owlrunkit 0.18.4 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.19.0
+
+- Adds `bootstrap --dry-run|--apply` as one exact-registry, project-local,
+  lifecycle-locked onboarding transaction. It initializes or upgrades Core,
+  reconciles and validates profiles, adopts the release, runs doctor, and
+  restores its bounded preimage on failure without refreshing shared Skills.
+- Makes first-use help and empty-profile repair actionable, and reports the
+  installed package/Core/Skill identity independently instead of accepting a
+  matching version string with drifted Core bytes.
+- Runs Quick commands in an isolated temporary consumer with bounded dependency
+  projection and tool-cache directories, separating workspace source changes,
+  requested ignored-artifact bindings, and dependency-environment identity.
+- Adds `quick-reuse` planning and execution for a passed prior receipt plus an
+  explicitly allowed small delta. Reuse fails closed on prior candidate,
+  command, dependency, ignored-binding, or out-of-scope path drift.
+- Stores repeated Quick and Verification Envelope stdout/stderr as verified
+  content-addressed evidence objects while retaining the existing receipt-local
+  references and create-only receipt semantics.
+- Adds `quick-runtime-verify` with explicit workspace mutation, external
+  mutation, rollback, final external state, failed/last-passed stage, and
+  recovery lineage fields. Command-reported runtime truth remains distinct from
+  independent deployment or business acceptance.
+- Adds Project Event V4 actions for reopening or invalidating upstream work,
+  propagating downstream waiting, and atomically transferring responsibility.
+  Immutable prior failures, assignments, handoffs, and evidence remain visible.
+- Adds a six-layer human outcome projection that separates candidate identity,
+  workspace attestation, verification, product/UX acceptance, deployment/runtime
+  activation, and production/business validity; lower layers never promote the
+  higher ones automatically.
+- Adds local-only `efficiency record|status` metrics for repeated commands,
+  explicit false blocks and manual interventions, handoff wait, and
+  time-to-acceptable-result. Receipt count is intentionally not a success
+  metric and no telemetry is sent.
+- Preserves the independent continuity and assurance axes, mandatory Formal
+  risk routing, strict predecessor contracts, and
+  `authorizationGranted=false` for Git, release, deployment, production, and
+  business authority.
+
 ## 0.18.4
 
 - Adds controller-owned `project target-snapshot --dry-run|--apply` for binding

package/README.md

@@ -37,6 +37,14 @@ These additions use Profile Detection V3, Status/Takeover V2, Assurance Route
 V2, and Usage Mode Recommendation V2; the published predecessor contracts
 remain unchanged.
 
+RunKit 0.19.0 consolidates the daily-use dogfood backlog into one release. It
+adds atomic onboarding, isolated Quick dependency/cache execution, bounded
+reuse of unchanged evidence, content-addressed output storage, explicit
+external-runtime and rollback truth, upstream rework propagation, atomic
+transfer actions, business-layer outcome projection, and local efficiency
+metrics. These conveniences do not weaken Formal routing or grant Git,
+release, deployment, production, or business authority.
+
 The 0.18 Project Driver is a bounded surface for new projects and controlled
 dogfood. Its product name does not claim to be a general long-running,
 multi-phase, or enterprise control plane. Version 0.18 adds one bounded
@@ -51,7 +59,7 @@ separate authority boundaries.
 ## Install
 
 ```bash
-npm install --save-exact owlrunkit@0.18.4
+npm install --save-exact owlrunkit@0.19.0
 ```
 
 Use `npx --no-install owlrunkit` for project commands. The package bootstrap
@@ -66,12 +74,23 @@ the project Config must independently bind the same Core.
 
 ```bash
 npx --no-install owlrunkit --version
+npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
+  --exact owlrunkit@0.19.0 --dry-run
+npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
+  --exact owlrunkit@0.19.0 --apply
 npx --no-install owlrunkit init --workspace /absolute/path/to/project
 npx --no-install owlrunkit doctor --workspace /absolute/path/to/project
 npx --no-install owlrunkit mode recommend --workspace /absolute/path/to/project
 npx --no-install owlrunkit mode status --workspace /absolute/path/to/project
 ```
 
+`bootstrap` is the complete first-onboarding and eligible idle-upgrade entry.
+It binds the exact project-local package to the official registry, initializes
+Core, reconciles and validates profiles, writes adoption evidence, and reads
+back doctor. Dry-run is zero-write; failed apply restores the governed preimage
+and keeps a failure receipt. It reports shared Skill drift but never silently
+updates a user or fleet Skill.
+
 `mode recommend` is read-only and defaults to human output; add `--json` for a
 machine contract. The five user modes are presets over `continuity`
 (`none | project_driver`) and `assurance` (`none | quick | formal`). They never
@@ -186,10 +205,10 @@ classification, and explicit `proven` / `notProven` statements. Omitting
 `--entry-snapshot` verifies the current candidate bytes but records
 `overlayStatus=candidate_only`.
 
-The cache classification covers cache paths visible to Git status, such as
+External-delivery intake cache classification covers paths visible to Git status, such as
 `.vitest/**`, `.vite/**`, `.pytest_cache/**`, and `__pycache__/**`. It does not
-claim to bind ignored paths (`ignoredPathsBound=false`) and does not yet create
-an isolated dependency consumer or temporary test cache. Lockfile or
+claim to bind ignored paths (`ignoredPathsBound=false`) and does not create a
+Quick isolated consumer. Lockfile or
 `node_modules` changes outside the packet are disclosed as dependency
 environment changes. Any other entry-to-candidate delta, or any packet path
 outside the WorkItem's allowed ownership, blocks import before project truth is
@@ -320,6 +339,17 @@ Run Quick with:
 npx --no-install owlrunkit quick-verify --workspace . -- npm test
 npx --no-install owlrunkit quick-verify --workspace . --stdin-file ./remote-check.sh --attest \
   -- ssh test-host /bin/sh
+npx --no-install owlrunkit quick-verify --workspace . --isolate \
+  --dependency-root /absolute/dependency-consumer -- npm test
+npx --no-install owlrunkit quick-verify --workspace . \
+  --bind-ignored .generated/audit.json -- node ./verify-generated.mjs
+npx --no-install owlrunkit quick-reuse --workspace . \
+  --base-receipt .owlcoda/runkit/quick/receipts/<id>/receipt.json \
+  --allow-path src/new-adapter.mjs --dry-run -- node --test tests/new-adapter.test.mjs
+npx --no-install owlrunkit quick-verify --workspace . --capture-runtime \
+  -- ./deploy-and-readback.sh
+npx --no-install owlrunkit quick-runtime-verify --workspace . \
+  --receipt .owlcoda/runkit/quick/receipts/<id>/runtime-transition.json
 npx --no-install owlrunkit quick-metrics --workspace .
 npx --no-install owlrunkit quick-metrics --workspace . --verbose
 ```
@@ -333,6 +363,50 @@ restore phases remain visible while the complete artifacts stay receipt-bound.
 `--attest` runs the existing attestation immediately and returns its independent
 object alongside the Quick result; it does not promote Quick to Formal.
 
+`--isolate` emits Quick Receipt V3 and runs the exact command from a disposable
+copy of Git-visible candidate files. Common cache variables and temporary files
+point outside the source checkout; new ignored artifacts are disclosed and
+discarded, while a visible source edit in the consumer invalidates the receipt.
+The exact caller-owned command is not an OS write sandbox; direct writes it
+performs outside the consumer remain subject to the explicit before/after
+bindings.
+An optional `--dependency-root` projects an already-installed `node_modules`
+into the consumer, prepends its binary directory, and hash-binds package, lock,
+installed-package, and executable metadata before and after execution. RunKit
+does not install dependencies or contact a registry for this command.
+
+Repeatable literal `--bind-ignored` paths opt specific ignored workspace bytes
+into Workspace Snapshot V2. Missing is a bound state; file or directory changes
+invalidate Quick. Unrequested ignored paths remain explicitly outside the
+claim. V1/V2 receipts and Workspace Snapshot V1 keep their existing meanings.
+
+`quick-reuse` checks an earlier passed, source-unchanged Quick receipt against
+the current candidate at byte level. A clean commit does not create false drift
+when it preserves the previously dirty candidate bytes. Only literal
+`--allow-path` deltas may remain; any other tracked, untracked, deleted,
+renamed, submodule, or previously bound ignored-path delta blocks before the
+exact command runs. `--apply` then runs only the delta gate and records
+`OwlCodaQuickEvidenceReuseReceiptV1`. It does not promote either Quick receipt
+to Formal, UX, deployment, production, or business acceptance.
+
+New Quick output and Verification Envelope stdout/stderr bytes are also placed
+in a project-global create-only SHA-256 object store. Repeated objects reuse the
+same content identity; receipt-local Quick paths remain readable through
+copy-on-write materialization, and historical receipt paths are not rewritten
+or destructively compacted.
+
+`--capture-runtime` sets `OWLRUNKIT_RUNTIME_REPORT` to an initially absent,
+receipt-local path. The exact command may write one strict
+`OwlCodaRunKitExternalRuntimeReportV1`; RunKit then keeps the ordinary Quick
+receipt and adds an `OwlCodaRunKitRuntimeTransitionReceiptV1`. The companion
+separates derived `workspaceMutation` from command-reported
+`externalMutation`, and binds ordered stages, failed/last-passed stages,
+rollback, final external state, and recovery artifacts with explicit
+`capturedBefore` and `restoresTo` identities. Missing or inconsistent runtime
+truth fails closed without erasing the Quick receipt. This is a hash-bound
+command report, not an independent external observation or deployment
+authorization; `quick-runtime-verify` verifies stored integrity only.
+
 `quick-metrics` is local-only and returns aggregate counts. Add `--verbose`
 when the individual receipt paths are needed. The former `--local` flag remains
 accepted as a compatibility no-op. New successful receipts no longer carry
@@ -340,6 +414,30 @@ the fixed `quick_ignored_artifact_unbound` issue; historical receipts remain
 strictly readable without surfacing that non-actionable code as an attestation
 issue.
 
+Quick's default human result is business-first: it says whether the exact
+verification passed, what candidate/workspace evidence is bound, and keeps
+product/UX, deployment/runtime, and production/business acceptance visibly
+separate. A command-reported runtime transition is labeled as reported rather
+than independently observed. Use `--json` for the strict
+`OwlCodaRunKitOutcomeSummaryV1` projection.
+
+RunKit can measure its own local workflow friction without telemetry:
+
+```bash
+npx --no-install owlrunkit efficiency record --workspace . \
+  --event-id wave-start --at 2026-08-13T00:00:00.000Z \
+  --kind workflow_started --workflow-id wave-1 --summary 'Wave started.'
+npx --no-install owlrunkit efficiency status --workspace .
+npx --no-install owlrunkit efficiency status --workspace . --verbose --json
+```
+
+Repeated Quick command executions are derived from matching command, candidate,
+input, and dependency bindings. False blocks and manual interventions count
+only when explicitly recorded. Handoff wait comes from Project Driver truth;
+time-to-acceptable-result requires paired workflow start/result marks. Receipt
+volume is intentionally not a value metric, and every result keeps Git,
+release, deployment, production, and business authority false.
+
 ## Formal Delivery in three commands
 
 Given a Goal Contract and the paths this work item may write, the happy path is:

package/docs/architecture/OWLCODA_RUNKIT_0190_CONSOLIDATED_DAILY_USE_PRODUCT_DECISION_20260812.md

@@ -0,0 +1,97 @@
+# OwlRunKit 0.19.0 Consolidated Daily-Use Product Decision
+
+状态：**Owner 已授权实施；七个 Wave 的源代码候选已完成，正式发布验证进行中**
+
+## Decision
+
+0.19.0 是一次整合型小版本后的次版本升级。它不会继续拆出多个 0.18.x，
+而是在一个 release candidate 中收敛 0.18.4 明确留下、且已被 OwlChen、MES、
+OwlFootball 和 MERM dogfood 重复验证的十类摩擦。
+
+长期产品原则保持不变：RunKit 默认轻、必要时重。它是飞行记录仪和阶段控制器，
+不是每条研发命令的审批系统。
+
+## Product Axes
+
+用户可见 mode 继续只是两个正交维度的 preset：
+
+- continuity：`none | project_driver`
+- assurance：`none | quick | formal`
+
+长周期、跨会话和多阶段主要提高 continuity。只有多 authority、多 writer、资金、
+权限、安全、不可逆变更、回滚不确定、schema/data migration 或明确 Formal
+acceptance 才强制 Formal。风险解除后允许降级，升级不成为粘性状态。
+
+## 0.19.0 Scope
+
+### Wave 1 — Atomic onboarding
+
+- 一条可预览、可原子应用、失败可回滚的 bootstrap；
+- `init --help` 与空 profile 首次接入死锁；
+- project-local exact binding 和 shared Skill drift 的明确诊断。
+
+### Wave 2 — Isolated verification
+
+- 临时 dependency consumer 和工具缓存隔离；
+- 源码、ignored cache、dependency environment 三类变化分离；
+- 只有任务明确需要时才哈希绑定 ignored paths。
+
+### Wave 3 — Evidence reuse
+
+- 旧 receipt + 小范围允许 delta 的复用规划与精确增量 gate；
+- 大 artifact 以 content-addressed hash/reference 去重，保留可恢复性。
+
+### Wave 4 — Runtime and recovery truth
+
+- `workspaceMutation`、`externalMutation`、`rollbackPerformed`、
+  `finalExternalState`、`failedStage`、`lastPassedStage`、`rollbackOutcome`；
+- recovery evidence 明确 `capturedBefore`、`restoresTo` 等语义。
+
+### Wave 5 — Rework lifecycle
+
+- 原生 reopen/invalidate upstream WorkItem；
+- downstream waiting propagation；
+- 原子 transfer/reject-and-return 高层动作，同时保留不可变底层事件。
+
+### Wave 6 — Human outcome and economics
+
+- 收据先展示业务阶段结果、验收层级和未证明边界；
+- 统计重复命令、误阻塞、人工介入、handoff 等待和 time-to-acceptable-result；
+- 指标用于约束 RunKit 自身摩擦，不以 receipt 数量冒充价值。
+
+### Wave 7 — Release closure
+
+- predecessor contracts 精确兼容或显式版本化 successor；
+- 独立风险审查、Core identity、packed Skill/package、registry consumer；
+- 一次性发布 `owlrunkit@0.19.0`。
+
+## Safety And Authority Boundaries
+
+- 用户 mode 是偏好，不是授权；较轻 mode 不能绕过强制 Formal 事实；
+- RunKit 结果始终保持 `authorizationGranted=false`；
+- receipt acceptance 不等于 commit、push、tag、publish、deploy、production 或业务验收；
+- controller/target 必须是分离的真实目录，冻结 target 不接受控制 artifacts 注入；
+- 已发布 strict schema 不原地重解释，破坏性变化必须新建版本并让 predecessor 共存；
+- bootstrap 不静默刷新用户级/fleet Skill，不静默修改 Git，不联网执行发布动作。
+
+## Evidence Layers
+
+界面与 receipt 必须依次区分：
+
+1. candidate file identity；
+2. workspace/overlay attestation；
+3. verification command/test result；
+4. UX 或独立产品验收；
+5. deployment/runtime activation；
+6. production 或业务有效性。
+
+低层证据不得自动提升为高层结论。
+
+## What Cannot Be Claimed Yet
+
+- 0.19.0 尚未 tag、publish 或被任何外部项目采用；
+- 本文不是 npm registry receipt，源代码完成不能替代 packed consumer 与
+  registry consumer 验证；
+- 当前可以声称七个 Wave 已进入单一 0.19.0 release candidate，不能声称
+  npm latest 已改变；
+- public mirror、官网、8019、全局 Skill 与外部项目升级不属于本次授权。

package/docs/architecture/OWLCODA_RUN_KIT_CONTRACT_V0_2.md

@@ -478,6 +478,44 @@ bytes as exact stdin, and binds their workspace-relative path, byte size, and
 SHA-256. V1 remains the no-stdin receipt and stays readable. Neither schema
 binds undeclared ignored outputs or grants any authority.
 
+Core `0.19.0` adds `OwlCodaQuickVerificationReceiptV3` for explicit isolation,
+dependency-environment binding, and ignored-path binding. `--isolate` runs a
+Git-visible candidate copy in a disposable consumer and records consumer source
+versus discarded ignored-artifact deltas. `--dependency-root` binds an existing
+dependency environment without installing it. `--bind-ignored` is the only
+operation that emits `OwlCodaWorkspaceSnapshotV2` and claims those selected
+ignored bytes. Workspace source, selected ignored paths, dependency metadata,
+and consumer source mutations are distinct fail-closed facts. Disposable
+ignored artifacts do not mutate or become evidence for the source checkout.
+
+Core `0.19.0` also adds `OwlCodaQuickEvidenceReusePlanV1` and
+`OwlCodaQuickEvidenceReuseReceiptV1`. A reuse plan verifies one earlier strict,
+passed, source-unchanged Quick receipt from the same workspace, derives the
+current candidate delta from Git objects plus both snapshots, and refuses any
+path outside literal caller allowances before command execution. Byte-identical
+dirty content later committed to Git remains unchanged evidence. Apply runs one
+exact delta gate through Quick and records both receipt hashes; it grants no
+authority and does not satisfy Formal or higher acceptance layers.
+
+Quick output and Verification Envelope stdout/stderr evidence use a project-
+global create-only SHA-256 object store. Existing Quick receipt-local material
+paths remain valid; no historical tree is rewritten or deleted. Object reuse is
+storage/provenance behavior, never additional assurance.
+
+Core `0.19.0` can additionally bind external transition truth without changing
+Quick Receipt V1/V2/V3. `quick-verify --capture-runtime` gives the exact child
+an initially absent receipt-local `OWLRUNKIT_RUNTIME_REPORT` path. A strict
+`OwlCodaRunKitExternalRuntimeReportV1` there is projected into a separately
+hashed `OwlCodaRunKitRuntimeTransitionReceiptV1` that binds the Quick receipt
+bytes, report bytes, derived workspace mutation, command-reported external
+mutation, ordered stages, rollback outcome, final external state, and recovery
+artifact `capturedBefore` / `restoresTo` semantics. A failed stage followed by
+a successful rollback remains a failed transition with useful evidence; it is
+not promoted to Quick, Formal, deployment, or business acceptance. Missing or
+inconsistent runtime truth fails closed while preserving the base Quick
+receipt. `quick-runtime-verify` rechecks stored bytes and projection integrity;
+it does not independently re-observe the external runtime or grant authority.
+
 Deterministic `repair` persists a reviewable plan before replay, reuses only
 fresh receipt-bound coverage, replays pending exact argv, and appends
 replacement lineage. Failed and orphaned attempts remain inspectable. Repair
@@ -539,6 +577,25 @@ stale Packet, invalid evidence or engine drift must still follow the Core's
 foreign-project authority. Signing, keys, external anchors and GitHub Actions
 remain deferred.
 
+## Core v0.19 atomic onboarding
+
+Core `0.19.0` keeps Contract `0.2` and all existing authority boundaries. The
+versioned `OwlCodaRunKitOnboardingBootstrapPlanV1` dry-run binds the exact
+project-local package and official registry release, checks upgrade safety,
+previews profile reconciliation, reports shared Skill drift, and performs zero
+writes. `bootstrap --apply` rechecks that plan under a project-owned lock, then
+runs Core initialization, profile reconcile/validation, exact adoption and
+doctor readback as one high-level transaction.
+
+The transaction governs RunKit config, profiles, their migration/apply
+receipts, and adoption evidence. A failure after mutation restores their exact
+preimage before writing an append-only
+`OwlCodaRunKitOnboardingBootstrapReceiptV1`. A concurrent bootstrap, active or
+invalid project lifecycle, ambiguous project tool, exact-package mismatch, or
+registry mismatch fails closed. The command does not modify package files,
+source, Git, deployments, production, business state, or shared Skills, and it
+never grants those authorities.
+
 ## Deferred work
 
 Contract v0.2 still does not add a built-in browser or Electron driver, Plugin,

package/integrations/codex/skills/owlcoda-runkit/SKILL.md

@@ -7,10 +7,10 @@ description: Run receipt-backed, project-owned work with OwlCoda RunKit. Use whe
 
 Use the bundled deterministic Core to coordinate work through project artifacts rather than chat memory. Require Node.js 20 or later.
 
-Bundled release: standalone `owlrunkit@0.18.4`, bundling Contract `0.2` and
-Core `0.18.4` with manifest
-`sha256:372d4c247e4b40b0fd2f3fe0f5bf928548095bfb7e2e92e9ac66790e2717f77d`.
-The published `owlrunkit@0.18.3` package is the trusted prior for rollback;
+Bundled release: standalone `owlrunkit@0.19.0`, bundling Contract `0.2` and
+Core `0.19.0` with manifest
+`sha256:803fb7de76a6ccffd1ec5e0164eeff15a580209fa6dfbef9e561345ab616b403`.
+The published `owlrunkit@0.18.4` package is the trusted prior for rollback;
 verify exact official npm registry provenance before adoption. The immutable
 rollback baseline for the prior release is `owlrunkit@0.16.1` with SHA-1
 `1bc119d24879bdd8959af16b364af55ca9d61ea9` and canonical npm tarball URL
@@ -190,11 +190,23 @@ below has no CLI entry.
 ## Initialize and inspect
 
 ```bash
+npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
+  --exact owlrunkit@0.19.0 --dry-run
+npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
+  --exact owlrunkit@0.19.0 --apply
 npx --no-install owlrunkit init --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit inspect --json --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit status --workspace "$PROJECT_ROOT"
 ```
 
+Prefer `bootstrap` for a new standalone-package consumer or an eligible idle
+project upgrade. Its dry-run is zero-write; apply rechecks the exact local
+package and official registry binding under a project-owned lock, then performs
+Core initialization, profile reconcile/validation, adoption and doctor
+readback. A later-step failure restores the governed preimage and leaves a
+failure receipt. Shared Skill inspection is diagnostic only; bootstrap never
+silently changes a user or fleet Skill.
+
 Initialization may write only `.owlcoda/runkit/`. It must not modify business source.
 It atomically upgrades a known ConfigV1 project or refreshes an older v0.2
 Core patch identity and writes a local migration receipt with
@@ -246,6 +258,9 @@ npx --no-install owlrunkit quick-metrics \
 
 npx --no-install owlrunkit quick-metrics \
   --workspace "$PROJECT_ROOT" --verbose
+
+npx --no-install owlrunkit efficiency status \
+  --workspace "$PROJECT_ROOT"
 ```
 
 `--stdin-file` copies and SHA-256-binds at most 1 MiB of regular non-symlink
@@ -256,6 +271,15 @@ default; `--verbose` adds receipt paths. Metrics are always local-only and
 perform no telemetry or network request; the former `--local` flag remains an
 accepted compatibility no-op.
 
+Quick's default human result leads with pass/fail and explicitly separates
+candidate identity, workspace attestation, verification, product/UX,
+deployment/runtime, and production/business evidence. A lower layer never
+promotes a higher layer. Use `efficiency record` only for an observed workflow
+start, confirmed false block, manual intervention, or named acceptable result;
+use `efficiency status` to inspect local repeated commands, handoff wait, and
+time-to-result. These metrics are project-local, perform no telemetry, exclude
+receipt count as a value signal, and grant no additional authority.
+
 Core v0.13 also adds deterministic repair and exact-byte offline transport:
 
 ```bash

package/integrations/codex/skills/owlcoda-runkit/assets/templates/config.json

@@ -2,9 +2,9 @@
   "schemaVersion": "OwlCodaRunKitConfigV2",
   "core": {
     "contractVersion": "0.2",
-    "coreVersion": "0.18.4",
-    "coreManifestSha256": "sha256:372d4c247e4b40b0fd2f3fe0f5bf928548095bfb7e2e92e9ac66790e2717f77d",
-    "coreSourceRef": "artifact:sha256:372d4c247e4b40b0fd2f3fe0f5bf928548095bfb7e2e92e9ac66790e2717f77d"
+    "coreVersion": "0.19.0",
+    "coreManifestSha256": "sha256:803fb7de76a6ccffd1ec5e0164eeff15a580209fa6dfbef9e561345ab616b403",
+    "coreSourceRef": "artifact:sha256:803fb7de76a6ccffd1ec5e0164eeff15a580209fa6dfbef9e561345ab616b403"
   },
   "authorizationPolicy": "external_explicit_authority_required"
 }

package/integrations/codex/skills/owlcoda-runkit/references/contract-v0.2.md

@@ -478,6 +478,44 @@ bytes as exact stdin, and binds their workspace-relative path, byte size, and
 SHA-256. V1 remains the no-stdin receipt and stays readable. Neither schema
 binds undeclared ignored outputs or grants any authority.
 
+Core `0.19.0` adds `OwlCodaQuickVerificationReceiptV3` for explicit isolation,
+dependency-environment binding, and ignored-path binding. `--isolate` runs a
+Git-visible candidate copy in a disposable consumer and records consumer source
+versus discarded ignored-artifact deltas. `--dependency-root` binds an existing
+dependency environment without installing it. `--bind-ignored` is the only
+operation that emits `OwlCodaWorkspaceSnapshotV2` and claims those selected
+ignored bytes. Workspace source, selected ignored paths, dependency metadata,
+and consumer source mutations are distinct fail-closed facts. Disposable
+ignored artifacts do not mutate or become evidence for the source checkout.
+
+Core `0.19.0` also adds `OwlCodaQuickEvidenceReusePlanV1` and
+`OwlCodaQuickEvidenceReuseReceiptV1`. A reuse plan verifies one earlier strict,
+passed, source-unchanged Quick receipt from the same workspace, derives the
+current candidate delta from Git objects plus both snapshots, and refuses any
+path outside literal caller allowances before command execution. Byte-identical
+dirty content later committed to Git remains unchanged evidence. Apply runs one
+exact delta gate through Quick and records both receipt hashes; it grants no
+authority and does not satisfy Formal or higher acceptance layers.
+
+Quick output and Verification Envelope stdout/stderr evidence use a project-
+global create-only SHA-256 object store. Existing Quick receipt-local material
+paths remain valid; no historical tree is rewritten or deleted. Object reuse is
+storage/provenance behavior, never additional assurance.
+
+Core `0.19.0` can additionally bind external transition truth without changing
+Quick Receipt V1/V2/V3. `quick-verify --capture-runtime` gives the exact child
+an initially absent receipt-local `OWLRUNKIT_RUNTIME_REPORT` path. A strict
+`OwlCodaRunKitExternalRuntimeReportV1` there is projected into a separately
+hashed `OwlCodaRunKitRuntimeTransitionReceiptV1` that binds the Quick receipt
+bytes, report bytes, derived workspace mutation, command-reported external
+mutation, ordered stages, rollback outcome, final external state, and recovery
+artifact `capturedBefore` / `restoresTo` semantics. A failed stage followed by
+a successful rollback remains a failed transition with useful evidence; it is
+not promoted to Quick, Formal, deployment, or business acceptance. Missing or
+inconsistent runtime truth fails closed while preserving the base Quick
+receipt. `quick-runtime-verify` rechecks stored bytes and projection integrity;
+it does not independently re-observe the external runtime or grant authority.
+
 Deterministic `repair` persists a reviewable plan before replay, reuses only
 fresh receipt-bound coverage, replays pending exact argv, and appends
 replacement lineage. Failed and orphaned attempts remain inspectable. Repair
@@ -539,6 +577,25 @@ stale Packet, invalid evidence or engine drift must still follow the Core's
 foreign-project authority. Signing, keys, external anchors and GitHub Actions
 remain deferred.
 
+## Core v0.19 atomic onboarding
+
+Core `0.19.0` keeps Contract `0.2` and all existing authority boundaries. The
+versioned `OwlCodaRunKitOnboardingBootstrapPlanV1` dry-run binds the exact
+project-local package and official registry release, checks upgrade safety,
+previews profile reconciliation, reports shared Skill drift, and performs zero
+writes. `bootstrap --apply` rechecks that plan under a project-owned lock, then
+runs Core initialization, profile reconcile/validation, exact adoption and
+doctor readback as one high-level transaction.
+
+The transaction governs RunKit config, profiles, their migration/apply
+receipts, and adoption evidence. A failure after mutation restores their exact
+preimage before writing an append-only
+`OwlCodaRunKitOnboardingBootstrapReceiptV1`. A concurrent bootstrap, active or
+invalid project lifecycle, ambiguous project tool, exact-package mismatch, or
+registry mismatch fails closed. The command does not modify package files,
+source, Git, deployments, production, business state, or shared Skills, and it
+never grants those authorities.
+
 ## Deferred work
 
 Contract v0.2 still does not add a built-in browser or Electron driver, Plugin,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlrunkit",
-  "version": "0.18.4",
+  "version": "0.19.0",
   "description": "Project Driver for cross-Agent project continuity and progression; execution, evidence, verification, and recovery are the underlying trust substrate.",
   "license": "GPL-3.0-or-later",
   "author": "yeemio <owlclaw@163.com>",

package/packages/attest/README.md

@@ -1,15 +1,18 @@
 # `@owlcoda/attest`
 
 `@owlcoda/attest` is OwlCoda RunKit's unsigned, read-only verification plane.
-It verifies Quick Receipt V1 and V2 artifacts, Formal public verification
+It verifies Quick Receipt V1, V2, and V3 artifacts, Formal public verification
 bundles, and local `OwlCodaAttestationRefV1` references without importing the
 private mutation Core. V2 adds one hash-bound stdin material while preserving
-the same unsigned, authorization-free assurance boundary.
+the same unsigned, authorization-free assurance boundary. V3 adds a disposable
+consumer record, optional dependency-environment binding, and explicit ignored
+workspace bindings while leaving V1/V2 unchanged.
 
 The package is an unsigned V1 distribution candidate. It is intentionally
 marked private until naming clearance and release authorization exist.
-`consumer-surface-v1.json` freezes the complete command, schema, reference,
-issue-code, compatibility, privacy, metrics, and unsupported-claim covenant.
+`consumer-surface-v1.json` remains the byte-compatible predecessor contract.
+`consumer-surface-v2.json` adds Receipt V3, Snapshot V2, isolated Quick, and
+explicit ignored-path issue codes without reinterpreting V1.
 
 ## CLI
 
@@ -58,7 +61,8 @@ in the repository documentation under
 receipts but does not require N-1 to trust an unknown future Core identity.
 
 The packed candidate includes its GPL-3.0-or-later license, a package-level
-SPDX 2.3 SBOM, and the frozen Consumer Surface V1 manifest. Local metrics never
+SPDX 2.3 SBOM, the frozen Consumer Surface V1 manifest, and the additive V2
+surface. Local metrics never
 send telemetry and are not a performance target. They describe local receipt
 state; separate consumption must be evidenced by a caller-owned attestation
 result.