git:20260905.a3ac6c6 to git:20260905.f0c360f

2 added, 2 removed. Audit A to A.

# Contents

- `src/` – portable declarative and imperative workflow SDKs, host-resource admission, diagrams, direct Vercel AI Gateway generation, local vectorization, semantic operations, MCP, and canvas integration.

- `apps/desktop/` – the canonical `atet` CLI, complete local media host, durable scheduler, HTML and Three.js overlays, native capture helpers, frontend, and desktop shell.

- `apps/web/` – the static `atet.sh` site, with a local browser bundle and a production-only anonymous pageview boundary but no API, account, or credential surface.

- `packages/scene/` – the shared local scene-analysis contract.

- `src/code/` – portable declarative graph authoring, the closed public capability projection, compilation, planning, and execution contracts.

- `schema/` – version-one diagram JSON Schema.

- `skills/atet/` – the canonical Atet Agent Skill.

- `.agents/skills/` – portable repository orchestration and knowledge-base workflows.

- `kb/` – the Git-backed Markdown vault for rationale, evidence, maintained synthesis, plans, and scoped agent context.

- `examples/` – checked diagram, configuration, and executable imperative and declarative Bun workflow examples.

- `scripts/` – schema, skill, package, release, and official-vectorizer verification.

- `dist/` and `apps/desktop/dist/cli/` – committed Bun-targeted entrypoints consumed by package and Git installs.

- `.github/workflows/` – routed SDK, local-host, static-site, macOS-native, official VTracer, and immutable release checks.

- `docs/` – current architecture, npm publication, and Vercel provider runbooks.

- `README.md`, `CONTRIBUTING.md`, `SECURITY.md`, `LICENSE`, and `NOTICE.md` – public documentation, policy, and terms.

- `WRITING.md` and `STYLE.md` – internal and public prose contracts.

- `package.json`, `tsconfig.json`, and `bun.lock` – standalone package and verification configuration.

# Guidelines

- Use Bun 1.3.14 and run `bun run check` before handing off a change.

- Follow `WRITING.md` for internal prose and `STYLE.md` for public prose, preserving facts, exact terms, literals, quotations, links, and necessary uncertainty.

- Follow the shared [README guidelines](https://github.com/hraness/.github/blob/main/README_GUIDELINES.md) for the root README and any site copy that summarizes it.

- Apply unreasonably robust programming when agent work is cheap. Prefer coherent cross-file correctness and focused deterministic evidence while treating production risk, provider coordination, rollout, and observation as real costs.

- Deliver changes to `main` through a current-head pull request. Keep the stable `Required` CI job green, resolve every review thread, and serialize merges. Human approval stays optional while one regular maintainer would otherwise self-review. Never force-push or bypass the gate.

- Keep this repository independently buildable. Never depend on sibling paths, Git submodules, or coordinated `main` branches; consume external Hraness packages only through reviewed immutable release tags or commits.

- Extract a shared package only after a second concrete consumer proves a stable product-neutral contract. Shared packages never import product code.

- Keep Atet's product and editor presentation local. Add `@hraness/ui` for portable accessible primitives or `@hraness/design-kit` for optional shared presentation only after concrete reuse warrants the dependency; domain layout and content remain Atet-owned.

- Freeze shared interfaces before parallel lanes begin. Give one integration owner manifests, lockfiles, generated registries, and other convergence files, then let consumers upgrade immutable releases independently.

- Keep mandatory edit-time rules in the closest `AGENTS.md`, current procedures in `docs/`, executable contracts in types, schemas, and tests, and rationale, evidence, synthesis, and plans in `kb/`. KB lanes run `bun run kb:check:lane`; the integrator performs one refresh and `bun run kb:check`.

- Keep `@hraness/atet` at the repository root. The root package owns both the portable SDK and canonical `atet` binary built from `apps/desktop/cli/main.ts`.

- Keep canonical commands namespaced as `atet diagram init|check|render`, `atet image generate|vectorize`, and the `code`, `mcp`, `canvas`, `skill`, and `doctor` surfaces.

- Keep local vectorization authentication-free and network-silent. Gateway generation reads `AI_GATEWAY_API_KEY` before `VERCEL_OIDC_TOKEN`, never persists credentials, pins the Gateway origin, bounds responses, and sets `maxRetries: 0`.

- Keep `/artifacts/`, `.env`, and `.env.*` ignored. Recordings, imported media, private project metadata, Gateway tokens, and provider options must never enter Git or a package artifact.

- Treat `vercel env run -- <command>` as the ergonomic local Vercel path. Never shell out to infer or scrape a token from the Vercel CLI.

- Treat Production as Atet's only durable Vercel environment. Do not create a custom environment, persistent Preview domain, or provider-authoritative Preview branch. Pull requests may use Vercel's built-in disposable Preview target, without production-only variables or another durable backend. Follow [the Vercel runbook](docs/vercel.md) and audit provider identity before changing this seam.

- Preserve `.diagram.json` version one and the five same-stem render outputs: `.tldr`, light and dark SVG, and light and dark PNG.

- Keep one self-contained Atet identity. Public APIs, serialized identifiers, source imports, configuration, and runtime surfaces use only Atet names.

- Preserve every immutable version-1 tag and Release. Never rewrite a historical tag or recreate a repository at the former GitHub path, because doing so would replace GitHub's compatibility redirect.

- Treat diagram source as authoritative and generated media as replaceable. Defaults may resolve mechanics but must not invent claims, labels, legends, relationships, or decorative meaning.

- Model invalid states out, parse foreign values from `unknown`, and keep output deterministic. Preserve readable regression examples; add property tests for laws, parsers, reducers, ordering, and round trips, and promote shrunk failures into named deterministic examples.

- Keep semantic registries fixed and typed. Never accept source text, evaluation, dynamic imports, executable workspace configuration, shell commands, or caller-selected remote URLs.

- Preserve the root module and `./workflow` v0.8 imperative APIs. Add declarative graphs through `./code` and lower-level compiler contracts through `./code/advanced`; do not add `./code/testing` or `./code/workflows` exports.

- Treat explicitly imported workflow modules as trusted current-user Bun code. Compile graphs only against the host's closed capability projection, reject an unsupported capability before executor or resource admission, and do not add an open operation-registration hook.

- Treat the portable SDK and core as the canonical graph contract. The complete local host consumes that contract through its own closed projection and owns durable media execution. The Desktop shell adds only native capture, permissions, and UI.

- Model one project as immutable source plus explicit revisions, candidates, selections, and delivery variants. Keep ready work bounded by resource claims and serialize expensive encodes by default.

- Keep imperative workflows as explicitly imported trusted Bun modules over the fixed operation registry. Parse runtime input, bound and uniquely identify steps, drain dispatched work before returning, retain completed-step receipts on every failure path, and do not load caller-selected source paths.

- Keep semantic SDK, CLI, MCP, and workflow resource admission machine-global and crash-safe on macOS and Linux, with a truthful process-local fallback elsewhere. Preserve profile identity, FIFO admission for overlapping claims, callback-settlement ownership, and inherited lease descriptors through spawned vectorizer processes.

- Keep MCP paths root-relative and capability-small. Bound source bytes, arrays, shapes, edges, scale, pixels, findings, subprocess duration, and output bytes before execution.

- Keep vectorization fail-closed with checksum-pinned VTracer archives, inert rebuilt SVG, measured fidelity, and full provenance receipts. Do not add an embedded-raster fallback, upscaling model, or bundled commercial font.

- - Follow `docs/publishing.md` for the historical interactive npm bootstrap and direct OIDC releases. Preserve `contentPolicy.class=dual-use` and the root `DISCLOSURE` in every package. After the exact active CI workflow's `push` run and `Required` job succeed on protected current `main`, an agent acting under standing release authorization runs `bun run ./scripts/push-npm-release-tag.ts <version>` with already-available owner `gh` and Git credentials. The script must keep authentication opaque; bind immutable owner `User` ID `894119`, public repository ID `1310516748`, the exact live `npm-stage` environment with administrator bypass disabled, sole `branch_policy` protection, and sole `v*` tag deployment policy, plus the exact package/current-main/active-CI run and attempt/Required job; enforce bounded monotonic stable or numeric `beta.N` remote-tag inventory; refuse conflicts and inherited local refs; and push only one exact annotated `v<version>` ref. An exact same remote annotated tag and commit is an idempotent no-op. Missing authentication or ambiguous evidence fails closed.

- - Use two exact active rulesets matching `refs/tags/v*`: **Immutable version tags** restricts update and deletion with an empty bypass list, while **Release tag creation** restricts creation and has owner `User` ID `894119` as its sole always-bypass actor. The local tag command must read back both before mutation. Never grant generic GitHub Actions integration ID `15368`, an administrator, a repository role, a team, or another integration this bypass; never combine creation with update/delete or create probe tags. Protected tag-push workflows must bind the actor and event sender to that owner and the exact public repository before checkout, require the annotated tag/package/source identity, publish each unique version directly through OIDC with its final initial tag (`latest` or `beta`), verify registry integrity, channel, signatures, and provenance, and never use staged publishing or dist-tag promotion. Stable tags independently verify npm before the official VTracer matrix and immutable Latest Release; beta tags stop after npm readback. Trust a dedicated Release App only after its isolated credential and exact immutable App ID are configured explicitly.

+ - Follow `docs/publishing.md` for the historical bootstrap and later releases. Preserve `contentPolicy.class=dual-use` and the root `DISCLOSURE` in every package. Trust only `.github/workflows/npm-stage.yml` with `npm stage publish` permission bound to the exact `npm-stage` environment. Keep that environment restricted solely to selected `main`, with administrator bypass disabled, no required deployment reviewers, and no secrets. Pushes and default dispatches build and upload without OIDC; only an owner current-main dispatch with boolean `publish_to_npm=true` may admit the staging job, which must reauthorize the exact run attempt, owner `actor` and `triggering_actor`, workflow/repository identity, protected ref, and source before npm setup. The packed manifest must not contain npm's top-level `tag` override, and `publishConfig` must contain exactly canonical public `access` and `registry`; independently parse the exact USTAR archive and reject every scoped-registry, proxy, authentication, tag, provenance, or other packed npm override in the OIDC job. Stage only a stable candidate newer than live public `latest`; use empty user/global npm configuration, reject ambient `npm_config_tag`, prove pinned npm's untouched default tag is `latest`, and do not pass `--tag` so npm's built-in monotonic-latest guard remains active. npm supports multiple pending stages, exposes no atomic single-pending option, and does not authorize `npm stage list` with the short-lived trusted-publishing token. Keep this workflow the sole staging authority: serialize dispatches, record a successful version-bound Actions intent immediately before each mutation attempt, and reject unresolved intents across every retained attempt of the current and completed runs while their version remains newer than public `latest`. A failed, ambiguous, or rejected stage attempt may release only its exact intent through the exceptional owner-authorized `resolved_stage_version` input after its provider state is resolved; a promoted stage advances `latest` and releases its intent automatically. Leave the input empty normally. The one-pending-stage rule is an operational invariant for this authority, not a claim that npm prevents or exposes out-of-band concurrent stages to OIDC. Disallow traditional publishing tokens. npm's public promotion remains human-gated by two-factor authentication.

+ - Use two exact active rulesets matching `refs/tags/v*`: **Immutable version tags** restricts update and deletion with an empty bypass list, while **Release tag creation** restricts creation and has owner `User` ID `894119` as its sole always-bypass actor. Never grant generic GitHub Actions integration ID `15368`, an administrator, a repository role, a team, or another integration this bypass; never combine creation with update/delete or create probe tags. Publish and verify the exact staged npm artifact first, approve its public promotion with human 2FA, then run `bun run ./scripts/push-npm-release-tag.ts <exact-stable-version>` from clean current `main`; that preflight-only creator must read back owner/repository/rulesets/environment/protected-main/CI/public-latest/remote-tag identity before its sole exact annotated-tag push and must never publish npm. The protected tag workflow must bind actor and event sender to owner `User` ID `894119` and repository ID `1310516748` before checkout, require exact public `dist-tags.latest`, registry signatures, and npm-audit-verified npm-publish plus SLSA attestations bound to the tarball, source SHA, `npm-stage.yml` on `main`, `workflow_dispatch`, repository and owner IDs, GitHub-hosted builder, and signed stage run attempt. Immediately before the immutable Latest Release, re-read that exact owner-triggered attempt and its version-bound job, require one successful durable intent directly before the attempted npm mutation, and re-read live npm latest, integrity, signatures, and attestations. Do not require whole-job success: a failed, cancelled, or timed-out runner may have completed the provider write, and the exact cryptographically verified public provenance is the durable acceptance proof. Bind the Release body to the exact workflow, repository, tag, source, stage attempt, integrity, and attestation; accept an existing Release only from GitHub Actions bot ID `41898282` with that exact provenance and title. Never move a tag or republish an npm version.

- Treat the user's request to change this repository as standing authorization for routine task-owned commits, pushes, pull requests, merges, releases, deployments, and production verification after the repository's required validation, review, identity, and rollout gates pass. Do not ask for another confirmation at each delivery step.

- Use the repository's documented delivery workflow and preserve every runtime-enforced approval, branch protection, environment rule, safety policy, and final gate. Ask for user input only when delivery needs a material product decision, missing credentials or authority, an irreversibly destructive action outside task scope, or resolution of a release failure that cannot be handled safely and autonomously.

- Prefer short-lived repository workload identities such as OIDC trusted publishing, GitHub Apps, and narrowly scoped machine identities. Do not add long-lived personal tokens, weaken two-factor authentication, or bypass provider controls to eliminate an interactive prompt. Batch unavoidable human-gated production promotions into intentional stable releases while agents publish validated prerelease or beta channels through workload identities when the repository supports them.

- Preserve useful reasoning fan-out, but avoid unnecessary checkout fan-out. Prefer subagents in the current task for bounded research, review, diagnosis, and focused checks when they can safely share one working tree; create a separate task or worktree only for independently deliverable divergent edits, an isolated verification tree, or a different execution environment.

- Give each expensive focused validation command and external wait one owner. The integration owner reviews that evidence and runs the repository-required aggregate or final gate once after convergence. Reuse evidence only for the exact Git tree, command, lockfiles, toolchain, relevant environment, and validity period, and never to skip a required final integration, merge, release, deployment, or production-verification gate.

- On Hraness development machines, use `$hra-local-efficiency` and the installed host scheduler for heavyweight top-level commands when available. Keep ordinary work in the compute lane; give authenticated browser/dev-server/Chromium work one `browser-auth` owner and Mac-only validation one `mac-native` owner.

- When a CI or policy gate scans complete Git history, check out the exact governed SHA and fetch only the fully qualified governed refs before scanning. Preserve the complete-history gate and reject unexpected refs instead of importing unrelated concurrent heads.

- At closeout, record applicable branch, PR, check, merge, release, deployment, and production evidence. Archive only conclusively finished tasks, never from silence alone, and reclaim only freshly revalidated clean merged worktrees through the guarded exact-path flow.