mirai-graph 1.3.0 → 1.5.0

package/releases/1.5.0.md

@@ -0,0 +1,37 @@
+# Mirai Graph 1.5.0
+
+Compatible additive release for existing 1.x consumers. Published to npm under
+`legacy-1`; it does not replace the 2.x `latest` channel or migrate consumers.
+
+## Changes
+
+- Existing Project Technology connect/refresh can import a bounded provider
+  export without Git when an authenticated distributor supplies its exact
+  export digest, graph identity, revision and forward ancestry proof.
+- Read-only source verification binds that proof to the accepted target and
+  real Git revision before packaging. Caller-supplied trust is not inferred
+  from an export's own claims and never grants permission to perform work.
+- Folder inventory follows only explicitly declared graph and raw-source paths,
+  detects stale content and rejects unsafe or missing sources.
+- CLI archive trust can be passed through stdin without a temporary trust file.
+
+## Compatibility and safety
+
+Existing Git provider operations, complete target and execution contracts,
+transactional rollback and fail-closed behavior remain in force. No new profile,
+registry, daemon or schema family is introduced. The graph manifest remains
+2.0.0 and the Project Technology activation contract remains 1.0.0.
+
+Archive metadata must come from an independently authenticated release; this
+package does not establish a distributor's trust or copy private source content.
+
+## Verification
+
+`npm run release:check` runs the current suite, including 39 existing Project
+Technology checks and 71 archive/source-proof checks. The archive cases cover
+no-Git import, exact replay, forward refresh, downgrade, tamper, graph conflict,
+missing trust, source inventory and read-only behavior.
+
+Local validation uses macOS ARM64 with Node 22.23.2. Federation's native
+Windows/macOS/Linux complete installation matrix is a separate acceptance gate;
+this release does not claim that matrix or a Federation release has passed.

package/releases/README.md

@@ -15,6 +15,8 @@ Release notes must separate:
 
 ## Release Notes
 
+- [v1.5.0](1.5.0.md) - compatible 1.x authenticated archive providers and
+  declared-source inventory without Git (`legacy-1`, not npm `latest`).
 - [v1.2.0](1.2.0.md) - portable task-boundary project continuity in Project
   Technology.
 - [v1.1.0](1.1.0.md) - universal sequential context traversal and usage

package/schemas/executable-technology.schema.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mirai-graph.org/schemas/executable-technology.schema.json",
+  "title": "Mirai Graph Executable Technology",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "id", "title", "owner", "outcome", "lifecycle", "version", "source_refs", "operations", "scenarios"],
+  "properties": {
+    "schema_version": { "const": "1.0.0" },
+    "id": { "$ref": "#/$defs/id" },
+    "title": { "$ref": "#/$defs/text" },
+    "owner": { "$ref": "#/$defs/id" },
+    "outcome": { "$ref": "#/$defs/text" },
+    "lifecycle": { "enum": ["reviewed", "accepted", "active"] },
+    "version": { "$ref": "#/$defs/text" },
+    "source_refs": { "$ref": "#/$defs/nonEmptyIds" },
+    "projection_refs": { "$ref": "#/$defs/ids" },
+    "operations": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/operation" }
+    },
+    "scenarios": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/scenario" }
+    }
+  },
+  "$defs": {
+    "id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@?=+*\\-]{1,255}$" },
+    "text": { "type": "string", "minLength": 1 },
+    "ids": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/id" } },
+    "nonEmptyIds": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "$ref": "#/$defs/id" } },
+    "operation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "title", "summary", "owner", "capability_ref", "output_refs", "check_refs", "source_refs"],
+      "properties": {
+        "id": { "$ref": "#/$defs/id" },
+        "title": { "$ref": "#/$defs/text" },
+        "summary": { "$ref": "#/$defs/text" },
+        "owner": { "$ref": "#/$defs/id" },
+        "capability_ref": { "$ref": "#/$defs/id" },
+        "prerequisites": { "$ref": "#/$defs/ids" },
+        "input_refs": { "$ref": "#/$defs/ids" },
+        "output_refs": { "$ref": "#/$defs/nonEmptyIds" },
+        "check_refs": { "$ref": "#/$defs/nonEmptyIds" },
+        "stop_condition_refs": { "$ref": "#/$defs/ids" },
+        "rollback_refs": { "$ref": "#/$defs/ids" },
+        "source_refs": { "$ref": "#/$defs/nonEmptyIds" },
+        "instructional_refs": { "$ref": "#/$defs/ids" },
+        "applicability": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/text" } },
+        "negative_boundaries": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/text" } }
+      }
+    },
+    "scenario": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "title", "outcome", "operation_ids"],
+      "properties": {
+        "id": { "$ref": "#/$defs/id" },
+        "title": { "$ref": "#/$defs/text" },
+        "outcome": { "$ref": "#/$defs/text" },
+        "operation_ids": { "$ref": "#/$defs/nonEmptyIds" },
+        "required_inputs": { "$ref": "#/$defs/ids" },
+        "audience": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/text" } }
+      }
+    }
+  }
+}

package/schemas/project-technology-target-export.schema.json

@@ -15,6 +15,7 @@
     "target_id": { "type": "string", "minLength": 2 },
     "semantic_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
     "provider_revision": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "provider_graph_id": { "type": "string", "minLength": 2, "maxLength": 256, "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@?=+*-]+$" },
     "decision_refs": { "$ref": "#/$defs/nonEmptyRefs" },
     "goal_binding": {
       "type": "object", "additionalProperties": false,

package/schemas/technology-course-pack.schema.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mirai-graph.org/schemas/technology-course-pack.schema.json",
+  "title": "Mirai Graph Technology Course Pack",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "technology_id", "technology_title", "technology_outcome", "technology_version", "technology_digest", "audience", "scenario_ids", "source_refs", "source_revisions", "scenarios", "sections", "exercises", "checks", "omissions", "limitations", "course_pack_digest"],
+  "properties": {
+    "schema_version": { "const": "1.0.0" },
+    "technology_id": { "$ref": "#/$defs/id" },
+    "technology_title": { "type": "string", "minLength": 1 },
+    "technology_outcome": { "type": "string", "minLength": 1 },
+    "technology_version": { "type": "string", "minLength": 1 },
+    "technology_digest": { "$ref": "#/$defs/digest" },
+    "audience": { "$ref": "#/$defs/id" },
+    "scenario_ids": { "$ref": "#/$defs/nonEmptyIds" },
+    "source_refs": { "$ref": "#/$defs/nonEmptyIds" },
+    "source_revisions": { "type": "object", "additionalProperties": { "type": "string", "minLength": 1 } },
+    "scenarios": { "type": "array", "minItems": 1, "items": { "type": "object" } },
+    "sections": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["order", "technology_node_id", "title", "summary", "owner", "capability_ref", "prerequisite_ids", "input_refs", "output_refs", "check_refs", "stop_condition_refs", "rollback_refs", "source_refs", "instructional_refs"],
+        "properties": {
+          "order": { "type": "integer", "minimum": 1 },
+          "technology_node_id": { "$ref": "#/$defs/id" },
+          "title": { "type": "string", "minLength": 1 },
+          "summary": { "type": "string", "minLength": 1 },
+          "owner": { "$ref": "#/$defs/id" },
+          "capability_ref": { "$ref": "#/$defs/id" },
+          "prerequisite_ids": { "$ref": "#/$defs/ids" },
+          "input_refs": { "$ref": "#/$defs/ids" },
+          "output_refs": { "$ref": "#/$defs/nonEmptyIds" },
+          "check_refs": { "$ref": "#/$defs/nonEmptyIds" },
+          "stop_condition_refs": { "$ref": "#/$defs/ids" },
+          "rollback_refs": { "$ref": "#/$defs/ids" },
+          "source_refs": { "$ref": "#/$defs/nonEmptyIds" },
+          "instructional_refs": { "$ref": "#/$defs/ids" }
+        }
+      }
+    },
+    "exercises": { "type": "array" },
+    "checks": { "$ref": "#/$defs/nonEmptyIds" },
+    "omissions": { "type": "array" },
+    "limitations": { "type": "array" },
+    "course_pack_digest": { "$ref": "#/$defs/digest" }
+  },
+  "$defs": {
+    "id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@?=+*\\-]{1,255}$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "ids": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/id" } },
+    "nonEmptyIds": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "$ref": "#/$defs/id" } }
+  }
+}

package/standard/project-technology.md

@@ -1,12 +1,65 @@
 # Project Technology
 
-Status: 1.3 stable standard; activation contract remains 1.0.0
+Status: 1.4 stable standard; activation contract remains 1.0.0
 
 Project Technology is the shared executable mechanism of Mirai Graph. It is
 not a profile, a second graph or a source of domain methodology.
 
 ## One Mechanism, Different Graphs
 
+### Archived providers (unreleased compatibility extension)
+
+The normal source provider path continues to verify Git HEAD and ancestry.
+For an immutable distribution, `connect` also accepts `providerArchive` in the
+JavaScript options, or `--provider-archive-trust <file>` in the CLI (use `-`
+to read that bounded JSON from stdin without creating a temporary file):
+
+```json
+{
+  "exportSha256": "<SHA-256 of the exact bounded export bytes>",
+  "graphId": "example.provider",
+  "providerRevision": "<exact 40-character source revision>",
+  "ancestorRevisions": ["<previous supported revision, proven during release build>"]
+}
+```
+
+This is a **consumer trust input**, not provider self-authentication. The caller
+must derive it from an authenticated release lock/manifest after checking its
+integrity and issuer. Never calculate a hash from an untrusted download and
+call that authentication. Mirai does not discover, download or trust adjacent
+metadata automatically. Packaging must verify the export against the accepted
+source target and the declared source revision before publishing its digest.
+Ancestor entries must be proven by the source Git history during that build;
+they are not inferred from version numbers, dates or commit hash ordering.
+
+The existing `technology verify <repository> --source <bounded-export>` and
+`verifyProviderExport(repository, options)` provide a read-only source-side
+proof for packaging. They require a revision-bound enabled manifest, exact HEAD,
+accepted target and matching execution contract, and return the anchor with at
+most 4096 proven ancestors. A packaging caller must then authenticate the release
+metadata containing this anchor. This proof is not permission to execute a
+significant task; requesting significant work through it is blocked.
+
+Exports produced by `provide` now include `provider_graph_id`. Old Git-backed
+exports remain readable; archive import requires the graph identity. `connect`
+uses the same full accepted execution contract validation and atomic import.
+`--refresh-binding` still requires the same target and semantic/architecture
+contract; a changed revision must explicitly descend from the current binding
+in the authenticated release metadata. A wrong or incomplete anchor fails,
+even when a working Git checkout happens to be available. The caller cannot
+use archive trust to authorize work, change owners, expand scope or bypass
+acceptance. `provide` continues to require the canonical Git source; archive
+consumers import its immutable output, never regenerate acceptance from copies.
+
+Status/verify use the hash-bound local import and remain read-only. Without a
+Git repository, inventory reads only the manifest and explicitly declared graph
+and raw-source paths, with a bounded traversal. Missing, unsafe or unsupported
+declared paths block sync before writes. Symlinks and secret/excluded paths are
+not imported. Ordinary folders use content digests and a null inventory revision,
+never a fabricated Git revision. If Git metadata exists but Git is unavailable,
+inventory fails closed instead of silently treating a checkout as an archive.
+Raw-source access and release authenticity remain separate responsibilities.
+
 The root `graph.json` declares the repository scope and profiles. The same
 Project Technology operations therefore work for:
 
@@ -19,6 +72,35 @@ Each graph keeps its own objects and relations. Project Technology only
 standardizes safe inventory, task context, accepted-target binding, freshness
 and verification.
 
+## Executable Technologies And Course Projections
+
+An executable technology is an accepted graph of reusable operations and
+user-facing scenarios. It is suitable for a long method that has both an
+end-to-end path and independently useful parts. Each operation binds its owner,
+capability, prerequisites, inputs, outputs, checks, stop conditions, rollback
+and exact raw source references.
+
+A scenario names an outcome and selects the operations needed to reach it.
+Project Technology calculates prerequisite closure, so a course or executor
+cannot silently omit a required safety step.
+
+```bash
+mirai-graph technology course compile . --technology graph/specs/technology.json
+mirai-graph technology course compile . --technology graph/specs/technology.json --scenario scenario.recovery
+mirai-graph technology course verify . --course-pack course-pack.json
+mirai-graph technology course reconcile . --course-pack course-pack.json --projection edited-course.json
+```
+
+The JavaScript API exposes `compileTechnologyCourse`,
+`verifyTechnologyCourse` and `reconcileTechnologyCourse`.
+
+A Course Pack is hash-bound to the normalized technology, chosen scenarios,
+sources and revisions. It may be rendered into a document, learning system or
+documentation site. It remains a projection: editorial changes may be routed
+to the documentation owner, while changed prerequisites, owners, checks, stop
+conditions, rollback or scope become semantic proposals. Reconciliation never
+writes them into the accepted technology automatically.
+
 ## Immutable Artifact Releases
 
 Project Technology can preserve versioned file bundles without turning their