owlrunkit 0.18.0 → 0.18.2

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 0.18.2
+
+- Makes `project checkpoint --help` action-specific and returns a complete,
+  shell-safe correction command when a measured checkpoint omits
+  `--completed-units`.
+- Keeps symlinked workspace roots fail-closed while reporting the canonical
+  `--workspace` path, including the macOS `/tmp` to `/private/tmp` case.
+- Returns a bounded stdout/stderr `outputSummary` at the top level of Quick
+  results without changing the receipt or weakening full-output binding.
+- Retries one transient registry transport failure while retaining the existing
+  per-attempt timeout, and distinguishes DNS, connection, timeout, HTTP,
+  authentication, and missing-version failures.
+- Aligns the packaged README with five-mode routing and existing profile
+  reconciliation instead of treating long-running, release, or production
+  labels as automatic Formal triggers.
+- Adds action-specific `quick-verify --help`, lists canonical risk-category
+  values in mode help and validation errors, and marks formatting-only profile
+  reconcile plans with `normalizationOnly: true`.
+
+## 0.18.1
+
+- Adds read-only `mode recommend` and `mode status` commands with five
+  user-facing presets over independent continuity and assurance dimensions.
+- Routes long-running, interruption recovery, and ordinary reversible project
+  mutation to Project Driver continuity without automatically forcing Formal.
+  Multi-writer, permission/security, funds, irreversible, rollback-uncertain,
+  schema/data migration, and explicit acceptance facts still force Formal.
+- Fixes Quick metrics to report receipt-time pass, fail, and source mutation
+  independently of later workspace drift.
+- Returns the standalone `quick-attest` command from Quick results and adds
+  action-specific `quick-attest --help`.
+- Diagnoses managed Skill/config Core version drift independently from installed
+  file integrity.
+- Aligns `doctor` with full profile validation, stops profile detection from
+  inventing absent `src/**` and `tests/**` surfaces, and adds atomic profile
+  reconciliation for an existing project.
+- Adds action-specific `adopt --help` and keeps top-level inspection focused on
+  the Project Driver's dominant project gap when one exists.
+- Preserves `authorizationGranted=false` and the separation between workflow,
+  acceptance, Git, release, deployment, production, and business authority.
+
 ## 0.18.0
 
 - Introduces the Project Driver product path for continuity across Agents and

package/README.md

@@ -6,6 +6,15 @@ makes that continuity inspectable and recoverable. RunKit 0.18 keeps work
 moving across Agents and sessions through a typed direct flow while preserving
 the existing assurance, source, and evidence boundaries.
 
+RunKit 0.18.1 adds a human-first usage-mode recommendation that selects
+continuity and assurance independently. It keeps ordinary development light
+while preserving mandatory Formal routing for material safety and authority
+facts.
+
+RunKit 0.18.2 is a focused dogfood patch for clearer CLI help, actionable
+checkpoint and canonical-path errors, bounded Quick output summaries, typed
+registry diagnostics, and explicit profile normalization previews.
+
 The 0.18 Project Driver is a bounded surface for new projects and controlled
 dogfood. Its product name does not claim to be a general long-running,
 multi-phase, or enterprise control plane. Version 0.18 adds one bounded
@@ -20,7 +29,7 @@ separate authority boundaries.
 ## Install
 
 ```bash
-npm install --save-exact owlrunkit@0.18.0
+npm install --save-exact owlrunkit@0.18.2
 ```
 
 The `owlrunkit` bootstrap uses the project's exact locally bound CLI for
@@ -36,8 +45,15 @@ the project Config must independently bind the same Core.
 owlrunkit --version
 owlrunkit init --workspace /absolute/path/to/project
 owlrunkit doctor --workspace /absolute/path/to/project
+owlrunkit mode recommend --workspace /absolute/path/to/project
+owlrunkit mode status --workspace /absolute/path/to/project
 ```
 
+`mode recommend` is read-only and defaults to human output; add `--json` for a
+machine contract. The five user modes are presets over `continuity`
+(`none | project_driver`) and `assurance` (`none | quick | formal`). They never
+grant Git, release, deployment, production, or business authority.
+
 ## Project Driver: Coordinate a multi-Agent project
 
 RunKit 0.18 keeps the project alive independently of any one Agent or chat.
@@ -100,9 +116,10 @@ Normal users supply the one definition JSON to `init`, then use typed flags and
 values. They do not need to author request, event, receipt, or hash JSON. The
 legacy `--request <event.json>` path remains available for existing automation
 and compatibility. Multiple Agents do not make project coordination Formal by
-themselves. This flow does not make project coordination Formal by itself; the
-assurance lane follows the underlying high-risk integration,
-release, production, migration, destructive, or explicit Formal-acceptance boundary.
+themselves. Project Driver continuity does not make project coordination Formal
+by itself. The assurance lane follows actual writer and authority count,
+rollback certainty, permissions, security, funds, irreversibility, schema/data
+migration, and explicit acceptance contracts—not environment labels alone.
 
 `project verification --defer` is a small deferred-verification ledger, not a
 test scheduler. It records stable check IDs, why they were intentionally not
@@ -154,30 +171,52 @@ high-confidence candidates:
 ```bash
 owlrunkit profiles detect --workspace . --dry-run
 owlrunkit profiles detect --workspace . --apply
+owlrunkit profiles reconcile --workspace . --dry-run
+owlrunkit profiles reconcile --workspace . --apply
 owlrunkit profiles validate --workspace .
 ```
 
-`--apply` is create-only. It refuses ambiguous or low-confidence candidates,
-source drift, symlinks, and launchers that do not resolve to exact local files.
-It directly supports lock-bound npm plus exact project-installed pnpm, Yarn,
-and Bun launchers. A PATH-only package manager remains review-required. It
-never silently replaces an existing profile set.
+`profiles detect --apply` is create-only. `profiles reconcile` previews or
+atomically updates an existing profile set and leaves a migration receipt. Both
+paths refuse ambiguous or low-confidence candidates, source drift, symlinks,
+and launchers that do not resolve to exact local files. Detection directly
+supports lock-bound npm plus exact project-installed pnpm, Yarn, and Bun
+launchers. A PATH-only package manager remains review-required. A dry-run that
+only canonicalizes JSON formatting reports `normalizationOnly: true` instead of
+showing unexplained hash drift with an empty update list.
+
+## Choose auto, off, light, managed, or formal
+
+Start with the human-first read-only recommendation:
+
+```bash
+owlrunkit mode recommend --workspace .
+```
+
+- **off / No RunKit** uses neither continuity nor assurance for analysis,
+  documentation, and disposable exploration that needs no reusable evidence.
+- **light / Quick Verification** runs one exact low-risk, source-bound command.
+- **managed** adds Project Driver continuity; each WorkItem may still use no
+  assurance, Quick, or Formal according to its own facts.
+- **formal / Formal Delivery** is forced by multiple writers, permission or
+  security boundaries, funds, irreversible work, uncertain rollback,
+  schema/data migration, or an explicit Formal acceptance contract.
+- **auto** derives the preset from supplied facts and is the default.
 
-## Choose No RunKit, Quick, or Formal
+Production, release, deployment, long duration, and interruption recovery do
+not force Formal by themselves. Long or interrupted work primarily selects
+Project Driver continuity. Risk containment permits a fresh lower-assurance
+recommendation; escalation is not sticky.
 
-Route explicit risk facts before starting work:
+Machine integrations may route an explicit risk-facts document directly:
 
 ```bash
 owlrunkit assurance route --workspace . \
   --request ./scripts/runkit-contract/templates/assurance-request.json
 ```
 
-- **No RunKit** is for work that needs neither a reusable receipt nor controlled
-  writes.
-- **Quick Verification** is for one low-risk, source-bound command that needs a
-  reusable receipt but no writer lease or Formal acceptance.
-- **Formal Delivery** is for multi-writer, long-running, migration, integration,
-  release, production, funds, destructive, or formally accepted work.
+`mode recommend --help` lists every accepted `--risk-category`; an invalid
+category reports both the rejected value and the canonical allowed list.
 
 The router fails closed to Formal when required risk facts are incomplete.
 Quick receipts cannot become Formal acceptance, and Formal acceptance does not
@@ -189,6 +228,11 @@ Run Quick with:
 owlrunkit quick-verify --workspace . -- npm test
 ```
 
+The top-level Quick result includes a bounded `outputSummary` with the last
+meaningful stdout/stderr lines, so common summaries such as `155 passed` are
+visible without opening `stdout.log`. The receipt still binds the complete
+stdout and stderr artifacts; the summary is presentation only.
+
 ## Formal Delivery in three commands
 
 Given a Goal Contract and the paths this work item may write, the happy path is:

package/docs/architecture/OWLCODA_RUNKIT_USAGE_MODE_SELECTION_PRODUCT_DECISION_20260811.md

@@ -0,0 +1,166 @@
+# OwlCoda RunKit 使用模式选择：Sierac MES Dogfood 产品决议
+
+状态：**0.18.1 已发布；本文主体保留发布前产品决议，文末追加 0.18.2 dogfood 补丁候选**
+日期：2026-08-11
+
+## 已验证现场事实
+
+以下结论来自对
+`/Users/yeemio/AI/project/sieracMes-AI/.owlcoda/runkit/` 的只读检查，
+不是体验推测：
+
+- W1.6 留下四份 Quick Receipt V1。按回执生成时的 `exitResult` 与
+  `mutationDecision` 分类，结果是 3 pass、1 fail、0 source mutation；四份均为
+  `source_unchanged`。
+- 旧版 `quick-metrics` 使用“当前 workspace 是否仍匹配历史回执”来统计历史结果。
+  在后续源码变化后，它把四份回执全部错算为 `sourceMutated`，并输出
+  `passed=0 / failed=0 / sourceMutated=4`。
+- Quick 的实际测试命令发现了 W1.6 的 pytest 问题；RunKit 的价值是保留失败、
+  绑定候选并阻止错误完成声明，不是替代项目测试发现业务缺陷。
+- 三次相关 Quick 的机器耗时约九秒。主要摩擦来自人工选择模式、填写标识和
+  时间戳、分别 checkpoint/integrate，以及排查不一致命令。
+- Project Driver 对长线程、跨会话恢复、脏工作树和延期验收有实际价值。
+- 现场成功回执长期携带 `quick_ignored_artifact_unbound`，但 attestation 仍可为
+  GO；该 issue 目前缺少清晰、可行动的严重级别。
+
+## 产品长期决策
+
+RunKit 定位为“飞行记录仪和阶段控制器”，不是所有命令的审批系统。
+
+用户看到五种模式，但内部不以单一枚举承担全部语义。路由始终保留两个正交维度：
+
+| 用户模式 | continuity | assurance | 典型用途 |
+| --- | --- | --- | --- |
+| `off` | `none` | `none` | 分析、文档、一次性探索、无需复用证据的小任务 |
+| `light` | `none` | `quick` | 单 writer、低风险、一个冻结候选、一条精确验证命令 |
+| `managed` | `project_driver` | WorkItem 级 `none/quick/formal` | 跨会话目标、交接、checkpoint、gate |
+| `formal` | 依连续性事实自动选择 | `formal` | 真正高风险或合同要求正式验收的边界 |
+| `auto` | 按事实选择 | 按事实选择 | 默认推荐 |
+
+模式只表达工作流偏好，不表达授权。任何模式都不得授予 Git、发布、部署、生产或
+业务权限。
+
+下列事实强制 Formal：多 writer、权限或安全边界、资金、不可逆变更、回滚不确定、
+schema/data migration、明确 Formal acceptance。`off/light/managed` 不能覆盖这些
+事实。
+
+下列标签或事实单独出现时不强制 Formal：普通项目源码修改、`longRunning`、
+`interruptionRecovery`、production、release、deployment。长周期和中断恢复主要
+选择 Project Driver；单 writer、可回滚且有业务读回的普通源码变更可以是
+`managed + quick`。风险被 containment 后必须重新路由，升级不具有粘性。
+
+## 0.18.0 已有能力
+
+- Quick Verification 保存 source-bound 命令回执、stdout/stderr 和失败状态。
+- Project Driver 保存目标、WorkItem、依赖、checkpoint、handoff、decision、
+  verification gate 和 takeover 状态。
+- Formal Delivery 提供候选、lease、严格证据与正式验收边界。
+- 所有这些能力都保持 `authorizationGranted=false`，验收与 Git/发布/部署/业务授权
+  分离。
+
+0.18.0 并没有提供五模式入口，也没有解决本次现场暴露的历史 metrics、Quick 后续
+命令、`quick-attest --help` 和 Skill/Core 版本漂移诊断。
+
+## 本轮 0.18.1 候选实现
+
+### 使用模式只读入口
+
+新增：
+
+```bash
+owlrunkit mode recommend --workspace "$PWD"
+owlrunkit mode status --workspace "$PWD"
+```
+
+普通输出为人类可读文本；`--json` 提供严格机器结果。推荐结果包含：推荐模式、
+continuity、assurance、触发原因、被拒绝的较轻模式、预计新增步骤和证据数、下一条
+命令、降级是否允许，以及完整权限边界。
+
+`mode status` 当前只报告 `default_auto`，不创建 `.owlcoda`，也不暗示已有持久化
+设置。本轮没有实现 `mode set`。
+
+### MVP 一致性修复
+
+- `quick-metrics` 以历史回执自身的 `exitResult` 与 `mutationDecision` 统计 pass、
+  fail 和 source mutation；当前 workspace 漂移不再改写历史结果。回执 schema、
+  snapshot binding 和输出材料仍校验；Core/context 的信任结论继续由
+  `quick-attest` 独立报告，不改写历史运行统计。
+- Quick 结果的后续命令改为可执行的
+  `owlrunkit quick-attest --workspace ... --receipt ...`。
+- `quick-attest --help` 返回 action-specific help。
+- assurance router 不再因普通 project mutation、long-running、interruption
+  recovery 或 production/release/deployment 标签自动升级 Formal；真正强制事实仍
+  fail closed，且解除后可以降级。
+- Skill installer 的只读 `inspect` 同时检查受管文件完整性与运行包的
+  Skill/config Core 版本；版本旧时明确返回 `version_mismatch`。
+- 同一候选内的 profile 一致性修复不再为不存在、也无法从真实脚本/workspace
+  推导出的 `src/**`、`tests/**` 制造阻塞项，并提供现有 profile 的原子 reconcile。
+
+## 后续缺口
+
+### P1：Quick warning 需要可行动语义
+
+把 `quick_ignored_artifact_unbound` 区分为不影响当前决策的 maintenance note 与会
+阻断复用的 issue。验收标准：GO 回执不再永久携带无法行动的高噪声告警；任何被
+降级的提示仍在详细输出中可查，真实材料缺口继续 fail closed。
+
+### P1：Project Driver 日常动作减负
+
+自动生成安全的事件 ID 和时间戳，并提供一个原子“完成 WorkItem 并在条件满足时
+integrate”动作；`completedUnits` 可从已声明的单工作项单位推导。验收标准：普通
+单项完成不需要手填 ID/时间戳，也不需要两次独立命令，同时 append-only 事件和
+重试幂等性不变。
+
+### P1：验证指纹按真实路径范围绑定
+
+Quick/coverage 应区分验证声明覆盖的源码、仅文档/空白变化和真正全局 gate。验收
+标准：不相关文档或空白变化不会诱导重复大测试；声明范围内变化、lockfile 变化和
+global gate 仍正确失效。
+
+### P2：持久化模式偏好
+
+只有在只读推荐经过更多 dogfood 后再评估
+`owlrunkit mode set --mode auto|off|light|managed|formal`。验收标准：偏好具有明确
+来源和审计读回，且永远不能覆盖强制 Formal 路由。
+
+## 不能声称的内容
+
+- 本文主体形成时记录的是 0.18.1 发布前候选；0.18.1 后续发布事实以
+  `docs/PRODUCT-TRUTH.md` 和独立 release receipt 为准。本文本身不证明 npm、Core、
+  Skill 或任何项目已升级。
+- `mode recommend` 根据调用者提供的结构化事实路由；它不会自动发现所有业务、
+  权限、资金或迁移风险。
+- RunKit 降低进度、证据和完成状态幻觉，不直接解决 Sierac MES 业务问答幻觉。
+  后者仍由 canonical 接口、schema、adapter 与 Answer Harness 负责。
+- Quick 不是 Formal acceptance，Project Driver 不是测试执行器，任何 GO/accepted
+  结果都不授予 Git、发布、部署、生产或业务权限。
+
+## 版本建议
+
+本组变更当时适合形成 `owlrunkit@0.18.1` 小版本候选：它保持 0.18 的 Project Driver
+和回执合同，新增只读 CLI，并修复 dogfood 验证出的行为缺陷。候选只有在聚焦测试、
+RunKit contract/package gate、Core 身份同步、pack 内容检查和安装 smoke 都通过后
+才具备发布评审资格；发布、项目升级与运行时激活仍是之后的独立动作。
+
+## 0.18.2 dogfood 补丁追加
+
+0.18.1 发布后，Sierac MES 与 OwlChen 的项目级使用继续证明 `managed + quick` 是普通
+跨会话源码 Wave 的合适默认，Formal 只应由真实高风险事实触发。OwlChen 已读回项目
+本地 0.18.1 的 doctor、profiles、Formal、Quick、metrics 与模式选择器主路径；进程级
+共享 Skill 因另一项目存在 active execution/lease 而停止升级，这是正确的安全边界，
+不是缺陷。
+
+这些后续 dogfood 暴露的缺口适合形成 0.18.2 patch，而不是新增平台能力：
+
+- symlink workspace 拒绝时直接给出 canonical `--workspace`，包括 macOS
+  `/tmp` 到 `/private/tmp`；
+- `project checkpoint --help` 和 measured WorkItem 缺参错误给出完整命令；
+- Quick 顶层返回有界 stdout/stderr 摘要，同时完整日志继续由回执绑定；
+- doctor 对 registry transport 做一次重试、每次保留原有超时上限，并区分 DNS、连接、
+  超时、HTTP、认证和版本缺失；
+- `quick-verify --help` 可用，risk category 的帮助与错误列出同一组规范值；
+- profile 纯格式规范化计划显式返回 `normalizationOnly: true`；
+- package README 与五模式、profile reconcile 的已实现真值一致。
+
+当前这些内容只是本地 `owlrunkit@0.18.2` 候选。它不代表 commit、tag、npm 发布、
+全局 Skill 更新、OwlChen/OwlFootball 迁移或任何业务授权已经发生。

package/integrations/codex/skills/owlcoda-runkit/SKILL.md

@@ -7,10 +7,10 @@ description: Run receipt-backed, project-owned work with OwlCoda RunKit. Use whe
 
 Use the bundled deterministic Core to coordinate work through project artifacts rather than chat memory. Require Node.js 20 or later.
 
-Bundled release: standalone `owlrunkit@0.18.0`, bundling Contract `0.2` and
-Core `0.18.0` with manifest
-`sha256:2cafa3b76a6b267888b116edfb04d9d6b455db0a7dcd289b30a265d418b7abec`.
-The published `owlrunkit@0.17.2` package is the trusted prior for rollback;
+Bundled release: standalone `owlrunkit@0.18.2`, bundling Contract `0.2` and
+Core `0.18.2` with manifest
+`sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6`.
+The published `owlrunkit@0.18.1` package is the trusted prior for rollback;
 verify exact official npm registry provenance before adoption. The immutable
 rollback baseline for the prior release is `owlrunkit@0.16.1` with SHA-1
 `1bc119d24879bdd8959af16b364af55ca9d61ea9` and canonical npm tarball URL
@@ -55,9 +55,10 @@ remains available for existing automation and compatibility.
   check is no longer required, first resolve an explicit project decision and
   close it as `no_longer_required` with that decision ID. Never report the
   second disposition as a passing test.
-- "Verify/finish": select No RunKit, Quick, or Formal from the underlying risk;
-  bind a Formal WorkItem to its actual execution and lease when applicable.
-  Multi-Agent coordination alone does not select Formal.
+- "Verify/finish": select continuity and assurance independently from the
+  underlying risk; bind a Formal WorkItem to its actual execution and lease when
+  applicable. Multi-Agent coordination, long duration, or interruption recovery
+  alone does not select Formal.
 
 For a multi-Agent project, checkpoint meaningful state changes promptly. A
 checkpoint is not a heartbeat and must not contain a guessed percentage.
@@ -244,6 +245,11 @@ node "$RUNKIT_PACKAGE_ROOT/scripts/runkit-contract/install-codex-skill.mjs" \
   --target "$RUNKIT_SKILL_TARGET" --archive "$RUNKIT_SKILL_ARCHIVE_ROOT"
 ```
 
+`inspect` checks both managed-file integrity and the Skill/config Core version
+against the package that runs the command. A `version_mismatch` result is an
+explicit upgrade diagnostic; it is not evidence that the installed Skill was
+loaded into the current session and grants no update authority.
+
 The install manifest binds every Skill, Core, contract and attest file.
 Unknown installed drift fails closed instead of being overwritten. A changed
 process-wide Skill requires a registered complete fleet. Register each coverage
@@ -332,6 +338,8 @@ owlrunkit fleet register-root --fleet-root /absolute/declared-projects
 owlrunkit fleet discover
 owlrunkit profiles detect --workspace "$PROJECT_ROOT" --dry-run
 owlrunkit profiles detect --workspace "$PROJECT_ROOT" --apply
+owlrunkit profiles reconcile --workspace "$PROJECT_ROOT" --dry-run
+owlrunkit mode recommend --workspace "$PROJECT_ROOT"
 owlrunkit assurance route --workspace "$PROJECT_ROOT" \
   --request "$ASSURANCE_REQUEST_JSON"
 owlrunkit status --workspace "$PROJECT_ROOT"
@@ -340,28 +348,45 @@ owlrunkit status --workspace "$PROJECT_ROOT"
 Fleet discovery is complete only within all registered coverage roots, an
 explicit one-off root list, or a caller-supplied frozen `--fleet-manifest`. It
 refuses unreachable roots and cannot protect projects outside registered
-coverage. `profiles detect --apply` is create-only and adopts only unambiguous
-high-confidence, project-local regular-file launchers; existing profiles and
-low-confidence candidates remain untouched. Lock-bound npm and exact
+coverage. `profiles detect --apply` creates only an absent profile set and
+adopts only unambiguous high-confidence, project-local regular-file launchers;
+`profiles reconcile` previews or atomically updates an existing profile set
+with a rollback receipt. Low-confidence candidates remain untouched. Lock-bound npm and exact
 project-installed pnpm, Yarn, and Bun launchers are supported; PATH-only
 package managers remain review-required. `assurance route`
 deterministically selects No RunKit, Quick Verification or Formal Delivery
 from explicit risk facts and fails closed to Formal when required facts are
 missing.
 
-## Choose the smallest assurance lane
+## Choose continuity and assurance independently
+
+Start with `owlrunkit mode recommend --workspace "$PROJECT_ROOT"`. The five
+user-facing modes are presets over two independent dimensions:
+
+- continuity: `none | project_driver`
+- assurance: `none | quick | formal`
 
-Choose the lane before planning. Do not create a Formal execution merely
-because this skill is available.
+Use `off` for analysis, documentation, and disposable exploration; `light` for
+one frozen low-risk candidate plus one Quick command; `managed` for Project
+Driver continuity with per-WorkItem assurance; and `formal` only at a genuine
+Formal boundary. `auto` derives those choices from facts. The selected mode is
+a workflow preference, never authorization.
 
 - Use ordinary project tools without RunKit for disposable prototypes, early
   research, visual exploration or clean short tasks that need no durable
   handoff, evidence consumption or formal acceptance.
 - Use Quick Verification for one low-risk command that needs a source-bound,
   reusable verification receipt but no writer lease or formal acceptance.
-- Use Formal Delivery for multi-writer work, long-running or interrupted work,
-  dirty parallel workspaces, migration, integration, release, production,
-  funds or another delivery requiring formal acceptance.
+- Use Project Driver for cross-session, long-running, interrupted, or durable
+  handoff needs. A managed WorkItem may still use no assurance or one Quick.
+- Use Formal Delivery for multi-writer work, permission or security boundaries,
+  funds, irreversible changes, uncertain rollback, schema/data migration, or
+  an explicit Formal-acceptance contract.
+
+Production, release, deployment, ordinary source mutation, long duration, and
+interruption labels do not force Formal by themselves. When the forcing fact is
+contained, route again and allow de-escalation. `off`, `light`, or `managed`
+cannot override a still-present mandatory Formal fact.
 
 If work crosses lanes, re-evaluate risk and authority. Moving from Quick to
 Formal requires a fresh GoalContract, exact write scope, profiles and authority;

package/integrations/codex/skills/owlcoda-runkit/assets/templates/config.json

@@ -2,9 +2,9 @@
   "schemaVersion": "OwlCodaRunKitConfigV2",
   "core": {
     "contractVersion": "0.2",
-    "coreVersion": "0.18.0",
-    "coreManifestSha256": "sha256:2cafa3b76a6b267888b116edfb04d9d6b455db0a7dcd289b30a265d418b7abec",
-    "coreSourceRef": "artifact:sha256:2cafa3b76a6b267888b116edfb04d9d6b455db0a7dcd289b30a265d418b7abec"
+    "coreVersion": "0.18.2",
+    "coreManifestSha256": "sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6",
+    "coreSourceRef": "artifact:sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6"
   },
   "authorizationPolicy": "external_explicit_authority_required"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlrunkit",
-  "version": "0.18.0",
+  "version": "0.18.2",
   "description": "Project Driver for cross-Agent project continuity and progression; execution, evidence, verification, and recovery are the underlying trust substrate.",
   "license": "GPL-3.0-or-later",
   "author": "yeemio <owlclaw@163.com>",

package/packages/attest/distribution-manifest-v1.json

@@ -36,10 +36,20 @@
     "sha256": "sha256:3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986"
   },
   "supportedProducerCoreIdentities": [
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.18.2",
+      "coreManifestSha256": "sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6"
+    },
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.18.1",
+      "coreManifestSha256": "sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07"
+    },
     {
       "contractVersion": "0.2",
       "coreVersion": "0.18.0",
-      "coreManifestSha256": "sha256:2cafa3b76a6b267888b116edfb04d9d6b455db0a7dcd289b30a265d418b7abec"
+      "coreManifestSha256": "sha256:72c481dbafe06a9c56cd940d74a3fe109a82b73a3c43d0bb54923ea6c584c04e"
     },
     {
       "contractVersion": "0.2",

package/packages/attest/src/quick.mjs

@@ -18,10 +18,20 @@ import { captureWorkspaceSnapshot } from "./workspace-snapshot.mjs";
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.18.2",
+    coreManifestSha256: "sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.18.1",
+    coreManifestSha256: "sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.18.0",
-    coreManifestSha256: "sha256:2cafa3b76a6b267888b116edfb04d9d6b455db0a7dcd289b30a265d418b7abec",
+    coreManifestSha256: "sha256:72c481dbafe06a9c56cd940d74a3fe109a82b73a3c43d0bb54923ea6c584c04e",
   },
   {
     contractVersion: "0.2",

package/registry-release-policy-v1.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV1",
   "status": "release_candidate_unpublished",
   "packageName": "owlrunkit",
-  "candidateVersion": "0.18.0",
+  "candidateVersion": "0.18.2",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "currentPublishedRelease": {
     "packageName": "owlrunkit",
-    "version": "0.17.2",
-    "shasum": "73f46ec4db52d74697436900f36eafe72cb67132",
-    "integrity": "sha512-djTV1O/Clm7VCpx7boyXpJCfLfyAjuLUf+zoNLy7xyCG3LnmDiVUWtQcZFEyqWW8ts1ptd9DYyyZFdK5w1dAbA==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.17.2.tgz"
+    "version": "0.18.1",
+    "shasum": "6d35c15f90ed775c583356754b831856d1a3c0a6",
+    "integrity": "sha512-07wWnSfY6RUavcb+ZpUbZ1S0nBjN7/8VIFHyP6blOB+PIrDnnST/8f7CoLgADYpfwjZiF5gR9U6XFwXa0kgVrg==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.1.tgz"
   },
   "registryRelease": null,
   "registryEvidenceMustBeExternal": true,

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.18.0",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.18.0",
+  "name": "owlrunkit-0.18.2",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.18.2",
   "creationInfo": {
     "created": "2026-07-29T00:00:00Z",
     "creators": [
@@ -14,8 +14,8 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.18.0",
-      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.0.tgz",
+      "versionInfo": "0.18.2",
+      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.2.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
       "licenseDeclared": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.18.0"
+          "referenceLocator": "pkg:npm/owlrunkit@0.18.2"
         }
       ]
     }