synorch 0.2.0 → 0.4.0-beta.0

package/CHANGELOG.md

@@ -7,6 +7,58 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0-beta.0] - 2026-09-26
+
+Pre-release, published under the npm dist-tag `beta` (`npm i -g synorch@beta`). `latest` stays on 0.3.0.
+
+### Added
+
+- The `syn` harness: a conversation-first, interactive coding agent in the terminal. Running `syn` with no arguments opens a session; the 0.3.0 structure commands (`inspect`, `init`, `sync`, `doctor`) are unchanged.
+- Multiple providers behind one session: a ChatGPT subscription login, a bridge that runs the local Claude Code CLI with its native toolset, and direct API keys.
+- Orchestration: the orchestrator decomposes work into isolated workers (separate worktrees) and routes an independent review to a different provider than the one that wrote the change; orchestration can run in the background while the conversation continues.
+- `/review` as the independent review step, with a pinned review artifact, a verdict card and a fix follow-up.
+- Permission modes `ask`, `auto`, `full` and `plan`: risky actions prompt instead of being silently denied.
+- An MCP client with OAuth for remote servers.
+- Claude Code compatible skills, slash commands and plugins, including plugin hooks and agents.
+- Effort control per turn and per route.
+- Themes, a welcome screen and logo, and layered panels for skills, plugins, MCP, status, runs, memory, config and help.
+- `/rewind` and `/fork` for conversation history.
+- Global install: `syn` works from any directory without a prior `init`.
+
+### Known limitations
+
+- Beta: not every feature has been validated in real terminals yet, and one Windows CI test is flaky.
+
+## [0.3.0] - 2026-09-22
+
+### Added
+
+- Canonical Agent Manifest v1 and Canonical Skill Contract v1: machine-checkable frontmatter for every generated agent and skill, validated by `doctor` alongside the required body sections and a numbered `Procedure`.
+- Per-layer byte ceilings enforced by `doctor` — entrypoint 2 500, constitution 1 500, core protocol 2 000, agent manifest 3 000, base skill 6 000, reference file 15 000 — with depth moved into `references/` files that load only when a procedure step needs them.
+- `skill-creator`, the ninth canonical base skill: it distills repeatedly confirmed project knowledge into a generated project skill after three confirmations from distinct tasks, or immediately on a user correction.
+- A Git-tracked observation ledger at `.ai/tasks/observations.yaml`, seeded by `init`, plus a `.ai/tasks/.gitignore` that keeps per-task working records local.
+- A generated-skill contract for `.ai/skills/project/**` enforced by `doctor`: evidence with existing in-root sources and matching digests, a `priority: skill` ceiling, a 15KB size limit, a twelve active-skill budget, confirming task ids that must exist in the ledger, and shape warnings for incident-log narration, missing triggers and unsourced claims.
+- `sync` prunes expired observations and reports how many it removed.
+
+### Changed
+
+- Retirement guidance now matches the implemented first slice: `doctor` detects stale evidence, while unused-skill and supersession decisions remain review-driven until usage telemetry exists.
+- Agent manifests and base skills were rewritten to contract depth, with `not_for`, `inputs`, `tools`, `outputs`, `allowed_skills` and `reports` promoted from prose into frontmatter.
+- `sync` never creates, overwrites or deletes anything under `.ai/skills/project/**`, with or without `--force`.
+- Existing 0.2.x structures must be regenerated with `syn init --force` followed by `syn sync --force` to pick up the canonical contracts, the ninth base skill and the observation ledger.
+- Hand-written agent directories under `.ai/agents/` are now held to the Canonical Agent Manifest contract: `doctor` reports a missing `AGENT.md`, invalid frontmatter, a name that does not match its directory, an unknown skill reference or a missing required section as an error.
+- `init` never overwrites `.ai/tasks/observations.yaml`. The ledger is seeded when absent and preserved from then on, with or without `--force`, and `inspect` and `init` report it as `preserved` rather than `update` or `conflict`. `.ai/tasks/.gitignore` remains canonical and is still refreshed by `--force`.
+- Activating a generated project skill is expressed by `status: active` in the skill's own frontmatter and by the observation moving to `status: promoted` with the new optional `promoted_to` link. There is no registry entry: `.ai/projects/<id>.skills.yaml` has no project-skill slot and is regenerated by every `sync`.
+- Agent manifests no longer restate the procedure, required inputs, stop conditions or output contract of their primary skills; each points at the skill that owns them, so a rule lives in exactly one layer.
+- `sync` fails explicitly with exit code 2 on a schema-invalid observation ledger instead of pruning or rewriting it.
+- `doctor` reports `generated.broken-promotion-link` when a `promoted` observation's `promoted_to` names no skill under `.ai/skills/project/`.
+- Recorded digest prefixes must now be at least 32 hex characters, in both the observation ledger and generated-skill evidence; a shorter prefix no longer counts as a digest match.
+- Diagnostics that reported a schema failure now render it as `path: message` on one line instead of a raw zod JSON dump, and a defect that has a dedicated code is no longer also reported as a generic contract violation.
+
+### Fixed
+
+- A generated skill could declare a `references` entry with a UNC root, a drive letter or a `..` segment and receive no diagnostic, and declared references were never resolved at all. The lexical rule is now shared with the canonical checks and applied before the absolute-path test, and `diagnoseGeneratedSkills` validates containment, existence and the 15000-byte ceiling under `generated.unsafe-reference-path`, `generated.missing-reference-file` and `generated.reference-size` (a warning, like every other layer ceiling).
+
 ## [0.2.0] - 2026-09-21
 ### Added
 
@@ -36,6 +88,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - A bundled, provenance-tracked Ingenium skill catalog with on-demand loading rules.
 - Model profiles, orchestration protocols, minimal context packets, verification contracts, and provider adapters.
 
-[Unreleased]: https://github.com/TunahanTuna/synorch/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/TunahanTuna/synorch/compare/v0.4.0-beta.0...HEAD
+[0.4.0-beta.0]: https://github.com/TunahanTuna/synorch/compare/v0.3.0...v0.4.0-beta.0
+[0.3.0]: https://github.com/TunahanTuna/synorch/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/TunahanTuna/synorch/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/TunahanTuna/synorch/releases/tag/v0.1.0

package/README.md

@@ -1,60 +1,370 @@
+<div align="center">
+
+<img src="assets/brand/synorch-logo.svg" alt="Synorch logo" width="96" height="96">
+
 # Synorch
 
-`synorch`, Codex ve Claude Code için provider-bağımsız, orchestrator merkezli agent/skill/protokol yapısı kuran Node.js tabanlı bir CLI'dır. Paket adı `synorch`, kurulumdan sonraki kısa terminal komutu `syn`'dir.
+**Turn any repository into an orchestrator-led AI development organization — in one command.**
+
+[![npm version](https://img.shields.io/npm/v/synorch.svg?color=0b7285&label=npm)](https://www.npmjs.com/package/synorch)
+[![license](https://img.shields.io/badge/license-MIT-0b7285.svg)](./LICENSE)
+[![node](https://img.shields.io/badge/node-%3E%3D24-0b7285.svg)](https://nodejs.org)
+
+`npx synorch init` · works with **Codex** and **Claude Code** · zero runtime, zero lock-in
+
+</div>
+
+---
+
+### The mark
+
+The Synorch logo is the product in one picture: **synthesis + orchestration**.
+
+- **Top diamond — the conductor.** One decision center reads the goal and plans the work.
+- **Side arcs — parallel workers.** Specialists (explorer, implementer, debugger, reviewer) run side by side, each in its own isolated space, possibly on different models and providers.
+- **Center lens — the shared core.** The work they build together, held to evidence and independent review.
+- **Bottom diamond — the result.** Everything converges into one verified outcome.
+
+The gradient flows top to bottom, teal → blue → violet: from intent, through work, to result. In the terminal the same mark is drawn as half-block pixel art (`src/harness/tui/logo-art.ts`) and re-tinted by the active theme; the vector source is in [`assets/brand/`](assets/brand/).
+
+## Why Synorch exists
+
+Coding agents are already good at writing code. What they are bad at is *running a project*.
+
+Left alone, a single agent session drifts in predictable ways. It starts implementing before anyone agreed on a plan. It re-reads the same repository from scratch in every subagent, burning tokens on facts it already knew. It grades its own homework, so the review is never independent. It guesses your stack instead of proving it. And every new session starts from zero, because nothing it learned was written down anywhere durable.
+
+Synorch fixes the *organization* around the model, not the model itself.
 
-## Kullanım
+It is a CLI that installs a provider-neutral **orchestration system** into a folder, a repository, or a multi-repo workspace: one decision-making orchestrator, a set of specialized worker roles, constitutional protocols they cannot override, evidence-backed project facts, and a skill library that loads only when it is actually needed. After `syn init` and `syn sync`, you keep working exactly as before — inside Codex or Claude Code — except the agent now operates inside a structure with rules, memory, and receipts.
 
-Kurulum yapmadan çalıştırma:
+### What it is not
+
+Synorch is deliberately small in scope, and honest about it:
+
+- It is **not** a model runtime. It never calls an API, never holds your keys, never runs a conversation loop.
+- It is **not** a background daemon. Nothing watches your files. Every action is a command you type.
+- It is **not** another coding assistant. It makes the one you already pay for behave like a team.
+- It **never invents** your architecture. Empty folder in, generic core out — no hallucinated project facts.
+- It **never fakes** provider capabilities. If Codex or Claude Code can't do something, `syn doctor` tells you instead of pretending a markdown file solved it.
+
+---
+
+## Quick start
 
 ```bash
-npx synorch init
-pnpm dlx synorch init
-yarn dlx synorch init
+# Inside an existing repository — no install needed
+npx synorch init      # install the orchestration core
+npx synorch sync      # discover the real stack from evidence
+npx synorch doctor    # verify every reference end to end
 ```
 
-Global kurulumdan sonra kısa komut:
+Prefer a global install and the short command:
 
 ```bash
 npm install --global synorch
-syn init
+syn init && syn sync && syn doctor
 ```
 
-## Geliştirme
+Installing from a local checkout (works on Windows, macOS and Linux; no `syn init` needed — bare `syn` in a terminal opens the agent session):
 
 ```bash
 pnpm install
-pnpm check
-pnpm dev -- inspect
+pnpm run install:global   # build, pack and install a self-contained global copy
+syn --version             # 0.4.0-beta.0 (<commit>)
+```
+
+See [docs/harness/delivery/install.md](./docs/harness/delivery/install.md) for the linked (live-rebuild) variant, updating and uninstalling.
+
+Other package managers work the same way:
+
+```bash
+pnpm dlx synorch init
+yarn dlx synorch init
 ```
 
-## Komutlar
+Then just open Codex or Claude Code in that folder. The generated `AGENTS.md` and `CLAUDE.md` become the entry point, and the orchestrator takes it from there.
+
+> **Requires Node.js 24+.** Synorch is written in strict-TypeScript ESM; the published package ships compiled JavaScript in `dist/`, so no transpiler ends up in your dependency tree.
+
+---
+
+## The 60-second tour
+
+```bash
+$ syn inspect          # dry run: exactly what would be written, and what would conflict
+Target: /home/dev/acme-api
+Scope: repository
++ create    AGENTS.md
++ create    CLAUDE.md
++ create    .ai/constitution.md
++ create    .ai/protocols/core/orchestration.md
+...
+! conflict  .ai/skills/planning/SKILL.md
+
+1 conflict(s) found. Existing files will not be overwritten without --force.
+```
+
+```bash
+$ syn sync             # evidence-driven discovery, then registry refresh
+Discovered 3 project(s).
+  acme-api: services/api
+  acme-web: apps/web
+  acme-jobs: services/jobs
+```
+
+```bash
+$ syn doctor           # integrity check from workspace entry down to skill file
+ERROR skill.registry.missing_file: Registered skill has no file on disk (.ai/skills/technology/react-patterns/SKILL.md)
+```
+
+`doctor` exits non-zero on any error, so it drops straight into CI.
+
+---
+
+## How the system works
+
+### One decision center
+
+You talk to the orchestrator. Only the orchestrator talks back to you. Everything else happens below the waterline.
+
+```text
+                        You
+                         │
+                         ▼
+                  ┌─────────────┐
+                  │ Orchestrator│  plans · decides · delegates · verifies
+                  └──────┬──────┘
+         ┌───────────┬───┴───────┬────────────┐
+         ▼           ▼           ▼            ▼
+     Explorer   Implementer   Debugger    Reviewer
+    (read-only)  (scoped      (root       (independent
+                  writes)      cause)      of the author)
+```
+
+The orchestrator is a control plane, not a contributor. It is forbidden from writing production, test, config, or documentation code — even when the change is one line. It may only write orchestration artifacts under `.ai/tasks/**`. The agent that implemented something can never be the final judge of it.
+
+### Every task gets planned, approved, and proven
+
+```text
+SESSION_BOOTSTRAP → MODEL_PROFILE_CONFIRMATION → INTAKE → DISCOVERY
+→ CLARIFICATION → PLAN → USER_APPROVAL → DECOMPOSITION → DISPATCH
+→ MONITORING → VERIFICATION → REVIEW → FINAL_REPORT
+```
+
+Two gates are non-negotiable. Before the first task of a session, the orchestrator shows you the active provider and the model assigned to every role and waits for confirmation. Before any execution, it shows you a plan and waits for approval. Nothing starts silently.
+
+### Effort scales with risk
+
+Full ceremony on a typo fix is just expensive theater. Synorch classifies every task before execution:
+
+| Tier | Workers | Verification | Independent review |
+| --- | --- | --- | --- |
+| **trivial** | one fast worker | claim-specific evidence only | not by default |
+| **standard** | matched to scope | targeted checks | on material or boundary-crossing changes |
+| **high-risk** | complex worker | comprehensive evidence | mandatory |
+
+Tiers can only be escalated — if a finding widens the scope mid-flight, the task moves up, never down. Headed-browser verification is opt-in: it needs either your explicit request or a named criterion that cheaper evidence genuinely cannot settle.
+
+### Context packets instead of re-reading the repo
+
+The expensive failure mode of multi-agent setups is that every worker rediscovers the same codebase. Synorch's answer is a schema'd handoff: the orchestrator does broad discovery **once**, then compiles a minimal, sourced packet per task.
+
+```yaml
+task_id: auth-refresh-fix-implementation
+assigned_role: implementer
+model_tier: complex_worker
+
+objective: Fix the session loss that occurs during refresh token rotation.
+
+scope:
+  owned_paths: [src/auth/**, tests/auth/**]
+  read_paths: [src/session/**]
+  forbidden_paths: [src/billing/**]
+
+known_facts:
+  - statement: Token rotation is active on refresh
+    source: src/auth/refresh-service.ts
+    confidence: verified
+
+acceptance_criteria:
+  - Replaying an old refresh token revokes the whole token family
+  - A normal refresh does not terminate the active session
+
+verification:
+  commands: [pnpm test auth, pnpm typecheck]
+```
+
+Workers report back in the same structured shape — changed files, commands run, decisions made, unresolved risks. Follow-up work uses **delta handoff** (`extends:` plus only what changed) rather than resending the whole packet. If a worker notices that the files its context was built on have shifted, it stops and escalates instead of acting on stale truth.
+
+### Facts, not guesses
+
+`syn sync` walks your repository or workspace deterministically and records what it can *prove*, with a source path attached to every claim:
+
+```yaml
+test:
+  value: pnpm test
+  cwd: frontend
+  source: package.json
+  confidence: verified
+```
+
+It parses JavaScript/TypeScript manifests plus Maven and Gradle definitions, and it is careful about false positives: commented-out coordinates and entries sitting only under dependency/plugin *management* do not count as evidence of an active framework. Nested module trees are discovered recursively, with a separate depth budget so a deep Java source tree isn't silently truncated. When a safety limit is genuinely reached, sync fails loudly rather than handing you an incomplete snapshot.
+
+### Skills load just in time
+
+Every project registry gets the same nine canonical base skills:
+
+`planning` · `project-discovery` · `codebase-exploration` · `implementation` · `verification` · `debugging` · `code-review` · `task-conductor` · `skill-creator`
+
+Technology skills are added **only** when matching verified evidence exists:
+
+| Detected | Activated skills |
+| --- | --- |
+| TypeScript | `typescript-patterns` |
+| React | `react-patterns`, `react-modern`, `frontend-craft` |
+| Vue / Nuxt | `vue-modern`, `frontend-craft` |
+| Java | `java-patterns`, `java-backend` |
+| Spring Boot | `spring-boot-patterns` |
+| JPA / Hibernate | `jpa-patterns`, `db-schema-craft`, `query-tuning` |
+| Express / Fastify / NestJS | `node-backend` |
+| Maven · Gradle | `maven-build` · `gradle-build` |
+| Tailwind CSS | `tailwind-v4-tokens` |
+
+Beyond that, `sync` materializes a bundled 32-skill Ingenium library under `.ai/skills/library/ingenium/`, with source, license, and provenance recorded in `.ai/skills/catalog.yaml`. Those entries stay `available`, not loaded — the orchestrator pulls one into context only when a task description actually matches its description. Loading the whole pool at once is explicitly forbidden, which is the difference between a useful library and a context bill.
+
+Three states, kept distinct: **available** (in the catalog) → **active** (in a project registry) → **loaded** (in a task context). Session bootstrap never scans the catalog.
+
+Anthropic Agent Skills, Superpowers, and Microsoft Agent Skills are catalogued `reference-only` with pinned commit IDs. Third-party content is never auto-imported or executed without a separate security and license review.
+
+### Provider-neutral core, honest adapters
+
+Protocols are written against capability tiers, not vendor model names:
+
+```yaml
+model_tiers:
+  orchestrator: [strongest_reasoning, delegation, long_context]
+  complex_worker: [strong_coding, autonomous_execution]
+  fast_worker: [low_latency, low_cost]
+```
+
+Adapters map those tiers onto the real model IDs of whichever provider you're running, with overrides resolving session → project → workspace → provider default. **Silent fallback is banned.** If a requested model isn't available, or the provider doesn't support per-subagent model selection, or the main session model can't be changed mid-flight, you are told — by `doctor` and again at session confirmation. Synorch will never let a markdown file imply a capability the host doesn't actually have.
+
+---
+
+## Commands
 
 ```bash
 syn inspect [--target <path>] [--scope workspace|repository]
-syn init [--target <path>] [--scope workspace|repository] [--force]
-syn sync [--target <path>] [--force] [--json]
-syn doctor [--target <path>] [--json]
+syn init    [--target <path>] [--scope workspace|repository] [--force]
+syn sync    [--target <path>] [--force] [--json]
+syn doctor  [--target <path>] [--json]
+```
+
+| Command | What it does |
+| --- | --- |
+| `inspect` | Dry run. Prints every file that would be created, updated, left unchanged, or flagged as a conflict. Writes nothing. |
+| `init` | Installs the canonical structure and provider entrypoints. Never touches your source code. Existing differing files are preserved unless `--force`. |
+| `sync` | Manually triggered discovery. Records project facts with evidence, resolves skills, writes registries. Refuses to clobber hand-edited generated files without `--force`. |
+| `doctor` | Validates the full reference chain — workspace entry → project record → module dirs → manifests → command `cwd` → skill registry → skill file — plus canonical base-skill completeness and path containment (both lexical traversal and `realpath` symlink/junction escapes). |
+
+`--json` on `sync` and `doctor` gives machine-readable output for CI pipelines.
+
+**Safety defaults that actually hold:** existing differing files are never overwritten without an explicit `--force`, and the observation ledger `.ai/tasks/observations.yaml` is never overwritten even with it — it is seeded once and reported as `preserved` thereafter; the active skill registry is written *last*, after every prerequisite output, so a failed write leaves the previous working registry intact; and nothing is reported `healthy` while a single reference is missing, broken, duplicated, or pointing outside the root.
+
+---
+
+## Generated structure
+
+```text
+.ai/
+├── manifest.yaml
+├── constitution.md              # constitutional, non-overridable rules
+├── workspace.yaml
+├── projects/
+│   ├── <project-id>.yaml        # evidence-backed project facts
+│   └── <project-id>.skills.yaml # skill selections + rationale + matched evidence
+├── protocols/
+│   ├── registry.yaml
+│   └── core/
+│       ├── orchestration.md          planning-and-approval.md
+│       ├── delegation.md             model-routing.md
+│       ├── context-handoff.md        verification.md
+│       ├── failure-recovery.md       user-communication.md
+├── agents/
+│   └── <role>/AGENT.md           # Canonical Agent Manifest v1, one per role:
+│                                 # orchestrator · explorer · implementer · reviewer · debugger
+├── skills/
+│   ├── <canonical base skills>/SKILL.md      # Canonical Skill Contract v1
+│   │   └── references/*.md                   # depth loaded only when a step needs it
+│   ├── technology/<selected>/SKILL.md
+│   ├── project/<generated>/SKILL.md   # earned project skills; sync never writes here
+│   ├── library/ingenium/**            # bundled, on-demand
+│   └── catalog.yaml                   # provenance, license, activation mode
+├── model-profiles/
+│   ├── openai.yaml
+│   └── claude.yaml
+├── tasks/                        # plans, context packets, decision log
+│   ├── observations.yaml         # the Git-tracked observation ledger
+│   └── .gitignore                # per-task working records stay local
+└── providers/
+    ├── codex.md
+    └── claude-code.md
+```
+
+Plus `AGENTS.md` and `CLAUDE.md` at the root as provider entrypoints.
+
+### Workspace mode vs. repository mode
+
+**Repository mode** puts the structure inside a single repo, so it travels through Git and the whole team shares it.
+
+**Workspace mode** puts one shared system in a parent folder above several repositories, each tracked as its own project record:
+
+```text
+workspace/
+├── AGENTS.md
+├── CLAUDE.md
+├── .ai/
+├── repo-a/
+└── repo-b/
+```
+
+Cloned a new repo into the workspace? Run `syn sync`. There is no watcher and no full re-`init`.
+
+On an empty folder, Synorch installs the generic orchestration core and stops. No invented stack, no imaginary architecture, `projects: []`.
+
+---
+
+## Contributing
+
+```bash
+pnpm install
+pnpm check          # typecheck + test + build
+pnpm dev -- inspect # run the CLI from source
 ```
 
-## Skill havuzu
+`pnpm check` also runs as a `prepack` gate, so nothing ships without passing typecheck, tests, and build. Package contents are restricted by an explicit allowlist, CI uses read-only default permissions with pinned action SHAs, and npm releases go out through Trusted Publishing (OIDC) — no long-lived tokens stored anywhere.
 
-`init`, Ingenium'dan bağımsız canonical `task-conductor` dahil sekiz base skill üretir. Task Conductor yalnız non-trivial brief'lerde merkezi decomposition/routing disiplini olarak kullanılır; tek satırlık işler için orkestra kurulmaz.
+---
 
-`sync`, proje sahibinin 32 skill'lik Ingenium havuzunu destek dosyalarıyla birlikte `.ai/skills/library/ingenium/` altına materialize eder ve kaynak/lisans/provenance bilgisini `.ai/skills/catalog.yaml` içinde tutar. Katalog girdileri yalnız `available` durumundadır ve varsayılan olarak context'e yüklenmez. React, Java, Node, Vue, JPA ve Tailwind skill'leri yalnız verified stack kanıtıyla aktive edilir; diğer skill'ler görev açıklaması gerçekten eşleştiğinde just-in-time yüklenir. Bütün havuzun aynı anda taranması veya context'e alınması yasaktır.
+## Documentation
 
-Görevler `trivial`, `standard` veya `high-risk` olarak sınıflandırılır. Trivial işler tek fast worker ve claim-specific kanıtla tamamlanır; bağımsız reviewer, full-project kontroller ve headed browser varsayılan olarak kullanılmaz. Browser doğrulaması yalnız kullanıcı isteğiyle veya daha ucuz kanıtların çözemediği isimlendirilmiş bir kriter için ayrıca onay alınarak yapılır.
+| Document | Contents |
+| --- | --- |
+| [Architecture](./docs/AI-ORCHESTRATION-ARCHITECTURE.md) | The full design: orchestration model, protocol system, context architecture, model routing, discovery, open decisions, and the dated decision log. |
+| [Multi-provider harness vision](./docs/FUTURE-MULTI-PROVIDER-HARNESS.md) | Where this goes next — running different providers in different roles under one orchestrator. Proposal stage, not implemented. |
+| [CHANGELOG](./CHANGELOG.md) | Version history, Keep a Changelog + SemVer. |
+| [Release notes v0.4.0-beta.0](./docs/releases/v0.4.0-beta.0.md) | Human-readable notes for the current beta (`synorch@beta`). |
+| [Release notes v0.3.0](./docs/releases/v0.3.0.md) | Human-readable notes for the current stable release. |
+| [Security policy](./SECURITY.md) | Report vulnerabilities through the private channel, not a public issue. |
 
-Anthropic Agent Skills, Superpowers ve Microsoft Agent Skills kaynakları sabit commit kimlikleriyle kataloglanır ancak güvenlik ve lisans incelemesi yapılmadan içerikleri otomatik import veya execute edilmez.
+---
 
-`init`, kaynak koda dokunmadan canonical orchestration çekirdeğini kurar. Ardından `sync`, repository veya workspace modüllerini kanıta dayalı olarak keşfeder, proje/skill registry'lerini ve seçilen teknoloji skill'lerini üretir; kullanıcı tarafından değiştirilmiş generated teknoloji skill'lerini yalnızca açık `--force` ile yeniler. Son olarak `doctor`, referans zincirini, canonical base skill kümesini ve path/symlink sınırlarını doğrular.
+## Roadmap
 
-Mimari kararlar için [mimari planı](./docs/AI-ORCHESTRATION-ARCHITECTURE.md) inceleyin.
+Today Synorch generates and validates the structure; your host agent executes it. The [multi-provider harness proposal](./docs/FUTURE-MULTI-PROVIDER-HARNESS.md) sketches a future layer that could connect authorized provider accounts, run different models in different roles under one orchestrator, persist task state, and manage the implementation-to-review flow across vendors. That layer is not implemented, and this README will not pretend otherwise.
 
-## Gereksinimler ve proje bilgileri
+---
 
-- Node.js 24 veya daha yeni bir sürüm gerekir.
-- Sürüm geçmişi için [CHANGELOG.md](./CHANGELOG.md) dosyasını inceleyin.
-- Güvenlik açıklarını herkese açık issue yerine [güvenlik politikasındaki](./SECURITY.md) özel bildirim akışıyla paylaşın.
-- Synorch, [MIT lisansı](./LICENSE) altında yayımlanır.
+## License
 
-Güncel sürüm notları [Synorch v0.2.0](./docs/releases/v0.2.0.md) belgesinde yer alır.
+MIT © [Tunahan Tuna](https://github.com/TunahanTuna) — see [LICENSE](./LICENSE).

package/dist/application/doctor-service.d.ts

@@ -16,6 +16,22 @@ export declare class DoctorService {
     private validateCommandPaths;
     private validateSkillRegistry;
     private validateRegisteredSkills;
+    /**
+     * Canonical Agent Manifest v1 and Canonical Skill Contract v1 enforcement.
+     * Contract violations are errors; layer size overruns are warnings.
+     */
+    private validateCanonicalContracts;
+    private validateAgentManifest;
+    private validateSkillContract;
+    /**
+     * A declared reference must resolve inside its own skill directory both
+     * lexically and after symbolic links are canonicalized.
+     */
+    private validateSkillReferences;
+    private checkFileSize;
+    private readOptionalText;
+    private listDirectoryNames;
+    private listMarkdownFiles;
     private isExistingDirectory;
     private isExistingRegularFile;
     private isCanonicalPathWithin;

package/dist/application/doctor-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-service.d.ts","sourceRoot":"","sources":["../../src/application/doctor-service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAGnE,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAE9D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAWD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;gBAErB,UAAU,EAAE,UAAU;IAI5B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;YAyFhE,sBAAsB;YAkItB,0BAA0B;YA+F1B,2BAA2B;YA+B3B,oBAAoB;YAqDpB,qBAAqB;YA4DrB,wBAAwB;YAiHxB,mBAAmB;YAOnB,qBAAqB;YAOrB,qBAAqB;YASrB,gBAAgB;CAgD/B"}
+{"version":3,"file":"doctor-service.d.ts","sourceRoot":"","sources":["../../src/application/doctor-service.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAgBnE,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAE9D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAoBD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;gBAErB,UAAU,EAAE,UAAU;IAI5B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;YA4FhE,sBAAsB;YAkItB,0BAA0B;YA+F1B,2BAA2B;YA+B3B,oBAAoB;YAqDpB,qBAAqB;YA4DrB,wBAAwB;IAiHtC;;;OAGG;YACW,0BAA0B;YAmB1B,qBAAqB;YA0DrB,qBAAqB;IAgDnC;;;OAGG;YACW,uBAAuB;YAgDvB,aAAa;YAWb,gBAAgB;YAShB,kBAAkB;YAalB,iBAAiB;YAajB,mBAAmB;YAOnB,qBAAqB;YAOrB,qBAAqB;YASrB,gBAAgB;CAgD/B"}