mirai-graph 1.0.0-rc.8 → 1.0.0

package/CHANGELOG.md

@@ -4,6 +4,47 @@ All notable changes to Mirai Graph will be documented in this file.
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-08-17
+
+### Changed
+
+- Project Technology is now the stable public execution mechanism for ordinary
+  projects, skills, platforms and multi-repository systems.
+- The package, CLI and programmatic API leave release-candidate status without
+  changing the public `graph.json` schema or the accepted safety boundaries.
+
+### Evidence Boundary
+
+- Stable means the documented contracts and release checks are supported for
+  production adoption. It does not claim that every project outcome is correct
+  without project-specific goals, evidence and review.
+
+## [1.0.0-rc.11] - 2026-08-17
+
+### Fixed
+
+- The bounded architecture contract now preserves the exact human architecture
+  owner together with component, capability and operational ownership data.
+- Federation adapters can consume the public contract without reconstructing
+  owner identity from a package owner.
+
+## [1.0.0-rc.10] - 2026-08-17
+
+### Fixed
+
+- Project Technology now reads complete tracked-file inventories in large
+  repositories instead of accepting Node's default child-process buffer.
+- A regression proves that an accepted target remains discoverable after more
+  than one megabyte of earlier tracked paths.
+
+## [1.0.0-rc.9] - 2026-08-17
+
+### Fixed
+
+- `mirai-graph technology ...` now resolves an omitted repository or `.` from
+  the caller's working directory instead of the installed package directory.
+- CLI regressions cover omitted, relative and absolute repository selection.
+
 ## [1.0.0-rc.8] - 2026-08-17
 
 ### Added

package/README.md

@@ -10,7 +10,7 @@ Use it when a software project has useful knowledge spread across README files,
 docs, issues, chats, code comments and AI prompts, and you need a small
 machine-readable map that developers and AI assistants can validate and reuse.
 
-Status: public `1.0.0-rc.8` release candidate.
+Status: stable public `1.0.0` release.
 
 ## What Problem Does It Solve?
 
@@ -42,8 +42,8 @@ Start with a normal repository and use Mirai Graph to:
 
 ## Current Installation Status
 
-The repository is ready as the `mirai-graph@1.0.0-rc.8` release candidate.
-Until npm publication is confirmed, use the repository checkout path:
+The repository is ready as the stable `mirai-graph@1.0.0` package. To verify a
+repository checkout directly, use:
 
 ```bash
 git clone https://github.com/zabarov/mirai-graph.git
@@ -52,7 +52,7 @@ npm install
 npm run release:check
 ```
 
-After npm publication, external projects will use:
+External projects use:
 
 ```bash
 npm install -D mirai-graph
@@ -272,7 +272,7 @@ routes. See [Profile Boundaries](standard/profile-boundaries.md).
 
 ## Release Candidate
 
-The current release candidate consolidates the validator-backed public standard
+The stable 1.0 release consolidates the validator-backed public standard
 across the core model, profiles, executable process control, instrumentation,
 Character Layer, adopter kit and evidence boundaries.
 

package/docs/repository-purpose.md

@@ -23,7 +23,7 @@ The repository should become the public source of truth for:
 - synthetic benchmarks and playground materials;
 - publications, citations and research evidence.
 
-For the current public release candidate, "source of truth" means public
+For the current stable release, "source of truth" means public
 standardization and reproducible examples. It does not mean that private
 project graphs, internal workflows or generated context packs are published
 here.
@@ -87,7 +87,7 @@ The model is not just a knowledge graph. It combines:
 - implementation and adoption methods.
 - organization-governance coordination patterns.
 
-The current 1.0 release candidate also makes the operating model executable
+The stable 1.0 release also makes the operating model executable
 enough to test:
 
 - launch records define bounded work permission;
@@ -182,7 +182,7 @@ test the model:
 
 Synthetic evidence must be clearly separated from real-world validation.
 
-In the current release candidate, `playground/` is an index of runnable CLI
+In the stable release, `playground/` is an index of runnable CLI
 examples. A hosted or interactive playground is future work.
 
 ### 6. Link Publications And Research Evidence

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirai-graph",
-  "version": "1.0.0-rc.8",
+  "version": "1.0.0",
   "private": false,
   "description": "An evolutionary graph operating model for managing the growth of complex systems.",
   "license": "MIT",

package/packages/cli/mirai-graph.js

@@ -31,9 +31,9 @@ function usage() {
   console.error("  Reports explain validation decisions. They do not authorize canonical updates.");
 }
 
-function run(script, args) {
+function run(script, args, cwd = root) {
   const result = spawnSync(node, [path.join(root, script), ...args], {
-    cwd: root,
+    cwd,
     stdio: "inherit"
   });
   process.exit(result.status === null ? 1 : result.status);
@@ -53,7 +53,7 @@ if (command === "technology") {
     usage();
     process.exit(1);
   }
-  run("packages/cli/project-technology.js", [subcommand, ...rest]);
+  run("packages/cli/project-technology.js", [subcommand, ...rest], process.cwd());
 }
 
 if (command === "init" || command === "detect" || command === "bootstrap") {

package/packages/cli/validate-project-technology.js

@@ -58,8 +58,15 @@ function executionContract() {
     }],
     architecture_contract: {
       contract_ref: "contract.fixture.architecture",
-      acceptance_ref: "decision.fixture.accepted", lifecycle: "accepted",
-      owner_ids: ["runtime"], package_ids: ["fixture/runtime"],
+      acceptance_ref: "decision.fixture.accepted", architecture_owner_id: "human.fixture.owner", lifecycle: "accepted",
+      owner_ids: ["runtime"], component_ids: ["component.fixture.runtime"],
+      package_ids: ["fixture/runtime"], capability_ids: ["capability.fixture.runtime"],
+      ownership_boundaries: [{
+        subject_ref: "capability.fixture.runtime", data_owner: "runtime", access_owner: "runtime",
+        lifecycle_owner: "runtime", interface_owner: "runtime", runtime_owner: "runtime",
+      }],
+      required_relations: ["component.fixture.runtime->capability.fixture.runtime"],
+      allowed_relations: [], forbidden_relations: ["capability.fixture.runtime->capability.fixture.legacy"],
       required_dependencies: [], forbidden_dependencies: ["fixture/runtime->fixture/legacy"],
     },
   };
@@ -222,10 +229,43 @@ try {
   const disabled = technology.execute("disable", skill, { apply: true });
   check("disabled_state_fails_closed", disabled.status === "success" && technology.verify(skill, { significantWork: true }).status === "blocked");
 
+  const largeProvider = initRepo(root, "large-provider");
+  addTarget(largeProvider);
+  const emptyBlob = spawnSync("git", ["hash-object", "-w", "--stdin"], {
+    cwd: largeProvider, input: "", encoding: "utf8",
+  }).stdout.trim();
+  const padding = "x".repeat(190);
+  const indexInfo = Array.from({ length: 5200 }, (_, index) =>
+    `100644 ${emptyBlob}\tarchive/${String(index).padStart(5, "0")}-${padding}.txt\n`
+  ).join("");
+  const indexed = spawnSync("git", ["update-index", "--index-info"], {
+    cwd: largeProvider, input: indexInfo, encoding: "utf8", maxBuffer: 64 * 1024 * 1024,
+  });
+  check("large_repository_fixture_created", indexed.status === 0, indexed.stderr);
+  git(largeProvider, "commit", "-qm", "large tracked index");
+  const largeRevision = git(largeProvider, "rev-parse", "HEAD");
+  check("large_repository_enable", technology.execute("enable", largeProvider, { apply: true }).status === "success");
+  const largeProvided = technology.execute("provide", largeProvider, {
+    apply: true, targetId: TARGET_ID, semanticDigest: SEMANTIC_DIGEST, providerRevision: largeRevision,
+  });
+  check("large_repository_target_is_not_lost_to_process_buffer", largeProvided.status === "success", largeProvided.blockers);
+
   const cli = spawnSync(process.execPath, [path.join(__dirname, "mirai-graph.js"), "technology", "explain", federation], { encoding: "utf8" });
   const cliResult = JSON.parse(cli.stdout);
   check("unified_cli_contract", cli.status === 0 && cliResult.operation_id === "mirai.project_technology.explain" && cliResult.operation_mode === "read_only");
 
+  const cliFromCwd = spawnSync(process.execPath, [path.join(__dirname, "mirai-graph.js"), "technology", "status"], {
+    cwd: federation, encoding: "utf8",
+  });
+  const cliFromCwdResult = JSON.parse(cliFromCwd.stdout);
+  check("unified_cli_defaults_to_caller_cwd", cliFromCwd.status === 0 && cliFromCwdResult.repository_id === "fixture-federation", cliFromCwdResult);
+
+  const cliDot = spawnSync(process.execPath, [path.join(__dirname, "mirai-graph.js"), "technology", "status", "."], {
+    cwd: federation, encoding: "utf8",
+  });
+  const cliDotResult = JSON.parse(cliDot.stdout);
+  check("unified_cli_resolves_relative_repo_from_caller_cwd", cliDot.status === 0 && cliDotResult.repository_id === "fixture-federation", cliDotResult);
+
   process.stdout.write(`${JSON.stringify({ status: "success", checks_passed: checks.length, checks_failed: 0, checks }, null, 2)}\n`);
 } finally {
   fs.rmSync(root, { recursive: true, force: true });

package/packages/project-technology/index.js

@@ -77,7 +77,11 @@ function result(operation, operationMode, status, extra = {}) {
 }
 
 function git(repo, ...args) {
-  const completed = spawnSync("git", args, { cwd: repo, encoding: "utf8" });
+  const completed = spawnSync("git", args, {
+    cwd: repo,
+    encoding: "utf8",
+    maxBuffer: 64 * 1024 * 1024,
+  });
   return completed.status === 0 ? completed.stdout.trim() : "";
 }
 
@@ -225,16 +229,44 @@ function normalizeExecutionContract(value) {
   scopes.sort((a, b) => canonicalBytes(a).localeCompare(canonicalBytes(b)));
 
   const architecture = value.architecture_contract && typeof value.architecture_contract === "object" && !Array.isArray(value.architecture_contract) ? value.architecture_contract : {};
-  const architectureAllowed = new Set(["contract_ref", "acceptance_ref", "lifecycle", "owner_ids", "package_ids", "required_dependencies", "forbidden_dependencies"]);
+  const architectureAllowed = new Set([
+    "contract_ref", "acceptance_ref", "architecture_owner_id", "lifecycle", "owner_ids", "component_ids",
+    "package_ids", "capability_ids", "ownership_boundaries", "required_relations",
+    "allowed_relations", "forbidden_relations", "required_dependencies", "forbidden_dependencies",
+  ]);
   if (Object.keys(architecture).some((key) => !architectureAllowed.has(key))) blockers.push("provider_architecture_contract_not_bounded");
   const contractRef = String(architecture.contract_ref || "").trim();
   const acceptanceRef = String(architecture.acceptance_ref || "").trim();
+  const architectureOwnerId = String(architecture.architecture_owner_id || "").trim();
   const lifecycle = String(architecture.lifecycle || "").trim();
   if (!REF_RE.test(contractRef)) blockers.push("provider_architecture_contract_ref_missing_or_unsafe");
   if (!REF_RE.test(acceptanceRef)) blockers.push("provider_architecture_acceptance_ref_missing_or_unsafe");
+  if (!REF_RE.test(architectureOwnerId)) blockers.push("provider_architecture_owner_missing_or_unsafe");
   if (!ACCEPTED_LIFECYCLES.has(lifecycle)) blockers.push("provider_architecture_not_accepted");
   const ownerIds = boundedRefs(architecture.owner_ids, "architecture_owner_ids", blockers);
+  const componentIds = boundedRefs(architecture.component_ids, "architecture_component_ids", blockers);
   const packageIds = boundedRefs(architecture.package_ids, "architecture_package_ids", blockers);
+  const capabilityIds = boundedRefs(architecture.capability_ids, "architecture_capability_ids", blockers);
+  const ownershipBoundaries = [];
+  if (!Array.isArray(architecture.ownership_boundaries) || architecture.ownership_boundaries.length === 0) blockers.push("provider_architecture_ownership_boundaries_empty");
+  else for (const boundary of architecture.ownership_boundaries) {
+    const keys = ["subject_ref", "data_owner", "access_owner", "lifecycle_owner", "interface_owner", "runtime_owner"];
+    if (!boundary || typeof boundary !== "object" || Array.isArray(boundary) || Object.keys(boundary).some((key) => !keys.includes(key))) {
+      blockers.push("provider_architecture_ownership_boundary_invalid"); continue;
+    }
+    const normalizedBoundary = Object.fromEntries(keys.map((key) => [key, String(boundary[key] || "").trim()]));
+    if (Object.values(normalizedBoundary).some((id) => !REF_RE.test(id))) {
+      blockers.push("provider_architecture_ownership_boundary_unsafe"); continue;
+    }
+    if (![...componentIds, ...packageIds, ...capabilityIds].includes(normalizedBoundary.subject_ref)) blockers.push("provider_architecture_ownership_subject_unknown");
+    if (["data_owner", "access_owner", "lifecycle_owner", "interface_owner", "runtime_owner"].some((key) => !ownerIds.includes(normalizedBoundary[key]))) blockers.push("provider_architecture_boundary_owner_unapproved");
+    ownershipBoundaries.push(normalizedBoundary);
+  }
+  ownershipBoundaries.sort((a, b) => canonicalBytes(a).localeCompare(canonicalBytes(b)));
+  const requiredRelations = boundedRelations(architecture.required_relations, "architecture_required_relations", blockers);
+  const allowedRelations = boundedRelations(architecture.allowed_relations, "architecture_allowed_relations", blockers);
+  const forbiddenRelations = boundedRelations(architecture.forbidden_relations, "architecture_forbidden_relations", blockers);
+  if (requiredRelations.some((item) => forbiddenRelations.includes(item))) blockers.push("provider_architecture_forbidden_relation");
   const requiredDependencies = boundedRelations(architecture.required_dependencies, "required_dependencies", blockers);
   const forbiddenDependencies = boundedRelations(architecture.forbidden_dependencies, "forbidden_dependencies", blockers);
   if (requiredDependencies.some((item) => forbiddenDependencies.includes(item))) blockers.push("provider_architecture_forbidden_dependency");
@@ -253,9 +285,16 @@ function normalizeExecutionContract(value) {
     architecture_contract: {
       contract_ref: contractRef,
       acceptance_ref: acceptanceRef,
+      architecture_owner_id: architectureOwnerId,
       lifecycle,
       owner_ids: ownerIds,
+      component_ids: componentIds,
       package_ids: packageIds,
+      capability_ids: capabilityIds,
+      ownership_boundaries: ownershipBoundaries,
+      required_relations: requiredRelations,
+      allowed_relations: allowedRelations,
+      forbidden_relations: forbiddenRelations,
       required_dependencies: requiredDependencies,
       forbidden_dependencies: forbiddenDependencies,
     },

package/releases/1.0.0-rc.10.md

@@ -0,0 +1,14 @@
+# Mirai Graph 1.0.0-rc.10
+
+This release candidate completes the public Project Technology pilot against
+the real Federation graph.
+
+## Verified outcome
+
+- commands without a repository argument use the caller's project;
+- large tracked-file inventories are read completely;
+- accepted target objects cannot disappear because of a process-output limit;
+- the Project Technology contract and fail-closed safety rules are unchanged.
+
+Stable `1.0.0` remains deferred until this RC has been exercised by the SIMAI
+Federation and all release-managed skills.

package/releases/1.0.0-rc.11.md

@@ -0,0 +1,14 @@
+# Mirai Graph 1.0.0-rc.11
+
+This release candidate closes the final architecture-owner gap found by the
+real Federation process resolver.
+
+## Verified outcome
+
+- complete large-repository target discovery;
+- exact human architecture owner in the bounded contract;
+- component, package, capability and operational ownership remain digest-bound;
+- no private source or full provider graph is exported.
+
+Stable `1.0.0` remains deferred until Federation 8.20.0 and all managed skills
+complete their release checks.

package/releases/1.0.0-rc.9.md

@@ -0,0 +1,14 @@
+# Mirai Graph 1.0.0-rc.9
+
+This release candidate fixes the public Project Technology CLI boundary found
+during the Federation migration pilot.
+
+## Verified outcome
+
+- a command run from a project without a repository argument uses that project;
+- an explicit `.` is resolved from the caller's working directory;
+- absolute repository paths keep working;
+- the Project Technology contract and safety gates are unchanged from RC.8.
+
+Stable `1.0.0` remains deferred until this RC has been exercised by the SIMAI
+Federation and all release-managed skills.

package/releases/1.0.0.md

@@ -0,0 +1,23 @@
+# Mirai Graph 1.0.0
+
+Mirai Graph 1.0.0 is the first stable public release.
+
+## What is stable
+
+- one `graph.json` manifest and exact `graph.lock.json` imports;
+- public Project Technology CLI and programmatic API;
+- task-scoped context, accepted target and architecture checks;
+- bounded provider export/import and safe refresh-binding;
+- fail-closed verification for stale, incomplete or tampered contracts;
+- read-only diagnostics and idempotent transactional operations.
+
+## Verified use
+
+The release-candidate series was integrated into Federation 8.20.0 across 25
+managed skills. Stable 1.0 keeps the same public schema and safety boundaries.
+
+## Claim boundary
+
+Stable status covers the published contracts, CLI and release checks. Project
+results still require project-specific goals, evidence, tests and human
+decisions at product or architecture boundaries.

package/releases/README.md

@@ -1,6 +1,6 @@
 # Mirai Graph Release Process
 
-Status: 1.0 release-candidate release process
+Status: stable 1.0 release process
 
 ## Purpose
 
@@ -15,6 +15,7 @@ Release notes must separate:
 
 ## Release Notes
 
+- [v1.0.0](1.0.0.md) - stable Project Technology, CLI and public contract.
 - [v1.0.0-rc.6](1.0.0-rc.6.md) - anti-drift / quality-control release
   consolidation across Semantic Intent, Dynamic Episode, Goal Vector and
   Technology Quality Feedback.

package/standard/project-technology.md

@@ -47,6 +47,11 @@ references, Done When, requirements and acceptance references, constraints,
 non-goals, deferred boundaries, approved repository/owner/package/file/action
 scope, the accepted architecture boundary and a contract digest.
 
+The architecture boundary carries exact component, package and capability
+identities, ownership for data/access/lifecycle/interface/runtime, required and
+forbidden relations, and dependency constraints. This keeps an imported target
+executable without copying the provider's private source or full graph.
+
 ## Hybrid Source Of Truth
 
 Project Technology may select graph objects and point to raw sources. It must