owlrunkit 0.19.1 → 0.19.2

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## 0.19.2
+
+- Adds read-only `formal preflight` and reuses it before an envelope-backed
+  Formal check writes candidate or evidence artifacts. It reports enforcement
+  backend, package-script subprocesses, protected `.owlcoda/runkit/` scan
+  conflicts, temporary-directory needs, device paths, and actionable repairs.
+- Adds Formal Check V2 failure taxonomy for source failures, missing envelope
+  capability, unresolved toolchains, and backend-proven network denial while
+  preserving the existing Formal Check V1 contract. Classification uses
+  trusted runner facts, never command-authored stdout or stderr; the current
+  backend conservatively leaves unproven network causes as source failures.
+- Adds `formal attach-evidence` for fully attested, source-bound
+  `supplemental-local` or `networked` Quick evidence and a deterministic finish
+  summary. The environment classification is explicitly operator-declared and
+  not attested by Quick Receipt V3. Supplemental evidence is always non-gating
+  and cannot replace a Formal-eligible passed check.
+- Re-attests supplemental receipt and material bytes at accepted finish, excludes stale
+  candidate attachments, rejects symlinked evidence roots, and preserves exact
+  resume semantics for the evidence summary.
+- Completes action-specific Formal and Project Driver help for supported
+  options without changing Git, release, deployment, production, or business
+  authority boundaries.
+- Adds Project Status and Takeover V3 so `overall=completed` means only that the
+  WorkItem ledger is complete. Without separate authority the visible delivery
+  disposition is `code_complete_without_release_authority`, the dominant gap is
+  `release_authority`, and the next action is never silently `none`.
+- Requires a different assigned Agent before a WorkItem enters `verifying`,
+  warns when verifying/completed checkpoints lack a Quick or Formal receipt
+  reference, and keeps an initialized Project Driver in managed continuity when
+  auto mode would otherwise recommend off.
+- Adds append-only Project Event V5 and `project work-item revise-scope` for
+  superseding owned paths or measurable units without rewriting the project
+  definition or allowing old checkpoints to prove the revised scope.
+- Accepts ISO-8601 UTC timestamps with seconds or up to three fractional digits
+  and stores canonical millisecond timestamps. Passed-gate defer errors now
+  identify the successor/new-gate correction path.
+
 ## 0.19.1
 
 - Fixes profile reconciliation for mature projects where an existing profile

package/README.md

@@ -52,6 +52,21 @@ binding instead of creating a second profile with duplicate IDs. Existing
 owner profiles, strict validation, atomic rollback, and shared-Skill activation
 boundaries remain unchanged.
 
+RunKit 0.19.2 makes Formal Delivery easier to configure without weakening its
+sandbox. A read-only envelope preflight reports known backend, subprocess,
+temporary-directory, device-path, and protected runtime-root conflicts before
+candidate evidence is written. Failed envelope checks receive typed failure
+categories. Fully attested Quick receipts may be attached as source-bound
+`supplemental-local` or `networked` evidence, but remain explicitly non-gating
+and can never replace a Formal-eligible passed check.
+
+The same candidate makes Project Driver completion honest: a completed
+WorkItem ledger without separate Git/release/deploy authority is visibly
+`code_complete_without_release_authority`, not a product-finished `next: none`.
+Independent verification requires a different assigned Agent. Append-only
+scope revision can widen or narrow a WorkItem after diagnosis without rewriting
+history, and missing Quick/Formal receipt references remain visible warnings.
+
 The 0.18 Project Driver is a bounded surface for new projects and controlled
 dogfood. Its product name does not claim to be a general long-running,
 multi-phase, or enterprise control plane. Version 0.18 adds one bounded
@@ -65,6 +80,11 @@ separate authority boundaries.
 
 ## Install
 
+`owlrunkit@0.19.2` is an unpublished release candidate. Until registry
+publication is independently verified, the current installable release is
+`owlrunkit@0.19.1`; a locally packed 0.19.2 tarball is for candidate testing
+only and is not adoption provenance.
+
 ```bash
 npm install --save-exact owlrunkit@0.19.1
 ```
@@ -137,6 +157,13 @@ npx --no-install owlrunkit project reject-and-return --workspace . --rework-id r
 npx --no-install owlrunkit project assign --workspace . --assignment-id assign-2 \
   --at 2026-08-09T00:11:00.000Z --work-item work-item-1 \
   --agent agent-successor --supersedes assign-1
+npx --no-install owlrunkit project work-item revise-scope --workspace . \
+  --revision-id scope-1 --at 2026-08-09T00:11:30Z \
+  --assignment-id assign-2 --work-item work-item-1 --owner-agent agent-successor \
+  --owned-path 'src/adapter/**' --owned-path 'src/canonical-store/**' \
+  --measurable-unit interface --measurable-total 2 \
+  --reason 'Diagnosis proved the canonical store is part of this bounded fix' \
+  --evidence evidence/scope-decision.txt
 npx --no-install owlrunkit project decision --workspace . --open --decision-id decision-1 \
   --at 2026-08-09T00:12:00.000Z --title 'Choose the accepted source path' \
   --question 'Which source path should continue?' --owner-agent agent-successor \
@@ -178,6 +205,19 @@ by itself. The assurance lane follows actual writer and authority count,
 rollback certainty, permissions, security, funds, irreversibility, schema/data
 migration, and explicit acceptance contracts—not environment labels alone.
 
+`project checkpoint --state verifying` requires the current assignment to have
+been superseded by a different Agent. This turns independent verification into
+a mechanical project invariant without forcing Formal. A verifying or completed
+checkpoint that does not reference a recognizable Quick/Formal receipt remains
+valid project truth but receives `no_bound_verification_receipt`; the warning is
+about the missing bound reference and does not attest any referenced receipt.
+
+`project work-item revise-scope` appends Event V5 and never rewrites the original
+definition. It must bind the current assignment and owner, records the previous
+and new paths/measurable contract, and invalidates older checkpoints for progress
+projection. Repeating the exact revision is idempotent; changing an existing
+revision fails closed.
+
 `project reject-and-return` applies only to the current explicit failed
 checkpoint. One Event V2 atomically binds that failure, its prior assignment,
 the reviewer, evidence, target Agent, and new assignment. The failed checkpoint
@@ -262,6 +302,12 @@ WorkItem. An assignment may bind an exact RunKit execution and lease; in that
 case, the WorkItem cannot complete until the execution has a trusted accepted
 closeout and its lease is released.
 
+In Status/Takeover V3, `overall=completed` is explicitly the WorkItem-ledger
+state. Because Project Driver never grants repository or runtime authority, that
+state is paired with `deliveryDisposition=code_complete_without_release_authority`,
+`dominantGap.kind=release_authority`, a non-empty external-authority next action,
+and `authorizationGranted=false`.
+
 `project takeover` adds the current candidate, its exact added/changed/removed
 path delta from the previous imported delivery, and handoffs that are stale
 because later project truth superseded them. These are read-only projections;
@@ -474,6 +520,9 @@ Formal also accepts a real project command through an enforced Verification
 Envelope:
 
 ```bash
+npx --no-install owlrunkit formal preflight --workspace . \
+  --envelope scripts/runkit-contract/templates/verification-envelope.json
+
 npx --no-install owlrunkit formal check --workspace . --run-id release-001 \
   --work-item delivery --check-id project-tests \
   --envelope scripts/runkit-contract/templates/verification-envelope.json
@@ -489,6 +538,24 @@ the policy, the command is not run and no Formal acceptance is possible.
 Existing legacy verification may still capture evidence, but it is not silently
 promoted into this Formal path.
 
+If a required project check cannot run inside the envelope, attach its fully
+attested Quick receipt to the same source candidate:
+
+```bash
+npx --no-install owlrunkit formal attach-evidence --workspace . \
+  --run-id release-001 --evidence-id local-migration-readback \
+  --kind supplemental-local --receipt /absolute/path/to/receipt.json
+```
+
+Use `networked` only for a Quick command that used network access. This is an
+operator declaration, not a fact attested by Quick Receipt V3; the attachment
+and summary therefore expose `classificationBasis=operator_declared_not_attested`.
+The receipt and its materials are re-attested, but attached evidence is always
+non-gating and cannot replace a passed Formal check or grant Git, release,
+deployment, production, or business authority. Evidence Summary generation is
+part of accepted finish; rejected and blocked closeouts remain honest without
+creating an acceptance-oriented summary.
+
 Use `npx --no-install owlrunkit status --workspace .` for a concise human view of what is ready,
 what has not happened, how many gates remain, and the next allowed action.
 
@@ -497,6 +564,10 @@ what has not happened, how many gates remain, and the next allowed action.
 `SourceCandidateV2` makes a dirty but precisely bounded candidate a first-class
 artifact. It binds the baseline, exact owned-path closure, source manifest,
 and payload bytes without requiring a Git commit.
+The serialized candidate contract is bounded to 64 MiB and 2,000,000 JSON
+values. Freeze applies the same bound as the reader before writing that
+candidate's payload or document, so an oversized workspace fails closed rather
+than producing an unreadable candidate.
 
 ```bash
 npx --no-install owlrunkit candidate freeze --workspace . --run-id release-001 \

package/docs/architecture/OWLCODA_RUNKIT_0191_PROFILE_RECONCILE_PATCH_PRODUCT_DECISION_20260813.md

@@ -1,6 +1,6 @@
 # OwlRunKit 0.19.1 Profile Reconcile Patch Product Decision
 
-状态：**候选实现完成，发布实况以 registry 读回和发布回执为准**
+状态：**已发布；registry、私仓 tag、项目 adoption 与共享 Skill 激活均已读回**
 
 ## Decision
 
@@ -22,9 +22,15 @@ command。它不会新增第二份重复 command，也不会削弱最终 profile
   三个独立状态转换；bootstrap 只诊断 Skill drift，不静默刷新 fleet Skill；
 - 0.19.0 的 continuity、assurance、Formal 和 predecessor-contract 边界不变。
 
-## Evidence And Claims
+## Release Truth
 
-发布前必须通过成熟项目冲突回归、profile/bootstrap 聚焦测试、完整 RunKit
+0.19.1 已通过成熟项目冲突回归、profile/bootstrap 聚焦测试、完整 RunKit
 gate、Core identity、packed package/Skill、干净 consumer 和 npm registry
-字节读回。本文不能在这些 Gate 完成前声称 0.19.1 已发布，也不能把一份
-package receipt 冒充 shared Skill 已激活或其他项目已推广。
+字节读回。发布源码是 `0367295c153ed36548a366633de39d5a1b832b3b`，tag
+是 `owlrunkit-v0.19.1`，npm `latest` 是 `0.19.1`。
+
+OwlCoda 项目已从官方 registry 精确采用 0.19.1，并得到 doctor `ready`、
+profiles `valid`、inspect `idle` 与 Quick `GO`。process-level shared Skill 也在
+完整 fleet 预检通过后原子升级到 0.19.1；58 个受管项目的 Core config 已生成
+可回滚迁移回执。上述事实不授予 Git、部署、生产或业务权限。完整证据见
+`docs/handoff/OWLCODA_RUNKIT_0191_PRIVATE_GIT_NPM_RELEASE_RECEIPT_20260813.md`。

package/docs/architecture/OWLCODA_RUNKIT_0192_FORMAL_USABILITY_PRODUCT_DECISION_20260813.md

@@ -0,0 +1,141 @@
+# OwlRunKit 0.19.2 Formal Usability and Project Driver Honesty Product Decision
+
+状态：**候选实施中；尚未发布、采用或激活**
+
+## Decision
+
+0.19.2 是一次整合型 Formal 可用性与 Project Driver 诚实状态补丁。它集中修正
+OwlChen 与 OwlFootball 真实主线 dogfood 中已经复现的接入摩擦，不增加新的
+Gate，也不放宽 Verification Envelope 的执行边界。
+
+目标是让合法项目命令在执行前获得可行动的静态诊断，让失败回执区分源码
+失败与环境不兼容，并允许同一源码候选的本地或联网补充验证被明确标记、绑定
+和汇总。补充验证永远不是 Formal 门禁证据。
+
+Project Driver 同时把“工单账完成”与“获准 Git、发布、部署或上线”拆成两个
+不同事实，并把独立验收者、诊断后的范围修订和缺少绑定验证回执做成可执行
+合同，而不是只留在 Agent 提示词里。
+
+## Scope
+
+### Formal envelope preflight
+
+- 新增只读 `formal preflight --envelope <file>`；
+- 输出 backend、阶段命令、已知隐式子进程、临时目录和 RunKit runtime 扫描
+  冲突；
+- 对必然失败的能力缺口返回 blocker，并给出最小 envelope 修正建议；
+- `formal check --envelope` 在写入 candidate、check 或 evidence 前复用同一
+  preflight，已知 blocker 零写入停止。
+
+### Typed Formal failure
+
+Formal Check V2 保留以下稳定分类词汇：
+
+- `source_check_failed`；
+- `envelope_capability_missing`；
+- `toolchain_resolution_failed`；
+- `network_policy_blocked`。
+
+分类只能来自 RunKit runner/backend 的受信结构化事实，不能解析被测命令可伪造
+的 stdout/stderr。当前 macOS backend 能证明 backend capability、launch/toolchain、
+cleanup/source 失败；只有后续 backend 明确返回结构化 network-denial cause 时才发出
+`network_policy_blocked`。无法归因的命令非零退出保守记为 `source_check_failed`。
+
+旧 `OwlCodaRunKitFormalCheckV1` 字节和语义保持不变。新增字段通过 V2
+合同发布，读取器同时支持 V1 与 V2。
+
+### Source-bound supplemental evidence
+
+新增：
+
+```text
+owlrunkit formal attach-evidence \
+  --workspace <root> --run-id <id> --evidence-id <id> \
+  --kind supplemental-local|networked --receipt <quick-receipt.json>
+```
+
+附件必须通过完整 Quick attestation，并与当前有效 Formal SourceCandidate
+在同一 workspace 状态下绑定。它保存自己的 Quick workspace fingerprint，
+同时绑定 Formal `sourceFingerprint`、candidate path 和 candidate hash。
+Formal Core 使用运行时计算的当前 Core identity 调用被 Core manifest 绑定的
+Quick attester；发布面中自引用的当前 identity 字段不参与该运行时信任判断。
+`supplemental-local|networked` 是操作者声明的执行环境分类；Quick Receipt V3
+并不证明网络是否被使用，因此附件和摘要必须同时写明
+`classificationBasis=operator_declared_not_attested`，不得把该标签说成 attested fact。
+
+`formal finish --decision accepted` 自动生成一份 Evidence Summary，列出当前源码的 Formal checks
+与 supplemental evidence。只有 Formal-eligible checks 参与 acceptance；摘要必须
+明确声明 supplemental evidence 为 non-gating，不能替代 sandbox、授权或业务验收。
+
+### CLI and runtime-root guidance
+
+- `formal finish --help` 展示 `--decision` 与 `--finalize-id`；
+- `formal preflight` 和 `formal attach-evidence` 有 action-specific help；
+- 已存在但缺 help 的 Project Driver actions 补齐；
+- broad lint/format/test 命令可能扫描 `.owlcoda/runkit/**` 时，在 Formal
+  preflight 中直接给出 ignore 修正，而不是等待 sandbox 执行失败。
+
+### Project Driver honesty and first-use repair
+
+- Project Status V3 与 Takeover V3 保留 `overall=completed` 的工单账语义，但在
+  没有外部授权时固定输出
+  `deliveryDisposition=code_complete_without_release_authority`、
+  `dominantGap.kind=release_authority` 和一条非空外部授权下一动作；
+- `authorizationGranted` 始终为 `false`，Project Driver 不能自行授予 Git、发布、
+  部署、生产或业务权限；
+- 进入 `verifying` 前必须由另一 Agent 接管当前 assignment，同一实现者直接把
+  自己标为 verifying 时零写入拒绝，并返回可复制的 handoff/assignment 修正路径；
+- 新增 append-only Event V5 `project work-item revise-scope`，允许当前 Owner 在
+  诊断后 supersede `ownedPaths` 与 measurable 合同；原 definition 和历史事件不被
+  改写，范围修订后旧 checkpoint 不再证明新范围已完成；
+- `verifying` 或 `completed` checkpoint 未引用可识别的 Quick/Formal 回执时，
+  Status V3 输出 `no_bound_verification_receipt` warning。该 warning 只证明缺少引用，
+  不证明引用本身已经通过 attestation；
+- 已存在 Project Driver definition 时，`mode recommend --mode auto` 保持
+  `managed + assurance none|quick`，不再把已初始化的总控账本劝回 `off`；
+- Project Driver 时间戳接受 ISO-8601 UTC 秒精度或最多三位小数，并以 `.sssZ`
+  规范化保存；action help 展示必填 measured checkpoint 与 scope revision 参数；
+- 对已通过 gate 的 defer 仍 fail-closed，但错误必须同时给出新 gate 或
+  `project successor` 的可行动路径。
+
+## Preserved Boundaries
+
+- supplemental evidence 永远 `gating=false`、`authorizationGranted=false`；
+- accepted Formal 仍要求当前源码至少一条有效 Formal-eligible passed check；
+- preflight、attachment、summary 不授予 Git、发布、部署、生产、凭据或业务权限；
+- 不自动修改项目 lint/format 配置，不扩大 writable paths、network 或 subprocess
+  allowlist；
+- Linux backend 仍 fail-closed，本轮不新增执行器；
+- 已发布 V1 schema 不原地重解释；破坏性变化使用 successor schema；
+- SourceCandidateV2 文档支持上限为 64 MiB、2,000,000 个 JSON value；freeze
+  在任何该候选 payload 或 candidate 写入前使用与 reader 相同的上限检查；
+- 0.19.2 package、Git、tag、npm、项目 adoption 与 shared Skill activation 是独立
+  状态转换，本文不能证明其中任何一个已完成。
+
+## Acceptance Scenarios
+
+1. backend 缺失、已知 subprocess 缺口或 broad scan 冲突在 Formal 写入前阻止执行；
+2. 正常 source assertion 失败分类为 `source_check_failed`；
+3. launch/toolchain 与 sandbox capability 由结构化事实分类；命令输出中的同名文本
+   不能改变分类，未被 backend 证明的 network cause 不冒充 policy fact；
+4. source drift、失败 Quick receipt、材料漂移或不同 workspace 的附件 fail-closed；
+5. 合法 supplemental-local/networked receipt 可被当前 candidate 绑定；
+6. source 改变后旧附件保留但不进入当前 Evidence Summary；
+7. accepted finish 的摘要同时展示门禁 Formal checks 和 non-gating attachments；
+8. 没有 passed Formal check 时，attachments 再多也不能 accepted finish；
+9. 新旧 FormalCheck 合同都可读取，V1 输出不变；
+10. 所有新增结果保持 `authorizationGranted=false`。
+11. 工单账全部完成后，Status/Takeover 仍醒目显示未获发布授权，且下一动作不为
+    `none`；
+12. 同一 Agent 直接进入 verifying 零写入拒绝，另一 Agent 完成 handoff/assignment
+    后可进入 verifying；
+13. scope revision 不改写 definition，旧 revision/checkpoint 不能证明新范围；
+14. `...ssZ` 时间戳被接受并规范为 `...ss.000Z`，所有 action help 可直接执行；
+15. 已初始化 Project Driver 的 auto mode 推荐 managed，缺绑定回执只产生 warning，
+    不自动升级 Formal。
+
+## Release Truth
+
+当前只授权形成和验证 0.19.2 source candidate。未授权 commit、push、tag、npm
+publish、项目升级或 shared Skill 更新。候选必须先通过聚焦合同测试、相关 RunKit
+gate、Core identity 与真实 packed-consumer dogfood，之后才能单独决定发布。

package/integrations/codex/skills/owlcoda-runkit/SKILL.md

@@ -7,11 +7,13 @@ description: Run receipt-backed, project-owned work with OwlCoda RunKit. Use whe
 
 Use the bundled deterministic Core to coordinate work through project artifacts rather than chat memory. Require Node.js 20 or later.
 
-Bundled release: standalone `owlrunkit@0.19.1`, bundling Contract `0.2` and
-Core `0.19.1` with manifest
-`sha256:291ef97c93a513eed24a29f75c400b61cefd6a8c0ab228401cf2c6a73ea9e622`.
-The published `owlrunkit@0.19.0` package is the trusted prior for rollback;
-verify exact official npm registry provenance before adoption. The immutable
+Bundled candidate: standalone `owlrunkit@0.19.2`, bundling Contract `0.2` and
+Core `0.19.2` with manifest
+`sha256:c46ae9d8ed0572e5636ab5725f922f8db3ee5bf0f966b200bce7b2287c9267c8`.
+This candidate is not published. The current published release remains
+`owlrunkit@0.19.1`, which is the trusted prior for rollback and the only
+registry-installable version named by this Skill before publication. Verify
+exact official npm registry provenance before adoption. The immutable
 rollback baseline for the prior release is `owlrunkit@0.16.1` with SHA-1
 `1bc119d24879bdd8959af16b364af55ca9d61ea9` and canonical npm tarball URL
 `https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.16.1.tgz`.
@@ -26,7 +28,8 @@ the user to operate the CLI when the request and authority are already clear.
 
 The normal mainline is `init`, `assign`, `checkpoint`, `handoff`,
 `reject-and-return`, `decision`, `verification`, `integrate`, `status`, and
-`takeover`. External source lanes use `target-snapshot` and `import-delivery`
+`takeover`. A diagnosed WorkItem scope change uses append-only `work-item
+revise-scope`. External source lanes use `target-snapshot` and `import-delivery`
 without installing RunKit or writing control artifacts into the frozen target.
 After a project
 derives completed, `successor` is the bounded lifecycle step. `init` accepts one project definition
@@ -43,6 +46,10 @@ remains available for existing automation and compatibility.
 - "I decided ...": append a decision resolution with rationale and evidence.
 - "Hand this to another Agent": append the handoff, then a successor assignment;
   never overwrite the old assignment.
+- "The diagnosis changed this WorkItem's paths or measurable contract": append
+  one `project work-item revise-scope` event bound to the current assignment and
+  owner. Never edit the project definition or treat an older checkpoint as
+  completion evidence for the revised scope.
 - "Reject this failed candidate and return it": use one `project
   reject-and-return` event. Preserve the failed checkpoint, bind the review
   evidence, create the rework assignment, and never rewrite failure as active.
@@ -71,11 +78,19 @@ remains available for existing automation and compatibility.
   underlying risk; bind a Formal WorkItem to its actual execution and lease when
   applicable. Multi-Agent coordination, long duration, or interruption recovery
   alone does not select Formal.
+- "Everything in the ledger is complete": report
+  `code_complete_without_release_authority` unless a separate external actor has
+  granted the relevant Git/release/deploy authority. Never translate
+  `overall=completed` into product activation or `next: none`.
 
 For a multi-Agent project, checkpoint meaningful state changes promptly. A
 checkpoint is not a heartbeat and must not contain a guessed percentage.
 Completion requires evidence. If an assignment binds an execution, derive its
 state from the closeout and lease rather than trusting the Agent's claim.
+Before entering `verifying`, hand off and supersede the implementation assignment
+with a different Agent. If a verifying/completed checkpoint has no recognizable
+Quick/Formal receipt reference, preserve the checkpoint but report
+`no_bound_verification_receipt`; do not claim that a mere reference was attested.
 
 ```bash
 npx --no-install owlrunkit project init --workspace "$PROJECT_ROOT" --definition "$PROJECT_JSON"
@@ -92,6 +107,11 @@ npx --no-install owlrunkit project reject-and-return --workspace "$PROJECT_ROOT"
   --rework-id "$REWORK_ID" --at "$OCCURRED_AT" --work-item "$WORK_ITEM_ID" \
   --reviewer-agent "$REVIEWER_AGENT_ID" --to-agent "$AGENT_ID" \
   --reason "$REJECTION_REASON" --next "$NEXT_ACTION" --evidence "$EVIDENCE_REF"
+npx --no-install owlrunkit project work-item revise-scope --workspace "$PROJECT_ROOT" \
+  --revision-id "$REVISION_ID" --at "$OCCURRED_AT" \
+  --assignment-id "$ASSIGNMENT_ID" --work-item "$WORK_ITEM_ID" \
+  --owner-agent "$AGENT_ID" --owned-path "$OWNED_PATH" \
+  --reason "$SCOPE_REASON" --evidence "$EVIDENCE_REF"
 npx --no-install owlrunkit project decision --workspace "$PROJECT_ROOT" --resolve \
   --decision-id "$DECISION_ID" --at "$OCCURRED_AT" --resolution "$RESOLUTION" \
   --rationale "$RATIONALE" --evidence "$EVIDENCE_REF"
@@ -502,6 +522,9 @@ Formal accepted evidence admits the built-in Node syntax check and real project
 commands executed through a Verification Envelope:
 
 ```bash
+npx --no-install owlrunkit formal preflight \
+  --workspace "$PROJECT_ROOT" --envelope "$VERIFICATION_ENVELOPE_JSON"
+
 npx --no-install owlrunkit formal check \
   --workspace "$PROJECT_ROOT" --run-id "$RUN_ID" \
   --work-item "$WORK_ITEM_ID" --check-id "$CHECK_ID" \
@@ -517,10 +540,30 @@ command optimistically. The public 0.17 package provides the enforced macOS
 backend; Linux remains fail-closed. Legacy `verify` may capture evidence but
 must not be silently promoted into this Formal path.
 
+When a required project check cannot run inside the envelope, run it through
+Quick against the same frozen source and attach the fully attested receipt:
+
+```bash
+npx --no-install owlrunkit formal attach-evidence \
+  --workspace "$PROJECT_ROOT" --run-id "$RUN_ID" \
+  --evidence-id "$EVIDENCE_ID" --kind supplemental-local \
+  --receipt "$QUICK_RECEIPT_JSON"
+```
+
+Use `networked` instead of `supplemental-local` only when the attached command
+used network access. This classification is operator-declared and not attested
+by Quick Receipt V3, so artifacts expose
+`classificationBasis=operator_declared_not_attested`. Supplemental evidence
+remains non-gating: its receipt and materials are re-attested and summarized by
+an accepted `formal finish`, but it never substitutes for a passed Formal-eligible check or
+grants Git, release, deployment, or business authority.
+
 ## Freeze a dirty SourceCandidateV2
 
 Freeze, verify and materialize an immutable candidate without requiring a Git
-commit:
+commit. SourceCandidateV2 documents are limited to 64 MiB and 2,000,000 JSON
+values; producer and reader enforce the same bound before candidate payload or
+document writes.
 
 ```bash
 npx --no-install owlrunkit candidate freeze --workspace "$PROJECT_ROOT" \

package/integrations/codex/skills/owlcoda-runkit/assets/templates/config.json

@@ -2,9 +2,9 @@
   "schemaVersion": "OwlCodaRunKitConfigV2",
   "core": {
     "contractVersion": "0.2",
-    "coreVersion": "0.19.1",
-    "coreManifestSha256": "sha256:291ef97c93a513eed24a29f75c400b61cefd6a8c0ab228401cf2c6a73ea9e622",
-    "coreSourceRef": "artifact:sha256:291ef97c93a513eed24a29f75c400b61cefd6a8c0ab228401cf2c6a73ea9e622"
+    "coreVersion": "0.19.2",
+    "coreManifestSha256": "sha256:c46ae9d8ed0572e5636ab5725f922f8db3ee5bf0f966b200bce7b2287c9267c8",
+    "coreSourceRef": "artifact:sha256:c46ae9d8ed0572e5636ab5725f922f8db3ee5bf0f966b200bce7b2287c9267c8"
   },
   "authorizationPolicy": "external_explicit_authority_required"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlrunkit",
-  "version": "0.19.1",
+  "version": "0.19.2",
   "description": "Project Driver for cross-Agent project continuity and progression; execution, evidence, verification, and recovery are the underlying trust substrate.",
   "license": "GPL-3.0-or-later",
   "author": "yeemio <owlclaw@163.com>",

package/packages/attest/distribution-manifest-v1.json

@@ -39,6 +39,11 @@
     "sha256": "sha256:3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986"
   },
   "supportedProducerCoreIdentities": [
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.19.2",
+      "coreManifestSha256": "sha256:c46ae9d8ed0572e5636ab5725f922f8db3ee5bf0f966b200bce7b2287c9267c8"
+    },
     {
       "contractVersion": "0.2",
       "coreVersion": "0.19.1",

package/packages/attest/src/quick.mjs

@@ -19,6 +19,11 @@ import { captureWorkspaceSnapshot } from "./workspace-snapshot.mjs";
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.19.2",
+    coreManifestSha256: "sha256:c46ae9d8ed0572e5636ab5725f922f8db3ee5bf0f966b200bce7b2287c9267c8",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.19.1",
@@ -134,7 +139,7 @@ export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
     coreVersion: "0.13.0",
     coreManifestSha256: "sha256:0455c847bf2df77703583c6f19c20cf103206bafc4f122795bf34d3f85f0263d",
   },
-]);
+].map(identity => Object.freeze(identity)));
 
 function dependencyEnvironmentCurrent(binding, materials) {
   if (binding === null || binding === undefined) return true;
@@ -211,11 +216,11 @@ function resultTemplate({ receipt, receiptPath, receiptSha256, decision, issues,
   };
 }
 
-export function attestQuickReceiptDetailsFromBytes({
+function attestQuickReceiptDetailsFromBytesWithCatalog({
   receiptPath,
   receiptBytes,
   workspaceRoot,
-}) {
+}, supportedCoreIdentities) {
   const absoluteReceiptPath = resolveRegularFilePath(receiptPath);
   let receipt;
   try {
@@ -241,7 +246,7 @@ export function attestQuickReceiptDetailsFromBytes({
   let materialMissing = false;
   let materialMismatch = false;
 
-  const coreValid = SUPPORTED_QUICK_CORE_IDENTITIES.some((core) =>
+  const coreValid = supportedCoreIdentities.some((core) =>
     receipt.coreIdentity.contractVersion === core.contractVersion
     && receipt.coreIdentity.coreVersion === core.coreVersion
     && receipt.coreIdentity.coreManifestSha256 === core.coreManifestSha256);
@@ -375,6 +380,34 @@ export function attestQuickReceiptDetailsFromBytes({
   };
 }
 
+export function attestQuickReceiptDetailsFromBytes(options) {
+  return attestQuickReceiptDetailsFromBytesWithCatalog(
+    options,
+    SUPPORTED_QUICK_CORE_IDENTITIES,
+  );
+}
+
+export function attestQuickReceiptDetailsFromBytesWithCoreCatalog(
+  options,
+  supportedCoreIdentities,
+) {
+  if (
+    !Array.isArray(supportedCoreIdentities)
+    || supportedCoreIdentities.length === 0
+    || supportedCoreIdentities.some((identity) => (
+      identity?.contractVersion !== "0.2"
+      || typeof identity?.coreVersion !== "string"
+      || !/^sha256:[a-f0-9]{64}$/u.test(identity?.coreManifestSha256 ?? "")
+    ))
+  ) {
+    throw new Error("trusted Quick Core catalog is invalid");
+  }
+  return attestQuickReceiptDetailsFromBytesWithCatalog(
+    options,
+    supportedCoreIdentities,
+  );
+}
+
 export function attestQuickReceiptDetails({ receiptPath, workspaceRoot }) {
   const { absolutePath, bytes } = readFileBytesBounded(receiptPath);
   return attestQuickReceiptDetailsFromBytes({

package/registry-release-policy-v1.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV1",
   "status": "release_candidate_unpublished",
   "packageName": "owlrunkit",
-  "candidateVersion": "0.19.1",
+  "candidateVersion": "0.19.2",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "currentPublishedRelease": {
     "packageName": "owlrunkit",
-    "version": "0.19.0",
-    "shasum": "83d156554924e2e1c58d972e1c7d31262bddb186",
-    "integrity": "sha512-edtzE58ShWEM4C0IpHJQiu2h0kKBSprU+LjaZNsXTXObeVZlGuAxZXkD7Jn6chMk3mpCidOf4VtA1/an+EZNWw==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.19.0.tgz"
+    "version": "0.19.1",
+    "shasum": "e14aac84fb680ec9051d786bc84848c8f3ca0ca4",
+    "integrity": "sha512-I9sd41tD4kDXz8fOuZqMC06JOmofFDitveInGOPbsGJH5HCp7oa+dMdBCSO2KJjdfsVDXoiOPiTpxfahbTUfrg==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.19.1.tgz"
   },
   "registryRelease": null,
   "registryEvidenceMustBeExternal": true,

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.19.1",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.19.1",
+  "name": "owlrunkit-0.19.2",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.19.2",
   "creationInfo": {
     "created": "2026-07-29T00:00:00Z",
     "creators": [
@@ -14,8 +14,8 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.19.1",
-      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.19.1.tgz",
+      "versionInfo": "0.19.2",
+      "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
       "licenseDeclared": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.19.1"
+          "referenceLocator": "pkg:npm/owlrunkit@0.19.2"
         }
       ]
     }