mirai-graph 1.3.0 → 1.5.0

package/CHANGELOG.md

@@ -4,6 +4,44 @@ All notable changes to Mirai Graph will be documented in this file.
 
 ## [Unreleased]
 
+## [1.5.0] - 2026-09-03
+
+Compatible 1.x maintenance line, published under `legacy-1`; the npm `latest`
+channel and the separate 2.x development line are unchanged.
+
+- Project Technology can connect and refresh a bounded provider export without
+  Git using explicit authenticated-release trust supplied by the consumer.
+  Exact export bytes, graph identity, revision and forward ancestry are checked;
+  target/architecture/permission gates are unchanged. No automatic trust discovery.
+- Read-only source export verification proves the archive anchor against the
+  accepted target and Git revision before a distributor seals it in release
+  metadata. CLI trust can be supplied on stdin; no temporary trust file is needed.
+- No-Git inventory covers explicitly declared graph and raw-source paths, detects
+  stale content and blocks unsafe or missing sources before sync writes. Existing
+  Git inventories remain revision-bound; this does not invent source history.
+
+## [1.4.0] - 2026-08-29
+
+### Added
+
+- A domain-neutral executable-technology contract for large, ordered methods
+  whose scenarios reuse independently executable operations.
+- Deterministic Course Pack compilation with required dependency closure,
+  exact source binding and partial courses for one scenario.
+- Read-only `technology course compile`, `verify` and `reconcile` operations in
+  the public CLI and JavaScript API.
+- Universal positive and negative fixtures for course projection.
+
+### Safety Boundary
+
+- A course is a projection, not another source of truth. Reconciliation never
+  writes to the executable technology and semantic changes require an owner
+  decision.
+- Missing operations, dependency cycles, stale digests and secret fields fail
+  closed.
+- The public `graph.json` schema remains `2.0.0`; the Project Technology
+  activation contract remains `1.0.0` and no new profile is introduced.
+
 ## [1.3.0] - 2026-08-28
 
 ### Added

package/CITATION.cff

@@ -17,5 +17,5 @@ keywords:
   - complex systems
   - context engineering
   - systems engineering
-version: "1.2.0"
-date-released: "2026-08-27"
+version: "1.5.0"
+date-released: "2026-09-03"

package/README.md

@@ -156,6 +156,23 @@ The protected files remain outside graph data. The graph keeps only safe
 identity, lineage, state, references and checksums. Mirai Graph performs
 technical integrity checks; a domain owner decides what a version means.
 
+Large operational methods can be described once as executable technologies and
+compiled into staff courses without maintaining a second semantic copy:
+
+```bash
+mirai-graph technology course compile . --technology graph/specs/technology.json
+mirai-graph technology course compile . --technology graph/specs/technology.json --scenario scenario.recovery
+mirai-graph technology course verify . --course-pack course-pack.json
+mirai-graph technology course reconcile . --course-pack course-pack.json --projection edited-course.json
+```
+
+An executable technology contains reusable operations, their prerequisites,
+inputs, outputs, stop conditions, rollback paths, checks and raw source refs.
+Scenarios select the operations needed for a complete or partial outcome.
+Compilation restores every required dependency. Reconciliation is read-only:
+editorial differences go to the documentation owner, while changed execution
+or safety rules become proposals to the technology owner.
+
 Changing operations return a preview unless `--apply` is explicit. See
 [Project Technology](standard/project-technology.md) for provider/consumer
 binding, local state and safety boundaries.

package/examples/executable-technology-course/README.md

@@ -0,0 +1,16 @@
+# Executable Technology Course
+
+This domain-neutral fixture demonstrates one accepted executable technology,
+two independently usable scenarios and a deterministic instructional course
+projection. The recovery scenario automatically includes its required
+inventory operation.
+
+```bash
+mirai-graph technology course compile . \
+  --technology examples/executable-technology-course/technology.json \
+  --scenario scenario.recovery_preparation
+```
+
+Course packs are read-only projections. Their reconciliation result can return
+editorial changes, but semantic changes remain owner proposals and never write
+back into the executable technology.

package/examples/executable-technology-course/technology.json

@@ -0,0 +1,99 @@
+{
+  "schema_version": "1.0.0",
+  "id": "technology.service_release",
+  "title": "Safe service release",
+  "owner": "role.release_owner",
+  "outcome": "A verified service version is promoted with a tested recovery path.",
+  "lifecycle": "accepted",
+  "version": "2026.08",
+  "source_refs": ["repo://example/operations/release.md"],
+  "projection_refs": ["docs://staff-course/service-release"],
+  "operations": [
+    {
+      "id": "operation.inventory",
+      "title": "Inventory the current state",
+      "summary": "Record exact versions, dependencies and available environments before change.",
+      "owner": "role.release_owner",
+      "capability_ref": "capability.release.inventory",
+      "prerequisites": [],
+      "input_refs": ["input.release_request"],
+      "output_refs": ["evidence.current_state"],
+      "check_refs": ["check.inventory_complete"],
+      "stop_condition_refs": ["stop.unknown_current_state"],
+      "rollback_refs": [],
+      "source_refs": ["repo://example/operations/inventory.md"],
+      "instructional_refs": ["lesson.inventory"],
+      "applicability": ["release", "recovery"],
+      "negative_boundaries": ["Do not mutate the environment during inventory."]
+    },
+    {
+      "id": "operation.backup",
+      "title": "Prepare recovery",
+      "summary": "Create and verify a bounded backup and rollback procedure.",
+      "owner": "role.operations",
+      "capability_ref": "capability.release.recovery",
+      "prerequisites": ["operation.inventory"],
+      "input_refs": ["evidence.current_state"],
+      "output_refs": ["evidence.backup", "procedure.rollback"],
+      "check_refs": ["check.restore_smoke"],
+      "stop_condition_refs": ["stop.restore_not_proven"],
+      "rollback_refs": ["procedure.rollback"],
+      "source_refs": ["repo://example/operations/recovery.md"],
+      "instructional_refs": ["lesson.recovery"],
+      "applicability": ["release", "recovery"],
+      "negative_boundaries": ["A backup without a restore check is not sufficient."]
+    },
+    {
+      "id": "operation.validate",
+      "title": "Validate the candidate",
+      "summary": "Run the required functional, compatibility and safety checks.",
+      "owner": "role.tester",
+      "capability_ref": "capability.release.validation",
+      "prerequisites": ["operation.inventory"],
+      "input_refs": ["input.release_candidate"],
+      "output_refs": ["evidence.validation"],
+      "check_refs": ["check.acceptance"],
+      "stop_condition_refs": ["stop.blocking_regression"],
+      "rollback_refs": [],
+      "source_refs": ["repo://example/operations/validation.md"],
+      "instructional_refs": ["lesson.validation"],
+      "applicability": ["release"],
+      "negative_boundaries": ["A green syntax check is not an outcome verdict."]
+    },
+    {
+      "id": "operation.promote",
+      "title": "Promote the accepted version",
+      "summary": "Apply the exact accepted candidate and verify the resulting identity.",
+      "owner": "role.release_owner",
+      "capability_ref": "capability.release.promotion",
+      "prerequisites": ["operation.backup", "operation.validate"],
+      "input_refs": ["evidence.backup", "evidence.validation"],
+      "output_refs": ["evidence.release_readback"],
+      "check_refs": ["check.release_identity", "check.runtime_smoke"],
+      "stop_condition_refs": ["stop.identity_mismatch"],
+      "rollback_refs": ["procedure.rollback"],
+      "source_refs": ["repo://example/operations/promotion.md"],
+      "instructional_refs": ["lesson.promotion"],
+      "applicability": ["release"],
+      "negative_boundaries": ["Do not promote a candidate that differs from the accepted identity."]
+    }
+  ],
+  "scenarios": [
+    {
+      "id": "scenario.full_release",
+      "title": "Full release",
+      "outcome": "The accepted service version is released and verified.",
+      "operation_ids": ["operation.inventory", "operation.backup", "operation.validate", "operation.promote"],
+      "required_inputs": ["input.release_request", "input.release_candidate"],
+      "audience": ["release_manager", "operations_engineer"]
+    },
+    {
+      "id": "scenario.recovery_preparation",
+      "title": "Recovery preparation only",
+      "outcome": "A verified rollback path exists without performing a release.",
+      "operation_ids": ["operation.backup"],
+      "required_inputs": ["input.release_request"],
+      "audience": ["operations_engineer"]
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirai-graph",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "private": false,
   "description": "An evolutionary graph operating model for managing the growth of complex systems.",
   "license": "MIT",
@@ -12,47 +12,14 @@
   "exports": {
     "./project-technology": "./packages/project-technology/index.js"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/zabarov/mirai-graph.git"
-  },
-  "keywords": [
-    "graph",
-    "knowledge-graph",
-    "governance",
-    "complex-systems",
-    "context-engineering",
-    "ai-assisted-work"
-  ],
-  "author": "Rim Zabarov",
-  "files": [
-    "README.md",
-    "CHANGELOG.md",
-    "ROADMAP.md",
-    "LICENSE",
-    "LICENSE-DOCS",
-    "CITATION.cff",
-    "docs",
-    "standard",
-    "schemas",
-    "benchmarks",
-    "examples",
-    "packages",
-    "profiles",
-    "pilots",
-    "playground",
-    "publications",
-    "releases",
-    "templates",
-    ".github"
-  ],
   "scripts": {
-    "pretest": "npm run test:project-technology && npm run test:context-traversal && npm run test:project-continuity && npm run test:artifact-releases && npm run validate:project-technology-schemas",
-    "test:project-technology": "node packages/cli/validate-project-technology.js",
+    "pretest": "npm run test:project-technology && npm run test:context-traversal && npm run test:project-continuity && npm run test:artifact-releases && npm run test:technology-courses && npm run validate:project-technology-schemas",
+    "test:project-technology": "node packages/cli/validate-project-technology.js && node packages/cli/validate-provider-archive.js",
     "test:context-traversal": "node packages/cli/validate-context-traversal.js",
     "test:project-continuity": "node packages/cli/validate-project-continuity.js",
     "test:artifact-releases": "node packages/cli/validate-artifact-releases.js",
-    "validate:project-technology-schemas": "node -e \"const fs=require('fs'); for (const file of ['project-technology-extension.schema.json','project-technology-target-export.schema.json','context-traversal-receipt.schema.json','context-pack.schema.json']) JSON.parse(fs.readFileSync('schemas/'+file))\"",
+    "test:technology-courses": "node packages/cli/validate-technology-course.js",
+    "validate:project-technology-schemas": "node -e \"const fs=require('fs'); for (const file of ['project-technology-extension.schema.json','project-technology-target-export.schema.json','context-traversal-receipt.schema.json','context-pack.schema.json','executable-technology.schema.json','technology-course-pack.schema.json']) JSON.parse(fs.readFileSync('schemas/'+file))\"",
     "validate:graph-manifest": "node packages/cli/validate-graph-manifest-migration.js",
     "validate:minimal": "node packages/cli/validate-mirai-graph.js examples/minimal-graph",
     "validate:benchmark": "node packages/cli/validate-mirai-graph.js benchmarks/synthetic-context-reduction-v0",
@@ -123,5 +90,39 @@
     "validate:playground-report": "npm run --silent playground:report >/tmp/mirai-graph-playground-report.md && diff -u playground/demo-report.md /tmp/mirai-graph-playground-report.md && rg 'transition explanation|Instrumentation|Multi-source feedback|Baseline Comparison|baseline comparison' playground/demo-report.md",
     "test": "npm run validate:graph-manifest && npm run validate:minimal && npm run validate:benchmark && npm run validate:seed && npm run validate:profiles && npm run validate:ai-employee && npm run validate:skill-runtime && npm run validate:managed-project && npm run validate:implementation-control && npm run validate:implementation-control-cycles && npm run validate:launch-record && npm run validate:process-transition && npm run validate:process-transition-report && npm run validate:process-control && npm run validate:technology-quality-feedback && npm run validate:instrumentation-layer && npm run validate:instrumentation-report && npm run validate:dynamic-episodes && npm run validate:dynamic-episode-report && npm run validate:semantic-intent-resolution && npm run validate:goal-vector-quality-control && npm run validate:dna-alignment && npm run validate:work-state && npm run validate:risk-control && npm run validate:source-boundary && npm run validate:organization-governance && npm run validate:societal-governance && npm run validate:character-layer && npm run validate:character-layer-integration && npm run validate:model-portability-evidence && npm run validate:character-layer-readiness && npm run validate:templates && npm run validate:adopter-workflow && npm run validate:self-service-onboarding && npm run validate:init-fixtures && npm run validate:bootstrap-fixtures && npm run validate:release-state && npm run validate:mirai-graph-compat && npm run validate:cli-unified && npm run validate:pilots && npm run validate:context-packs && npm run validate:profile-results && npm run validate:routing-control && npm run seed:preview && npm run context:generate && npm run playground:demo && npm run playground:report && npm run readiness:benchmark && npm run benchmark:synthetic && npm run validate:baseline-comparison && npm run validate:markdown-report && npm run validate:playground-demo && npm run validate:playground-report && npm run test:negative && npm run test:character-layer-semantic-negative && npm run test:societal-governance-negative && npm run test:process-transition-negative && npm run test:technology-quality-feedback-negative && npm run test:instrumentation-layer-negative && npm run test:dynamic-episodes-negative && npm run test:semantic-intent-resolution-negative && npm run test:goal-vector-quality-control-negative",
     "release:check": "npm test && git diff --check"
-  }
-}
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zabarov/mirai-graph.git"
+  },
+  "keywords": [
+    "graph",
+    "knowledge-graph",
+    "governance",
+    "complex-systems",
+    "context-engineering",
+    "ai-assisted-work"
+  ],
+  "author": "Rim Zabarov",
+  "files": [
+    "README.md",
+    "CHANGELOG.md",
+    "ROADMAP.md",
+    "LICENSE",
+    "LICENSE-DOCS",
+    "CITATION.cff",
+    "docs",
+    "standard",
+    "schemas",
+    "benchmarks",
+    "examples",
+    "packages",
+    "profiles",
+    "pilots",
+    "playground",
+    "publications",
+    "releases",
+    "templates",
+    ".github"
+  ]
+}

package/packages/cli/mirai-graph.js

@@ -25,7 +25,7 @@ function usage() {
   console.error("  mirai-graph report playground");
   console.error("  mirai-graph release state [--markdown] [--require-git-tag] [--require-github-release] [--require-npm-published]");
   console.error("  mirai-graph technology <explain|status|plan|verify|context> [repository] [options]");
-  console.error("  mirai-graph technology <enable|sync|connect|disconnect|provide|disable|repair|artifact> [repository] [options] [--apply]");
+  console.error("  mirai-graph technology <enable|sync|connect|disconnect|provide|disable|repair|artifact|course> [repository] [options] [--apply]");
   console.error("");
   console.error("Boundary:");
   console.error("  Reports explain validation decisions. They do not authorize canonical updates.");

package/packages/cli/project-technology.js

@@ -13,6 +13,7 @@ function usage() {
   console.error("Options: --apply --task <text> --source <file> --target-id <id>");
   console.error("         --semantic-digest <sha256:...> --provider-revision <sha>");
   console.error("         --refresh-binding --significant-work --max-objects <count>");
+  console.error("Archive connect: --provider-archive-trust <verified-release-anchor.json>");
   console.error("Continuity: sync --boundary task_start|stage_complete|task_complete [--evidence <json>] [--expected-graph-digest <sha256:...>]");
   console.error("            verify --significant-work [--receipt-digest <sha256:...>]");
   console.error("Context: --phase discover --task <text>");
@@ -23,22 +24,32 @@ function usage() {
   console.error("           artifact release <repo> --input <path> --matter-id <id> --direction inbound|internal|outbound [--parent-release <id>] [--client-note <text>] [--create-export] [--apply]");
   console.error("           artifact compare <repo> --matter-id <id> --base-release <id> --target-release <id>");
   console.error("           artifact verify <repo> --matter-id <id> --release-id <id>");
+  console.error("Courses: course compile <repo> --technology <file> [--scenario <id>] [--audience <id>]");
+  console.error("         course verify <repo> --course-pack <file>");
+  console.error("         course reconcile <repo> --course-pack <file> --projection <file>");
 }
 
 function parse(argv) {
   if (!argv.length) return null;
   const operation = argv.shift();
   let artifactAction = null;
+  let courseAction = null;
   if (operation === "artifact") {
     artifactAction = argv.shift() || null;
     if (!new Set(["inspect", "release", "compare", "verify"]).has(artifactAction)) throw new Error("artifact requires inspect, release, compare or verify");
   }
+  if (operation === "course") {
+    courseAction = argv.shift() || null;
+    if (!new Set(["compile", "verify", "reconcile"]).has(courseAction)) throw new Error("course requires compile, verify or reconcile");
+  }
   let repository = ".";
   if (argv[0] && !argv[0].startsWith("--")) repository = argv.shift();
   const options = {};
-  const values = new Set(["--task", "--source", "--target-id", "--semantic-digest", "--provider-revision", "--max-objects", "--phase", "--input", "--select", "--selection", "--packet", "--evidence", "--selector", "--reason", "--confidence", "--context-budget", "--boundary", "--expected-graph-digest", "--receipt-digest", "--state-root", "--matter-id", "--direction", "--artifact-root", "--release-date", "--release-id", "--parent-release", "--base-release", "--target-release", "--client-note"]);
+  const values = new Set(["--task", "--source", "--target-id", "--semantic-digest", "--provider-revision", "--max-objects", "--phase", "--input", "--select", "--selection", "--packet", "--evidence", "--selector", "--reason", "--confidence", "--context-budget", "--boundary", "--expected-graph-digest", "--receipt-digest", "--state-root", "--matter-id", "--direction", "--artifact-root", "--release-date", "--release-id", "--parent-release", "--base-release", "--target-release", "--client-note", "--technology", "--scenario", "--audience", "--course-pack", "--projection"]);
   const flags = new Set(["--apply", "--refresh-binding", "--significant-work", "--create-export"]);
+  values.add("--provider-archive-trust");
   const names = {
+    "--provider-archive-trust": "providerArchiveTrustFile",
     "--task": "task", "--source": "source", "--target-id": "targetId",
     "--semantic-digest": "semanticDigest", "--provider-revision": "providerRevision",
     "--max-objects": "maxObjects", "--apply": "apply",
@@ -54,6 +65,8 @@ function parse(argv) {
     "--parent-release": "parentReleaseIds", "--base-release": "baseReleaseId",
     "--target-release": "targetReleaseId", "--client-note": "clientNote",
     "--create-export": "createExport",
+    "--technology": "technologyFile", "--scenario": "scenarioIds",
+    "--audience": "audience", "--course-pack": "coursePackFile", "--projection": "projectionFile",
   };
   while (argv.length) {
     const token = argv.shift();
@@ -63,10 +76,12 @@ function parse(argv) {
       const value = argv.shift();
       if (token === "--select") options.selectedIds = [...(options.selectedIds || []), value];
       else if (token === "--parent-release") options.parentReleaseIds = [...(options.parentReleaseIds || []), value];
+      else if (token === "--scenario") options.scenarioIds = [...(options.scenarioIds || []), value];
       else options[names[token]] = value;
     } else throw new Error(`unsupported argument ${token}`);
   }
   if (artifactAction) options.artifactAction = artifactAction;
+  if (courseAction) options.courseAction = courseAction;
   return { operation, repository: path.resolve(repository), options };
 }
 
@@ -77,6 +92,11 @@ function readJsonFile(file) {
 }
 
 function hydrateContextOptions(request) {
+  if (request.options.providerArchiveTrustFile) {
+    if (request.operation !== "connect") throw new Error("archive trust is only supported by connect");
+    request.options.providerArchive = request.options.providerArchiveTrustFile === "-"
+      ? JSON.parse(fs.readFileSync(0, "utf8")) : readJsonFile(request.options.providerArchiveTrustFile);
+  }
   if (request.operation === "sync" && request.options.boundary) {
     if (request.options.boundary !== "task_start" && !request.options.evidenceFile) throw new Error(`${request.options.boundary} requires --evidence`);
     if (request.options.evidenceFile) request.options.continuityEvidence = readJsonFile(request.options.evidenceFile);

package/packages/cli/validate-provider-archive.js

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+"use strict";
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const vm = require("vm");
+const { createRequire } = require("module");
+const { spawnSync } = require("child_process");
+const technology = require("../project-technology");
+const fixtureFile = path.join(__dirname, "validate-project-technology.js");
+const fixtureText = fs.readFileSync(fixtureFile, "utf8");
+const sandbox = { require: createRequire(fixtureFile), module: { exports: {} } };
+vm.runInNewContext(fixtureText.slice(0, fixtureText.indexOf("const checks = [];")) +
+  "\nmodule.exports={initRepo,addTarget,git,TARGET_ID,SEMANTIC_DIGEST};", sandbox);
+const fixture = sandbox.module.exports;
+const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "mirai-archive-test-")));
+const originalPath = process.env.PATH;
+const checks = [];
+function check(id, condition, details) { checks.push({ id, passed: Boolean(condition) }); assert.ok(condition, `${id}: ${JSON.stringify(details)}`); }
+function digestTree(dir) {
+  const files = [];
+  function walk(current) {
+    if (!fs.existsSync(current)) return;
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const file = path.join(current, entry.name);
+      if (entry.isDirectory()) walk(file);
+      else files.push([path.relative(dir, file), technology.sha256(fs.readFileSync(file))]);
+    }
+  }
+  walk(dir); return technology.sha256(JSON.stringify(files.sort()));
+}
+try {
+  const sourceRoot = path.join(root, "source"); fs.mkdirSync(sourceRoot);
+  const provider = fixture.initRepo(sourceRoot, "fixture-provider");
+  const consumer = fixture.initRepo(sourceRoot, "fixture-consumer");
+  let revision = fixture.addTarget(provider);
+  const stateRoot = path.join(root, "state");
+  const base = { targetId: fixture.TARGET_ID, semanticDigest: fixture.SEMANTIC_DIGEST, stateRoot, apply: true };
+  for (const repo of [provider, consumer]) assert.equal(technology.execute("enable", repo, base).status, "success");
+  fixture.git(provider, "add", "graph.json"); fixture.git(provider, "commit", "-qm", "accepted activation");
+  revision = fixture.git(provider, "rev-parse", "HEAD");
+  const releases = [];
+  for (let n = 0; n < 2; n++) {
+    if (n) { fixture.git(provider, "commit", "--allow-empty", "-qm", "compatible revision"); revision = fixture.git(provider, "rev-parse", "HEAD"); }
+    const provided = technology.execute("provide", provider, { ...base, providerRevision: revision });
+    assert.equal(provided.status, "success");
+    const beforeSourceProof = digestTree(root);
+    const sourceProof = technology.execute("verify", provider, { source: path.join(provider, provided.export_ref) });
+    check(`source_export_proven_${n}`, sourceProof.status === "success" && sourceProof.provider_archive.providerRevision === revision, sourceProof);
+    check(`source_proof_zero_write_${n}`, digestTree(root) === beforeSourceProof);
+    check(`source_proof_not_authority_${n}`, technology.execute("verify", provider, { source: path.join(provider, provided.export_ref), significantWork: true }).status === "blocked");
+    const providerManifestPath = path.join(provider, "graph.json");
+    const providerManifestBytes = fs.readFileSync(providerManifestPath);
+    fs.appendFileSync(providerManifestPath, " ");
+    check(`uncommitted_manifest_blocks_source_proof_${n}`, technology.execute("verify", provider, { source: path.join(provider, provided.export_ref) }).blockers.includes("provider_manifest_not_revision_bound"));
+    fs.writeFileSync(providerManifestPath, providerManifestBytes);
+    const bytes = fs.readFileSync(path.join(provider, provided.export_ref));
+    const source = path.join(root, `export-${n}.json`); fs.writeFileSync(source, bytes);
+    check(`external_export_blocks_source_proof_${n}`, technology.execute("verify", provider, { source }).blockers.includes("provider_export_outside_repository"));
+    // Build anchor on the verified SOURCE side, before Git is removed.
+    const ancestors = n ? [releases[0].providerRevision] : [];
+    for (const ancestor of ancestors) fixture.git(provider, "merge-base", "--is-ancestor", ancestor, revision);
+    releases.push({ ...base, source, providerRevision: revision, providerArchive: {
+      exportSha256: technology.sha256(bytes), graphId: "fixture-provider", providerRevision: revision, ancestorRevisions: ancestors,
+    } });
+  }
+  const packedConsumer = path.join(root, "consumer");
+  fs.cpSync(consumer, packedConsumer, { recursive: true, filter: file => path.basename(file) !== ".git" });
+  const emptyPath = path.join(root, "no-tools"); fs.mkdirSync(emptyPath); process.env.PATH = emptyPath;
+  check("git_is_absent", spawnSync("git", ["--version"]).error?.code === "ENOENT");
+  const invoke = options => technology.execute("connect", packedConsumer, options);
+  const noTrust = { ...releases[0] }; delete noTrust.providerArchive;
+  check("untrusted_archive_blocked", invoke(noTrust).blockers.includes("provider_revision_order_unverifiable"));
+  const before = digestTree(root);
+  check("preview", invoke({ ...releases[0], apply: false }).status === "preview");
+  check("preview_zero_write", digestTree(root) === before);
+  const connected = invoke(releases[0]);
+  check("archive_connect", connected.status === "success", connected);
+  check("complete_contract_imported", connected.target_binding.status === "ready", connected);
+  const after = digestTree(root);
+  check("repeat_changed_false", invoke(releases[0]).changed === false);
+  check("repeat_byte_identical", digestTree(root) === after);
+  const status = technology.execute("status", packedConsumer, base);
+  check("read_only_ready", status.target_binding.status === "ready", status);
+  technology.execute("verify", packedConsumer, base);
+  check("diagnostics_zero_write", digestTree(root) === after);
+  function denied(id, options, blocker) {
+    const prior = digestTree(root); const result = invoke(options);
+    check(id, result.status === "fail" && (!blocker || result.blockers.includes(blocker)), result);
+    check(`${id}_zero_write`, prior === digestTree(root));
+  }
+  denied("null_trust", { ...releases[0], providerArchive: null }, "provider_archive_trust_invalid");
+  denied("bad_digest", { ...releases[0], providerArchive: { ...releases[0].providerArchive, exportSha256: "0".repeat(64) } }, "provider_archive_export_digest_mismatch");
+  denied("bad_graph", { ...releases[0], providerArchive: { ...releases[0].providerArchive, graphId: "other.provider" } }, "provider_archive_graph_mismatch");
+  denied("bad_revision", { ...releases[0], providerArchive: { ...releases[0].providerArchive, providerRevision: "f".repeat(40) } }, "provider_archive_revision_mismatch");
+  denied("extra_trust_fields", { ...releases[0], providerArchive: { ...releases[0].providerArchive, approved: true } }, "provider_archive_trust_invalid");
+  denied("explicit_refresh_required", releases[1], "target_provider_refresh_required");
+  denied("missing_ancestry", { ...releases[1], refreshBinding: true, providerArchive: { ...releases[1].providerArchive, ancestorRevisions: [] } }, "provider_revision_not_forward");
+  denied("target_mismatch", { ...releases[1], targetId: "other.target", refreshBinding: true }, "target_provider_target_mismatch");
+  denied("semantic_mismatch", { ...releases[1], semanticDigest: `sha256:${"3".repeat(64)}`, refreshBinding: true }, "target_provider_semantic_mismatch");
+  const refreshed = invoke({ ...releases[1], refreshBinding: true });
+  check("forward_refresh", refreshed.status === "success" && refreshed.changed, refreshed);
+  const refreshedTree = digestTree(root);
+  check("refresh_idempotent", invoke({ ...releases[1], refreshBinding: true }).changed === false);
+  check("refresh_byte_identical", digestTree(root) === refreshedTree);
+  denied("downgrade", { ...releases[0], refreshBinding: true }, "provider_revision_not_forward");
+  const original = fs.readFileSync(releases[1].source);
+  fs.appendFileSync(releases[1].source, " ");
+  denied("tampered_bytes", { ...releases[1], refreshBinding: true }, "provider_archive_export_digest_mismatch");
+  fs.writeFileSync(releases[1].source, original);
+  function alteredExport(id, alter, expected) {
+    const payload = JSON.parse(original); alter(payload);
+    fs.writeFileSync(releases[1].source, technology.canonicalBytes(payload));
+    const options = { ...releases[1], refreshBinding: true, providerArchive: { ...releases[1].providerArchive,
+      exportSha256: technology.sha256(fs.readFileSync(releases[1].source)), graphId: payload.provider_graph_id } };
+    denied(id, options, expected); fs.writeFileSync(releases[1].source, original);
+  }
+  alteredExport("provider_conflict", p => { p.provider_graph_id = "another.provider"; }, "target_provider_graph_conflict");
+  alteredExport("incomplete_contract", p => { p.requirement_bindings = []; });
+  alteredExport("contract_tamper", p => { p.goal_binding.done_when_ids = ["done.other"]; });
+  alteredExport("valid_but_different_contract", p => {
+    p.allowed_change_scope[0].file_patterns = ["packages/other/**"];
+    p.execution_contract_digest = technology.sha256(technology.canonicalBytes(technology.normalizeExecutionContract(p).contract));
+  }, "provider_execution_contract_refresh_mismatch");
+  alteredExport("reviewed_not_accepted", p => { p.architecture_contract.lifecycle = "reviewed"; });
+  alteredExport("private_extra_field", p => { p.private_source = "not allowed"; }, "provider_export_not_bounded");
+  const graphFile = path.join(packedConsumer, "graph.json"); const graphBefore = fs.readFileSync(graphFile);
+  const graph = JSON.parse(graphBefore); graph.extensions["mirai.project_technology"].enabled = false;
+  fs.writeFileSync(graphFile, JSON.stringify(graph));
+  denied("disabled", releases[1], "project_technology_not_enabled");
+  check("disabled_diagnostics_available", technology.execute("status", packedConsumer, base).operation_mode === "read_only");
+  fs.writeFileSync(graphFile, graphBefore);
+  const trustFile = path.join(root, "trust.json"); fs.writeFileSync(trustFile, JSON.stringify(releases[1].providerArchive));
+  const cli = spawnSync(process.execPath, [path.join(__dirname, "project-technology.js"), "connect", packedConsumer,
+    "--source", releases[1].source, "--target-id", base.targetId, "--semantic-digest", base.semanticDigest,
+    "--provider-revision", releases[1].providerRevision, "--state-root", stateRoot,
+    "--provider-archive-trust", trustFile, "--apply"], { encoding: "utf8" });
+  check("cli_no_git_idempotent", cli.status === 0 && JSON.parse(cli.stdout).changed === false, cli.stdout);
+  // A new identity field is optional for historical Git exports, but required
+  // for authenticated archive imports. Existing stored contracts remain valid.
+  const legacy = JSON.parse(original); delete legacy.provider_graph_id;
+  fs.writeFileSync(releases[1].source, technology.canonicalBytes(legacy));
+  check("historical_export_readable", technology.readExport(releases[1].source).blockers.length === 0);
+  denied("legacy_archive_needs_graph_identity", { ...releases[1], providerArchive: { ...releases[1].providerArchive,
+    exportSha256: technology.sha256(fs.readFileSync(releases[1].source)) } }, "provider_archive_graph_mismatch");
+  fs.writeFileSync(releases[1].source, original);
+  const folderInventory = technology.inventory(packedConsumer);
+  check("folder_inventory_nonempty", folderInventory.files.some(file => file.path === "graph.json") && folderInventory.files.some(file => file.path === "README.md"), folderInventory);
+  check("folder_inventory_sync", technology.execute("sync", packedConsumer, base).status === "success");
+  check("folder_inventory_sync_noop", technology.execute("sync", packedConsumer, base).changed === false);
+  const readme = path.join(packedConsumer, "README.md"); const readmeBefore = fs.readFileSync(readme);
+  fs.appendFileSync(readme, "\nChanged declared raw source\n");
+  const staleTree = digestTree(root);
+  check("folder_changed_source_is_stale", technology.execute("status", packedConsumer, base).blockers.includes("project_technology_inventory_stale"));
+  check("folder_stale_status_zero_write", digestTree(root) === staleTree);
+  fs.writeFileSync(readme, readmeBefore);
+  const graphForMissing = JSON.parse(fs.readFileSync(graphFile)); graphForMissing.graph.raw_sources.push("missing-required-source.md");
+  fs.writeFileSync(graphFile, JSON.stringify(graphForMissing));
+  const missingBefore = digestTree(root);
+  check("missing_declared_source_blocks_sync", technology.execute("sync", packedConsumer, base).blockers.includes("inventory_declared_source_missing"));
+  check("missing_source_sync_zero_write", digestTree(root) === missingBefore);
+  fs.writeFileSync(graphFile, graphBefore);
+  console.log(JSON.stringify({ status: "success", check_count: checks.length, checks }, null, 2));
+} finally { process.env.PATH = originalPath; fs.rmSync(root, { recursive: true, force: true }); }