project-tiny-context-harness 0.8.16 → 0.11.0

package/migrations/README.md

@@ -2,6 +2,60 @@
 
 Schema migrations for Harness config and managed file layout belong here.
 
+The completed 0.10.x line adds opt-in, dry-run-first `context register`, `context move` and
+`context transaction status|rollback|complete`. Current writes use
+`context-mutation-journal-v3`, whose immutable generations bind each NFC logical
+key to its exact physical path while retaining complete mode/file-identity
+endpoint snapshots and the shared Active Authority lock.
+`context-mutation-journal-v2` remains recovery-readable with equal logical and
+physical paths. An unfinished pre-v2 journal is deliberately not guessed or
+rewritten: use the matching older package to recover it, inspect/restore the
+recorded bytes manually, or obtain project-owner recovery direction before a new
+mutation. They do not migrate existing
+projects or reinterpret legacy policies. Register losslessly appends one
+recoverable Context node. Move preserves one registered Context/Area owner,
+structured default-child references and explicit local Context-Markdown links;
+unstructured exact references or an incomplete bounded scan block apply. Both
+use current-byte/mode/file-identity endpoint comparison, candidate-tree
+validation and one logical recoverable journal published as immutable
+digest-linked generations. Recovery and Long-Task Authority changes serialize
+through the existing Active Authority lock. There is no automatic policy
+conversion, force bypass, hidden TOML normalization, hostile-writer mutex or
+claim of cross-file physical atomicity.
+
+Version 0.10.1 adds `ty-context context create --path <path> --role <role>`.
+It writes one TODO-only, unregistered Markdown scaffold and does not modify
+`project_context/context.toml` or the default footprint. Existing files,
+registered paths, unsafe/link-traversing paths and concurrently appearing
+destinations are refused rather than overwritten. Replace every TODO with
+durable owner facts before a separate registration step; the unchanged
+scaffold intentionally does not satisfy registered-Context recoverability.
+This is a new opt-in command and requires no consumer migration.
+
+Version 0.11.0 adds an opt-in sparse Design Authority bundle. Existing projects
+with only an unmarked root `DESIGN.md` remain valid one-file closures and are
+not rewritten. Adoption inserts the exact
+`<!-- ty-context-design-authority-format: bundle-v1 -->` declaration as the
+first non-empty Markdown body line after supported YAML front matter and creates
+`design_system/authority.manifest.json` in the same explicit DSA/Authority
+Revision. Generated `design_system/tokens.json` and subordinate owners remain
+explicit adoption outputs, not upgrade migration. Marker and manifest are a
+strict pair: either half missing, renamed, empty or invalid fails closure. DRA
+recovery/handoff and Long-Task bindings use the complete entry plus closure
+digest; a raw-file-only legacy binding fails closed and must be regenerated or
+rebound. A deliberate return to one-file Authority removes both halves only
+through explicit DSA adoption/Authority Revision. Static inspection can enforce
+the current pair and stale bindings, but a fresh checkout containing neither
+half has no authenticated historical adoption registry. Upgrade never infers
+Token values, owner splits, candidate selection, adoption or a human revision.
+
+Version 0.10.0 includes `context-units-to-context`. Explicit `upgrade` applies
+only when every retired `[[context_units]]` table is a provably simple
+single-line TOML table. It renames the table and removes only retired `id` and
+`area` fields while preserving all untouched bytes and the existing EOL.
+Complex/mixed-EOL input, unknown legacy fields and current/legacy path
+conflicts are `manual_required`; ordinary `sync` never runs this migration.
+
 Version 0.6.0 includes `long-task-v1-retirement`. It safely removes the
 retired repo-local Hook, reports a legacy active projection as
 `manual_required`, and deliberately does not import V1 progress or receipts
@@ -14,6 +68,51 @@ success/degradation, evidence-capability or external-impact authority. Those
 meanings must be re-authored from Source; migration never infers them from old
 Progress or Receipts.
 
+## Version 0.9.0 complete-delivery authority
+
+Version 0.9.0 retains the `long-task-delivery-v2` Contract marker. A Contract
+that omits `task.target_profile.completion_authority` is parsed as
+`machine_only`, preserving the older fail-safe machine-only meaning, and
+Preflight emits the actionable
+`completion_authority_legacy_default_machine_only` warning. New authoring
+should state either `machine_only` or `declared_authorities` explicitly.
+
+Material Source compilation now derives fragment and anchor projections below
+the Source-item level. Every `supporting_basis` fragment/anchor projection must
+name at least one known delivery-semantic Fact; an empty or integrity-only Fact
+set is rejected. Legacy single-fragment Source-item projections that already
+carry delivery Fact refs remain readable through deterministic projection, but
+new authoring should classify every multi-fragment row explicitly. Superseding
+Source must carry the same-domain replacement meaning in a delivery-semantic
+Fact; migration does not invent that Fact or infer precedence.
+
+Changing to `declared_authorities` is a semantic owner decision, not a
+mechanical migration. Re-author every blocking external route from Source with
+its declared actor/owner, target, environment, keyed Given/When scenario,
+evidence requirements and exact per-obligation Claim/applicability/Fact/proof/
+method/capability/Expected-authority decomposition. Migration must not infer an
+actor, authenticate a real-world identity, weaken Expected, collapse rows into
+an aggregate Boolean, or silently convert unsupported machine proof to an
+external judgment.
+
+New Final Gates emit `long-task-final-receipt-v3` with one of
+`machine_accepted`, `delivery_accepted`, `blocked_external` or `needs_work`.
+Version 2 Receipts remain readable for audit only. They are not current
+acceptance evidence, cannot be upgraded by appending an External Confirmation
+record and must be followed by a current Compile and complete Final Gate.
+Legacy `machine_accepted_external_pending` remains compatibility-read-only and
+cannot clear Active Authority or close. Only fresh `machine_accepted` and
+`delivery_accepted` may close.
+
+External fulfillment uses the strict
+`long-task-external-confirmation-record-v1` input and the `external prepare`,
+`submit`, `status` and `revoke` commands. Record hashes prove local integrity,
+not signatures or actor authentication. Relevant-input changes invalidate only
+when independence is soundly derivable; otherwise the whole record becomes
+stale. These rules make the release `manual-required` for affected active
+Long-Task consumers. No generic Browser, Native or Device observer SDK is part
+of this migration.
+
 ## Admitted-observation/runtime-TCB revision
 
 The next Long-Task compatibility boundary intentionally does not provide a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "project-tiny-context-harness",
-  "version": "0.8.16",
+  "version": "0.11.0",
   "description": "Minimal project memory and validation harness for AI coding agents.",
   "license": "MIT",
   "author": "Seven128",
@@ -71,14 +71,16 @@
     "node": ">=24"
   },
   "dependencies": {
-    "@google/design.md": "^0.3.0",
-    "impeccable": "^3.2.1",
+    "@google/design.md": "0.4.0",
+    "impeccable": "^3.6.0",
+    "mdast-util-from-markdown": "^2.0.3",
     "re2js": "2.8.6",
-    "smol-toml": "1.7.0",
+    "smol-toml": "1.8.0",
+    "toml-eslint-parser": "1.0.3",
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@types/node": "^26.1.1",
+    "@types/node": "^24",
     "typescript": "^7.0.2"
   }
 }

package/source-mappings.yaml

@@ -23,6 +23,24 @@ source_mappings:
   - source: ".codex/ty-context-managed/minimal_tools"
     target: "packages/ty-context/assets/tools"
     mode: "copy-tree"
+  - source: ".codex/ty-context-managed/minimal_tools/validate_context.py"
+    target: "tools/validate_context.py"
+    mode: "copy-file"
+  - source: ".codex/ty-context-managed/minimal_tools/context_rules.json"
+    target: "tools/context_rules.json"
+    mode: "copy-file"
   - source: ".github/workflows/harness.yml"
     target: "packages/ty-context/assets/github/harness.yml"
     mode: "copy-file"
+  - source: "tools/formal_process_supervisor_native_types.cs"
+    target: "packages/ty-context/assets/runtime/windows-job-supervisor/formal_process_supervisor_native_types.cs"
+    mode: "copy-file"
+  - source: "tools/formal_process_supervisor_native_run.cs"
+    target: "packages/ty-context/assets/runtime/windows-job-supervisor/formal_process_supervisor_native_run.cs"
+    mode: "copy-file"
+  - source: "tools/formal_process_supervisor_native_helpers.cs"
+    target: "packages/ty-context/assets/runtime/windows-job-supervisor/formal_process_supervisor_native_helpers.cs"
+    mode: "copy-file"
+  - source: "tools/windows_job_process_supervisor.ps1"
+    target: "packages/ty-context/assets/runtime/windows-job-supervisor/windows_job_process_supervisor.ps1"
+    mode: "copy-file"