mirai-graph 1.2.0 → 1.4.0

package/CHANGELOG.md

@@ -4,6 +4,58 @@ All notable changes to Mirai Graph will be documented in this file.
 
 ## [Unreleased]
 
+## [1.4.0] - 2026-08-29
+
+### Added
+
+- A domain-neutral executable-technology contract for large, ordered methods
+  whose scenarios reuse independently executable operations.
+- Deterministic Course Pack compilation with required dependency closure,
+  exact source binding and partial courses for one scenario.
+- Read-only `technology course compile`, `verify` and `reconcile` operations in
+  the public CLI and JavaScript API.
+- Universal positive and negative fixtures for course projection.
+
+### Safety Boundary
+
+- A course is a projection, not another source of truth. Reconciliation never
+  writes to the executable technology and semantic changes require an owner
+  decision.
+- Missing operations, dependency cycles, stale digests and secret fields fail
+  closed.
+- The public `graph.json` schema remains `2.0.0`; the Project Technology
+  activation contract remains `1.0.0` and no new profile is introduced.
+
+## [1.3.0] - 2026-08-28
+
+### Added
+
+- Generic immutable artifact releases in the existing Project Technology
+  engine: inspect, release, compare and verify.
+- Public JavaScript API and matching CLI for direct files, directories, ZIP,
+  TAR and TAR.GZ bundles.
+- Hash-bound manifests, release lineage, technical comparisons, deterministic
+  client-safe exports and portable metadata in `graph/specs`.
+- Transactional release creation with lease, compare-and-swap, atomic
+  activation, readback, rollback and idempotent repeat behavior.
+
+### Safety Boundary
+
+- Unsafe paths, links, encrypted or nested archives, executable and
+  macro-enabled files, normalized duplicates and archive-limit violations fail
+  closed.
+- Raw artifacts and private document content do not enter graph metadata.
+- Artifact integrity is not domain approval; consumers retain semantic
+  ownership.
+- The public graph schema remains `2.0.0` and the Project Technology
+  activation contract remains `1.0.0`.
+
+### Verification
+
+- New fixtures cover immutable releases, multiple matters, branching,
+  comparisons, tamper detection, concurrency, CAS conflicts, safe archives,
+  unsupported formats, read-only zero-write and shared folders.
+
 ## [1.2.0] - 2026-08-27
 
 ### Added

package/README.md

@@ -10,7 +10,7 @@ Use it when a software project has useful knowledge spread across README files,
 docs, issues, chats, code comments and AI prompts, and you need a small
 machine-readable map that developers and AI assistants can validate and reuse.
 
-Status: stable public `1.2.0` release.
+Status: stable public `1.3.0` release.
 
 ## What Problem Does It Solve?
 
@@ -42,7 +42,7 @@ Start with a normal repository and use Mirai Graph to:
 
 ## Current Installation Status
 
-The repository provides the stable `mirai-graph@1.2.0` package. To verify a
+The repository provides the stable `mirai-graph@1.3.0` package. To verify a
 repository checkout directly, use:
 
 ```bash
@@ -142,6 +142,37 @@ Accepted facts and reusable cases live in `graph/specs`; mutable receipts and
 rollback data stay host-local. The same contract works in Git repositories and
 ordinary shared folders.
 
+Project Technology can also preserve immutable releases of file bundles:
+
+```bash
+mirai-graph technology artifact inspect . --input incoming.zip
+mirai-graph technology artifact release . --input incoming.zip --matter-id agreement-main --direction inbound
+mirai-graph technology artifact release . --input incoming.zip --matter-id agreement-main --direction inbound --apply
+mirai-graph technology artifact compare . --matter-id agreement-main --base-release 20260828-01 --target-release 20260828-02
+mirai-graph technology artifact verify . --matter-id agreement-main --release-id 20260828-02
+```
+
+The protected files remain outside graph data. The graph keeps only safe
+identity, lineage, state, references and checksums. Mirai Graph performs
+technical integrity checks; a domain owner decides what a version means.
+
+Large operational methods can be described once as executable technologies and
+compiled into staff courses without maintaining a second semantic copy:
+
+```bash
+mirai-graph technology course compile . --technology graph/specs/technology.json
+mirai-graph technology course compile . --technology graph/specs/technology.json --scenario scenario.recovery
+mirai-graph technology course verify . --course-pack course-pack.json
+mirai-graph technology course reconcile . --course-pack course-pack.json --projection edited-course.json
+```
+
+An executable technology contains reusable operations, their prerequisites,
+inputs, outputs, stop conditions, rollback paths, checks and raw source refs.
+Scenarios select the operations needed for a complete or partial outcome.
+Compilation restores every required dependency. Reconciliation is read-only:
+editorial differences go to the documentation owner, while changed execution
+or safety rules become proposals to the technology owner.
+
 Changing operations return a preview unless `--apply` is explicit. See
 [Project Technology](standard/project-technology.md) for provider/consumer
 binding, local state and safety boundaries.

package/docs/adoption/cli.md

@@ -91,6 +91,19 @@ npx mirai-graph technology context . --phase compile --input receipt.json --sele
 npx mirai-graph technology context . --phase verify --packet context-pack.json --evidence usage-evidence.json
 ```
 
+Versioned file bundles use the same Project Technology entrypoint:
+
+```bash
+npx mirai-graph technology artifact inspect . --input incoming.zip
+npx mirai-graph technology artifact release . --input incoming.zip --matter-id agreement-main --direction inbound
+npx mirai-graph technology artifact release . --input incoming.zip --matter-id agreement-main --direction inbound --apply
+npx mirai-graph technology artifact compare . --matter-id agreement-main --base-release 20260828-01 --target-release 20260828-02
+npx mirai-graph technology artifact verify . --matter-id agreement-main --release-id 20260828-02
+```
+
+Inspection, comparison and verification are read-only. Release creation is a
+preview until `--apply` is present.
+
 Omitting `--phase` keeps the original bounded context-discovery behavior.
 Receipt, selection, context-pack and usage-evidence files are caller-owned
 inputs and outputs; the command never stores them itself.

package/examples/executable-technology-course/README.md

@@ -0,0 +1,16 @@
+# Executable Technology Course
+
+This domain-neutral fixture demonstrates one accepted executable technology,
+two independently usable scenarios and a deterministic instructional course
+projection. The recovery scenario automatically includes its required
+inventory operation.
+
+```bash
+mirai-graph technology course compile . \
+  --technology examples/executable-technology-course/technology.json \
+  --scenario scenario.recovery_preparation
+```
+
+Course packs are read-only projections. Their reconciliation result can return
+editorial changes, but semantic changes remain owner proposals and never write
+back into the executable technology.

package/examples/executable-technology-course/technology.json

@@ -0,0 +1,99 @@
+{
+  "schema_version": "1.0.0",
+  "id": "technology.service_release",
+  "title": "Safe service release",
+  "owner": "role.release_owner",
+  "outcome": "A verified service version is promoted with a tested recovery path.",
+  "lifecycle": "accepted",
+  "version": "2026.08",
+  "source_refs": ["repo://example/operations/release.md"],
+  "projection_refs": ["docs://staff-course/service-release"],
+  "operations": [
+    {
+      "id": "operation.inventory",
+      "title": "Inventory the current state",
+      "summary": "Record exact versions, dependencies and available environments before change.",
+      "owner": "role.release_owner",
+      "capability_ref": "capability.release.inventory",
+      "prerequisites": [],
+      "input_refs": ["input.release_request"],
+      "output_refs": ["evidence.current_state"],
+      "check_refs": ["check.inventory_complete"],
+      "stop_condition_refs": ["stop.unknown_current_state"],
+      "rollback_refs": [],
+      "source_refs": ["repo://example/operations/inventory.md"],
+      "instructional_refs": ["lesson.inventory"],
+      "applicability": ["release", "recovery"],
+      "negative_boundaries": ["Do not mutate the environment during inventory."]
+    },
+    {
+      "id": "operation.backup",
+      "title": "Prepare recovery",
+      "summary": "Create and verify a bounded backup and rollback procedure.",
+      "owner": "role.operations",
+      "capability_ref": "capability.release.recovery",
+      "prerequisites": ["operation.inventory"],
+      "input_refs": ["evidence.current_state"],
+      "output_refs": ["evidence.backup", "procedure.rollback"],
+      "check_refs": ["check.restore_smoke"],
+      "stop_condition_refs": ["stop.restore_not_proven"],
+      "rollback_refs": ["procedure.rollback"],
+      "source_refs": ["repo://example/operations/recovery.md"],
+      "instructional_refs": ["lesson.recovery"],
+      "applicability": ["release", "recovery"],
+      "negative_boundaries": ["A backup without a restore check is not sufficient."]
+    },
+    {
+      "id": "operation.validate",
+      "title": "Validate the candidate",
+      "summary": "Run the required functional, compatibility and safety checks.",
+      "owner": "role.tester",
+      "capability_ref": "capability.release.validation",
+      "prerequisites": ["operation.inventory"],
+      "input_refs": ["input.release_candidate"],
+      "output_refs": ["evidence.validation"],
+      "check_refs": ["check.acceptance"],
+      "stop_condition_refs": ["stop.blocking_regression"],
+      "rollback_refs": [],
+      "source_refs": ["repo://example/operations/validation.md"],
+      "instructional_refs": ["lesson.validation"],
+      "applicability": ["release"],
+      "negative_boundaries": ["A green syntax check is not an outcome verdict."]
+    },
+    {
+      "id": "operation.promote",
+      "title": "Promote the accepted version",
+      "summary": "Apply the exact accepted candidate and verify the resulting identity.",
+      "owner": "role.release_owner",
+      "capability_ref": "capability.release.promotion",
+      "prerequisites": ["operation.backup", "operation.validate"],
+      "input_refs": ["evidence.backup", "evidence.validation"],
+      "output_refs": ["evidence.release_readback"],
+      "check_refs": ["check.release_identity", "check.runtime_smoke"],
+      "stop_condition_refs": ["stop.identity_mismatch"],
+      "rollback_refs": ["procedure.rollback"],
+      "source_refs": ["repo://example/operations/promotion.md"],
+      "instructional_refs": ["lesson.promotion"],
+      "applicability": ["release"],
+      "negative_boundaries": ["Do not promote a candidate that differs from the accepted identity."]
+    }
+  ],
+  "scenarios": [
+    {
+      "id": "scenario.full_release",
+      "title": "Full release",
+      "outcome": "The accepted service version is released and verified.",
+      "operation_ids": ["operation.inventory", "operation.backup", "operation.validate", "operation.promote"],
+      "required_inputs": ["input.release_request", "input.release_candidate"],
+      "audience": ["release_manager", "operations_engineer"]
+    },
+    {
+      "id": "scenario.recovery_preparation",
+      "title": "Recovery preparation only",
+      "outcome": "A verified rollback path exists without performing a release.",
+      "operation_ids": ["operation.backup"],
+      "required_inputs": ["input.release_request"],
+      "audience": ["operations_engineer"]
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirai-graph",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "private": false,
   "description": "An evolutionary graph operating model for managing the growth of complex systems.",
   "license": "MIT",
@@ -13,11 +13,13 @@
     "./project-technology": "./packages/project-technology/index.js"
   },
   "scripts": {
-    "pretest": "npm run test:project-technology && npm run test:context-traversal && npm run test:project-continuity && npm run validate:project-technology-schemas",
+    "pretest": "npm run test:project-technology && npm run test:context-traversal && npm run test:project-continuity && npm run test:artifact-releases && npm run test:technology-courses && npm run validate:project-technology-schemas",
     "test:project-technology": "node packages/cli/validate-project-technology.js",
     "test:context-traversal": "node packages/cli/validate-context-traversal.js",
     "test:project-continuity": "node packages/cli/validate-project-continuity.js",
-    "validate:project-technology-schemas": "node -e \"const fs=require('fs'); for (const file of ['project-technology-extension.schema.json','project-technology-target-export.schema.json','context-traversal-receipt.schema.json','context-pack.schema.json']) JSON.parse(fs.readFileSync('schemas/'+file))\"",
+    "test:artifact-releases": "node packages/cli/validate-artifact-releases.js",
+    "test:technology-courses": "node packages/cli/validate-technology-course.js",
+    "validate:project-technology-schemas": "node -e \"const fs=require('fs'); for (const file of ['project-technology-extension.schema.json','project-technology-target-export.schema.json','context-traversal-receipt.schema.json','context-pack.schema.json','executable-technology.schema.json','technology-course-pack.schema.json']) JSON.parse(fs.readFileSync('schemas/'+file))\"",
     "validate:graph-manifest": "node packages/cli/validate-graph-manifest-migration.js",
     "validate:minimal": "node packages/cli/validate-mirai-graph.js examples/minimal-graph",
     "validate:benchmark": "node packages/cli/validate-mirai-graph.js benchmarks/synthetic-context-reduction-v0",

package/packages/cli/mirai-graph.js

@@ -25,7 +25,7 @@ function usage() {
   console.error("  mirai-graph report playground");
   console.error("  mirai-graph release state [--markdown] [--require-git-tag] [--require-github-release] [--require-npm-published]");
   console.error("  mirai-graph technology <explain|status|plan|verify|context> [repository] [options]");
-  console.error("  mirai-graph technology <enable|sync|connect|disconnect|provide|disable|repair> [repository] [options] [--apply]");
+  console.error("  mirai-graph technology <enable|sync|connect|disconnect|provide|disable|repair|artifact|course> [repository] [options] [--apply]");
   console.error("");
   console.error("Boundary:");
   console.error("  Reports explain validation decisions. They do not authorize canonical updates.");

package/packages/cli/project-technology.js

@@ -19,16 +19,33 @@ function usage() {
   console.error("         --phase expand --input <receipt.json> --select <id> [--select <id>]");
   console.error("         --phase compile --input <receipt.json> --selection <selection.json>");
   console.error("         --phase verify --packet <context-pack.json> --evidence <usage-evidence.json>");
+  console.error("Artifacts: artifact inspect <repo> --input <path>");
+  console.error("           artifact release <repo> --input <path> --matter-id <id> --direction inbound|internal|outbound [--parent-release <id>] [--client-note <text>] [--create-export] [--apply]");
+  console.error("           artifact compare <repo> --matter-id <id> --base-release <id> --target-release <id>");
+  console.error("           artifact verify <repo> --matter-id <id> --release-id <id>");
+  console.error("Courses: course compile <repo> --technology <file> [--scenario <id>] [--audience <id>]");
+  console.error("         course verify <repo> --course-pack <file>");
+  console.error("         course reconcile <repo> --course-pack <file> --projection <file>");
 }
 
 function parse(argv) {
   if (!argv.length) return null;
   const operation = argv.shift();
+  let artifactAction = null;
+  let courseAction = null;
+  if (operation === "artifact") {
+    artifactAction = argv.shift() || null;
+    if (!new Set(["inspect", "release", "compare", "verify"]).has(artifactAction)) throw new Error("artifact requires inspect, release, compare or verify");
+  }
+  if (operation === "course") {
+    courseAction = argv.shift() || null;
+    if (!new Set(["compile", "verify", "reconcile"]).has(courseAction)) throw new Error("course requires compile, verify or reconcile");
+  }
   let repository = ".";
   if (argv[0] && !argv[0].startsWith("--")) repository = argv.shift();
   const options = {};
-  const values = new Set(["--task", "--source", "--target-id", "--semantic-digest", "--provider-revision", "--max-objects", "--phase", "--input", "--select", "--selection", "--packet", "--evidence", "--selector", "--reason", "--confidence", "--context-budget", "--boundary", "--expected-graph-digest", "--receipt-digest", "--state-root"]);
-  const flags = new Set(["--apply", "--refresh-binding", "--significant-work"]);
+  const values = new Set(["--task", "--source", "--target-id", "--semantic-digest", "--provider-revision", "--max-objects", "--phase", "--input", "--select", "--selection", "--packet", "--evidence", "--selector", "--reason", "--confidence", "--context-budget", "--boundary", "--expected-graph-digest", "--receipt-digest", "--state-root", "--matter-id", "--direction", "--artifact-root", "--release-date", "--release-id", "--parent-release", "--base-release", "--target-release", "--client-note", "--technology", "--scenario", "--audience", "--course-pack", "--projection"]);
+  const flags = new Set(["--apply", "--refresh-binding", "--significant-work", "--create-export"]);
   const names = {
     "--task": "task", "--source": "source", "--target-id": "targetId",
     "--semantic-digest": "semanticDigest", "--provider-revision": "providerRevision",
@@ -40,6 +57,13 @@ function parse(argv) {
     "--context-budget": "contextBudget",
     "--boundary": "boundary", "--expected-graph-digest": "expectedGraphDigest",
     "--receipt-digest": "receiptDigest", "--state-root": "stateRoot",
+    "--matter-id": "matterId", "--direction": "direction", "--artifact-root": "artifactRoot",
+    "--release-date": "releaseDate", "--release-id": "releaseId",
+    "--parent-release": "parentReleaseIds", "--base-release": "baseReleaseId",
+    "--target-release": "targetReleaseId", "--client-note": "clientNote",
+    "--create-export": "createExport",
+    "--technology": "technologyFile", "--scenario": "scenarioIds",
+    "--audience": "audience", "--course-pack": "coursePackFile", "--projection": "projectionFile",
   };
   while (argv.length) {
     const token = argv.shift();
@@ -48,9 +72,13 @@ function parse(argv) {
       if (!argv.length) throw new Error(`missing value for ${token}`);
       const value = argv.shift();
       if (token === "--select") options.selectedIds = [...(options.selectedIds || []), value];
+      else if (token === "--parent-release") options.parentReleaseIds = [...(options.parentReleaseIds || []), value];
+      else if (token === "--scenario") options.scenarioIds = [...(options.scenarioIds || []), value];
       else options[names[token]] = value;
     } else throw new Error(`unsupported argument ${token}`);
   }
+  if (artifactAction) options.artifactAction = artifactAction;
+  if (courseAction) options.courseAction = courseAction;
   return { operation, repository: path.resolve(repository), options };
 }
 

package/packages/cli/validate-artifact-releases.js

@@ -0,0 +1,282 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const crypto = require("crypto");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const zlib = require("zlib");
+const technology = require("../project-technology");
+
+let passed = 0;
+const failures = [];
+function check(id, condition, detail = null) {
+  if (condition) passed += 1;
+  else failures.push({ id, detail });
+}
+
+function writeJson(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function repository(root, id) {
+  const repo = path.join(root, id);
+  fs.mkdirSync(repo, { recursive: true });
+  writeJson(path.join(repo, "graph.json"), {
+    $schema: "https://mirai-graph.dev/schemas/graph-manifest.schema.json",
+    format: "mirai-graph",
+    schema_version: "2.0.0",
+    id,
+    aliases: [],
+    title: id,
+    scope: "repository",
+    kind: "project_graph",
+    owner: "fixture",
+    profiles: [],
+    graph: { root: "graph", source_of_truth: ["graph/specs"], objects: [], relations: [], schemas: [], generated: [], raw_sources: [] },
+    imports: [],
+    extensions: { "mirai.project_technology": { contract_version: "1.0.0", enabled: true, context_policy: "task_scoped", source_boundary: "hybrid_sot" } },
+  });
+  return repo;
+}
+
+function octal(value, width) {
+  return Buffer.from(value.toString(8).padStart(width - 1, "0") + "\0");
+}
+
+function tar(entries) {
+  const output = [];
+  for (const [name, content] of Object.entries(entries)) {
+    const bytes = Buffer.from(content);
+    const header = Buffer.alloc(512);
+    Buffer.from(name).copy(header, 0, 0, 100);
+    octal(0o600, 8).copy(header, 100);
+    octal(0, 8).copy(header, 108);
+    octal(0, 8).copy(header, 116);
+    octal(bytes.length, 12).copy(header, 124);
+    octal(0, 12).copy(header, 136);
+    Buffer.from("        ").copy(header, 148);
+    header[156] = "0".charCodeAt(0);
+    Buffer.from("ustar\0").copy(header, 257);
+    const checksum = header.reduce((sum, byte) => sum + byte, 0);
+    octal(checksum, 8).copy(header, 148);
+    output.push(header, bytes, Buffer.alloc((512 - (bytes.length % 512)) % 512));
+  }
+  output.push(Buffer.alloc(1024));
+  return Buffer.concat(output);
+}
+
+function rawZip(entries) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+  for (const entry of entries) {
+    const name = Buffer.from(entry.name);
+    const content = Buffer.from(entry.content || "");
+    const compressed = zlib.deflateRawSync(content);
+    const flags = entry.flags || 0x0800;
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(0x04034b50, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(flags, 6);
+    local.writeUInt16LE(8, 8);
+    local.writeUInt32LE(compressed.length, 18);
+    local.writeUInt32LE(entry.claimedSize || content.length, 22);
+    local.writeUInt16LE(name.length, 26);
+    localParts.push(local, name, compressed);
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(0x02014b50, 0);
+    central.writeUInt16LE(0x0314, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(flags, 8);
+    central.writeUInt16LE(8, 10);
+    central.writeUInt32LE(compressed.length, 20);
+    central.writeUInt32LE(entry.claimedSize || content.length, 24);
+    central.writeUInt16LE(name.length, 28);
+    central.writeUInt32LE(entry.externalAttributes || 0, 38);
+    central.writeUInt32LE(offset, 42);
+    centralParts.push(central, name);
+    offset += local.length + name.length + compressed.length;
+  }
+  const centralBytes = Buffer.concat(centralParts);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralBytes.length, 12);
+  end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...localParts, centralBytes, end]);
+}
+
+function repoSnapshot(repo) {
+  const files = [];
+  function walk(current) {
+    for (const name of fs.readdirSync(current).sort()) {
+      const absolute = path.join(current, name);
+      const stat = fs.lstatSync(absolute);
+      if (stat.isDirectory()) walk(absolute);
+      else if (stat.isFile()) files.push([path.relative(repo, absolute), crypto.createHash("sha256").update(fs.readFileSync(absolute)).digest("hex")]);
+    }
+  }
+  walk(repo);
+  return JSON.stringify(files);
+}
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), "mirai-artifact-release-"));
+const repo = repository(root, "artifact-project");
+const input = path.join(root, "incoming");
+fs.mkdirSync(input);
+fs.writeFileSync(path.join(input, "contract.txt"), "version one\n");
+
+const inspectBefore = repoSnapshot(repo);
+const inspected = technology.inspectArtifactBundle(repo, input);
+check("inspect_success", inspected.status === "success" && inspected.bundle.file_count === 1, inspected);
+check("inspect_zero_write", repoSnapshot(repo) === inspectBefore);
+
+const preview = technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main",
+  direction: "inbound",
+  artifactRoot: "documents/matters",
+  releaseDate: "20260828",
+});
+check("release_preview", preview.status === "preview" && preview.operation_mode === "preview" && preview.changed === false, preview);
+check("preview_zero_write", repoSnapshot(repo) === inspectBefore);
+
+const first = technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main",
+  direction: "inbound",
+  artifactRoot: "documents/matters",
+  releaseDate: "20260828",
+  apply: true,
+});
+check("first_release_created", first.status === "success" && first.changed && first.release_id === "20260828-01", first);
+check("first_release_verified", technology.verifyArtifactRelease(repo, first.release_id, { matterId: "contract-main" }).status === "success");
+
+const repeated = technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main",
+  direction: "inbound",
+  artifactRoot: "documents/matters",
+  releaseDate: "20260828",
+  apply: true,
+});
+check("same_release_idempotent", repeated.status === "success" && repeated.changed === false && repeated.release_id === first.release_id, repeated);
+
+fs.writeFileSync(path.join(input, "contract.txt"), "version two\n");
+fs.writeFileSync(path.join(input, "appendix.txt"), "appendix\n");
+const second = technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main",
+  direction: "outbound",
+  artifactRoot: "documents/matters",
+  releaseDate: "20260828",
+  parentReleaseIds: [first.release_id],
+  clientNote: "Обновлены условия и добавлено приложение.",
+  createExport: true,
+  apply: true,
+});
+check("second_release_numbered", second.status === "success" && second.release_id === "20260828-02", second);
+check("client_export_created", Boolean(second.export_ref && fs.existsSync(path.join(repo, second.export_ref))), second);
+const compared = technology.compareArtifactReleases(repo, first.release_id, second.release_id, { matterId: "contract-main" });
+check("comparison_detects_changes", compared.status === "success" && compared.comparison.added.includes("appendix.txt") && compared.comparison.changed.includes("contract.txt"), compared);
+
+const readOnlySnapshot = repoSnapshot(repo);
+check("verify_success", technology.verifyArtifactRelease(repo, second.release_id, { matterId: "contract-main" }).status === "success");
+check("compare_and_verify_zero_write", repoSnapshot(repo) === readOnlySnapshot);
+const exportedInspect = technology.inspectArtifactBundle(repo, path.join(repo, second.export_ref));
+check("generated_zip_is_readable", exportedInspect.status === "success" && exportedInspect.bundle.file_count === 3, exportedInspect);
+
+const secondFile = path.join(repo, "documents/matters/contract-main/releases/20260828-02/package/contract.txt");
+const secondBytes = fs.readFileSync(secondFile);
+fs.writeFileSync(secondFile, "tampered\n");
+check("tampered_file_blocked", technology.verifyArtifactRelease(repo, second.release_id, { matterId: "contract-main" }).blockers.includes("artifact_package_file_digest_mismatch"));
+fs.writeFileSync(secondFile, secondBytes);
+
+check("missing_parent_blocked", technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main", direction: "internal", artifactRoot: "documents/matters",
+  releaseDate: "20260829", parentReleaseIds: ["20260101-01"], apply: true,
+}).blockers.includes("artifact_parent_release_missing"));
+check("stale_cas_blocked", technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main", direction: "internal", artifactRoot: "documents/matters",
+  releaseDate: "20260829", expectedGraphDigest: "sha256:" + "0".repeat(64), apply: true,
+}).blockers.includes("artifact_registry_compare_and_swap_conflict"));
+
+const lease = path.join(repo, "documents/matters/contract-main/.artifact-release.lock");
+fs.writeFileSync(lease, "busy");
+check("concurrent_lease_blocked", technology.createArtifactRelease(repo, input, {
+  matterId: "contract-main", direction: "internal", artifactRoot: "documents/matters",
+  releaseDate: "20260829", apply: true,
+}).blockers.includes("artifact_release_lease_conflict"));
+fs.unlinkSync(lease);
+
+const other = technology.createArtifactRelease(repo, input, {
+  matterId: "nda-secondary", direction: "inbound", artifactRoot: "documents/matters",
+  releaseDate: "20260828", apply: true,
+});
+check("multiple_matters_independent", other.status === "success" && other.release_id === "20260828-01", other);
+
+const tarPath = path.join(root, "safe.tar");
+fs.writeFileSync(tarPath, tar({ "folder/agreement.txt": "safe\n" }));
+check("tar_supported", technology.inspectArtifactBundle(repo, tarPath).status === "success");
+const tgzPath = path.join(root, "safe.tar.gz");
+fs.writeFileSync(tgzPath, zlib.gzipSync(fs.readFileSync(tarPath)));
+check("tar_gz_supported", technology.inspectArtifactBundle(repo, tgzPath).status === "success");
+
+const unsafeTar = path.join(root, "unsafe.tar");
+fs.writeFileSync(unsafeTar, tar({ "../escape.txt": "unsafe\n" }));
+check("traversal_blocked", technology.inspectArtifactBundle(repo, unsafeTar).blockers.includes("artifact_path_unsafe"));
+const unsafeZip = path.join(root, "unsafe.zip");
+fs.writeFileSync(unsafeZip, rawZip([{ name: "../escape.txt", content: "unsafe" }]));
+check("zip_traversal_blocked", technology.inspectArtifactBundle(repo, unsafeZip).blockers.includes("artifact_path_unsafe"));
+const encryptedZip = path.join(root, "encrypted.zip");
+fs.writeFileSync(encryptedZip, rawZip([{ name: "contract.txt", content: "secret", flags: 0x0801 }]));
+check("encrypted_zip_blocked", technology.inspectArtifactBundle(repo, encryptedZip).blockers.includes("artifact_archive_encrypted"));
+const duplicateZip = path.join(root, "duplicate.zip");
+fs.writeFileSync(duplicateZip, rawZip([{ name: "Contract.txt", content: "a" }, { name: "contract.txt", content: "b" }]));
+check("normalized_duplicate_blocked", technology.inspectArtifactBundle(repo, duplicateZip).blockers.includes("artifact_normalized_path_duplicate"));
+const symlinkZip = path.join(root, "symlink.zip");
+fs.writeFileSync(symlinkZip, rawZip([{ name: "contract-link", content: "target", externalAttributes: (0o120777 << 16) >>> 0 }]));
+check("zip_symlink_blocked", technology.inspectArtifactBundle(repo, symlinkZip).blockers.includes("artifact_symlink_blocked"));
+const bombZip = path.join(root, "bomb.zip");
+fs.writeFileSync(bombZip, rawZip([{ name: "large.txt", content: "a", claimedSize: 50 * 1024 * 1024 }]));
+check("compression_ratio_blocked", technology.inspectArtifactBundle(repo, bombZip).blockers.includes("artifact_compression_ratio_limit_exceeded"));
+const executable = path.join(root, "payload.exe");
+fs.writeFileSync(executable, "not executable");
+check("executable_blocked", technology.inspectArtifactBundle(repo, executable).blockers.includes("artifact_executable_or_macro_blocked"));
+const unsupported = path.join(root, "bundle.7z");
+fs.writeFileSync(unsupported, "fixture");
+check("unsupported_archive_blocked", technology.inspectArtifactBundle(repo, unsupported).blockers.includes("artifact_archive_provider_required"));
+
+if (process.platform !== "win32") {
+  const symlink = path.join(root, "input-link");
+  fs.symlinkSync(input, symlink);
+  check("input_symlink_blocked", technology.inspectArtifactBundle(repo, symlink).blockers.includes("artifact_input_symlink_blocked"));
+}
+
+const registryText = fs.readFileSync(path.join(repo, "graph/specs/artifact-releases.json"), "utf8");
+check("registry_has_no_host_path", !registryText.includes(root));
+check("registry_has_no_document_content", !registryText.includes("version two") && !registryText.includes("Обновлены условия"));
+
+const folder = repository(root, "shared-folder");
+const folderInput = path.join(root, "folder-input.txt");
+fs.writeFileSync(folderInput, "same bytes\n");
+const folderRelease = technology.createArtifactRelease(folder, folderInput, {
+  matterId: "matter-one", direction: "inbound", releaseDate: "20260828", apply: true,
+});
+check("plain_folder_supported", folderRelease.status === "success", folderRelease);
+const folderRepeat = technology.createArtifactRelease(folder, folderInput, {
+  matterId: "matter-one", direction: "inbound", releaseDate: "20260828", apply: true,
+});
+check("plain_folder_repeat_byte_identical", folderRepeat.changed === false);
+
+const report = {
+  schema_version: "1.0.0",
+  operation_id: "mirai.project_technology.artifact_release_validation",
+  status: failures.length ? "fail" : "success",
+  passed,
+  failed: failures.length,
+  failures,
+};
+process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+fs.rmSync(root, { recursive: true, force: true });
+process.exitCode = failures.length ? 1 : 0;