mirai-graph 1.2.0 → 1.3.0

package/packages/project-technology/index.js

@@ -15,6 +15,7 @@ const {
 } = require("../cli/graph-manifest");
 const traversal = require("./context-traversal");
 const continuity = require("./continuity");
+const artifacts = require("./artifact-release");
 
 const CONTRACT_VERSION = "1.0.0";
 const EXTENSION_KEY = "mirai.project_technology";
@@ -788,6 +789,7 @@ function verify(repoArg, options = {}) {
 }
 
 function execute(operation, repoArg, options = {}) {
+  if (operation === "artifact") return artifacts.executeArtifact(repoArg, options);
   const readOnly = { explain, status, plan, verify, context };
   if (readOnly[operation]) return readOnly[operation](repoArg, options);
   const transactional = { enable, sync, connect, disconnect, provide, disable, repair };
@@ -802,9 +804,11 @@ module.exports = {
   LOCAL_DIR,
   bindingValues,
   canonicalBytes,
+  compareArtifactReleases: artifacts.compareArtifactReleases,
   connect,
   compileContext: traversal.compileContext,
   context,
+  createArtifactRelease: artifacts.createArtifactRelease,
   discoverContext: traversal.discoverContext,
   disable,
   disconnect,
@@ -814,6 +818,7 @@ module.exports = {
   explain,
   extensionContract,
   inventory,
+  inspectArtifactBundle: artifacts.inspectArtifactBundle,
   normalizeExecutionContract,
   continuity,
   plan,
@@ -825,5 +830,6 @@ module.exports = {
   sync,
   targetBindingStatus,
   verify,
+  verifyArtifactRelease: artifacts.verifyArtifactRelease,
   verifyContext: traversal.verifyContext,
 };

package/releases/1.3.0.md

@@ -0,0 +1,16 @@
+# Mirai Graph 1.3.0
+
+Mirai Graph 1.3.0 adds generic immutable releases for file bundles to the
+existing Project Technology engine.
+
+Projects can inspect a bundle, preview or create a release, compare two
+releases and verify stored files against their manifest. The graph stores only
+safe lineage, state, references and checksums; protected artifact content
+remains outside graph data.
+
+The release supports direct files, directories, ZIP, TAR and TAR.GZ, with
+fail-closed archive checks, transactional activation, rollback, concurrency
+protection and idempotent repeats.
+
+The public `graph.json` schema remains `2.0.0`. The Project Technology
+activation contract remains `1.0.0`.

package/releases/README.md

@@ -20,6 +20,7 @@ Release notes must separate:
 - [v1.1.0](1.1.0.md) - universal sequential context traversal and usage
   verification in Project Technology.
 - [v1.0.0](1.0.0.md) - stable Project Technology, CLI and public contract.
+- [v1.3.0](1.3.0.md) - immutable artifact releases in Project Technology.
 - [v1.0.0-rc.6](1.0.0-rc.6.md) - anti-drift / quality-control release
   consolidation across Semantic Intent, Dynamic Episode, Goal Vector and
   Technology Quality Feedback.

package/standard/project-technology.md

@@ -1,6 +1,6 @@
 # Project Technology
 
-Status: 1.2 stable standard; activation contract remains 1.0.0
+Status: 1.3 stable standard; activation contract remains 1.0.0
 
 Project Technology is the shared executable mechanism of Mirai Graph. It is
 not a profile, a second graph or a source of domain methodology.
@@ -19,6 +19,46 @@ Each graph keeps its own objects and relations. Project Technology only
 standardizes safe inventory, task context, accepted-target binding, freshness
 and verification.
 
+## Immutable Artifact Releases
+
+Project Technology can preserve versioned file bundles without turning their
+contents into graph data:
+
+```text
+inspect -> release preview -> transactional release -> compare -> verify
+```
+
+The generic CLI is:
+
+```bash
+mirai-graph technology artifact inspect . --input incoming.zip
+mirai-graph technology artifact release . --input incoming.zip --matter-id agreement-main --direction inbound
+mirai-graph technology artifact release . --input incoming.zip --matter-id agreement-main --direction inbound --apply
+mirai-graph technology artifact compare . --matter-id agreement-main --base-release 20260828-01 --target-release 20260828-02
+mirai-graph technology artifact verify . --matter-id agreement-main --release-id 20260828-02
+```
+
+The programmatic API exposes `inspectArtifactBundle`,
+`createArtifactRelease`, `compareArtifactReleases` and
+`verifyArtifactRelease`.
+
+Each immutable release keeps the original input, a normalized package, a
+hash-bound manifest and a technical comparison. The portable registry at
+`graph/specs/artifact-releases.json` stores only opaque matter/release ids,
+relative or provider refs, lineage, state and digests. Raw files, document
+contents, party names and private discussion remain in the protected artifact
+store.
+
+Direct files, directories, ZIP, TAR and TAR.GZ are supported. Unsafe paths,
+links, encrypted archives, executable or macro-enabled files, nested archives,
+normalized path collisions and configured archive limits fail closed. RAR and
+7z need an explicitly supplied safe provider.
+
+Creation uses a lease, compare-and-swap registry digest, temporary assembly,
+atomic activation and readback. Repeating the same release returns
+`changed=false`. Domain consumers own the meaning of release states; Mirai
+Graph owns only generic identity, lineage, integrity and technical comparison.
+
 ## Portable Project Continuity
 
 Project Technology preserves verified project experience at task boundaries:
@@ -137,6 +177,10 @@ source still answers "how should the domain work be done?".
   rejected from portable continuity.
 - Significant work with an enabled continuity policy fails closed when its
   terminal receipt is missing or stale.
+- Artifact inspection, comparison and verification are read-only. Release
+  creation is preview-only without `--apply`.
+- An artifact manifest or generated export never proves legal, business or
+  domain acceptance.
 - A context pack is not ready while a required branch, source, access boundary
   or validator is missing, stale, blocked, deprecated, conflicting or
   digest-mismatched.