intent-eval-core — @intentsolutions/core one-pager + operator audit + changelog

0-intent-eval-core-one-pager-and-operator-audit.md

intent-eval-core — @intentsolutions/core one-pager + operator audit + changelog

intent-eval-core (@intentsolutions/core)

The canonical contracts kernel for the Intent Eval Platform — types, schemas, and validators with no runtime attached.

TypeScript types, JSON Schemas (draft 2020-12), generated Zod validators, and state machines for the platform's 16 canonical entities, the NORMATIVE gate-result/v1 in-toto predicate, and the bicameral authoring-contract families (authoring/v1, byte-frozen, plus the strict authoring/v2 skill-frontmatter fork). Every validator in the platform — deterministic gates, behavioral evaluators, the rollout-gate decision shell — imports its contract definitions from this one package.

Links: GitHub repo · npm package

---

One-Pager

Problem

A multi-repo evaluation platform decays the same way every distributed system does: each consumer quietly redefines the shared entity shapes locally. One repo's gate-result grows a field the others never see; a judge emits a verdict enum the gate shell can't parse; an authoring validator and the marketplace it serves disagree about what a valid SKILL.md even is. Without a single contract authority, "every validator emits the same Evidence Bundle" is an aspiration, not a property.

Solution

@intentsolutions/core is a kernel-only package — contracts and nothing else. It carries:

• 16 canonical entity contracts (schemas/v1/): the 13 Blueprint-B entities — EvalSpec, EvalRun, MatcherMap, EvidenceBundle, JudgeDecision, RuntimeReceipt, RegressionPack, RolloutGate, SkillSnapshot, SessionTrace, ToolInvocation, CostRecord, FailureTaxonomy — plus SkillVersion (the 14th, DR-028 T1), UsageEvent and HumanReview (the 15th and 16th, DR-103 D1). Each as a TypeScript interface, a JSON Schema, and a Zod validator.
• The NORMATIVE gate-result/v1 in-toto predicate body, plus the retraction/v1, dashboard-render/v1, skill-refiner-pass/v1, and human-review/v1 predicates, all scoped to the evals.intentsolutions.io namespace.
• schemas/authoring/v1/ — six authoring contracts (skill-frontmatter, plugin-manifest, agent-definition, mcp-config, hook-config, marketplace-catalog), each composed as allOf(upstream-base + three universal folds + is-overlay). The whole v1 family is byte-frozen at the v0.4.1 tag, machine-enforced by a test that git-diffs every frozen path.
• schemas/authoring/v2/ — the strict five-contract fork (scoped-Bash, shell-substitution widening, reserved-name hardening, 1024-char description cap on skill-frontmatter, plus v2 bases for mcp-config, plugin-manifest, agent-definition, hook-config, marketplace-catalog), self-contained with zero $ref into v1 so the frozen family can never silently mutate it.

JSON Schema is the canonical wire format; the Zod validators are generated from the schemas (codegen idempotency is a CI gate), so the two surfaces cannot drift. A version-locked Python distribution (intent-eval-core on PyPI) ships the same contracts as Pydantic v2 models. State machines govern entity transitions. Runtime execution, judging, and harness logic are enforced anti-goals — adding them fails CI.

W5

Who	Intent Solutions. Consumers: audit-harness (deterministic gates), j-rig-skill-binary-eval (behavioral eval), intent-rollout-gate (decision shell), plus the marketplace and internal authoring validators that consume the authoring/* families.
What	Canonical contracts kernel: TS types, JSON Schemas (draft 2020-12), generated Zod validators, Pydantic v2 mirror, state machines. No execution, no judges, no gates.
Where	npm as @intentsolutions/core (ESM, Node ≥ 20, pnpm ≥ 9) + PyPI as intent-eval-core (Pydantic v2); source at github.com/jeremylongshore/intent-eval-core.
When	v0.1.0 first published 2026-05-17; latest release v0.9.0 on 2026-06-26; actively developed.
Why	One source of truth for contract definitions so every platform validator emits Evidence Bundle rows against identical shapes — the platform's unification thesis (DR-010), enforced rather than assumed.

Stack

Layer	Choice
Language	TypeScript 5.7, strict: true plus every additional strictness flag; ESM-only. Python mirror in Pydantic v2
Runtime dependency	zod ^4 — the only one (TS side)
Wire format	JSON Schema draft 2020-12 (canonical); Zod validators + Pydantic models generated from it
Tests	vitest (100% coverage floor) + tsd type-level assertions + ajv schema fixtures + Python parity tests against the shared golden corpus
Architecture enforcement	dependency-cruiser forbidden rules + 4-axis boundary checker (FORBIDDEN.md / ALLOWLIST.md / scripts/check-boundaries.ts)
Quality harness	@intentsolutions/audit-harness (escape-scan, arch, hash-pinned policy)
API stability	@microsoft/api-extractor golden snapshot + SemVer regression gate
CI/CD	GitHub Actions: CI, Boundary check, Doc Quality, Python, Release (npm + PyPI publish with sigstore provenance)

Differentiators

• Kernel-only by enforcement, not convention. "NOT a runtime / judge / harness / service / database" is codified in FORBIDDEN.md across npm-package, directory, and URL-pattern axes, checked by pnpm run boundaries and a dedicated CI workflow. Even ID generation is out — the kernel owns the ID standard (recognition patterns, lineage composition, the EVENT_ID_CONTRACT derivation pin) but not the clock-read-plus-hash generation, which is runtime execution.
• Schemas and validators cannot drift. Zod validators are codegen output; codegen:authoring:check fails the gate chain on stale generated code, and codegen:pydantic:check does the same for the Python mirror. Cross-field invariants JSON Schema can't express (e.g., in-toto subject ↔ predicate binding on EvidenceStatement) live as Zod refinements mirrored by Pydantic model_validators.
• Immutability is machine-checked. authoring/v1 is byte-frozen against the v0.4.1 git tag by a test; authoring/v2 forks with zero $ref back into v1, so neither family can mutate the other. A per-chamber isolation gate keeps the runtime and authoring chambers on independent $schemaVersion lanes and separate signing trust roots.
• Hardening gates that protect themselves. The rubric-floor guard is self-pinned in the harness hash manifest, so the same PR cannot weaken both the floor and the guard. Predicate-namespace isolation keeps authoring lint and signed attestations in separate namespaces.
• Supply-chain verifiable. Every release publishes with sigstore provenance (npm audit signatures verifies; the PyPI wheel is sigstore-python keyless-signed); v0.3.1+ also emits a signed, dashboard-verifiable evidence manifest per release.

---

Operator-Grade System Analysis

Executive summary

@intentsolutions/core v0.9.0 is a polyglot contracts library — npm @intentsolutions/core (Zod + JSON Schema) and PyPI intent-eval-core (Pydantic v2), version-locked — whose entire job is to define and validate contracts. It has one TS runtime dependency (zod), a 100% test-coverage floor, and a CI posture where most of the engineering effort lives in self-protecting gates: codegen idempotency (Zod + Pydantic), byte-freeze verification, predicate-namespace isolation, per-chamber isolation, rubric-floor self-pinning, API-surface snapshots, and architectural boundary checks. The package serves two "chambers": the runtime contract family (schemas/v1/ — Evidence Bundle, the 16 entities, gate-result/v1) and the authoring contract family (schemas/authoring/ — what counts as a valid skill, plugin, agent, MCP config, hook config, or marketplace catalog). Operators consume it as types only (zero runtime deps), as raw JSON Schemas (any ajv-class validator), as Zod parsers (opt-in, tree-shakable), or as Pydantic models (pip install intent-eval-core).

Architecture overview

intent-eval-core/
├── schemas/
│   ├── v1/                      # runtime family — 16 entity schemas + 5 predicate
│   │                            #   bodies (gate-result, retraction, dashboard-render,
│   │                            #   skill-refiner-pass, human-review) + _common.schema.json
│   │                            #   ($defs) + otel-attributes.yaml + index.json catalog
│   └── authoring/
│       ├── v1/                  # 6 authoring contracts, each allOf(upstream-base +
│       │   ├── upstream-base/   #   3 universal folds + is-overlay); BYTE-FROZEN at
│       │   └── is-overlay/     #   the v0.4.1 tag (machine-enforced)
│       └── v2/                  # strict five-contract fork; self-contained,
│           ├── upstream-base/   #   zero $ref into v1; ships MIGRATION.md
│           └── is-overlay/
├── src/
│   ├── entities/                # 16 entity interfaces + EvidenceBundlePayload
│   ├── predicates/              # gate-result-v1 / retraction-v1 / dashboard-render-v1 /
│   │                            #   skill-refiner-pass-v1 / human-review-v1 types
│   ├── state-machines/          # per-entity transition maps + shared semantics +
│   │                            #   retry/rollback/promotion lifecycle maps
│   ├── otel/v1/                 # pinned OTel attribute constants for runtime events
│   ├── validators/v1/           # Zod validators: per-entity, _generated/ codegen output,
│   │                            #   authoring/ + authoring/v2/ barrels
│   └── __tests__/               # frozen-tree, namespace-isolation, comment-coherence tests
├── python/                      # Pydantic v2 mirror (models.py + _generated/ + parity tests)
├── scripts/                     # codegen-authoring, codegen_pydantic, check-boundaries,
│                                #   check-predicate-namespace-isolation, check-rubric-floor,
│                                #   check-chamber-isolation, check_version_lockstep, api-diff
├── api/                         # api-extractor golden snapshot (SemVer regression gate)
└── .github/workflows/           # ci.yml · boundary-check.yml · doc-quality.yml ·
                                 #   python.yml · release.yml

Key structural decisions:

• JSON Schema is canon; everything else derives. codegen:validators regenerates the runtime-family Zod reference; codegen:authoring generates each authoring contract's composed schema + Zod validator from the upstream-base and is-overlay layers; codegen:pydantic regenerates the Python models. A runtime write-guard in the codegen refuses to emit anything under the frozen schemas/authoring/v1/ tree.
• Predicate bodies are closed-world. gate-result/v1 is the only fully spec-bound production predicate; adding or loosening a field requires a Class-1 council convening per the schema's own $comment. An extensions escape hatch exists on EvidenceStatement but is explicitly non-normative.
• Export map is the API. Subpath exports cover ./schemas/v1/*, ./schemas/authoring/v1/*, ./schemas/authoring/v2/*, ./validators/v1/*, ./validators/v1/authoring, ./validators/v1/authoring/v2, and ./otel/v1 — consumers import exactly the surface they need.

Operational reference — command surface

Command	What it does
pnpm install	Install deps (frozen-lockfile in CI)
pnpm run check	Canonical pre-commit gate chain: codegen:authoring:check → codegen:pydantic:check → check:predicate-namespace → check:chamber-isolation → check:rubric-floor → check-version-lockstep → lint → typecheck → test → arch → boundaries
pnpm run build	tsc -p tsconfig.build.json → dist/
pnpm run test / test:watch / test:coverage	vitest (100% coverage floor)
pnpm run test:types	tsd negative/positive type assertions
pnpm run codegen:validators	Regenerate _generated/ Zod reference from schemas/v1/*.schema.json
pnpm run codegen:authoring / codegen:authoring:check	Generate (or verify freshness of) composed authoring schemas + validators
pnpm run codegen:pydantic / codegen:pydantic:check	Generate (or verify freshness of) the Python Pydantic mirror
pnpm run arch	audit-harness arch — forbidden dependency-cruiser rules
pnpm run boundaries	4-axis boundary doctrine checker
pnpm run check:predicate-namespace	Fails if any authoring schema references the predicate namespace
pnpm run check:chamber-isolation	Fails if the runtime and authoring chambers share a schema-version lane or signing trust root
pnpm run check:rubric-floor	Fails if a required field is removed/weakened without an explicit ADR marker
pnpm run api:check / api:extract / api:diff	api-extractor SemVer-surface gate
pnpm run harness:verify	Hash-pinned testing-policy verification

CI (ci.yml) runs the same chain plus build, dist-artifact verification, api:check, test:types, and harness:verify; python.yml runs the Pydantic parity suite on py3.10–3.12. Releases: tag v*.*.* → release.yml publishes to npm with sigstore provenance AND to PyPI with sigstore-python keyless signing, and uploads a signed evidence manifest to the GitHub Release.

Security posture

• Provenance: publishConfig.provenance: true — every npm tarball carries sigstore provenance; consumers verify with npm audit signatures. The PyPI wheel is sigstore-python keyless-signed (Fulcio OIDC + Rekor). Since v0.3.1 each release also emits a cosign-signed (sigstore protobuf Bundle format) report-manifest.json evidence asset that downstream dashboards verify with sigstore.verify().
• Byte-freeze: schemas/authoring/v1/** plus its generated validators are frozen at the v0.4.1 tag; src/__tests__/authoring-v1-frozen.test.ts git-diffs all frozen paths and fails on any change. The v2 fork's zero-$ref rule removes the indirect-mutation channel entirely.
• Predicate-namespace + chamber gates: predicate URIs live only at evals.intentsolutions.io; the boundary checker's URL-pattern axis refuses labs.intentsolutions.io as a predicate host with no override path. check-predicate-namespace-isolation keeps the authoring family (deterministic lint) out of the attestation namespace (signed claims), and check-chamber-isolation keeps the runtime and authoring chambers on independent $schemaVersion lanes and separate signing trust roots — the two trust domains cannot blur.
• Anti-gaming, machine-enforced at all three layers: the DR-103 UsageEvent / HumanReview entities require a verified gated source (JSON-Schema if-then + Zod .superRefine + Pydantic model_validator) — a metered row or a human thumb pinned to nothing is refused; a service-account-authored HumanReview is a const false type error. human-review/v1 is permanently sigstore_staging by design (a human's open-ended text assessment is non-reproducible), pinned as a literal type so a flip to rekor_production is a compile error.
• Self-pinned guards: the rubric-floor checker is itself pinned in the harness hash manifest, so weakening the floor and the guard in one PR fails verification. Codegen (Zod + Pydantic), version-lockstep, and API-surface drift are likewise gated, not advisory.
• Process controls: branch protection with a required CI check; no direct pushes to main; SECURITY.md, CODEOWNERS, and a documented boundary-override process (council review for major crossings; no override exists for the predicate-URI host binding).

Current state assessment

• Latest release: v0.9.0 (2026-06-26) — lands the two DR-103 D1 net-new entities UsageEvent (product-metering ledger, distinct from CostRecord's provider spend) and HumanReview (open-ended human-trust signal, the human counterpart to JudgeDecision), taking the canonical set 14 → 16. Both are append-only, single-terminal-state, and anti-gaming-enforced at all three layers. Also formalizes the V ≤ C ≤ K version-ordering invariant and adds the per-chamber kernel isolation gate. Purely additive — no runtime contract changed, renamed, or removed.
• Entity-count lineage: the 13 Blueprint-B entities → SkillVersion (14th, DR-028 T1, shipped v0.8.0) → UsageEvent + HumanReview (15th + 16th, DR-103 D1, shipped v0.9.0). Every canonical record (index.json, the entity-index header, the schemas.test.ts toHaveLength(16) assertion, the Python parity count, the repo CLAUDE.md prose) asserts the same 16.
• Polyglot since v0.7.0: the same contracts ship as npm (Zod + JSON Schema) and PyPI (Pydantic v2), version-locked by check_version_lockstep.
• Lifecycle posture: skill-frontmatter is the only PUBLISHED authoring contract at v1; contracts #2–#6 (plugin-manifest, agent-definition, mcp-config, hook-config, marketplace-catalog) ship at v1/SHIPPED-INTERNAL, with a full strict v2 fork of all five landed in v0.6.0 — treat the v1 shapes of #2–#6 as subject to change.
• New predicates in flight, staging-only: skill-refiner-pass/v1 (v0.8.0, the Skill Refiner's accept attestation) and human-review/v1 (v0.9.0) both run sigstore_staging — no production-Rekor signing is wired for either.
• Quality floor held through v0.9.0: 100% coverage, 0 architecture violations, 0 boundary violations, codegen idempotent for the runtime + both authoring families + the Python mirror, monotonic-additive property test proving v2 rejects a strict superset of what v1 rejects.

Quick reference card

Package (npm)	@intentsolutions/core
Package (PyPI)	intent-eval-core (Pydantic v2 mirror)
Latest version	0.9.0 (2026-06-26)
License	Apache-2.0
Module system	ESM only; Node ≥ 20, pnpm ≥ 9
Runtime deps	zod ^4 (only needed if you use the TS validators)
Install	pnpm add @intentsolutions/core (types only) · pnpm add @intentsolutions/core zod (with validators) · pip install intent-eval-core (Pydantic)
Types	import type { EvalSpec, EvalRun, GateResultV1 } from '@intentsolutions/core'
JSON Schema	import schema from '@intentsolutions/core/schemas/v1/gate-result.schema.json' with { type: 'json' }
Zod validator	import { GateResultV1Schema } from '@intentsolutions/core/validators/v1/gate-result-v1'
Authoring (frozen v1)	@intentsolutions/core/schemas/authoring/v1/skill-frontmatter.schema.json
Authoring (strict v2)	@intentsolutions/core/schemas/authoring/v2/skill-frontmatter.schema.json · Zod barrel …/validators/v1/authoring/v2
Verify provenance	npm audit signatures
Full local gate	pnpm run check
Repo	https://github.com/jeremylongshore/intent-eval-core
npm	https://www.npmjs.com/package/@intentsolutions/core

---

Changelog

The six most recent releases, verbatim from the repo's CHANGELOG.md. Older entries (v0.4.1 back to v0.1.0) live in the repo.

[0.9.0] - 2026-06-26

Added

• HumanReview — a net-new canonical entity, added by ISEDC DR-103 D1. The kernel's open-ended HUMAN-trust signal on an EvalRun — the human counterpart to JudgeDecision. Langfuse-style "scores" fold into THREE ORTHOGONAL nullable channels (never crushed into one scalar): score_text (open-ended NON-COMPARABLE TEXT — consumers MUST NOT parse it into a scalar), thumbs (boolean), annotation (free text). Append-only ledger; single terminal state recorded; a revision is a NEW row citing supersedes_id, never a mutation. Anti-gaming is machine-enforced at all three layers: a review MUST pin to a verified source (non-null session_trace_id OR judge_decision_id); a service-account-authored row is refused (reviewer_is_service_account typed const false); at least one of the three channels must be present.
• UsageEvent — a net-new canonical entity, added by DR-103 D1. An append-only product-metering LEDGER row — the product-meter counterpart to CostRecord. DISTINCT from CostRecord: CostRecord attributes PROVIDER SPEND (money + tokens); UsageEvent meters PRODUCT-METER COUNTS in BUSINESS UNITS (meter + quantity + unit). A nullable cost_record_ref back-reference proves they are SEPARATE tables. Single terminal state recorded; append-only. Every metered (non-api_call) row MUST bind to a verified gated source — machine-enforced at JSON-Schema + Zod + Pydantic. No heterogeneous rollup: there is NO rolled-total field on the row by construction, backed by a consuming-surface test.

Changed

• Canonical entity count advanced 14 → 16 by the two DR-103 D1 entities UsageEvent + HumanReview — the entity-index header, schemas/v1/index.json, the schemas.test.ts count assertions (schema files 20 → 22; entity schemas 14 → 16), the Python parity exported-model count (18 → 20), and the repo CLAUDE.md entity-count prose all corrected together so no canonical record contradicts the count.
• Version-ordering invariant V ≤ C ≤ K formalized in the kernel test corpus — V = VENDOR (upstream-base version), C = CONSUMER (is-overlay version), K = KERNEL (published composition version). The invariant asserts the kernel never lags the consumer and the consumer never lags the vendor, holds by construction, and is unit-tested against 4 corpus cases plus every live authoring family. Strictly additive — no schema bytes changed (authoring/v1 stays byte-frozen at v0.4.1).
• Per-chamber kernel isolation gate (scripts/check-chamber-isolation.ts) — machine-enforces that the runtime (schemas/v1) and authoring (schemas/authoring) chambers keep INDEPENDENT $schemaVersion lanes and a separate signing trust root. Wired as pnpm run check:chamber-isolation into pnpm run check + CI. Strictly additive.

[0.8.0] - 2026-06-19

Added

• SkillVersion — the 14th canonical entity, added by DR-028 T1 DISCRIMINATOR. The kernel's refinement-lineage record for a skill — the entity the Skill Refiner appends to as it accepts edits. SEPARATE from SkillSnapshot: SkillSnapshot content-addressed-pins a skill's source state; SkillVersion captures the refinement LINEAGE. Net-new entity; the one-way-door is the @core publish. Field set is the DR-028 T1 ratified shape (id, skill_id, the load-bearing version_kind discriminator ∈ edit|revert|restore, nullable parent_version_id, source_snapshot_hash, refiner_strategy_id, created_at, created_by, reserved-additive tenant_id?). State-machine formalism and the status/signing fields are DEFERRED per the DR-028 T1 binding minority constraint — the minimal lineage-record shape is the safe shape to publish first.
• skill-refiner-pass/v1 in-toto predicate body — minted staging-first by Class-1 ADR DR-082. The signed attestation the Skill Refiner emits when a real SkillVersion clears the @j-rig/refiner-core acceptance gate (significant Pareto-dominance on the behavioral dimension + non-regression on every named dimension, one-sided z-test at the stated α). ADDITIVE — net-new predicate URI. Signed body = the DR-082 Q2 determinant set (strip any one and the PASS is unfalsifiable). Runs sigstore_staging until all four DR-082 Q3 production triggers hold; no production-Rekor signing is wired.

Changed

• DR-085 pre-release corrective decisions (D3/D4/D5) — one-way-door fixes applied before v0.8.0 (ISEDC corrective council, 7-0). D3 — lineage integrity + parent nullability: SkillVersion gains a self content_hash and parent_content_hash; the hash alphabet is now bare sha256, byte-aligned to SkillSnapshot.combined_sha. D4 — semantic disambiguation: added result_snapshot_hash (POST-EDIT output); source_snapshot_hash now consistently means PRE-EDIT input on both entity and predicate. D5 — three-layer enforcement of signed cross-field invariants (verdict==='accept' ⇒ every named_dimension_deltas[].non_regressed, version_kind ∈ {revert,restore} ⇒ parent_version_id !== null) at JSON-Schema + Zod + Pydantic.

[0.7.0] - 2026-06-16

The polyglot kernel release. The same canonical contracts now ship as npm @intentsolutions/core (Zod + JSON Schemas) AND PyPI intent-eval-core (Pydantic v2 models), version-locked — and six audit-deferred kernel specs are locked additively. SemVer MINOR.

Added

• Python distribution: Pydantic v2 models generated from the kernel JSON Schemas, published to PyPI as intent-eval-core with sigstore-python keyless signing (first-ever PyPI release). Codegen pipeline (scripts/codegen_pydantic.py over schemas/v1/*.json, byte-identical idempotency gate), a canonical models.py surface re-exporting the entity + predicate-body models with hand-written model_validators mirroring the Zod .superRefine() blocks, and a parity suite running the SHARED golden fixtures through the Python models to assert identical accept/reject. Version-lockstep gate keeps package.json ↔ pyproject.toml ↔ __init__.__version__ in agreement.
• Six audit-deferred kernel specs LOCKED additively (deferrals A/B/C/D/E/G) — the shapes Blueprint B named-but-deferred are now locked, every lockup additive + backward-compatible: AssertionExpression typed-class enum, MatcherInputPattern.structural payload, ScoringConfig weights/tiebreaker, gate-result/v1 coverage-element shape (string + optional coverage_detail[]), ToolInvocationError.enum_class registry, and the tenant_id reservation on EvalSpec/EvalRun/SkillSnapshot.
• ID + event-ID standards (primitives.ts) — the kernel now owns the ID/event-ID STANDARD (recognition patterns, type guards, safe brand-or-null helpers, the deterministic EVENT_ID_CONTRACT derivation pin, lineage-chain helpers) without GENERATING one (generation is a clock read + hash, runtime execution forbidden).
• Shared lifecycle-state-machine semantics + retry/rollback/promotion lifecycle maps — the shared semantics generic over any TransitionMap<S> (assertTransition, terminal/reachable-state analysis, toMermaid) plus the three cross-cutting policy machines Blueprint B § 3 enumerates, as concrete plain-data maps.
• OTel semantic-conventions pin for the runtime events (schemas/v1/otel-attributes.yaml + the @intentsolutions/core/otel/v1 projection) — pins one OTel-idiomatic dotted-lowercase attribute name per event so the five emitters cannot drift on key spelling.
• Cross-schema invariant catalog + 6767-h coverage map + CI gates — a machine-readable register of the 7 authoring-contract dependency-edge invariants, a field-level provenance map for the composed contracts, and three coverage-map CI gates.

Fixed

• authoring/v2 generated Zod mirrors the schema's minLength: 1 — restores ajv ↔ Zod parity for the v2 contracts.

Changed

• CI hardening lanes — vendored-config lint lane (yamllint + actionlint + markdownlint), advisory typos spell-check lane, lefthook.yml git-hooks config, and a tailnet ntfy CI-failure alert.

[0.6.0] - 2026-06-13

The authoring/v2 five-contract family release plus two new CI gates. SemVer MINOR.

Added

• authoring/v2 five-contract family (implements DR-062): mcp-config, plugin-manifest, agent-definition, hook-config, marketplace-catalog — v2 upstream-bases regenerated from the lab's captured projections (documented fields only, upstream requiredness, upstream wire forms); every IS narrowing/extension relocated to the v2 is-overlays with convergence triggers; pure-allOf compositions; codegen validators + fixture corpora. authoring/v1 remains byte-frozen. Per-contract detail is canonical in schemas/authoring/v2/CHANGELOG.md.
• Prose-anchor validity gate: vendored 6767-h heading inventory + check-prose-anchors CI workflow failing the build on dangling $comment citations.
• Changelog-observance gate: any schemas/ change without a same-PR governing-CHANGELOG entry (with lineage reference) fails CI.

Fixed

• ScoringConfigSchema mirrors the open-world JSON Schema (.strict() → .passthrough()); NORMATIVE gate_reasons non-empty rule for {fail, advisory, error} now enforced in both the JSON Schema and the Zod validator.
• Predicate-namespace gate scans the whole schemas/authoring family; byte-freeze test covers all seven v1 authoring validator sources.

[0.5.0] - 2026-06-11

The STRICT v2 authoring fork. Lands schemas/authoring/v2/skill-frontmatter — the strict IS-marketplace contract that closes the 4 CCP-shadow frontmatter gaps — as a fresh, self-contained, immutable fork of v1 (copy-then-tighten, zero $ref into v1). Purely additive: a new export subpath ./schemas/authoring/v2/* + ./validators/v1/authoring/v2; no v1 import-meaning changes. SemVer MINOR. DR-049 + the CCP kernel-shadow finding. Lifecycle SHIPPED-INTERNAL (canonical-promotion gated on the DR-049 recall eval + corpus migration).

Added

• schemas/authoring/v2/ STRICT authoring family — skill-frontmatter ALONE is forked to v2 (the other 5 contracts stay at v1 untouched, per DR-049 D-SAK-1). The v2 tree is a full self-contained mirror: marketplace-tier.schema.json (3 fold tightenings), a byte-copy of the v1 base modulo $id, the v1 overlay + scoped-Bash narrowing, the composed pure-allOf schema, index.json, CHANGELOG.md, and a non-normative MIGRATION.md. Zero $ref into v1.
• The 4 v2 tightenings vs frozen v1 (each catches the kernel up to the CCP prose validator): scoped-Bash (allowed-tools rejects a bare unscoped Bash token, structurally JSON-Schema-expressible); shell-substitution widen (description rejects $( and backticks); reserved-name hardening (name rejects any lowercase substring claude/anthropic); description cap lowered 1536 → 1024 chars.
• Codegen parameterized by authoring family — ContractSpec gained a typed version: 'v1' | 'v2' field with a runtime write-guard refusing to emit under the frozen v1 tree; the v1 generated output stays byte-identical.

Changed

• v1 BYTE-FROZEN at 0.4.1 — schemas/authoring/v1/** + its generated validators are byte-frozen and machine-enforced by a test that git-diffs every frozen path against the v0.4.1 tag. v1 stays the looser PUBLISHED contract (accepts bare Bash, 1025–1536-char descriptions, claude-reflect, and $(...)/backtick descriptions forever).

Security

• Verification — pnpm run check fully green; monotonic-additive property test proves v2 rejects a strict superset of what v1 rejects; ajv ↔ Zod fold agreement for all 4 v2 rules; v1 byte-frozen vs the v0.4.1 tag machine-checked; 100% coverage floor held.

[0.4.1] - 2026-06-11

A non-breaking relaxation of the skill-frontmatter authoring contract's allowed-tools type. SemVer PATCH — purely widening; every artifact valid under 0.4.0 stays valid.

Changed

• allowed-tools now accepts a CSV/space-delimited string OR a YAML array — a SUPERSET relaxation resolving the 23% CCP kernel-shadow deviation (836/838 disagreements were this one field). allowed-tools stays required; only the accepted type widened. A malformed value still rejects. Codegen extended so the generated Zod validator emits the combined string | string[] check; the other five contracts' generated output is byte-identical.

---

Older entries (v0.4.0 — 2026-06-11 back to v0.1.0 — 2026-05-17) are in the repo's CHANGELOG.md.