emeisazam · Oct 8, 2026 · Oct 1, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Audit high-severity advisories
-        run: pnpm audit --audit-level high
+        run: node scripts/audit-dependencies.mjs
 
       - name: Run the authoritative repository gate
         run: pnpm check
diff --git a/.gitignore b/.gitignore
@@ -10,3 +10,20 @@ coverage/
 tmp/
 .masa-cache/
 
+# Private local output; maintained fixtures remain in their source directories
+/audits/
+/local-plans/
+/reports/
+/screenshots/
+/receipts/
+/recordings/
+/captures/
+/output/
+/runtime/
+/settings.json
+/*.sqlite
+/*.sqlite-*
+/*.sqlite3
+/*.sqlite3-*
+/*.db
+/docs/audits/
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,7 +1,26 @@
 # Changelog
 
+## Unreleased
+
+- Patch the tooling Hono dependency to 4.13.7 and use a dependency audit that excludes only the exact local workspace importer collision.
+
 All material protocol and reference-tooling changes are recorded here. MASA uses semantic versioning; a tooling patch may advance without changing the normative protocol version when its record contracts remain compatible.
 
+## 0.2.2 - unreleased
+
+- Update the reviewed fast-uri 3.x dependency to 3.1.8 and regenerate the 0.2.2 tooling identity. MASA protocol 0.2.0 remains unchanged.
+- Refresh Vitest 4.1.11 and reviewed js-yaml, Hono and ip-address patches in the lock graph.
+- Packed tooling remains a local candidate; no public release is claimed.
+
+## 0.2.1 - unreleased
+
+Reference-tooling validation erratum for MASA 0.2.0. Record versions and schema identifiers remain 0.2.0; no conforming record needs re-versioning. Previously accepted fabricated lineage and incomplete completed transformations contradicted the existing written requirements and are now rejected. The 0.1.0 resources and historical evidence are preserved.
+
+- Bind every descendant relation to the generating receipt's actual parent input, output, effect and completed/partial outcome, in both predicate directions.
+- Trigger completed preservation/output requirements by status and operation identity, and check every relevant event.
+- Apply causal checks to resolved external event logs using compact closure summaries; standalone external-history validation remains explicitly limited.
+- Add a shared adversarial conformance matrix, regenerate canonical artifacts, and qualify newly packed 0.2.1 tooling before consumer adoption. No public tag or release is claimed.
+
 ## 0.2.0 - 2026-08-11
 
 Minor protocol and reference-tooling release.

diff --git a/README.md b/README.md
@@ -49,7 +49,7 @@ See [`docs/project-agnostic-integration.md`](docs/project-agnostic-integration.m
 
 ## Local conformance evidence
 
-The reference implementation records separate evidence for the `reader`, `writer`, `transformer`, `agent-host`, and `publisher` classes in [`conformance/0.2.0/evidence`](conformance/0.2.0/evidence). The current local run reports all five classes conformant on Node.js 22.22.3 for macOS arm64 against fixture-manifest digest `456f1fd3c5c9b4905dca5456ef3179ac651282a2885eeb6aac2b5997cc254da4`. The digest is refreshed from the examples, specification, capability catalog, schemas, ontology registries, JSON-LD context, and executable conformance runner whenever evidence is intentionally recorded.
+The reference implementation records separate evidence for the `reader`, `writer`, `transformer`, `agent-host`, and `publisher` classes in [`conformance/0.2.0/evidence`](conformance/0.2.0/evidence). The 0.2.2 reference-tooling candidate (protocol 0.2.0) local run reports all five classes conformant on Node.js 22.22.3 for macOS arm64 against fixture-manifest digest `e7d53ca104b4d36cdd8d6604e0884116f71b2900916161657ee913ab8bf5a279`. The digest is refreshed from the examples, specification, capability catalog, schemas, ontology registries, JSON-LD context, and executable conformance runner whenever evidence is intentionally recorded.
 
 Run `pnpm check` to regenerate derived code and verify conformance on the current machine. Run `pnpm conformance:evidence` only when intentionally recording a new local evidence snapshot. Conformance is always specific to an implementation version, MASA version, profile, class, platform, and exact fixture set; it is not a universal certification.
 

diff --git a/capabilities/0.2.0/reference.json b/capabilities/0.2.0/reference.json
@@ -4,11 +4,11 @@
   "masaVersion": "0.2.0",
   "id": "https://masa.sonicfield.org/capabilities/0.2.0/reference",
   "implementation": {
-    "id": "https://masa.sonicfield.org/implementations/typescript-reference/0.2.0",
+    "id": "https://masa.sonicfield.org/implementations/typescript-reference/0.2.2",
     "name": "MASA local TypeScript reference",
-    "version": "0.2.0"
+    "version": "0.2.2"
   },
-  "generatedAt": "2026-08-11T00:00:00.000Z",
+  "generatedAt": "2026-10-01T02:00:16.890Z",
   "capabilities": [
     {
       "id": "https://masa.sonicfield.org/capabilities/0.2.0/matter.validate",

diff --git a/cli/package.json b/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@sonicfield/masa-cli",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "private": true,
   "license": "MIT",
   "description": "Local command-line reference implementation for MASA",
@@ -34,7 +34,7 @@
   "devDependencies": {
     "@types/node": "24.13.3",
     "typescript": "7.0.2",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "engines": {
     "node": ">=22.20"

diff --git a/conformance/0.2.0/evidence/agent-host.json b/conformance/0.2.0/evidence/agent-host.json
@@ -4,30 +4,30 @@
   "extensions": {},
   "fixtureManifestDigest": {
     "algorithm": "sha-256",
-    "byteLength": 368867,
-    "digest": "456f1fd3c5c9b4905dca5456ef3179ac651282a2885eeb6aac2b5997cc254da4",
+    "byteLength": 716691,
+    "digest": "e7d53ca104b4d36cdd8d6604e0884116f71b2900916161657ee913ab8bf5a279",
     "status": "verified",
-    "verifiedAt": "2026-08-12T00:36:14.673Z"
+    "verifiedAt": "2026-10-01T02:00:19.738Z"
   },
   "id": "urn:uuid:10000000-0000-4000-8000-000000000004",
   "implementation": {
     "name": "MASA local TypeScript reference",
-    "version": "0.2.0"
+    "version": "0.2.2"
   },
   "masaVersion": "0.2.0",
   "migrationStatus": "not_tested",
   "platform": {
     "architecture": "arm64",
     "os": "darwin",
-    "runtime": "node v22.22.3"
+    "runtime": "node v26.8.2"
   },
   "profile": "agent",
-  "runAt": "2026-08-12T00:36:14.673Z",
+  "runAt": "2026-10-01T02:00:19.738Z",
   "status": "conformant",
   "subject": "@sonicfield/masa workspace",
   "suite": {
     "name": "masa-typescript-reference-conformance",
-    "version": "0.2.0"
+    "version": "0.2.2"
   },
   "tests": [
     {

diff --git a/conformance/0.2.0/evidence/publisher.json b/conformance/0.2.0/evidence/publisher.json
@@ -4,30 +4,30 @@
   "extensions": {},
   "fixtureManifestDigest": {
     "algorithm": "sha-256",
-    "byteLength": 368867,
-    "digest": "456f1fd3c5c9b4905dca5456ef3179ac651282a2885eeb6aac2b5997cc254da4",
+    "byteLength": 716691,
+    "digest": "e7d53ca104b4d36cdd8d6604e0884116f71b2900916161657ee913ab8bf5a279",
     "status": "verified",
-    "verifiedAt": "2026-08-12T00:36:14.673Z"
+    "verifiedAt": "2026-10-01T02:00:19.738Z"
   },
   "id": "urn:uuid:10000000-0000-4000-8000-000000000005",
   "implementation": {
     "name": "MASA local TypeScript reference",
-    "version": "0.2.0"
+    "version": "0.2.2"
   },
   "masaVersion": "0.2.0",
   "migrationStatus": "not_tested",
   "platform": {
     "architecture": "arm64",
     "os": "darwin",
-    "runtime": "node v22.22.3"
+    "runtime": "node v26.8.2"
   },
   "profile": "publication",
-  "runAt": "2026-08-12T00:36:14.673Z",
+  "runAt": "2026-10-01T02:00:19.738Z",
   "status": "conformant",
   "subject": "@sonicfield/masa workspace",
   "suite": {
     "name": "masa-typescript-reference-conformance",
-    "version": "0.2.0"
+    "version": "0.2.2"
   },
   "tests": [
     {

diff --git a/conformance/0.2.0/evidence/reader.json b/conformance/0.2.0/evidence/reader.json
@@ -4,30 +4,30 @@
   "extensions": {},
   "fixtureManifestDigest": {
     "algorithm": "sha-256",
-    "byteLength": 368867,
-    "digest": "456f1fd3c5c9b4905dca5456ef3179ac651282a2885eeb6aac2b5997cc254da4",
+    "byteLength": 716691,
+    "digest": "e7d53ca104b4d36cdd8d6604e0884116f71b2900916161657ee913ab8bf5a279",
     "status": "verified",
-    "verifiedAt": "2026-08-12T00:36:14.673Z"
+    "verifiedAt": "2026-10-01T02:00:19.738Z"
   },
   "id": "urn:uuid:10000000-0000-4000-8000-000000000001",
   "implementation": {
     "name": "MASA local TypeScript reference",
-    "version": "0.2.0"
+    "version": "0.2.2"
   },
   "masaVersion": "0.2.0",
   "migrationStatus": "not_tested",
   "platform": {
     "architecture": "arm64",
     "os": "darwin",
-    "runtime": "node v22.22.3"
+    "runtime": "node v26.8.2"
   },
   "profile": "core",
-  "runAt": "2026-08-12T00:36:14.673Z",
+  "runAt": "2026-10-01T02:00:19.738Z",
   "status": "conformant",
   "subject": "@sonicfield/masa workspace",
   "suite": {
     "name": "masa-typescript-reference-conformance",
-    "version": "0.2.0"
+    "version": "0.2.2"
   },
   "tests": [
     {

diff --git a/conformance/0.2.0/evidence/transformer.json b/conformance/0.2.0/evidence/transformer.json
@@ -4,30 +4,30 @@
   "extensions": {},
   "fixtureManifestDigest": {
     "algorithm": "sha-256",
-    "byteLength": 368867,
-    "digest": "456f1fd3c5c9b4905dca5456ef3179ac651282a2885eeb6aac2b5997cc254da4",
+    "byteLength": 716691,
+    "digest": "e7d53ca104b4d36cdd8d6604e0884116f71b2900916161657ee913ab8bf5a279",
     "status": "verified",
-    "verifiedAt": "2026-08-12T00:36:14.673Z"
+    "verifiedAt": "2026-10-01T02:00:19.738Z"
   },
   "id": "urn:uuid:10000000-0000-4000-8000-000000000003",
   "implementation": {
     "name": "MASA local TypeScript reference",
-    "version": "0.2.0"
+    "version": "0.2.2"
   },
   "masaVersion": "0.2.0",
   "migrationStatus": "not_tested",
   "platform": {
     "architecture": "arm64",
     "os": "darwin",
-    "runtime": "node v22.22.3"
+    "runtime": "node v26.8.2"
   },
   "profile": "transformation",
-  "runAt": "2026-08-12T00:36:14.673Z",
+  "runAt": "2026-10-01T02:00:19.738Z",
   "status": "conformant",
   "subject": "@sonicfield/masa workspace",
   "suite": {
     "name": "masa-typescript-reference-conformance",
-    "version": "0.2.0"
+    "version": "0.2.2"
   },
   "tests": [
     {
@@ -45,6 +45,11 @@
       "id": "transformer.processing-lineage",
       "status": "conformant"
     },
+    {
+      "diagnostics": [],
+      "id": "transformer.causal-preservation-matrix",
+      "status": "conformant"
+    },
     {
       "diagnostics": [],
       "id": "transformer.lineage-and-failure",

diff --git a/conformance/0.2.0/evidence/writer.json b/conformance/0.2.0/evidence/writer.json
@@ -4,30 +4,30 @@
   "extensions": {},
   "fixtureManifestDigest": {
     "algorithm": "sha-256",
-    "byteLength": 368867,
-    "digest": "456f1fd3c5c9b4905dca5456ef3179ac651282a2885eeb6aac2b5997cc254da4",
+    "byteLength": 716691,
+    "digest": "e7d53ca104b4d36cdd8d6604e0884116f71b2900916161657ee913ab8bf5a279",
     "status": "verified",
-    "verifiedAt": "2026-08-12T00:36:14.673Z"
+    "verifiedAt": "2026-10-01T02:00:19.738Z"
   },
   "id": "urn:uuid:10000000-0000-4000-8000-000000000002",
   "implementation": {
     "name": "MASA local TypeScript reference",
-    "version": "0.2.0"
+    "version": "0.2.2"
   },
   "masaVersion": "0.2.0",
   "migrationStatus": "not_tested",
   "platform": {
     "architecture": "arm64",
     "os": "darwin",
-    "runtime": "node v22.22.3"
+    "runtime": "node v26.8.2"
   },
   "profile": "core",
-  "runAt": "2026-08-12T00:36:14.673Z",
+  "runAt": "2026-10-01T02:00:19.738Z",
   "status": "conformant",
   "subject": "@sonicfield/masa workspace",
   "suite": {
     "name": "masa-typescript-reference-conformance",
-    "version": "0.2.0"
+    "version": "0.2.2"
   },
   "tests": [
     {

diff --git a/conformance/0.2.0/history/tooling-0.2.0/README.md b/conformance/0.2.0/history/tooling-0.2.0/README.md
@@ -0,0 +1 @@
+Historical MASA 0.2.0 tooling evidence, preserved byte for byte from source commit `9d89b1e570ef154a715fdcba5024b8271d1ecd30`. These files describe that earlier implementation and fixture digest; current evidence lives in ../../evidence/.
diff --git a/conformance/0.2.0/history/tooling-0.2.0/agent-host.json b/conformance/0.2.0/history/tooling-0.2.0/agent-host.json
@@ -0,0 +1,45 @@
+{
+  "class": "agent-host",
+  "diagnostics": [],
+  "extensions": {},
+  "fixtureManifestDigest": {
+    "algorithm": "sha-256",
+    "byteLength": 369464,
+    "digest": "007d7261686f5d33e346f0f849616e6036d383192e33340b272d11d66d16aa34",
+    "status": "verified",
+    "verifiedAt": "2026-09-12T20:33:04.330Z"
+  },
+  "id": "urn:uuid:10000000-0000-4000-8000-000000000004",
+  "implementation": {
+    "name": "MASA local TypeScript reference",
+    "version": "0.2.0"
+  },
+  "masaVersion": "0.2.0",
+  "migrationStatus": "not_tested",
+  "platform": {
+    "architecture": "arm64",
+    "os": "darwin",
+    "runtime": "node v22.22.3"
+  },
+  "profile": "agent",
+  "runAt": "2026-09-12T20:33:04.330Z",
+  "status": "conformant",
+  "subject": "@sonicfield/masa workspace",
+  "suite": {
+    "name": "masa-typescript-reference-conformance",
+    "version": "0.2.0"
+  },
+  "tests": [
+    {
+      "diagnostics": [],
+      "id": "agent-host.capabilities-and-record",
+      "status": "conformant"
+    },
+    {
+      "diagnostics": [],
+      "id": "agent-host.mcp-stdio",
+      "status": "conformant"
+    }
+  ],
+  "type": "masa:ConformanceResult"
+}
diff --git a/conformance/0.2.0/history/tooling-0.2.0/publisher.json b/conformance/0.2.0/history/tooling-0.2.0/publisher.json
@@ -0,0 +1,40 @@
+{
+  "class": "publisher",
+  "diagnostics": [],
+  "extensions": {},
+  "fixtureManifestDigest": {
+    "algorithm": "sha-256",
+    "byteLength": 369464,
+    "digest": "007d7261686f5d33e346f0f849616e6036d383192e33340b272d11d66d16aa34",
+    "status": "verified",
+    "verifiedAt": "2026-09-12T20:33:04.330Z"
+  },
+  "id": "urn:uuid:10000000-0000-4000-8000-000000000005",
+  "implementation": {
+    "name": "MASA local TypeScript reference",
+    "version": "0.2.0"
+  },
+  "masaVersion": "0.2.0",
+  "migrationStatus": "not_tested",
+  "platform": {
+    "architecture": "arm64",
+    "os": "darwin",
+    "runtime": "node v22.22.3"
+  },
+  "profile": "publication",
+  "runAt": "2026-09-12T20:33:04.330Z",
+  "status": "conformant",
+  "subject": "@sonicfield/masa workspace",
+  "suite": {
+    "name": "masa-typescript-reference-conformance",
+    "version": "0.2.0"
+  },
+  "tests": [
+    {
+      "diagnostics": [],
+      "id": "publisher.public-projection-audit",
+      "status": "conformant"
+    }
+  ],
+  "type": "masa:ConformanceResult"
+}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Historical MASA 0.2.0 tooling evidence, preserved byte for byte from source commit `9d89b1e570ef154a715fdcba5024b8271d1ecd30`. These files describe that earlier implementation and fixture digest; current evidence lives in ../../evidence/.