mirai-graph 1.2.0 → 1.3.0

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to Mirai Graph will be documented in this file.
 
 ## [Unreleased]
 
+## [1.3.0] - 2026-08-28
+
+### Added
+
+- Generic immutable artifact releases in the existing Project Technology
+  engine: inspect, release, compare and verify.
+- Public JavaScript API and matching CLI for direct files, directories, ZIP,
+  TAR and TAR.GZ bundles.
+- Hash-bound manifests, release lineage, technical comparisons, deterministic
+  client-safe exports and portable metadata in `graph/specs`.
+- Transactional release creation with lease, compare-and-swap, atomic
+  activation, readback, rollback and idempotent repeat behavior.
+
+### Safety Boundary
+
+- Unsafe paths, links, encrypted or nested archives, executable and
+  macro-enabled files, normalized duplicates and archive-limit violations fail
+  closed.
+- Raw artifacts and private document content do not enter graph metadata.
+- Artifact integrity is not domain approval; consumers retain semantic
+  ownership.
+- The public graph schema remains `2.0.0` and the Project Technology
+  activation contract remains `1.0.0`.
+
+### Verification
+
+- New fixtures cover immutable releases, multiple matters, branching,
+  comparisons, tamper detection, concurrency, CAS conflicts, safe archives,
+  unsupported formats, read-only zero-write and shared folders.
+
 ## [1.2.0] - 2026-08-27
 
 ### Added

package/README.md

@@ -10,7 +10,7 @@ Use it when a software project has useful knowledge spread across README files,
 docs, issues, chats, code comments and AI prompts, and you need a small
 machine-readable map that developers and AI assistants can validate and reuse.
 
-Status: stable public `1.2.0` release.
+Status: stable public `1.3.0` release.
 
 ## What Problem Does It Solve?
 
@@ -42,7 +42,7 @@ Start with a normal repository and use Mirai Graph to:
 
 ## Current Installation Status
 
-The repository provides the stable `mirai-graph@1.2.0` package. To verify a
+The repository provides the stable `mirai-graph@1.3.0` package. To verify a
 repository checkout directly, use:
 
 ```bash
@@ -142,6 +142,20 @@ Accepted facts and reusable cases live in `graph/specs`; mutable receipts and
 rollback data stay host-local. The same contract works in Git repositories and
 ordinary shared folders.
 
+Project Technology can also preserve immutable releases of file bundles:
+
+```bash
+mirai-graph technology artifact inspect . --input incoming.zip
+mirai-graph technology artifact release . --input incoming.zip --matter-id agreement-main --direction inbound
+mirai-graph technology artifact release . --input incoming.zip --matter-id agreement-main --direction inbound --apply
+mirai-graph technology artifact compare . --matter-id agreement-main --base-release 20260828-01 --target-release 20260828-02
+mirai-graph technology artifact verify . --matter-id agreement-main --release-id 20260828-02
+```
+
+The protected files remain outside graph data. The graph keeps only safe
+identity, lineage, state, references and checksums. Mirai Graph performs
+technical integrity checks; a domain owner decides what a version means.
+
 Changing operations return a preview unless `--apply` is explicit. See
 [Project Technology](standard/project-technology.md) for provider/consumer
 binding, local state and safety boundaries.

package/docs/adoption/cli.md

@@ -91,6 +91,19 @@ npx mirai-graph technology context . --phase compile --input receipt.json --sele
 npx mirai-graph technology context . --phase verify --packet context-pack.json --evidence usage-evidence.json
 ```
 
+Versioned file bundles use the same Project Technology entrypoint:
+
+```bash
+npx mirai-graph technology artifact inspect . --input incoming.zip
+npx mirai-graph technology artifact release . --input incoming.zip --matter-id agreement-main --direction inbound
+npx mirai-graph technology artifact release . --input incoming.zip --matter-id agreement-main --direction inbound --apply
+npx mirai-graph technology artifact compare . --matter-id agreement-main --base-release 20260828-01 --target-release 20260828-02
+npx mirai-graph technology artifact verify . --matter-id agreement-main --release-id 20260828-02
+```
+
+Inspection, comparison and verification are read-only. Release creation is a
+preview until `--apply` is present.
+
 Omitting `--phase` keeps the original bounded context-discovery behavior.
 Receipt, selection, context-pack and usage-evidence files are caller-owned
 inputs and outputs; the command never stores them itself.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirai-graph",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "private": false,
   "description": "An evolutionary graph operating model for managing the growth of complex systems.",
   "license": "MIT",
@@ -12,11 +12,46 @@
   "exports": {
     "./project-technology": "./packages/project-technology/index.js"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zabarov/mirai-graph.git"
+  },
+  "keywords": [
+    "graph",
+    "knowledge-graph",
+    "governance",
+    "complex-systems",
+    "context-engineering",
+    "ai-assisted-work"
+  ],
+  "author": "Rim Zabarov",
+  "files": [
+    "README.md",
+    "CHANGELOG.md",
+    "ROADMAP.md",
+    "LICENSE",
+    "LICENSE-DOCS",
+    "CITATION.cff",
+    "docs",
+    "standard",
+    "schemas",
+    "benchmarks",
+    "examples",
+    "packages",
+    "profiles",
+    "pilots",
+    "playground",
+    "publications",
+    "releases",
+    "templates",
+    ".github"
+  ],
   "scripts": {
-    "pretest": "npm run test:project-technology && npm run test:context-traversal && npm run test:project-continuity && npm run validate:project-technology-schemas",
+    "pretest": "npm run test:project-technology && npm run test:context-traversal && npm run test:project-continuity && npm run test:artifact-releases && npm run validate:project-technology-schemas",
     "test:project-technology": "node packages/cli/validate-project-technology.js",
     "test:context-traversal": "node packages/cli/validate-context-traversal.js",
     "test:project-continuity": "node packages/cli/validate-project-continuity.js",
+    "test:artifact-releases": "node packages/cli/validate-artifact-releases.js",
     "validate:project-technology-schemas": "node -e \"const fs=require('fs'); for (const file of ['project-technology-extension.schema.json','project-technology-target-export.schema.json','context-traversal-receipt.schema.json','context-pack.schema.json']) JSON.parse(fs.readFileSync('schemas/'+file))\"",
     "validate:graph-manifest": "node packages/cli/validate-graph-manifest-migration.js",
     "validate:minimal": "node packages/cli/validate-mirai-graph.js examples/minimal-graph",
@@ -88,39 +123,5 @@
     "validate:playground-report": "npm run --silent playground:report >/tmp/mirai-graph-playground-report.md && diff -u playground/demo-report.md /tmp/mirai-graph-playground-report.md && rg 'transition explanation|Instrumentation|Multi-source feedback|Baseline Comparison|baseline comparison' playground/demo-report.md",
     "test": "npm run validate:graph-manifest && npm run validate:minimal && npm run validate:benchmark && npm run validate:seed && npm run validate:profiles && npm run validate:ai-employee && npm run validate:skill-runtime && npm run validate:managed-project && npm run validate:implementation-control && npm run validate:implementation-control-cycles && npm run validate:launch-record && npm run validate:process-transition && npm run validate:process-transition-report && npm run validate:process-control && npm run validate:technology-quality-feedback && npm run validate:instrumentation-layer && npm run validate:instrumentation-report && npm run validate:dynamic-episodes && npm run validate:dynamic-episode-report && npm run validate:semantic-intent-resolution && npm run validate:goal-vector-quality-control && npm run validate:dna-alignment && npm run validate:work-state && npm run validate:risk-control && npm run validate:source-boundary && npm run validate:organization-governance && npm run validate:societal-governance && npm run validate:character-layer && npm run validate:character-layer-integration && npm run validate:model-portability-evidence && npm run validate:character-layer-readiness && npm run validate:templates && npm run validate:adopter-workflow && npm run validate:self-service-onboarding && npm run validate:init-fixtures && npm run validate:bootstrap-fixtures && npm run validate:release-state && npm run validate:mirai-graph-compat && npm run validate:cli-unified && npm run validate:pilots && npm run validate:context-packs && npm run validate:profile-results && npm run validate:routing-control && npm run seed:preview && npm run context:generate && npm run playground:demo && npm run playground:report && npm run readiness:benchmark && npm run benchmark:synthetic && npm run validate:baseline-comparison && npm run validate:markdown-report && npm run validate:playground-demo && npm run validate:playground-report && npm run test:negative && npm run test:character-layer-semantic-negative && npm run test:societal-governance-negative && npm run test:process-transition-negative && npm run test:technology-quality-feedback-negative && npm run test:instrumentation-layer-negative && npm run test:dynamic-episodes-negative && npm run test:semantic-intent-resolution-negative && npm run test:goal-vector-quality-control-negative",
     "release:check": "npm test && git diff --check"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/zabarov/mirai-graph.git"
-  },
-  "keywords": [
-    "graph",
-    "knowledge-graph",
-    "governance",
-    "complex-systems",
-    "context-engineering",
-    "ai-assisted-work"
-  ],
-  "author": "Rim Zabarov",
-  "files": [
-    "README.md",
-    "CHANGELOG.md",
-    "ROADMAP.md",
-    "LICENSE",
-    "LICENSE-DOCS",
-    "CITATION.cff",
-    "docs",
-    "standard",
-    "schemas",
-    "benchmarks",
-    "examples",
-    "packages",
-    "profiles",
-    "pilots",
-    "playground",
-    "publications",
-    "releases",
-    "templates",
-    ".github"
-  ]
-}
+  }
+}

package/packages/cli/mirai-graph.js

@@ -25,7 +25,7 @@ function usage() {
   console.error("  mirai-graph report playground");
   console.error("  mirai-graph release state [--markdown] [--require-git-tag] [--require-github-release] [--require-npm-published]");
   console.error("  mirai-graph technology <explain|status|plan|verify|context> [repository] [options]");
-  console.error("  mirai-graph technology <enable|sync|connect|disconnect|provide|disable|repair> [repository] [options] [--apply]");
+  console.error("  mirai-graph technology <enable|sync|connect|disconnect|provide|disable|repair|artifact> [repository] [options] [--apply]");
   console.error("");
   console.error("Boundary:");
   console.error("  Reports explain validation decisions. They do not authorize canonical updates.");

package/packages/cli/project-technology.js

@@ -19,16 +19,25 @@ function usage() {
   console.error("         --phase expand --input <receipt.json> --select <id> [--select <id>]");
   console.error("         --phase compile --input <receipt.json> --selection <selection.json>");
   console.error("         --phase verify --packet <context-pack.json> --evidence <usage-evidence.json>");
+  console.error("Artifacts: artifact inspect <repo> --input <path>");
+  console.error("           artifact release <repo> --input <path> --matter-id <id> --direction inbound|internal|outbound [--parent-release <id>] [--client-note <text>] [--create-export] [--apply]");
+  console.error("           artifact compare <repo> --matter-id <id> --base-release <id> --target-release <id>");
+  console.error("           artifact verify <repo> --matter-id <id> --release-id <id>");
 }
 
 function parse(argv) {
   if (!argv.length) return null;
   const operation = argv.shift();
+  let artifactAction = null;
+  if (operation === "artifact") {
+    artifactAction = argv.shift() || null;
+    if (!new Set(["inspect", "release", "compare", "verify"]).has(artifactAction)) throw new Error("artifact requires inspect, release, compare or verify");
+  }
   let repository = ".";
   if (argv[0] && !argv[0].startsWith("--")) repository = argv.shift();
   const options = {};
-  const values = new Set(["--task", "--source", "--target-id", "--semantic-digest", "--provider-revision", "--max-objects", "--phase", "--input", "--select", "--selection", "--packet", "--evidence", "--selector", "--reason", "--confidence", "--context-budget", "--boundary", "--expected-graph-digest", "--receipt-digest", "--state-root"]);
-  const flags = new Set(["--apply", "--refresh-binding", "--significant-work"]);
+  const values = new Set(["--task", "--source", "--target-id", "--semantic-digest", "--provider-revision", "--max-objects", "--phase", "--input", "--select", "--selection", "--packet", "--evidence", "--selector", "--reason", "--confidence", "--context-budget", "--boundary", "--expected-graph-digest", "--receipt-digest", "--state-root", "--matter-id", "--direction", "--artifact-root", "--release-date", "--release-id", "--parent-release", "--base-release", "--target-release", "--client-note"]);
+  const flags = new Set(["--apply", "--refresh-binding", "--significant-work", "--create-export"]);
   const names = {
     "--task": "task", "--source": "source", "--target-id": "targetId",
     "--semantic-digest": "semanticDigest", "--provider-revision": "providerRevision",
@@ -40,6 +49,11 @@ function parse(argv) {
     "--context-budget": "contextBudget",
     "--boundary": "boundary", "--expected-graph-digest": "expectedGraphDigest",
     "--receipt-digest": "receiptDigest", "--state-root": "stateRoot",
+    "--matter-id": "matterId", "--direction": "direction", "--artifact-root": "artifactRoot",
+    "--release-date": "releaseDate", "--release-id": "releaseId",
+    "--parent-release": "parentReleaseIds", "--base-release": "baseReleaseId",
+    "--target-release": "targetReleaseId", "--client-note": "clientNote",
+    "--create-export": "createExport",
   };
   while (argv.length) {
     const token = argv.shift();
@@ -48,9 +62,11 @@ function parse(argv) {
       if (!argv.length) throw new Error(`missing value for ${token}`);
       const value = argv.shift();
       if (token === "--select") options.selectedIds = [...(options.selectedIds || []), value];
+      else if (token === "--parent-release") options.parentReleaseIds = [...(options.parentReleaseIds || []), value];
       else options[names[token]] = value;
     } else throw new Error(`unsupported argument ${token}`);
   }
+  if (artifactAction) options.artifactAction = artifactAction;
   return { operation, repository: path.resolve(repository), options };
 }
 

package/packages/cli/validate-artifact-releases.js

@@ -0,0 +1,282 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const crypto = require("crypto");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const zlib = require("zlib");
+const technology = require("../project-technology");
+
+let passed = 0;
+const failures = [];
+function check(id, condition, detail = null) {
+  if (condition) passed += 1;
+  else failures.push({ id, detail });
+}
+
+function writeJson(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function repository(root, id) {
+  const repo = path.join(root, id);
+  fs.mkdirSync(repo, { recursive: true });
+  writeJson(path.join(repo, "graph.json"), {
+    $schema: "https://mirai-graph.dev/schemas/graph-manifest.schema.json",
+    format: "mirai-graph",
+    schema_version: "2.0.0",
+    id,
+    aliases: [],
+    title: id,
+    scope: "repository",
+    kind: "project_graph",
+    owner: "fixture",
+    profiles: [],
+    graph: { root: "graph", source_of_truth: ["graph/specs"], objects: [], relations: [], schemas: [], generated: [], raw_sources: [] },
+    imports: [],
+    extensions: { "mirai.project_technology": { contract_version: "1.0.0", enabled: true, context_policy: "task_scoped", source_boundary: "hybrid_sot" } },
+  });
+  return repo;
+}
+
+function octal(value, width) {
+  return Buffer.from(value.toString(8).padStart(width - 1, "0") + "\0");
+}
+
+function tar(entries) {
+  const output = [];
+  for (const [name, content] of Object.entries(entries)) {
+    const bytes = Buffer.from(content);
+    const header = Buffer.alloc(512);
+    Buffer.from(name).copy(header, 0, 0, 100);
+    octal(0o600, 8).copy(header, 100);
+    octal(0, 8).copy(header, 108);
+    octal(0, 8).copy(header, 116);
+    octal(bytes.length, 12).copy(header, 124);
+    octal(0, 12).copy(header, 136);
+    Buffer.from("        ").copy(header, 148);
+    header[156] = "0".charCodeAt(0);
+    Buffer.from("ustar\0").copy(header, 257);
+    const checksum = header.reduce((sum, byte) => sum + byte, 0);
+    octal(checksum, 8).copy(header, 148);
+    output.push(header, bytes, Buffer.alloc((512 - (bytes.length % 512)) % 512));
+  }
+  output.push(Buffer.alloc(1024));
+  return Buffer.concat(output);
+}
+
+function rawZip(entries) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+  for (const entry of entries) {
+    const name = Buffer.from(entry.name);
+    const content = Buffer.from(entry.content || "");
+    const compressed = zlib.deflateRawSync(content);
+    const flags = entry.flags || 0x0800;
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(0x04034b50, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(flags, 6);
+    local.writeUInt16LE(8, 8);
+    local.writeUInt32LE(compressed.length, 18);
+    local.writeUInt32LE(entry.claimedSize || content.length, 22);
+    local.writeUInt16LE(name.length, 26);
+    localParts.push(local, name, compressed);
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(0x02014b50, 0);
+    central.writeUInt16LE(0x0314, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(flags, 8);
+    central.writeUInt16LE(8, 10);
+    central.writeUInt32LE(compressed.length, 20);
+    central.writeUInt32LE(entry.claimedSize || content.length, 24);
+    central.writeUInt16LE(name.length, 28);
+    central.writeUInt32LE(entry.externalAttributes || 0, 38);
+    central.writeUInt32LE(offset, 42);
+    centralParts.push(central, name);
+    offset += local.length + name.length + compressed.length;
+  }
+  const centralBytes = Buffer.concat(centralParts);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralBytes.length, 12);
+  end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...localParts, centralBytes, end]);
+}
+
+function repoSnapshot(repo) {
+  const files = [];
+  function walk(current) {
+    for (const name of fs.readdirSync(current).sort()) {
+      const absolute = path.join(current, name);
+      const stat = fs.lstatSync(absolute);
+      if (stat.isDirectory()) walk(absolute);
+      else if (stat.isFile()) files.push([path.relative(repo, absolute), crypto.createHash("sha256").update(fs.readFileSync(absolute)).digest("hex")]);
+    }
+  }
+  walk(repo);
+  return JSON.stringify(files);
+}
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), "mirai-artifact-release-"));
+const repo = repository(root, "artifact-project");
+const input = path.join(root, "incoming");
+fs.mkdirSync(input);
+fs.writeFileSync(path.join(input, "contract.txt"), "version one\n");
+
+const inspectBefore = repoSnapshot(repo);
+const inspected = technology.inspectArtifactBundle(repo, input);
+check("inspect_success", inspected.status === "success" && inspected.bundle.file_count === 1, inspected);
+check("inspect_zero_write", repoSnapshot(repo) === inspectBefore);
+
+const preview = technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main",
+  direction: "inbound",
+  artifactRoot: "documents/matters",
+  releaseDate: "20260828",
+});
+check("release_preview", preview.status === "preview" && preview.operation_mode === "preview" && preview.changed === false, preview);
+check("preview_zero_write", repoSnapshot(repo) === inspectBefore);
+
+const first = technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main",
+  direction: "inbound",
+  artifactRoot: "documents/matters",
+  releaseDate: "20260828",
+  apply: true,
+});
+check("first_release_created", first.status === "success" && first.changed && first.release_id === "20260828-01", first);
+check("first_release_verified", technology.verifyArtifactRelease(repo, first.release_id, { matterId: "contract-main" }).status === "success");
+
+const repeated = technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main",
+  direction: "inbound",
+  artifactRoot: "documents/matters",
+  releaseDate: "20260828",
+  apply: true,
+});
+check("same_release_idempotent", repeated.status === "success" && repeated.changed === false && repeated.release_id === first.release_id, repeated);
+
+fs.writeFileSync(path.join(input, "contract.txt"), "version two\n");
+fs.writeFileSync(path.join(input, "appendix.txt"), "appendix\n");
+const second = technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main",
+  direction: "outbound",
+  artifactRoot: "documents/matters",
+  releaseDate: "20260828",
+  parentReleaseIds: [first.release_id],
+  clientNote: "Обновлены условия и добавлено приложение.",
+  createExport: true,
+  apply: true,
+});
+check("second_release_numbered", second.status === "success" && second.release_id === "20260828-02", second);
+check("client_export_created", Boolean(second.export_ref && fs.existsSync(path.join(repo, second.export_ref))), second);
+const compared = technology.compareArtifactReleases(repo, first.release_id, second.release_id, { matterId: "contract-main" });
+check("comparison_detects_changes", compared.status === "success" && compared.comparison.added.includes("appendix.txt") && compared.comparison.changed.includes("contract.txt"), compared);
+
+const readOnlySnapshot = repoSnapshot(repo);
+check("verify_success", technology.verifyArtifactRelease(repo, second.release_id, { matterId: "contract-main" }).status === "success");
+check("compare_and_verify_zero_write", repoSnapshot(repo) === readOnlySnapshot);
+const exportedInspect = technology.inspectArtifactBundle(repo, path.join(repo, second.export_ref));
+check("generated_zip_is_readable", exportedInspect.status === "success" && exportedInspect.bundle.file_count === 3, exportedInspect);
+
+const secondFile = path.join(repo, "documents/matters/contract-main/releases/20260828-02/package/contract.txt");
+const secondBytes = fs.readFileSync(secondFile);
+fs.writeFileSync(secondFile, "tampered\n");
+check("tampered_file_blocked", technology.verifyArtifactRelease(repo, second.release_id, { matterId: "contract-main" }).blockers.includes("artifact_package_file_digest_mismatch"));
+fs.writeFileSync(secondFile, secondBytes);
+
+check("missing_parent_blocked", technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main", direction: "internal", artifactRoot: "documents/matters",
+  releaseDate: "20260829", parentReleaseIds: ["20260101-01"], apply: true,
+}).blockers.includes("artifact_parent_release_missing"));
+check("stale_cas_blocked", technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main", direction: "internal", artifactRoot: "documents/matters",
+  releaseDate: "20260829", expectedGraphDigest: "sha256:" + "0".repeat(64), apply: true,
+}).blockers.includes("artifact_registry_compare_and_swap_conflict"));
+
+const lease = path.join(repo, "documents/matters/contract-main/.artifact-release.lock");
+fs.writeFileSync(lease, "busy");
+check("concurrent_lease_blocked", technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main", direction: "internal", artifactRoot: "documents/matters",
+  releaseDate: "20260829", apply: true,
+}).blockers.includes("artifact_release_lease_conflict"));
+fs.unlinkSync(lease);
+
+const other = technology.createArtifactRelease(repo, input, {
+  matterId: "nda-secondary", direction: "inbound", artifactRoot: "documents/matters",
+  releaseDate: "20260828", apply: true,
+});
+check("multiple_matters_independent", other.status === "success" && other.release_id === "20260828-01", other);
+
+const tarPath = path.join(root, "safe.tar");
+fs.writeFileSync(tarPath, tar({ "folder/agreement.txt": "safe\n" }));
+check("tar_supported", technology.inspectArtifactBundle(repo, tarPath).status === "success");
+const tgzPath = path.join(root, "safe.tar.gz");
+fs.writeFileSync(tgzPath, zlib.gzipSync(fs.readFileSync(tarPath)));
+check("tar_gz_supported", technology.inspectArtifactBundle(repo, tgzPath).status === "success");
+
+const unsafeTar = path.join(root, "unsafe.tar");
+fs.writeFileSync(unsafeTar, tar({ "../escape.txt": "unsafe\n" }));
+check("traversal_blocked", technology.inspectArtifactBundle(repo, unsafeTar).blockers.includes("artifact_path_unsafe"));
+const unsafeZip = path.join(root, "unsafe.zip");
+fs.writeFileSync(unsafeZip, rawZip([{ name: "../escape.txt", content: "unsafe" }]));
+check("zip_traversal_blocked", technology.inspectArtifactBundle(repo, unsafeZip).blockers.includes("artifact_path_unsafe"));
+const encryptedZip = path.join(root, "encrypted.zip");
+fs.writeFileSync(encryptedZip, rawZip([{ name: "contract.txt", content: "secret", flags: 0x0801 }]));
+check("encrypted_zip_blocked", technology.inspectArtifactBundle(repo, encryptedZip).blockers.includes("artifact_archive_encrypted"));
+const duplicateZip = path.join(root, "duplicate.zip");
+fs.writeFileSync(duplicateZip, rawZip([{ name: "Contract.txt", content: "a" }, { name: "contract.txt", content: "b" }]));
+check("normalized_duplicate_blocked", technology.inspectArtifactBundle(repo, duplicateZip).blockers.includes("artifact_normalized_path_duplicate"));
+const symlinkZip = path.join(root, "symlink.zip");
+fs.writeFileSync(symlinkZip, rawZip([{ name: "contract-link", content: "target", externalAttributes: (0o120777 << 16) >>> 0 }]));
+check("zip_symlink_blocked", technology.inspectArtifactBundle(repo, symlinkZip).blockers.includes("artifact_symlink_blocked"));
+const bombZip = path.join(root, "bomb.zip");
+fs.writeFileSync(bombZip, rawZip([{ name: "large.txt", content: "a", claimedSize: 50 * 1024 * 1024 }]));
+check("compression_ratio_blocked", technology.inspectArtifactBundle(repo, bombZip).blockers.includes("artifact_compression_ratio_limit_exceeded"));
+const executable = path.join(root, "payload.exe");
+fs.writeFileSync(executable, "not executable");
+check("executable_blocked", technology.inspectArtifactBundle(repo, executable).blockers.includes("artifact_executable_or_macro_blocked"));
+const unsupported = path.join(root, "bundle.7z");
+fs.writeFileSync(unsupported, "fixture");
+check("unsupported_archive_blocked", technology.inspectArtifactBundle(repo, unsupported).blockers.includes("artifact_archive_provider_required"));
+
+if (process.platform !== "win32") {
+  const symlink = path.join(root, "input-link");
+  fs.symlinkSync(input, symlink);
+  check("input_symlink_blocked", technology.inspectArtifactBundle(repo, symlink).blockers.includes("artifact_input_symlink_blocked"));
+}
+
+const registryText = fs.readFileSync(path.join(repo, "graph/specs/artifact-releases.json"), "utf8");
+check("registry_has_no_host_path", !registryText.includes(root));
+check("registry_has_no_document_content", !registryText.includes("version two") && !registryText.includes("Обновлены условия"));
+
+const folder = repository(root, "shared-folder");
+const folderInput = path.join(root, "folder-input.txt");
+fs.writeFileSync(folderInput, "same bytes\n");
+const folderRelease = technology.createArtifactRelease(folder, folderInput, {
+  matterId: "matter-one", direction: "inbound", releaseDate: "20260828", apply: true,
+});
+check("plain_folder_supported", folderRelease.status === "success", folderRelease);
+const folderRepeat = technology.createArtifactRelease(folder, folderInput, {
+  matterId: "matter-one", direction: "inbound", releaseDate: "20260828", apply: true,
+});
+check("plain_folder_repeat_byte_identical", folderRepeat.changed === false);
+
+const report = {
+  schema_version: "1.0.0",
+  operation_id: "mirai.project_technology.artifact_release_validation",
+  status: failures.length ? "fail" : "success",
+  passed,
+  failed: failures.length,
+  failures,
+};
+process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+fs.rmSync(root, { recursive: true, force: true });
+process.exitCode = failures.length ? 1 : 0;