mirai-graph 1.4.0 → 1.6.0

package/.github/workflows/ci.yml

@@ -29,6 +29,9 @@ jobs:
       - name: Verify portable project continuity
         run: node packages/cli/validate-project-continuity.js
 
+      - name: Verify local target and provider contracts
+        run: npm run test:project-technology
+
   release-check:
     runs-on: ubuntu-latest
 

package/CHANGELOG.md

@@ -4,6 +4,42 @@ All notable changes to Mirai Graph will be documented in this file.
 
 ## [Unreleased]
 
+## [1.6.0] - Unpublished candidate
+
+Compatible additive release for the 1.x line; intended npm channel `legacy-1`.
+The 2.x `latest` channel is not changed. Publication and independent acceptance
+are pending; no installed consumer is automatically migrated.
+
+- A valid new Git branch without its first commit can inventory only explicitly
+  declared sources. Corrupt or unavailable Git stays blocked; no revision is
+  invented and provider export still requires a real commit. The existing
+  three-platform CI matrix now includes local-target/provider regressions.
+
+- Explicitly selected local accepted targets in ordinary folders and
+  Git repositories, using the existing execution-contract validator and graph
+  reader. Independent caller-verified approval anchors prevent self-acceptance.
+- Local selection/disconnection reuse continuity lease, CAS, backup and rollback;
+  diagnostics are read-only. Semantic acceptance and source-content freshness
+  are separate; significant work requires current verification evidence.
+- `plan` now reports the same target binding as `status`, `context` and `verify`.
+  External provider identity and ancestry checks are unchanged.
+
+## [1.5.0] - 2026-09-03
+
+Compatible 1.x maintenance line, published under `legacy-1`; the npm `latest`
+channel and the separate 2.x development line are unchanged.
+
+- Project Technology can connect and refresh a bounded provider export without
+  Git using explicit authenticated-release trust supplied by the consumer.
+  Exact export bytes, graph identity, revision and forward ancestry are checked;
+  target/architecture/permission gates are unchanged. No automatic trust discovery.
+- Read-only source export verification proves the archive anchor against the
+  accepted target and Git revision before a distributor seals it in release
+  metadata. CLI trust can be supplied on stdin; no temporary trust file is needed.
+- No-Git inventory covers explicitly declared graph and raw-source paths, detects
+  stale content and blocks unsafe or missing sources before sync writes. Existing
+  Git inventories remain revision-bound; this does not invent source history.
+
 ## [1.4.0] - 2026-08-29
 
 ### Added

package/CITATION.cff

@@ -17,5 +17,5 @@ keywords:
   - complex systems
   - context engineering
   - systems engineering
-version: "1.2.0"
-date-released: "2026-08-27"
+version: "1.6.0"
+date-released: "2026-09-03"

package/README.md

@@ -2,6 +2,12 @@
 
 Make your project understandable to humans and AI.
 
+Local-target 1.6.0 candidate (not released): ordinary folders can select an accepted
+target without Git or a self-connected provider. The calling application must
+authenticate the owner's approval; adjacent checksums never grant authority.
+See [Project Technology](standard/project-technology.md#local-accepted-targets-candidate-extension)
+for the trust boundary, preview, verification and transactional selection.
+
 Mirai Graph turns scattered project knowledge into a structured graph of
 features, requirements, dependencies, risks, decisions, evidence and process
 gates.
@@ -10,7 +16,8 @@ Use it when a software project has useful knowledge spread across README files,
 docs, issues, chats, code comments and AI prompts, and you need a small
 machine-readable map that developers and AI assistants can validate and reuse.
 
-Status: stable public `1.3.0` release.
+Status: compatible 1.x line; `1.6.0` is an unpublished candidate based on `1.5.0`.
+The separate 2.x line is not included or migrated here.
 
 ## What Problem Does It Solve?
 
@@ -42,20 +49,18 @@ Start with a normal repository and use Mirai Graph to:
 
 ## Current Installation Status
 
-The repository provides the stable `mirai-graph@1.3.0` package. To verify a
-repository checkout directly, use:
+The compatible published baseline is `mirai-graph@1.5.0` on `legacy-1`.
+Do not use an unversioned npm install to select this generation: `latest` is
+independent. To verify this candidate, use its exact reviewed checkout:
 
 ```bash
-git clone https://github.com/zabarov/mirai-graph.git
-cd mirai-graph
-npm install
 npm run release:check
 ```
 
-External projects use:
+External 1.x projects can explicitly pin the published baseline:
 
 ```bash
-npm install -D mirai-graph
+npm install --save-dev --save-exact mirai-graph@1.5.0
 ```
 
 ## Connect A Project In 10 Minutes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirai-graph",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "private": false,
   "description": "An evolutionary graph operating model for managing the growth of complex systems.",
   "license": "MIT",
@@ -14,7 +14,7 @@
   },
   "scripts": {
     "pretest": "npm run test:project-technology && npm run test:context-traversal && npm run test:project-continuity && npm run test:artifact-releases && npm run test:technology-courses && npm run validate:project-technology-schemas",
-    "test:project-technology": "node packages/cli/validate-project-technology.js",
+    "test:project-technology": "node packages/cli/validate-project-technology.js && node packages/cli/validate-provider-archive.js && node packages/cli/validate-local-target.js",
     "test:context-traversal": "node packages/cli/validate-context-traversal.js",
     "test:project-continuity": "node packages/cli/validate-project-continuity.js",
     "test:artifact-releases": "node packages/cli/validate-artifact-releases.js",

package/packages/cli/graph-manifest.js

@@ -131,7 +131,14 @@ function validateManifest(manifest, repo = null) {
       for (const field of Object.keys(expected)) if (technology[field] !== expected[field]) errors.push(`extensions.mirai.project_technology.${field} is invalid`);
       if (typeof technology.enabled !== "boolean") errors.push("extensions.mirai.project_technology.enabled is invalid");
       if (technology.continuity_policy !== undefined && technology.continuity_policy !== "task_boundary") errors.push("extensions.mirai.project_technology.continuity_policy is invalid");
-      for (const field of Object.keys(technology)) if (!(field in expected) && !["enabled", "continuity_policy"].includes(field)) errors.push(`extensions.mirai.project_technology has unknown field ${field}`);
+      if (technology.target_source !== undefined) {
+        const selected = technology.target_source;
+        if (!selected || typeof selected !== "object" || Array.isArray(selected) || selected.kind !== "local" ||
+            !/^[A-Za-z0-9][A-Za-z0-9._:-]{1,255}$/.test(selected.target_id || "") ||
+            !/^[A-Za-z0-9][A-Za-z0-9._:-]{1,255}$/.test(selected.acceptance_ref || "") ||
+            Object.keys(selected).some(key => !["kind", "target_id", "acceptance_ref"].includes(key))) errors.push("extensions.mirai.project_technology.target_source is invalid");
+      }
+      for (const field of Object.keys(technology)) if (!(field in expected) && !["enabled", "continuity_policy", "target_source"].includes(field)) errors.push(`extensions.mirai.project_technology has unknown field ${field}`);
     }
   }
   if (manifest.graph !== null) {

package/packages/cli/project-technology.js

@@ -13,6 +13,8 @@ function usage() {
   console.error("Options: --apply --task <text> --source <file> --target-id <id>");
   console.error("         --semantic-digest <sha256:...> --provider-revision <sha>");
   console.error("         --refresh-binding --significant-work --max-objects <count>");
+  console.error("Archive connect: --provider-archive-trust <verified-release-anchor.json>");
+  console.error("Local target: sync --target-source <selector.json> --local-acceptance-trust <verified-owner-anchor.json> --expected-graph-digest <sha256:...> [--apply]");
   console.error("Continuity: sync --boundary task_start|stage_complete|task_complete [--evidence <json>] [--expected-graph-digest <sha256:...>]");
   console.error("            verify --significant-work [--receipt-digest <sha256:...>]");
   console.error("Context: --phase discover --task <text>");
@@ -46,7 +48,13 @@ function parse(argv) {
   const options = {};
   const values = new Set(["--task", "--source", "--target-id", "--semantic-digest", "--provider-revision", "--max-objects", "--phase", "--input", "--select", "--selection", "--packet", "--evidence", "--selector", "--reason", "--confidence", "--context-budget", "--boundary", "--expected-graph-digest", "--receipt-digest", "--state-root", "--matter-id", "--direction", "--artifact-root", "--release-date", "--release-id", "--parent-release", "--base-release", "--target-release", "--client-note", "--technology", "--scenario", "--audience", "--course-pack", "--projection"]);
   const flags = new Set(["--apply", "--refresh-binding", "--significant-work", "--create-export"]);
+  values.add("--provider-archive-trust");
+  values.add("--local-acceptance-trust");
+  values.add("--target-source");
   const names = {
+    "--local-acceptance-trust": "localAcceptanceTrustFile",
+    "--target-source": "targetSourceFile",
+    "--provider-archive-trust": "providerArchiveTrustFile",
     "--task": "task", "--source": "source", "--target-id": "targetId",
     "--semantic-digest": "semanticDigest", "--provider-revision": "providerRevision",
     "--max-objects": "maxObjects", "--apply": "apply",
@@ -89,6 +97,17 @@ function readJsonFile(file) {
 }
 
 function hydrateContextOptions(request) {
+  if (request.options.localAcceptanceTrustFile === "-" && request.options.providerArchiveTrustFile === "-") throw new Error("only one trust input may consume stdin");
+  if (request.options.localAcceptanceTrustFile) {
+    request.options.localAcceptance = request.options.localAcceptanceTrustFile === "-"
+      ? JSON.parse(fs.readFileSync(0, "utf8")) : readJsonFile(request.options.localAcceptanceTrustFile);
+  }
+  if (request.options.targetSourceFile) request.options.targetSource = readJsonFile(request.options.targetSourceFile);
+  if (request.options.providerArchiveTrustFile) {
+    if (request.operation !== "connect") throw new Error("archive trust is only supported by connect");
+    request.options.providerArchive = request.options.providerArchiveTrustFile === "-"
+      ? JSON.parse(fs.readFileSync(0, "utf8")) : readJsonFile(request.options.providerArchiveTrustFile);
+  }
   if (request.operation === "sync" && request.options.boundary) {
     if (request.options.boundary !== "task_start" && !request.options.evidenceFile) throw new Error(`${request.options.boundary} requires --evidence`);
     if (request.options.evidenceFile) request.options.continuityEvidence = readJsonFile(request.options.evidenceFile);

package/packages/cli/validate-local-target.js

@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+"use strict";
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawnSync } = require("child_process");
+const t = require("../project-technology");
+const root = fs.mkdtempSync(path.join(os.tmpdir(), "mirai-local-target-"));
+const repo = path.join(root, "ordinary folder");
+const stateRoot = path.join(root, "host-a");
+const selection = {kind:"local", target_id:"target.example.delivery", acceptance_ref:"decision.example.accepted"};
+const write = (ref,value) => {const file=path.join(repo,ref);fs.mkdirSync(path.dirname(file),{recursive:true});fs.writeFileSync(file,t.canonicalBytes(value));};
+const read = ref => JSON.parse(fs.readFileSync(path.join(repo,ref)));
+const objRef = id => `graph/specs/objects/${id}.json`;
+const object = id => ({id,kind:"constraint",title:id,summary:"Bounded example",profile:"implementation_control",lifecycle:"accepted",readiness:"accepted",evidence:[]});
+const snapshot = dir => {const out={}; function walk(at){for(const name of fs.readdirSync(at).sort()){const f=path.join(at,name);if(fs.statSync(f).isDirectory())walk(f);else out[path.relative(dir,f)]=t.sha256(fs.readFileSync(f));}} walk(dir);return out;};
+const checks=[];
+function check(id,fn){fn();checks.push({id,passed:true});}
+let trust;
+const options = () => ({stateRoot,localAcceptance:trust});
+const binding = () => t.status(repo,options()).target_binding;
+function mutate(ref,change,test){const before=fs.readFileSync(path.join(repo,ref)); const v=read(ref);change(v);write(ref,v);try{test();}finally{fs.writeFileSync(path.join(repo,ref),before);}}
+try {
+  write("graph.json",{$schema:"https://mirai-graph.dev/schemas/graph-manifest.schema.json",format:"mirai-graph",schema_version:"2.0.0",id:"project.example",aliases:[],title:"Ordinary folder",scope:"repository",kind:"project_graph",owner:"owner.example",profiles:["project_management","implementation_control"],imports:[],graph:{root:"graph",source_of_truth:["graph/specs"],objects:["graph/specs/index.json"],relations:["graph/specs/relations.json"],schemas:[],generated:["graph/generated"],raw_sources:["data"]},extensions:{"mirai.project_technology":{contract_version:"1.0.0",enabled:true,context_policy:"task_scoped",source_boundary:"hybrid_sot"}}});
+  const contract={decision_refs:[selection.acceptance_ref],goal_binding:{goal_id:"goal.example",done_when_ids:["done.example"]},requirement_bindings:[{requirement_id:"requirement.example",acceptance_ids:["acceptance.example"],done_when_ids:["done.example"]}],constraint_ids:["constraint.example"],non_goal_ids:["non_goal.example"],deferred_boundary_ids:["deferred.example"],allowed_change_scope:[{repository_id:"project.example",owner_id:"owner.example",package_id:"package.example",file_patterns:["data/tools/**"],actions:["modify","test"]}],architecture_contract:{contract_ref:"contract.example",acceptance_ref:selection.acceptance_ref,architecture_owner_id:"human.example",lifecycle:"accepted",owner_ids:["owner.example"],component_ids:["component.example"],package_ids:["package.example"],capability_ids:["capability.example"],ownership_boundaries:[{subject_ref:"component.example",data_owner:"owner.example",access_owner:"owner.example",lifecycle_owner:"owner.example",interface_owner:"owner.example",runtime_owner:"owner.example"}],required_relations:[],allowed_relations:[],forbidden_relations:[],required_dependencies:[],forbidden_dependencies:[]}};
+  const ids=[selection.target_id,selection.acceptance_ref,"goal.example","done.example","requirement.example","acceptance.example","constraint.example","non_goal.example","deferred.example","contract.example"];
+  for(const id of ids)write(objRef(id),object(id));
+  write("graph/specs/index.json",{object_files:ids.map(id=>`objects/${id}.json`)});
+  write("graph/specs/relations.json",[]);
+  fs.mkdirSync(path.join(repo,"data/tools"),{recursive:true});fs.writeFileSync(path.join(repo,"data/tools/method.txt"),"A bounded public method.\n");
+  const target={...object(selection.target_id),kind:"contract",tz_role:"contract",provider_execution_contract:contract,source_refs:["data/tools/method.txt"]};
+  write(objRef(selection.target_id),target);
+  const candidate=t.plan(repo,{stateRoot,targetSource:selection}).target_binding;
+  assert(candidate.semantic_digest);
+  target.semantic_digest=candidate.semantic_digest;target.content_revision=candidate.content_revision;write(objRef(selection.target_id),target);
+  const decision={...object(selection.acceptance_ref),kind:"decision",subtype:"architecture_baseline_acceptance",graph_id:"project.example",target_id:selection.target_id,owner_id:"human.example",semantic_digest:candidate.semantic_digest,execution_contract_digest:candidate.execution_contract_digest,approval_ref:"approval.example.owner"};
+  write(objRef(selection.acceptance_ref),decision);
+  // Synthetic authority fixture: independent trusted input is held outside
+  // the project and frozen before tamper tests. Production must verify issuer.
+  trust={graphId:"project.example",targetId:selection.target_id,ownerId:"human.example",decisionSha256:t.sha256(t.canonicalBytes(decision))};
+  check("selection_preview_zero_write",()=>{const before=snapshot(root);const r=t.execute("sync",repo,{...options(),targetSource:selection});assert.equal(r.status,"preview");assert.equal(r.target_binding.status,"ready");assert.deepEqual(snapshot(root),before);});
+  check("selection_requires_cas",()=>assert(t.execute("sync",repo,{...options(),apply:true,targetSource:selection}).blockers.includes("local_target_compare_and_swap_conflict")));
+  check("ordinary_folder_selects_without_git",()=>{const r=t.execute("sync",repo,{...options(),apply:true,targetSource:selection,expectedGraphDigest:t.continuity.graphDigest(repo)});assert.equal(r.status,"success",JSON.stringify(r));assert.equal(r.changed,true);assert(!fs.existsSync(path.join(repo,".git")));});
+  check("ready_exact_local_identity",()=>{assert.equal(binding().status,"ready",JSON.stringify(binding()));assert.equal(binding().source_kind,"local");assert.equal(binding().provider_revision,undefined);});
+  check("status_plan_context_verify_agree_and_read_only",()=>{const before=snapshot(root);for(const op of ["status","plan","context","verify"]){const r=t.execute(op,repo,{...options(),significantWork:true,task:"Bounded example"});assert.equal(r.target_binding.status,"ready",JSON.stringify(r));}assert.deepEqual(snapshot(root),before);});
+  check("asserted_accepted_is_not_trust",()=>assert(t.status(repo,{stateRoot}).target_binding.blockers.includes("local_target_acceptance_unverified")));
+  check("two_hosts_same_target_identity",()=>assert.deepEqual(t.status(repo,{...options(),stateRoot:path.join(root,"host-b")}).target_binding,binding()));
+  check("repeat_selection_byte_identical",()=>{const before=snapshot(root);const r=t.execute("sync",repo,{...options(),apply:true,targetSource:selection,expectedGraphDigest:t.continuity.graphDigest(repo)});assert.equal(r.changed,false);assert.deepEqual(snapshot(root),before);});
+  for(const lifecycle of ["draft","reviewed","stale","deprecated","blocked"]){check(`reject_${lifecycle}`,()=>mutate(objRef(selection.target_id),v=>v.lifecycle=lifecycle,()=>assert.equal(binding().status,"blocked")));}
+  check("unapproved_semantic_change",()=>mutate(objRef("requirement.example"),v=>v.summary="Different meaning",()=>assert(binding().blockers.includes("local_target_semantic_digest_mismatch"))));
+  check("rehashed_decision_is_not_trusted",()=>mutate(objRef(selection.acceptance_ref),v=>v.approval_ref="approval.other",()=>assert(binding().blockers.includes("local_target_acceptance_unverified"))));
+  check("foreign_owner",()=>mutate(objRef(selection.acceptance_ref),v=>v.owner_id="human.other",()=>assert(binding().blockers.includes("local_target_acceptance_identity_mismatch"))));
+  for(const key of ["requirement_bindings","allowed_change_scope","non_goal_ids","constraint_ids","deferred_boundary_ids"]){check(`empty_${key}`,()=>mutate(objRef(selection.target_id),v=>v.provider_execution_contract[key]=[],()=>assert.equal(binding().status,"blocked")));}
+  check("scope_owner_unapproved",()=>mutate(objRef(selection.target_id),v=>v.provider_execution_contract.allowed_change_scope[0].owner_id="owner.other",()=>assert(binding().blockers.includes("provider_contract_scope_owner_unapproved"))));
+  check("duplicate_target",()=>mutate("graph/specs/index.json",v=>{write("graph/specs/duplicate.json",target);v.object_files.push("duplicate.json");},()=>assert(binding().blockers.includes("duplicate_object_id"))));
+  fs.unlinkSync(path.join(repo,"graph/specs/duplicate.json"));
+  check("required_cycle",()=>mutate("graph/specs/relations.json",v=>v.push({id:"relation.cycle",type:"requires",source:selection.target_id,target:selection.target_id,lifecycle:"accepted"}),()=>assert(binding().blockers.includes("local_target_required_cycle"))));
+  check("private_path_rejected",()=>mutate(objRef(selection.target_id),v=>v.source_refs=["source/private/method.txt"],()=>assert(binding().blockers.includes("local_target_source_unsafe_or_missing"))));
+  check("parent_traversal_rejected",()=>mutate(objRef(selection.target_id),v=>v.source_refs=["../outside.txt"],()=>assert(binding().blockers.includes("local_target_source_unsafe_or_missing"))));
+  check("malformed_source_refs_fail_closed",()=>mutate(objRef(selection.target_id),v=>v.source_refs={ref:"data/tools/method.txt"},()=>assert(binding().blockers.includes("local_target_source_refs_invalid"))));
+  check("tool_drift_not_semantic_acceptance",()=>{const file=path.join(repo,"data/tools/method.txt");const before=fs.readFileSync(file);fs.writeFileSync(file,"Changed tool\n");try{const b=binding();assert(b.blockers.includes("local_target_content_stale"));assert(!b.blockers.includes("local_target_semantic_digest_mismatch"));}finally{fs.writeFileSync(file,before);}});
+  check("external_binding_never_falls_back",()=>{const file=path.join(t.continuity.stateRoot(repo,read("graph.json"),options()),"target-provider-binding.json");fs.writeFileSync(file,"{}");try{assert(binding().blockers.includes("local_external_target_conflict"));}finally{fs.unlinkSync(file);}});
+  check("disabled_blocks_significant_verify",()=>mutate("graph.json",v=>v.extensions["mirai.project_technology"].enabled=false,()=>assert(t.verify(repo,{...options(),significantWork:true}).blockers.includes("project_technology_disabled"))));
+  check("shared_lease_conflict_preserves_bytes",()=>{const file=path.join(repo,"graph/.project-technology-continuity.lock");fs.writeFileSync(file,"occupied");const before=snapshot(root);try{assert(t.execute("sync",repo,{...options(),apply:true,targetSource:selection,expectedGraphDigest:t.continuity.graphDigest(repo)}).blockers.includes("continuity_lease_conflict"));assert.deepEqual(snapshot(root),before);}finally{fs.unlinkSync(file);}});
+  check("offline_stale_cas_blocks",()=>assert(t.execute("sync",repo,{...options(),apply:true,targetSource:selection,expectedGraphDigest:"sha256:"+"0".repeat(64)}).blockers.includes("local_target_compare_and_swap_conflict")));
+  check("selection_failure_rolls_back_project",()=>{
+    const manifest=read("graph.json");const unselected=structuredClone(manifest);delete unselected.extensions["mirai.project_technology"].target_source;write("graph.json",unselected);
+    const before=snapshot(repo);const rename=fs.renameSync;let injected=false;
+    fs.renameSync=(from,to)=>{const result=rename(from,to);if(!injected&&String(to)===path.join(repo,"graph.json")){injected=true;throw new Error("fixture failure after manifest rename");}return result;};
+    try{const r=t.execute("sync",repo,{...options(),apply:true,targetSource:selection,expectedGraphDigest:t.continuity.graphDigest(repo)});assert(r.blockers.includes("local_target_rollback_applied"),JSON.stringify(r));assert.deepEqual(snapshot(repo),before);}finally{fs.renameSync=rename;write("graph.json",manifest);}
+  });
+  check("cli_local_trust_and_plan",()=>{
+    const file=path.join(root,"owner-trust.json");fs.writeFileSync(file,JSON.stringify(trust));
+    const r=spawnSync(process.execPath,[path.join(__dirname,"project-technology.js"),"plan",repo,"--local-acceptance-trust",file,"--state-root",stateRoot],{encoding:"utf8"});
+    assert.equal(r.status,0,r.stderr);assert.equal(JSON.parse(r.stdout).target_binding.status,"ready");
+  });
+  check("missing_verification_blocks_execution_not_diagnostics",()=>{
+    assert(t.verify(repo,{...options(),significantWork:true}).blockers.includes("local_target_verification_missing"));
+    assert(t.context(repo,{...options(),significantWork:true,task:"Bounded example"}).blockers.includes("local_target_verification_missing"));
+    assert.equal(t.plan(repo,options()).target_binding.status,"ready");
+  });
+  const evidence={task_digest:t.sha256("verified local fixture",true),outcome:"Verified bounded local method",requirement_refs:["requirement.example"],evidence_refs:["data/tools/method.txt"],checks:[{id:"check.example",verdict:"pass",evidence_ref:"data/tools/method.txt"}],changed_surfaces:["data/tools/method.txt"]};
+  check("verified_boundary_unlocks_significant_verify",()=>{
+    const r=t.execute("sync",repo,{...options(),apply:true,boundary:"stage_complete",continuityEvidence:evidence,expectedGraphDigest:t.continuity.graphDigest(repo)});
+    assert.equal(r.status,"success",JSON.stringify(r));
+    const v=t.verify(repo,{...options(),significantWork:true});assert.equal(v.status,"success",JSON.stringify(v));
+  });
+  check("repointing_content_pin_does_not_refresh_verification",()=>{
+    const file=path.join(repo,"data/tools/method.txt");const before=fs.readFileSync(file);fs.writeFileSync(file,"A newly checked method needs fresh evidence.\n");
+    try{mutate(objRef(selection.target_id),v=>v.content_revision=binding().content_revision,()=>{
+      assert.equal(binding().status,"ready");
+      assert(t.verify(repo,{...options(),significantWork:true}).blockers.includes("local_target_verification_stale"));
+    });}finally{fs.writeFileSync(file,before);}
+  });
+  check("two_hosts_same_context_discovery_digest",()=>{
+    const a=t.context(repo,{...options(),task:"Bounded example"});const b=t.context(repo,{...options(),stateRoot:path.join(root,"host-b"),task:"Bounded example"});
+    assert.deepEqual(a.traversal_receipt,b.traversal_receipt);
+    assert(t.verify(repo,{...options(),stateRoot:path.join(root,"host-b"),significantWork:true}).blockers.includes("local_target_verification_missing"));
+  });
+  // Optional synthetic fixture for consumer integration tests; never real data.
+  if(process.env.MIRAI_LOCAL_TARGET_FIXTURE_EXPORT){
+    const output=path.resolve(process.env.MIRAI_LOCAL_TARGET_FIXTURE_EXPORT);
+    fs.mkdirSync(output,{recursive:true});
+    for(const name of ["project","state","owner-trust.json"])assert(!fs.existsSync(path.join(output,name)),"fixture destination must be empty");
+    fs.cpSync(repo,path.join(output,"project"),{recursive:true});fs.cpSync(stateRoot,path.join(output,"state"),{recursive:true});
+    fs.writeFileSync(path.join(output,"owner-trust.json"),t.canonicalBytes(trust));
+  }
+  check("local_disconnect_transaction_and_repeat",()=>{
+    const r=t.execute("disconnect",repo,{...options(),apply:true,expectedGraphDigest:t.continuity.graphDigest(repo)});
+    assert.equal(r.status,"success",JSON.stringify(r));assert.equal(r.changed,true);assert.equal(binding().status,"not_configured");assert(r.rollback_ref);
+    const before=snapshot(root);assert.equal(t.execute("disconnect",repo,{...options(),apply:true}).changed,false);assert.deepEqual(snapshot(root),before);
+    assert.equal(t.execute("sync",repo,{...options(),apply:true,targetSource:selection,expectedGraphDigest:t.continuity.graphDigest(repo)}).status,"success");
+  });
+  const unborn=path.join(root,"new Git project");fs.cpSync(repo,unborn,{recursive:true});
+  assert.equal(spawnSync("git",["init","-q",unborn]).status,0);
+  check("unborn_inventory_declared_sources_and_zero_write",()=>{
+    const before=snapshot(unborn);const inv=t.inventory(unborn);
+    assert.deepEqual(inv.blockers||[],[]);assert.equal(inv.revision,null);
+    assert(inv.files.some(f=>f.path==="data/tools/method.txt"));assert.deepEqual(snapshot(unborn),before);
+  });
+  check("unborn_sync_and_repeat",()=>{
+    assert.equal(t.execute("sync",unborn,{...options(),apply:true}).status,"success");
+    const before=snapshot(unborn);assert.equal(t.execute("sync",unborn,{...options(),apply:true}).changed,false);assert.deepEqual(snapshot(unborn),before);
+  });
+  const headFile=path.join(unborn,".git/HEAD");const headBytes=fs.readFileSync(headFile);
+  check("invalid_detached_head_not_unborn",()=>{
+    fs.writeFileSync(headFile,"f".repeat(40)+"\n");
+    try{assert(t.inventory(unborn).blockers.includes("inventory_git_unavailable"));}finally{fs.writeFileSync(headFile,headBytes);}
+  });
+  check("corrupt_symbolic_branch_not_unborn",()=>{
+    const ref=headBytes.toString().trim().replace(/^ref: /,"");const file=path.join(unborn,".git",ref);fs.mkdirSync(path.dirname(file),{recursive:true});fs.writeFileSync(file,"not-a-commit\n");
+    try{assert(t.inventory(unborn).blockers.includes("inventory_git_unavailable"));}finally{fs.unlinkSync(file);}
+  });
+  check("corrupt_index_not_unborn",()=>{
+    const file=path.join(unborn,".git/index");fs.writeFileSync(file,"broken index");
+    try{assert(t.inventory(unborn).blockers.includes("inventory_git_unavailable"));}finally{fs.unlinkSync(file);}
+  });
+  check("unavailable_git_not_unborn",()=>{
+    const prior=process.env.PATH;process.env.PATH=path.join(root,"no-tools");
+    try{assert(t.inventory(unborn).blockers.includes("inventory_git_unavailable"));}finally{process.env.PATH=prior;}
+  });
+  check("unborn_provider_does_not_invent_revision",()=>{
+    const r=t.execute("provide",unborn,{...options(),apply:true,targetId:selection.target_id,semanticDigest:target.semantic_digest,providerRevision:"a".repeat(40)});
+    assert.notEqual(r.status,"success");
+  });
+  check("git_equivalent_identity",()=>{const before=binding();for(const args of [["init","-q"],["config","user.name","Fixture"],["config","user.email","fixture@example.invalid"],["add","."],["commit","-qm","accepted fixture"]])assert.equal(spawnSync("git",args,{cwd:repo}).status,0);assert.deepEqual(binding(),before);});
+  console.log(JSON.stringify({status:"success",checks_passed:checks.length,checks},null,2));
+} finally {fs.rmSync(root,{recursive:true,force:true});}

package/packages/cli/validate-provider-archive.js

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+"use strict";
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const vm = require("vm");
+const { createRequire } = require("module");
+const { spawnSync } = require("child_process");
+const technology = require("../project-technology");
+const fixtureFile = path.join(__dirname, "validate-project-technology.js");
+const fixtureText = fs.readFileSync(fixtureFile, "utf8");
+const sandbox = { require: createRequire(fixtureFile), module: { exports: {} } };
+vm.runInNewContext(fixtureText.slice(0, fixtureText.indexOf("const checks = [];")) +
+  "\nmodule.exports={initRepo,addTarget,git,TARGET_ID,SEMANTIC_DIGEST};", sandbox);
+const fixture = sandbox.module.exports;
+const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "mirai-archive-test-")));
+const originalPath = process.env.PATH;
+const checks = [];
+function check(id, condition, details) { checks.push({ id, passed: Boolean(condition) }); assert.ok(condition, `${id}: ${JSON.stringify(details)}`); }
+function digestTree(dir) {
+  const files = [];
+  function walk(current) {
+    if (!fs.existsSync(current)) return;
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const file = path.join(current, entry.name);
+      if (entry.isDirectory()) walk(file);
+      else files.push([path.relative(dir, file), technology.sha256(fs.readFileSync(file))]);
+    }
+  }
+  walk(dir); return technology.sha256(JSON.stringify(files.sort()));
+}
+try {
+  const sourceRoot = path.join(root, "source"); fs.mkdirSync(sourceRoot);
+  const provider = fixture.initRepo(sourceRoot, "fixture-provider");
+  const consumer = fixture.initRepo(sourceRoot, "fixture-consumer");
+  let revision = fixture.addTarget(provider);
+  const stateRoot = path.join(root, "state");
+  const base = { targetId: fixture.TARGET_ID, semanticDigest: fixture.SEMANTIC_DIGEST, stateRoot, apply: true };
+  for (const repo of [provider, consumer]) assert.equal(technology.execute("enable", repo, base).status, "success");
+  fixture.git(provider, "add", "graph.json"); fixture.git(provider, "commit", "-qm", "accepted activation");
+  revision = fixture.git(provider, "rev-parse", "HEAD");
+  const releases = [];
+  for (let n = 0; n < 2; n++) {
+    if (n) { fixture.git(provider, "commit", "--allow-empty", "-qm", "compatible revision"); revision = fixture.git(provider, "rev-parse", "HEAD"); }
+    const provided = technology.execute("provide", provider, { ...base, providerRevision: revision });
+    assert.equal(provided.status, "success");
+    const beforeSourceProof = digestTree(root);
+    const sourceProof = technology.execute("verify", provider, { source: path.join(provider, provided.export_ref) });
+    check(`source_export_proven_${n}`, sourceProof.status === "success" && sourceProof.provider_archive.providerRevision === revision, sourceProof);
+    check(`source_proof_zero_write_${n}`, digestTree(root) === beforeSourceProof);
+    check(`source_proof_not_authority_${n}`, technology.execute("verify", provider, { source: path.join(provider, provided.export_ref), significantWork: true }).status === "blocked");
+    const providerManifestPath = path.join(provider, "graph.json");
+    const providerManifestBytes = fs.readFileSync(providerManifestPath);
+    fs.appendFileSync(providerManifestPath, " ");
+    check(`uncommitted_manifest_blocks_source_proof_${n}`, technology.execute("verify", provider, { source: path.join(provider, provided.export_ref) }).blockers.includes("provider_manifest_not_revision_bound"));
+    fs.writeFileSync(providerManifestPath, providerManifestBytes);
+    const bytes = fs.readFileSync(path.join(provider, provided.export_ref));
+    const source = path.join(root, `export-${n}.json`); fs.writeFileSync(source, bytes);
+    check(`external_export_blocks_source_proof_${n}`, technology.execute("verify", provider, { source }).blockers.includes("provider_export_outside_repository"));
+    // Build anchor on the verified SOURCE side, before Git is removed.
+    const ancestors = n ? [releases[0].providerRevision] : [];
+    for (const ancestor of ancestors) fixture.git(provider, "merge-base", "--is-ancestor", ancestor, revision);
+    releases.push({ ...base, source, providerRevision: revision, providerArchive: {
+      exportSha256: technology.sha256(bytes), graphId: "fixture-provider", providerRevision: revision, ancestorRevisions: ancestors,
+    } });
+  }
+  const packedConsumer = path.join(root, "consumer");
+  fs.cpSync(consumer, packedConsumer, { recursive: true, filter: file => path.basename(file) !== ".git" });
+  const emptyPath = path.join(root, "no-tools"); fs.mkdirSync(emptyPath); process.env.PATH = emptyPath;
+  check("git_is_absent", spawnSync("git", ["--version"]).error?.code === "ENOENT");
+  const invoke = options => technology.execute("connect", packedConsumer, options);
+  const noTrust = { ...releases[0] }; delete noTrust.providerArchive;
+  check("untrusted_archive_blocked", invoke(noTrust).blockers.includes("provider_revision_order_unverifiable"));
+  const before = digestTree(root);
+  check("preview", invoke({ ...releases[0], apply: false }).status === "preview");
+  check("preview_zero_write", digestTree(root) === before);
+  const connected = invoke(releases[0]);
+  check("archive_connect", connected.status === "success", connected);
+  check("complete_contract_imported", connected.target_binding.status === "ready", connected);
+  const after = digestTree(root);
+  check("repeat_changed_false", invoke(releases[0]).changed === false);
+  check("repeat_byte_identical", digestTree(root) === after);
+  const status = technology.execute("status", packedConsumer, base);
+  check("read_only_ready", status.target_binding.status === "ready", status);
+  technology.execute("verify", packedConsumer, base);
+  check("diagnostics_zero_write", digestTree(root) === after);
+  function denied(id, options, blocker) {
+    const prior = digestTree(root); const result = invoke(options);
+    check(id, result.status === "fail" && (!blocker || result.blockers.includes(blocker)), result);
+    check(`${id}_zero_write`, prior === digestTree(root));
+  }
+  denied("null_trust", { ...releases[0], providerArchive: null }, "provider_archive_trust_invalid");
+  denied("bad_digest", { ...releases[0], providerArchive: { ...releases[0].providerArchive, exportSha256: "0".repeat(64) } }, "provider_archive_export_digest_mismatch");
+  denied("bad_graph", { ...releases[0], providerArchive: { ...releases[0].providerArchive, graphId: "other.provider" } }, "provider_archive_graph_mismatch");
+  denied("bad_revision", { ...releases[0], providerArchive: { ...releases[0].providerArchive, providerRevision: "f".repeat(40) } }, "provider_archive_revision_mismatch");
+  denied("extra_trust_fields", { ...releases[0], providerArchive: { ...releases[0].providerArchive, approved: true } }, "provider_archive_trust_invalid");
+  denied("explicit_refresh_required", releases[1], "target_provider_refresh_required");
+  denied("missing_ancestry", { ...releases[1], refreshBinding: true, providerArchive: { ...releases[1].providerArchive, ancestorRevisions: [] } }, "provider_revision_not_forward");
+  denied("target_mismatch", { ...releases[1], targetId: "other.target", refreshBinding: true }, "target_provider_target_mismatch");
+  denied("semantic_mismatch", { ...releases[1], semanticDigest: `sha256:${"3".repeat(64)}`, refreshBinding: true }, "target_provider_semantic_mismatch");
+  const refreshed = invoke({ ...releases[1], refreshBinding: true });
+  check("forward_refresh", refreshed.status === "success" && refreshed.changed, refreshed);
+  const refreshedTree = digestTree(root);
+  check("refresh_idempotent", invoke({ ...releases[1], refreshBinding: true }).changed === false);
+  check("refresh_byte_identical", digestTree(root) === refreshedTree);
+  denied("downgrade", { ...releases[0], refreshBinding: true }, "provider_revision_not_forward");
+  const original = fs.readFileSync(releases[1].source);
+  fs.appendFileSync(releases[1].source, " ");
+  denied("tampered_bytes", { ...releases[1], refreshBinding: true }, "provider_archive_export_digest_mismatch");
+  fs.writeFileSync(releases[1].source, original);
+  function alteredExport(id, alter, expected) {
+    const payload = JSON.parse(original); alter(payload);
+    fs.writeFileSync(releases[1].source, technology.canonicalBytes(payload));
+    const options = { ...releases[1], refreshBinding: true, providerArchive: { ...releases[1].providerArchive,
+      exportSha256: technology.sha256(fs.readFileSync(releases[1].source)), graphId: payload.provider_graph_id } };
+    denied(id, options, expected); fs.writeFileSync(releases[1].source, original);
+  }
+  alteredExport("provider_conflict", p => { p.provider_graph_id = "another.provider"; }, "target_provider_graph_conflict");
+  alteredExport("incomplete_contract", p => { p.requirement_bindings = []; });
+  alteredExport("contract_tamper", p => { p.goal_binding.done_when_ids = ["done.other"]; });
+  alteredExport("valid_but_different_contract", p => {
+    p.allowed_change_scope[0].file_patterns = ["packages/other/**"];
+    p.execution_contract_digest = technology.sha256(technology.canonicalBytes(technology.normalizeExecutionContract(p).contract));
+  }, "provider_execution_contract_refresh_mismatch");
+  alteredExport("reviewed_not_accepted", p => { p.architecture_contract.lifecycle = "reviewed"; });
+  alteredExport("private_extra_field", p => { p.private_source = "not allowed"; }, "provider_export_not_bounded");
+  const graphFile = path.join(packedConsumer, "graph.json"); const graphBefore = fs.readFileSync(graphFile);
+  const graph = JSON.parse(graphBefore); graph.extensions["mirai.project_technology"].enabled = false;
+  fs.writeFileSync(graphFile, JSON.stringify(graph));
+  denied("disabled", releases[1], "project_technology_not_enabled");
+  check("disabled_diagnostics_available", technology.execute("status", packedConsumer, base).operation_mode === "read_only");
+  fs.writeFileSync(graphFile, graphBefore);
+  const trustFile = path.join(root, "trust.json"); fs.writeFileSync(trustFile, JSON.stringify(releases[1].providerArchive));
+  const cli = spawnSync(process.execPath, [path.join(__dirname, "project-technology.js"), "connect", packedConsumer,
+    "--source", releases[1].source, "--target-id", base.targetId, "--semantic-digest", base.semanticDigest,
+    "--provider-revision", releases[1].providerRevision, "--state-root", stateRoot,
+    "--provider-archive-trust", trustFile, "--apply"], { encoding: "utf8" });
+  check("cli_no_git_idempotent", cli.status === 0 && JSON.parse(cli.stdout).changed === false, cli.stdout);
+  // A new identity field is optional for historical Git exports, but required
+  // for authenticated archive imports. Existing stored contracts remain valid.
+  const legacy = JSON.parse(original); delete legacy.provider_graph_id;
+  fs.writeFileSync(releases[1].source, technology.canonicalBytes(legacy));
+  check("historical_export_readable", technology.readExport(releases[1].source).blockers.length === 0);
+  denied("legacy_archive_needs_graph_identity", { ...releases[1], providerArchive: { ...releases[1].providerArchive,
+    exportSha256: technology.sha256(fs.readFileSync(releases[1].source)) } }, "provider_archive_graph_mismatch");
+  fs.writeFileSync(releases[1].source, original);
+  const folderInventory = technology.inventory(packedConsumer);
+  check("folder_inventory_nonempty", folderInventory.files.some(file => file.path === "graph.json") && folderInventory.files.some(file => file.path === "README.md"), folderInventory);
+  check("folder_inventory_sync", technology.execute("sync", packedConsumer, base).status === "success");
+  check("folder_inventory_sync_noop", technology.execute("sync", packedConsumer, base).changed === false);
+  const readme = path.join(packedConsumer, "README.md"); const readmeBefore = fs.readFileSync(readme);
+  fs.appendFileSync(readme, "\nChanged declared raw source\n");
+  const staleTree = digestTree(root);
+  check("folder_changed_source_is_stale", technology.execute("status", packedConsumer, base).blockers.includes("project_technology_inventory_stale"));
+  check("folder_stale_status_zero_write", digestTree(root) === staleTree);
+  fs.writeFileSync(readme, readmeBefore);
+  const graphForMissing = JSON.parse(fs.readFileSync(graphFile)); graphForMissing.graph.raw_sources.push("missing-required-source.md");
+  fs.writeFileSync(graphFile, JSON.stringify(graphForMissing));
+  const missingBefore = digestTree(root);
+  check("missing_declared_source_blocks_sync", technology.execute("sync", packedConsumer, base).blockers.includes("inventory_declared_source_missing"));
+  check("missing_source_sync_zero_write", digestTree(root) === missingBefore);
+  fs.writeFileSync(graphFile, graphBefore);
+  console.log(JSON.stringify({ status: "success", check_count: checks.length, checks }, null, 2));
+} finally { process.env.PATH = originalPath; fs.rmSync(root, { recursive: true, force: true }); }

package/packages/project-technology/continuity.js

@@ -406,6 +406,8 @@ module.exports = {
   digest,
   graphDigest,
   latestReceipt,
+  lock,
+  releaseLock,
   normalizeEvidence,
   stateRoot,
   status,