "design": "docs/15-SOURCE-LIFECYCLE-CLOSURE-DESIGN.md",
-      "evidence": [
-        "accept-source-change rejects missing or unreadable registered sources",
-        "register rejects a changed locator under an existing source ID",
-        "contract schema 1 has no safe source retirement state",
-        "a missing, relocated, or retired source therefore requires direct store editing to return check to clean"
-      ],
-      "frozenScope": [
-        "contract-schema-2-active-and-deprecated-source-lifecycle",
-        "explicit-deprecate-source-command",
-        "schema-1-lazy-compatibility-migration",
-        "checker-dashboard-context-and-publish-lifecycle-consistency",
-        "A-40-through-A-45"
-      ],
-      "result": {
-        "date": "2026-09-08",
-        "tests": 49,
-        "contractSchemasReadable": [
-          1,
-          2
-        ],
-        "contractSchemaWrittenByLifecycle": 2,
-        "dashboardViewModel": 3,
-        "selfHostedContractSchema": 1,
-        "selfHostedMigrationReason": "No self-hosted source is obsolete; schema 1 remains valid until a real source retirement requires lazy migration."
-      }
-    },
-    "laterCandidates": [
-      {
-        "id": "ci-reconciliation-artifacts",
-        "classification": "optional-adapter",
-        "status": "candidate-after-release-decision",
-        "boundary": "Reuse check and dashboard in external CI; do not add a scheduler, daemon, automatic acceptance, or approval."
-      },
-      {
-        "id": "targeted-context-consumer-protocol",
-        "classification": "optional-adapter",
-        "status": "candidate-requires-separate-design-authorization",
-        "boundary": "Coding Agent or IDE resolves candidate paths and consumes context --path; no Provider, Agent Runtime, business-code execution, or automatic authority expansion."
-      }
-    ]
-  },
-  "executionAuthority": {
-    "providerCallsAllowed": false,
-    "dependencyInstallationAllowed": false,
-    "networkAllowed": true,
-    "productImplementationAllowed": false,
-    "realProjectBetaAllowed": false,
-    "teamAcceptanceAllowed": false,
-    "releaseWorkAllowed": true,
-    "gitWriteOperationsAllowed": true,
-    "note": "The user authorized completing the public release and npmjs.org CLI authentication is verified as fushanyx1. Public npm visibility, private:false, release verification, Git release commit/tag/push, and npm publication are in scope for this release workflow. Provider calls, dependency installation, real-project access, and product expansion remain unauthorized."
-  },
-  "sourceOfTruth": {
-    "constitution": "docs/00-PRODUCT-CONSTITUTION.md",
-    "startup": "RTK.md",
-    "overview": "README.md",
-    "documentationIndex": "docs/README.md",
-    "programDesign": "docs/04-PROGRAM-DESIGN.md",
-    "acceptanceContract": "docs/05-ACCEPTANCE-CONTRACT.md",
-    "v1AuthoringClosureDesign": "docs/11-V1-AUTHORING-CLOSURE-DESIGN.md",
-    "knowledgeMaintenanceClosureRoadmap": "docs/12-KNOWLEDGE-MAINTENANCE-CLOSURE-ROADMAP.md",
-    "readOnlyGovernanceDashboardDesign": "docs/13-READ-ONLY-GOVERNANCE-DASHBOARD-DESIGN.md",
-    "formalReleaseReadiness": "docs/14-FORMAL-RELEASE-READINESS.md",
-    "sourceLifecycleClosureDesign": "docs/15-SOURCE-LIFECYCLE-CLOSURE-DESIGN.md",
-    "license": "LICENSE",
-    "notice": "NOTICE",
-    "installationAndDistribution": "docs/08-INSTALLATION-AND-DISTRIBUTION.md",
-    "historicalEvidence": [
-      "docs/06-HISTORICAL-PROTOTYPE.md",
-      "docs/07-REAL-TASK-EVIDENCE.md",
-      "docs/09-B0-DTG-TMC-MOBILE.md",
-      "docs/10-B0-DTG-TMC-PC.md"
-    ]
-  },
-  "next": [
-    "publish-frontend-project-context-1.0.0-to-public-npm"
-  ]
-}

package/RTK.md

@@ -1,13 +0,0 @@
-# Frontend Project Context — 启动路由
-
-按顺序读取：
-
-1. `docs/00-PRODUCT-CONSTITUTION.md`：产品身份、内核、永久边界与治理规则；
-2. `PROJECT_STATE.json`：当前版本、实现、授权和唯一下一步；
-3. 仅在任务需要时读取 `PROJECT_STATE.json.sourceOfTruth` 指向的设计或证据。
-
-当前摘要：`1.0.0-public-npm-release-ready`。v1 已冻结为 `frontend-project-context@1.0.0`，采用 Apache-2.0 与 `Copyright 2026 Fushan`；Source Lifecycle Closure 和全部 49 项本地验收通过。Contract reader 支持 schema 1/2，schema 1 只在首次成功 `deprecate-source --write` 时延迟升级为 2；proposal 与两个 lock 保持 1，projection renderer 为 3，Dashboard View Model 为 3。
-
-根 `AGENTS.md` 由人工维护；`.project-context/` 是本仓库自托管真源；投影只是可重新生成的消费端文件。任何历史文档与宪法冲突时以宪法为准，任何动态状态与 `PROJECT_STATE.json` 冲突时以后者为准。
-
-用户已授权完成公开发布；package 已固定 `private: false`、public access 和官方 npm registry，npmjs.org CLI 身份已验证。当前唯一下一步是完成最终 pack、release commit、`v1.0.0` tag/push 与 `npm publish`。Provider、依赖安装、真实业务项目访问和产品扩张仍未授权。