owlrunkit 0.19.0 → 0.19.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.19.1
+
+- Fixes profile reconciliation for mature projects where an existing profile
+  already owns command IDs such as `npm-build` or `npm-test`. When those
+  detected commands have one existing owner, reconciliation extends that owner
+  with the detected paths and current authoritative command definitions instead
+  of creating an invalid duplicate-command profile.
+- Preserves create-only receipts, atomic rollback, strict profile validation,
+  project-local CLI binding, `authorizationGranted=false`, and the separate
+  fleet/shared Skill activation gate.
+
 ## 0.19.0
 
 - Adds `bootstrap --dry-run|--apply` as one exact-registry, project-local,

package/README.md

@@ -45,6 +45,13 @@ transfer actions, business-layer outcome projection, and local efficiency
 metrics. These conveniences do not weaken Formal routing or grant Git,
 release, deployment, production, or business authority.
 
+RunKit 0.19.1 fixes mature-project onboarding when an existing owner profile
+already owns command IDs proposed by detection. Reconciliation now extends that
+sole command owner with the newly detected paths and authoritative command
+binding instead of creating a second profile with duplicate IDs. Existing
+owner profiles, strict validation, atomic rollback, and shared-Skill activation
+boundaries remain unchanged.
+
 The 0.18 Project Driver is a bounded surface for new projects and controlled
 dogfood. Its product name does not claim to be a general long-running,
 multi-phase, or enterprise control plane. Version 0.18 adds one bounded
@@ -59,7 +66,7 @@ separate authority boundaries.
 ## Install
 
 ```bash
-npm install --save-exact owlrunkit@0.19.0
+npm install --save-exact owlrunkit@0.19.1
 ```
 
 Use `npx --no-install owlrunkit` for project commands. The package bootstrap
@@ -75,9 +82,9 @@ the project Config must independently bind the same Core.
 ```bash
 npx --no-install owlrunkit --version
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.19.0 --dry-run
+  --exact owlrunkit@0.19.1 --dry-run
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.19.0 --apply
+  --exact owlrunkit@0.19.1 --apply
 npx --no-install owlrunkit init --workspace /absolute/path/to/project
 npx --no-install owlrunkit doctor --workspace /absolute/path/to/project
 npx --no-install owlrunkit mode recommend --workspace /absolute/path/to/project

package/docs/architecture/OWLCODA_RUNKIT_0190_CONSOLIDATED_DAILY_USE_PRODUCT_DECISION_20260812.md

@@ -1,6 +1,6 @@
 # OwlRunKit 0.19.0 Consolidated Daily-Use Product Decision
 
-状态：**Owner 已授权实施；七个 Wave 的源代码候选已完成，正式发布验证进行中**
+状态：**七个 Wave 已实现；私仓、tag、npm 与 exact-registry consumer 发布闭环已完成**
 
 ## Decision
 
@@ -87,11 +87,14 @@ acceptance 才强制 Formal。风险解除后允许降级，升级不成为粘
 
 低层证据不得自动提升为高层结论。
 
-## What Cannot Be Claimed Yet
-
-- 0.19.0 尚未 tag、publish 或被任何外部项目采用；
-- 本文不是 npm registry receipt，源代码完成不能替代 packed consumer 与
-  registry consumer 验证；
-- 当前可以声称七个 Wave 已进入单一 0.19.0 release candidate，不能声称
-  npm latest 已改变；
-- public mirror、官网、8019、全局 Skill 与外部项目升级不属于本次授权。
+## Release Truth And What Cannot Be Claimed
+
+- `owlrunkit@0.19.0` 已由私仓 release commit `830aa91c` 发布，npm
+  `latest` 已读回为 `0.19.0`；精确 registry consumer 已完成原子
+  bootstrap、doctor、profile、inspect、Quick 与 metrics 验证；
+- 发布不等于 fleet/shared Skill 激活、OwlCoda 项目 Core 迁移或任何外部项目
+  adoption；这些仍需要各自安全边界和独立读回；
+- 本文记录产品决策和已发布能力，完整 registry 字节、测试与未触碰边界见
+  `docs/handoff/OWLCODA_RUNKIT_0190_PRIVATE_GIT_NPM_RELEASE_RECEIPT_20260813.md`；
+- public mirror、官网、8019、全局 Skill、生产与业务验收不属于本次授权，不能
+  从本次 package release 推导为已完成。

package/docs/architecture/OWLCODA_RUNKIT_0191_PROFILE_RECONCILE_PATCH_PRODUCT_DECISION_20260813.md

@@ -0,0 +1,30 @@
+# OwlRunKit 0.19.1 Profile Reconcile Patch Product Decision
+
+状态：**候选实现完成，发布实况以 registry 读回和发布回执为准**
+
+## Decision
+
+0.19.1 是 0.19.0 的兼容补丁，不扩展 RunKit 的产品范围。真实 OwlCoda
+dogfood 发现，成熟项目已有 profile 持有 `npm-build`、`npm-test` 时，检测器
+提出新的 `node-quality` profile 会重复这些全局 command ID，使 bootstrap 在
+profile reconcile 阶段失败。
+
+当检测出的 commands 只有一个现有 owner 时，reconcile 现在复用该 owner：
+增加真实检测到的 paths，并以项目本地 authoritative tool binding 更新对应
+command。它不会新增第二份重复 command，也不会削弱最终 profile 校验。
+
+## Preserved Boundaries
+
+- owner profile bytes 仍只通过原子 reconcile 事务更新，失败恢复原始 bytes；
+- 多个不同 command owner 的歧义不会被静默合并；
+- bootstrap、receipt 与 mode 仍不授予 Git、发布、部署、生产或业务权限；
+- npm package 发布、项目 Core adoption 与 process-level shared Skill 激活仍是
+  三个独立状态转换；bootstrap 只诊断 Skill drift，不静默刷新 fleet Skill；
+- 0.19.0 的 continuity、assurance、Formal 和 predecessor-contract 边界不变。
+
+## Evidence And Claims
+
+发布前必须通过成熟项目冲突回归、profile/bootstrap 聚焦测试、完整 RunKit
+gate、Core identity、packed package/Skill、干净 consumer 和 npm registry
+字节读回。本文不能在这些 Gate 完成前声称 0.19.1 已发布，也不能把一份
+package receipt 冒充 shared Skill 已激活或其他项目已推广。

package/integrations/codex/skills/owlcoda-runkit/SKILL.md

@@ -7,10 +7,10 @@ description: Run receipt-backed, project-owned work with OwlCoda RunKit. Use whe
 
 Use the bundled deterministic Core to coordinate work through project artifacts rather than chat memory. Require Node.js 20 or later.
 
-Bundled release: standalone `owlrunkit@0.19.0`, bundling Contract `0.2` and
-Core `0.19.0` with manifest
-`sha256:803fb7de76a6ccffd1ec5e0164eeff15a580209fa6dfbef9e561345ab616b403`.
-The published `owlrunkit@0.18.4` package is the trusted prior for rollback;
+Bundled release: standalone `owlrunkit@0.19.1`, bundling Contract `0.2` and
+Core `0.19.1` with manifest
+`sha256:291ef97c93a513eed24a29f75c400b61cefd6a8c0ab228401cf2c6a73ea9e622`.
+The published `owlrunkit@0.19.0` package is the trusted prior for rollback;
 verify exact official npm registry provenance before adoption. The immutable
 rollback baseline for the prior release is `owlrunkit@0.16.1` with SHA-1
 `1bc119d24879bdd8959af16b364af55ca9d61ea9` and canonical npm tarball URL
@@ -191,9 +191,9 @@ below has no CLI entry.
 
 ```bash
 npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
-  --exact owlrunkit@0.19.0 --dry-run
+  --exact owlrunkit@0.19.1 --dry-run
 npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
-  --exact owlrunkit@0.19.0 --apply
+  --exact owlrunkit@0.19.1 --apply
 npx --no-install owlrunkit init --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit inspect --json --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit status --workspace "$PROJECT_ROOT"

package/integrations/codex/skills/owlcoda-runkit/assets/templates/config.json

@@ -2,9 +2,9 @@
   "schemaVersion": "OwlCodaRunKitConfigV2",
   "core": {
     "contractVersion": "0.2",
-    "coreVersion": "0.19.0",
-    "coreManifestSha256": "sha256:803fb7de76a6ccffd1ec5e0164eeff15a580209fa6dfbef9e561345ab616b403",
-    "coreSourceRef": "artifact:sha256:803fb7de76a6ccffd1ec5e0164eeff15a580209fa6dfbef9e561345ab616b403"
+    "coreVersion": "0.19.1",
+    "coreManifestSha256": "sha256:291ef97c93a513eed24a29f75c400b61cefd6a8c0ab228401cf2c6a73ea9e622",
+    "coreSourceRef": "artifact:sha256:291ef97c93a513eed24a29f75c400b61cefd6a8c0ab228401cf2c6a73ea9e622"
   },
   "authorizationPolicy": "external_explicit_authority_required"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlrunkit",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "Project Driver for cross-Agent project continuity and progression; execution, evidence, verification, and recovery are the underlying trust substrate.",
   "license": "GPL-3.0-or-later",
   "author": "yeemio <owlclaw@163.com>",

package/packages/attest/distribution-manifest-v1.json

@@ -39,6 +39,11 @@
     "sha256": "sha256:3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986"
   },
   "supportedProducerCoreIdentities": [
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.19.1",
+      "coreManifestSha256": "sha256:291ef97c93a513eed24a29f75c400b61cefd6a8c0ab228401cf2c6a73ea9e622"
+    },
     {
       "contractVersion": "0.2",
       "coreVersion": "0.19.0",

package/packages/attest/src/quick.mjs

@@ -19,6 +19,11 @@ import { captureWorkspaceSnapshot } from "./workspace-snapshot.mjs";
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.19.1",
+    coreManifestSha256: "sha256:291ef97c93a513eed24a29f75c400b61cefd6a8c0ab228401cf2c6a73ea9e622",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.19.0",

package/registry-release-policy-v1.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV1",
   "status": "release_candidate_unpublished",
   "packageName": "owlrunkit",
-  "candidateVersion": "0.19.0",
+  "candidateVersion": "0.19.1",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "currentPublishedRelease": {
     "packageName": "owlrunkit",
-    "version": "0.18.4",
-    "shasum": "8f2ef01da287b76b545eeebd6973bc40449dd302",
-    "integrity": "sha512-L3cFuJnU39p/EhgrRaJbEIB7gTRFxKzEpNmANw3kwNFrTe9Fe8wtwgdFOBXldX6xCJY+W44/8cw4P/dtAxiCAA==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.4.tgz"
+    "version": "0.19.0",
+    "shasum": "83d156554924e2e1c58d972e1c7d31262bddb186",
+    "integrity": "sha512-edtzE58ShWEM4C0IpHJQiu2h0kKBSprU+LjaZNsXTXObeVZlGuAxZXkD7Jn6chMk3mpCidOf4VtA1/an+EZNWw==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.19.0.tgz"
   },
   "registryRelease": null,
   "registryEvidenceMustBeExternal": true,

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.19.0",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.19.0",
+  "name": "owlrunkit-0.19.1",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.19.1",
   "creationInfo": {
     "created": "2026-07-29T00:00:00Z",
     "creators": [
@@ -14,8 +14,8 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.19.0",
-      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.19.0.tgz",
+      "versionInfo": "0.19.1",
+      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.19.1.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
       "licenseDeclared": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.19.0"
+          "referenceLocator": "pkg:npm/owlrunkit@0.19.1"
         }
       ]
     }

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.19.0";
+export const CORE_VERSION = "0.19.1";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [

package/scripts/runkit-contract/profile-onboarding.mjs

@@ -1440,9 +1440,47 @@ export function applyDetectedProfilesV3(input = {}) {
   });
 }
 
+function mergeDetectedProfileDefinition(current, detected) {
+  current.commands ??= [];
+  const addedPaths = detected.paths
+    .filter((value) => !current.paths.includes(value))
+    .sort();
+  current.paths = [...new Set([...current.paths, ...detected.paths])].sort();
+  const commands = new Map(current.commands.map((entry) => [entry.id, entry]));
+  const addedCommandIds = [];
+  const updatedCommandIds = [];
+  for (const detectedCommand of detected.commands) {
+    const currentCommand = commands.get(detectedCommand.id);
+    if (!currentCommand) {
+      current.commands.push(structuredClone(detectedCommand));
+      commands.set(detectedCommand.id, detectedCommand);
+      addedCommandIds.push(detectedCommand.id);
+    } else if (canonicalJson(currentCommand) !== canonicalJson(detectedCommand)) {
+      const index = current.commands.findIndex((entry) => entry.id === detectedCommand.id);
+      current.commands[index] = structuredClone(detectedCommand);
+      commands.set(detectedCommand.id, detectedCommand);
+      updatedCommandIds.push(detectedCommand.id);
+    }
+  }
+  current.commands.sort((left, right) => left.id.localeCompare(right.id));
+  if (
+    addedPaths.length === 0
+    && addedCommandIds.length === 0
+    && updatedCommandIds.length === 0
+  ) return null;
+  return {
+    profileId: current.id,
+    addedPaths,
+    addedCommandIds: addedCommandIds.sort(),
+    updatedCommandIds: updatedCommandIds.sort(),
+  };
+}
+
 function mergeDetectedProfiles(currentProfiles, detectedProfiles) {
   const profiles = currentProfiles.profiles.map((profile) => structuredClone(profile));
   const byId = new Map(profiles.map((profile) => [profile.id, profile]));
+  const commandOwners = new Map(profiles.flatMap((profile) =>
+    (profile.commands ?? []).map((entry) => [entry.id, profile.id])));
   const addedProfileIds = [];
   const updatedProfiles = [];
   for (const detected of [...detectedProfiles.profiles]
@@ -1456,45 +1494,26 @@ function mergeDetectedProfiles(currentProfiles, detectedProfiles) {
       const primaryCoverageComplete = impact.uncoveredPaths.length === 0
         && !impact.warnings.some((warning) => warning.startsWith("supporting_only_match:"));
       if (primaryCoverageComplete) continue;
+      const existingCommandOwnerIds = [...new Set(detected.commands
+        .map((command) => commandOwners.get(command.id))
+        .filter(Boolean))];
+      if (existingCommandOwnerIds.length === 1) {
+        const owner = byId.get(existingCommandOwnerIds[0]);
+        const update = mergeDetectedProfileDefinition(owner, detected);
+        if (update !== null) updatedProfiles.push(update);
+        for (const command of owner.commands) commandOwners.set(command.id, owner.id);
+        continue;
+      }
       const added = { ...structuredClone(detected), primary: false };
       profiles.push(added);
       byId.set(added.id, added);
+      for (const command of added.commands) commandOwners.set(command.id, added.id);
       addedProfileIds.push(added.id);
       continue;
     }
-    const addedPaths = detected.paths
-      .filter((value) => !current.paths.includes(value))
-      .sort();
-    current.paths = [...new Set([...current.paths, ...detected.paths])].sort();
-    const commands = new Map(current.commands.map((entry) => [entry.id, entry]));
-    const addedCommandIds = [];
-    const updatedCommandIds = [];
-    for (const detectedCommand of detected.commands) {
-      const currentCommand = commands.get(detectedCommand.id);
-      if (!currentCommand) {
-        current.commands.push(structuredClone(detectedCommand));
-        commands.set(detectedCommand.id, detectedCommand);
-        addedCommandIds.push(detectedCommand.id);
-      } else if (canonicalJson(currentCommand) !== canonicalJson(detectedCommand)) {
-        const index = current.commands.findIndex((entry) => entry.id === detectedCommand.id);
-        current.commands[index] = structuredClone(detectedCommand);
-        commands.set(detectedCommand.id, detectedCommand);
-        updatedCommandIds.push(detectedCommand.id);
-      }
-    }
-    current.commands.sort((left, right) => left.id.localeCompare(right.id));
-    if (
-      addedPaths.length > 0
-      || addedCommandIds.length > 0
-      || updatedCommandIds.length > 0
-    ) {
-      updatedProfiles.push({
-        profileId: current.id,
-        addedPaths,
-        addedCommandIds: addedCommandIds.sort(),
-        updatedCommandIds: updatedCommandIds.sort(),
-      });
-    }
+    const update = mergeDetectedProfileDefinition(current, detected);
+    if (update !== null) updatedProfiles.push(update);
+    for (const command of current.commands) commandOwners.set(command.id, current.id);
   }
   return {
     proposedProfiles: {

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -18,6 +18,9 @@ const OFFICIAL_CLI_ENTRYPOINT =
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.19.0", new Set([
+    "sha256:803fb7de76a6ccffd1ec5e0164eeff15a580209fa6dfbef9e561345ab616b403",
+  ])],
   ["0.18.4", new Set([
     "sha256:372d4c247e4b40b0fd2f3fe0f5bf928548095bfb7e2e92e9ac66790e2717f77d",
   ])],