owlrunkit 0.22.0 → 0.22.1

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.22.1
+
+- Makes process-wide Codex Skill activation require every discovered project
+  to already have an exact package, lockfile, installed CLI/Core, Config, and
+  official-registry adoption binding for the target RunKit version.
+- Removes project migration from the shared Skill installer. Skill activation
+  now replaces only the shared Skill bytes and emits V2 upgrade/rollback
+  receipts proving that the package manifest, lockfile, installed package
+  manifest, Config, and adoption evidence were unchanged.
+- Adds canonical project control locks, a fleet-registry transaction lock,
+  frozen-fleet revalidation, and recoverable install and rollback journals so
+  interruption cannot leave a silent half-upgrade or partial legacy Config
+  rollback.
+- Gives upgrade receipts and transaction journals independent, writer-enforced
+  byte bounds before Skill mutation. Legacy V1 Config preimages are stored as
+  transaction-scoped, hash-bound files instead of duplicated base64 journal
+  payloads, and terminal rollback recovery cannot rewrite a newly active
+  project after its control lock is released.
+- Binds V2 upgrade receipts to the exact fleet discovery source and frozen
+  membership. Rollback rediscovers the current fleet and refuses newly added,
+  active, or identity-drifted projects; legacy receipts require an explicit
+  current fleet source.
+- Makes both first activation and the read-only plan fail closed on an existing
+  incompatible default fleet or any path-level discovery issue.
+- Makes the read-only fleet Skill plan report package/adoption mismatches as
+  blocking, with a project-local install/bootstrap or adoption repair boundary,
+  instead of presenting Config-only projects as safe to activate.
+- Preserves legacy V1 rollback receipts while keeping all Git, release,
+  deployment, production, business, automation, and money authority false.
+
 ## 0.22.0
 
 - Adds the independent `OwlCodaRunKitHookRecoveryV1` public contract and

package/README.md

@@ -124,7 +124,7 @@ separate authority boundaries.
 
 ## Install
 
-This package is the lifecycle-stable, registry-gated `owlrunkit@0.22.0`
+This package is the lifecycle-stable, registry-gated `owlrunkit@0.22.1`
 artifact. Registry adoption remains fail-closed until its exact official npm
 version, shasum, integrity, and tarball URL are independently verified. Local
 tarballs remain candidate-test inputs and are never adoption provenance. Until
@@ -132,7 +132,7 @@ that registry evidence exists, use the package only for isolated candidate
 verification; do not treat the command below as available release truth.
 
 ```bash
-npm install --save-exact owlrunkit@0.22.0
+npm install --save-exact owlrunkit@0.22.1
 ```
 
 Use `npx --no-install owlrunkit` for project commands. The package bootstrap
@@ -148,9 +148,9 @@ the project Config must independently bind the same Core.
 ```bash
 npx --no-install owlrunkit --version
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.22.0 --dry-run
+  --exact owlrunkit@0.22.1 --dry-run
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.22.0 --apply
+  --exact owlrunkit@0.22.1 --apply
 npx --no-install owlrunkit init --workspace /absolute/path/to/project
 npx --no-install owlrunkit doctor --workspace /absolute/path/to/project
 npx --no-install owlrunkit inspect --workspace /absolute/path/to/project --json --compact
@@ -736,6 +736,22 @@ auditable but are never interpreted as active writers.
 
 RunKit rejects an unreachable root and freezes the exact active workspace list
 before a shared Skill or Core change.
+Shared Skill activation is the final fleet step: every discovered project must
+already bind the target release through its exact package declaration,
+lockfile, installed CLI/Core, Config, and official-registry adoption evidence.
+The installer replaces only the process-wide Skill. It locks every project
+control root in canonical order and proves the workspace package manifest,
+lockfile, installed package manifest, Config, and adoption evidence unchanged;
+it never upgrades project dependencies or Core. An interruption journal
+restores the exact prior Skill before a later installer action continues. The
+fleet registry remains transaction-locked through final receipt commit.
+Receipt and journal byte bounds are enforced by both writers and readers before
+Skill mutation; legacy Config preimages use transaction-scoped, hash-bound
+files so a large fleet does not make its recovery journal unreadable. V2
+receipts always bind their discovery source and frozen membership, so rollback
+must rediscover the same current fleet and also recovers atomically after an
+interruption. Legacy V1 rollback remains supported only when the operator
+supplies an explicit current fleet source.
 Explicit `--fleet-root` and `--fleet-manifest` remain available for bounded
 one-off operations. Completeness is intentionally limited to registered roots;
 RunKit does not claim machine-wide protection for an unregistered location.

package/integrations/codex/skills/owlcoda-runkit/SKILL.md

@@ -7,14 +7,14 @@ description: Run receipt-backed, project-owned work with OwlCoda RunKit. Use whe
 
 Use the bundled deterministic Core to coordinate work through project artifacts rather than chat memory. Require Node.js 20 or later.
 
-Bundled registry-gated artifact: standalone `owlrunkit@0.22.0`, bundling Contract
-`0.2` and Core `0.22.0` with manifest
-`sha256:e79d2123d88ada0e2e31f62fabee83b1d661ca02e93a383691a502f721ae1e7e`.
+Bundled registry-gated artifact: standalone `owlrunkit@0.22.1`, bundling Contract
+`0.2` and Core `0.22.1` with manifest
+`sha256:41447517f78b74a070802bd67c8b066a833eedde72e2606e3127fa1258c289a4`.
 Registry adoption remains fail-closed until exact official npm registry
-provenance for `owlrunkit@0.22.0` is independently verified. The published
-rollback baseline for this artifact is `owlrunkit@0.21.0`, with SHA-1
-`f9ecfa41ad2ba3140258234b49d98798675651f2` and canonical npm tarball URL
-`https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.21.0.tgz`.
+provenance for `owlrunkit@0.22.1` is independently verified. The published
+rollback baseline for this artifact is `owlrunkit@0.22.0`, with SHA-1
+`23fb305f24b2487a2a1de3c8e407d7e4606a3b86` and canonical npm tarball URL
+`https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.22.0.tgz`.
 The root `owlcoda` package has a separate version lifecycle.
 
 The session is an execution interface. Project artifacts are the system of record.
@@ -86,6 +86,17 @@ npx --no-install owlrunkit fleet skill-plan \
   --skill-root "$RUNKIT_SKILL_TARGET" --archive-root "$RUNKIT_SKILL_ARCHIVE_ROOT"
 ```
 
+Activate the process-wide Skill only after every discovered project already
+binds the target release through its exact package, lockfile, installed
+CLI/Core, Config, and official-registry adoption evidence. The Skill installer
+must not install project dependencies, initialize Core, or rewrite project
+state; its V2 receipt proves the package manifest, lockfile, installed package
+manifest, Config, and adoption evidence stayed unchanged. V2 restore always
+uses the receipt's frozen fleet binding; only a legacy V1 receipt may accept an
+explicit current fleet source. Receipt and recovery-journal bounds are checked
+before Skill mutation, and interruption recovery remains terminal before
+project control locks are released.
+
 Doctor reports both the package-bound and discovered shared Skill absolute
 paths and versions. Shared drift is visible but non-blocking for a valid
 project-local CLI. `loadedSkillVersion=unknown` is deliberate: RunKit cannot
@@ -304,9 +315,9 @@ below has no CLI entry.
 
 ```bash
 npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
-  --exact owlrunkit@0.22.0 --dry-run
+  --exact owlrunkit@0.22.1 --dry-run
 npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
-  --exact owlrunkit@0.22.0 --apply
+  --exact owlrunkit@0.22.1 --apply
 npx --no-install owlrunkit init --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit inspect --json --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit inspect --json --compact --workspace "$PROJECT_ROOT"
@@ -489,10 +500,16 @@ project has an active execution, an active writer lease, ambiguous control
 state, or invalid configuration. A missing registry is an error; do not use
 partial explicit coverage to bypass this guard.
 
-A successful update archives the exact prior Skill, migrates each inactive
-project, and writes an append-only upgrade receipt containing the prior Skill
-manifest identity and each prior ConfigV2 byte sequence. Use that receipt for
-an exact rollback:
+A successful update archives the exact prior Skill without migrating any
+project. It holds each project control lock while proving the package manifest,
+lockfile, installed package manifest, Config, and adoption evidence unchanged,
+then writes an append-only upgrade receipt. An interrupted swap is recovered
+from its bounded transaction journal before a later installer action proceeds.
+The registry transaction lock remains held through receipt commit. A V2
+receipt binds the exact fleet source and frozen membership; rollback
+rediscovers that fleet and uses its own interruption journal. Legacy V1
+receipts require an explicit current fleet source. Use the upgrade receipt for
+an exact Skill rollback:
 
 ```bash
 node "$RUNKIT_PACKAGE_ROOT/scripts/runkit-contract/install-codex-skill.mjs" \

package/integrations/codex/skills/owlcoda-runkit/assets/templates/config.json

@@ -2,9 +2,9 @@
   "schemaVersion": "OwlCodaRunKitConfigV2",
   "core": {
     "contractVersion": "0.2",
-    "coreVersion": "0.22.0",
-    "coreManifestSha256": "sha256:e79d2123d88ada0e2e31f62fabee83b1d661ca02e93a383691a502f721ae1e7e",
-    "coreSourceRef": "artifact:sha256:e79d2123d88ada0e2e31f62fabee83b1d661ca02e93a383691a502f721ae1e7e"
+    "coreVersion": "0.22.1",
+    "coreManifestSha256": "sha256:41447517f78b74a070802bd67c8b066a833eedde72e2606e3127fa1258c289a4",
+    "coreSourceRef": "artifact:sha256:41447517f78b74a070802bd67c8b066a833eedde72e2606e3127fa1258c289a4"
   },
   "authorizationPolicy": "external_explicit_authority_required"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlrunkit",
-  "version": "0.22.0",
+  "version": "0.22.1",
   "description": "Project Driver for cross-Agent project continuity and progression; execution, evidence, verification, and recovery are the underlying trust substrate.",
   "license": "GPL-3.0-or-later",
   "author": "yeemio <owlclaw@163.com>",

package/packages/attest/distribution-manifest-v1.json

@@ -42,6 +42,11 @@
     "sha256": "sha256:3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986"
   },
   "supportedProducerCoreIdentities": [
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.22.1",
+      "coreManifestSha256": "sha256:41447517f78b74a070802bd67c8b066a833eedde72e2606e3127fa1258c289a4"
+    },
     {
       "contractVersion": "0.2",
       "coreVersion": "0.22.0",

package/packages/attest/src/quick.mjs

@@ -23,6 +23,11 @@ import {
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.22.1",
+    coreManifestSha256: "sha256:41447517f78b74a070802bd67c8b066a833eedde72e2606e3127fa1258c289a4",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.22.0",

package/registry-release-policy-v2.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV2",
   "status": "release_artifact_registry_gated",
   "packageName": "owlrunkit",
-  "artifactVersion": "0.22.0",
+  "artifactVersion": "0.22.1",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "rollbackRelease": {
     "packageName": "owlrunkit",
-    "version": "0.21.0",
-    "shasum": "f9ecfa41ad2ba3140258234b49d98798675651f2",
-    "integrity": "sha512-hopLyvN5vp0y3xu0H0jQbMI6DxaDSWcGYcn7tAbCa0m2OqW2G8n5kJvnr217jqPYlArQwJ2TDPRLNmp4vPEhVQ==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.21.0.tgz"
+    "version": "0.22.0",
+    "shasum": "23fb305f24b2487a2a1de3c8e407d7e4606a3b86",
+    "integrity": "sha512-sQVFAOvOT7/qLWj5xwLkTvx2g2CGXT3JtRgQDK5Ku2okHGXN6FsgERYKv21IYOxRbEjABamhUwENTflw8ipeSQ==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.22.0.tgz"
   },
   "registryEvidenceMustBeExternal": true,
   "registryEvidenceSchemaVersion": "OwlCodaRunKitRegistryReleaseEvidenceV1",

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.22.0",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.22.0",
+  "name": "owlrunkit-0.22.1",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.22.1",
   "creationInfo": {
     "created": "2026-07-29T00:00:00Z",
     "creators": [
@@ -14,7 +14,7 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.22.0",
+      "versionInfo": "0.22.1",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.22.0"
+          "referenceLocator": "pkg:npm/owlrunkit@0.22.1"
         }
       ]
     }

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.22.0";
+export const CORE_VERSION = "0.22.1";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [

package/scripts/runkit-contract/fleet-skill-plan.mjs

@@ -1,13 +1,11 @@
-import { readFile } from "node:fs/promises";
 import path from "node:path";
 
-import {
-  currentCoreIdentity,
-  validateProjectConfigV2,
-} from "./core-contract.mjs";
+import { currentCoreIdentity } from "./core-contract.mjs";
 import { discoverFleet } from "./fleet-discovery.mjs";
-import { inspectInstalledSkillCompatibility } from "./install-codex-skill.mjs";
-import { inspectProjectControlState } from "./project-control-state.mjs";
+import {
+  inspectInstalledSkillCompatibility,
+  inspectProjectForSkillChange,
+} from "./install-codex-skill.mjs";
 
 function shellQuote(value) {
   return `'${String(value).replaceAll("'", `'"'"'`)}'`;
@@ -34,63 +32,6 @@ function fleetSourceArguments({
     : "";
 }
 
-function validLegacyConfigV1(config) {
-  return config?.schemaVersion === "OwlCodaRunKitConfigV1"
-    && config?.core?.contractVersion === "0.1"
-    && config?.authorizationPolicy === "external_explicit_authority_required";
-}
-
-async function inspectAffectedProject(workspaceRoot) {
-  const blockers = [];
-  const control = inspectProjectControlState({ workspaceRoot }).upgradeSafety;
-  for (const artifactId of control.activeRunIds) {
-    blockers.push({ code: "active_execution", workspaceRoot, artifactId });
-  }
-  for (const artifactId of control.activeLeaseIds) {
-    blockers.push({ code: "active_lease", workspaceRoot, artifactId });
-  }
-  for (const issue of control.issues) {
-    blockers.push({ code: "control_state_invalid", workspaceRoot, detail: issue });
-  }
-
-  const configPath = path.join(workspaceRoot, ".owlcoda/runkit/config.json");
-  let config = null;
-  try {
-    config = JSON.parse((await readFile(configPath)).toString("utf8"));
-  } catch (error) {
-    blockers.push({
-      code: "project_config_invalid",
-      workspaceRoot,
-      detail: error instanceof Error ? error.message : String(error),
-    });
-  }
-  if (config !== null) {
-    const validation = config.schemaVersion === "OwlCodaRunKitConfigV2"
-      ? validateProjectConfigV2(config)
-      : null;
-    if ((validation !== null && !validation.valid)
-      || (validation === null && !validLegacyConfigV1(config))) {
-      blockers.push({
-        code: "project_config_invalid",
-        workspaceRoot,
-        detail: validation?.issues?.join(",") ?? "unsupported_config",
-      });
-    }
-  }
-
-  return {
-    project: {
-      workspaceRoot,
-      configPath,
-      configCoreVersion: config?.core?.coreVersion ?? null,
-      activeRunIds: [...control.activeRunIds],
-      activeLeaseIds: [...control.activeLeaseIds],
-      upgradeSafe: blockers.length === 0,
-    },
-    blockers,
-  };
-}
-
 export async function planFleetSkillUpgradeV1({
   repositoryRoot,
   targetRoot,
@@ -125,11 +66,17 @@ export async function planFleetSkillUpgradeV1({
     for (const workspaceRoot of discovery.unreachableRoots) {
       blockers.push({ code: "fleet_root_unreachable", workspaceRoot });
     }
+    for (const issue of discovery.issues) {
+      blockers.push({
+        code: "fleet_discovery_issue",
+        detail: `${issue.code}:${issue.path}`,
+      });
+    }
   }
 
   const affectedProjects = [];
   for (const workspaceRoot of discovery?.workspaceRoots ?? []) {
-    const inspected = await inspectAffectedProject(workspaceRoot);
+    const inspected = await inspectProjectForSkillChange(workspaceRoot);
     affectedProjects.push(inspected.project);
     blockers.push(...inspected.blockers);
   }
@@ -187,6 +134,7 @@ export async function planFleetSkillUpgradeV1({
       complete: discovery.complete,
       workspaceCount: discovery.workspaceRoots.length,
       unreachableRoots: discovery.unreachableRoots,
+      issues: discovery.issues,
     },
     affectedProjects,
     blockers,
@@ -209,7 +157,7 @@ export function formatFleetSkillUpgradePlanHumanV1(plan) {
   if (plan.blockers.length > 0) {
     lines.push("Blockers:");
     for (const blocker of plan.blockers) {
-      lines.push(`- ${blocker.code}${blocker.workspaceRoot ? `: ${blocker.workspaceRoot}` : ""}${blocker.artifactId ? ` (${blocker.artifactId})` : ""}`);
+      lines.push(`- ${blocker.code}${blocker.workspaceRoot ? `: ${blocker.workspaceRoot}` : ""}${blocker.artifactId ? ` (${blocker.artifactId})` : ""}${blocker.detail ? `: ${blocker.detail}` : ""}`);
     }
   }
   lines.push(

package/scripts/runkit-contract/formal-workflow.mjs

@@ -1394,7 +1394,7 @@ export function resumeCompletedFormalFinishV1({
     };
   }
   if (
-    new Set(["0.19.2", "0.20.0", "0.20.1", "0.21.0", "0.21.1", "0.22.0"]).has(
+    new Set(["0.19.2", "0.20.0", "0.20.1", "0.21.0", "0.21.1", "0.22.0", "0.22.1"]).has(
       closeout.artifact.core?.coreVersion,
     )
     && (