chore(release): prepare OpenDomain 0.1.0-alpha.10 public cutover

CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+_No unreleased changes._
+
+## 0.1.0-alpha.10 - 2026-08-11
+
+- Add multi-product governance manifests, exposure propagation, dependency-cycle and forbidden-dependency checks,
+  and fail-closed public dependency closure while preserving ungoverned single-product compatibility.
+- Add stable Core API 1.0 entrypoints for validation, semantic query, and bounded context export; CLI commands reuse
+  the same implementation and preserve Candidate boundaries outside accepted documents.
+- Require governed canonical workspaces for product-level public export and prove direct/transitive Core-only
+  exposure leaks fail closed.
+- Add an explicit offline installed-package smoke mode for clean public projection and local-cache validation.
 - Correct historical prerelease headings, dates, and notable workspace and
   release-boundary entries against published tags and npm registry history.
 - Reorganize public guidance around natural-language Codex adoption, add paired

README.md

@@ -148,6 +148,8 @@ The current alpha includes:
 - accepted concepts, rules, lifecycles, events, and evidence;
 - Candidate-first AI inference with explicit human review;
 - deterministic Semantic Closure and derived read-first indexes;
+- optional multi-product workspace governance with deterministic exposure and publication-closure validation;
+- a side-effect-free Embeddable Core v1 with source-first query and versioned context export;
 - Grounding Request, Grounding Pack, and advisory/enforced Assurance;
 - built-in OpenSpec grounding and declarative Integration Profiles;
 - managed Codex instructions, Skills, updates, and diagnostics;
@@ -157,6 +159,22 @@ OpenDomain is suitable for bounded trials and public iteration. The format and
 CLI may still change before a stable release, and it should not yet be the sole
 governance source for production-critical domain decisions.
 
+For a multi-product canonical workspace, add a versioned
+`opendomain/governance.yaml` and place each domain group's normal semantic
+directories under its declared `source_root`. `opendomain validate --json`
+then returns product/group ownership, dependency graphs, exposure diagnostics,
+and derived public dependency closures. A passing closure is static evidence;
+it does not publish files, grant permissions, change Git, or require EchoPath.
+See [Multi-product workspace governance](USAGE.md#multi-product-workspace-governance).
+
+Host and plugin authors can import the package root or `@echopath-labs/opendomain/core`
+to call the same validate, query, and context-export implementation used by the
+CLI. `opendomain export context` returns accepted content and reports related
+Candidates separately; `--exposure public --product <id>` succeeds only from a
+validated public dependency closure. The API is read-only and does not manage
+EchoPath memory, accept Candidates, write projections, or publish releases. See
+[Embed Core and export context](USAGE.md#embed-core-and-export-context).
+
 ## Public Resources
 
 - [Usage Guide](USAGE.md)

README.zh-CN.md

@@ -137,6 +137,8 @@ opendomain validate
 - accepted 概念、规则、生命周期、事件与证据；
 - Candidate-first AI 推断和显式人工审查；
 - 确定性 Semantic Closure 与派生 read-first index；
+- 可选的多产品 workspace 治理、exposure 传播与 public dependency closure 校验；
+- 无进程副作用的 Embeddable Core v1、source-first query 与版本化 context export；
 - Grounding Request、Grounding Pack 和 advisory/enforced Assurance；
 - 内置 OpenSpec grounding 与声明式 Integration Profile；
 - 受管 Codex 指令、Skills、更新和诊断；
@@ -145,6 +147,19 @@ opendomain validate
 OpenDomain 当前适合限定范围试点和公开迭代。稳定版之前格式与 CLI 仍可能变化，暂时
 不应成为生产关键领域决策的唯一治理来源。
 
+多产品 canonical workspace 可以增加版本化的 `opendomain/governance.yaml`，并把每个
+domain group 的普通语义目录放入声明的 `source_root`。`opendomain validate --json`
+会返回 product/group owner、依赖图、exposure 诊断与派生 public closure。closure 通过
+只是静态证据，不会发布文件、授予权限、修改 Git，也不要求安装 EchoPath。详见
+[多产品 Workspace 治理](USAGE.zh-CN.md#多产品-workspace-治理)。
+
+Host 或插件作者可以从 package root 或 `@echopath-labs/opendomain/core` 导入与 CLI
+完全相同的 validate、query 和 context-export 实现。`opendomain export context` 只把
+accepted content 放进 documents，并单独标记 Candidate；
+`--exposure public --product <id>` 只有在当前 public dependency closure 可证明时才会
+成功。该 API 只读，不管理 EchoPath memory、不接受 Candidate、不写公开投影，也不执行
+release。详见[嵌入 Core 与导出 Context](USAGE.zh-CN.md#嵌入-core-与导出-context)。
+
 ## 公开资料
 
 - [简体中文使用指南](USAGE.zh-CN.md)

USAGE.md

@@ -123,6 +123,154 @@ Codex initialization manages:
 Existing content outside the managed block remains user-owned. A conflicting
 user-owned Skill is reported rather than overwritten.
 
+## Multi-Product Workspace Governance
+
+The existing single-product layout remains the default. When one physical
+`opendomain/` root must contain several independently owned products, add
+`opendomain/governance.yaml`:
+
+```yaml
+schema_version: "1.0"
+products:
+  - id: public_api
+    owners: [api-team]
+    exposure: public
+    dependencies: [shared_contracts]
+    forbidden_dependencies: [desktop_private]
+  - id: shared_contracts
+    owners: [platform-team]
+    exposure: public
+    dependencies: []
+    forbidden_dependencies: []
+  - id: desktop_private
+    owners: [desktop-team]
+    exposure: private
+    dependencies: [public_api]
+    forbidden_dependencies: []
+domain_groups:
+  - id: public_api.core
+    product: public_api
+    source_root: products/public-api/core
+    owners: [api-team]
+    exposure: public
+    dependencies: [shared_contracts.core]
+    forbidden_dependencies: [desktop_private.context]
+  - id: shared_contracts.core
+    product: shared_contracts
+    source_root: products/shared-contracts/core
+    owners: [platform-team]
+    exposure: public
+    dependencies: []
+    forbidden_dependencies: []
+  - id: desktop_private.context
+    product: desktop_private
+    source_root: products/desktop-private/context
+    owners: [desktop-team]
+    exposure: private
+    dependencies: [public_api.core]
+    forbidden_dependencies: []
+```
+
+Each `source_root` contains the normal `contexts/`, `concepts/`, `rules/`,
+`lifecycles/`, `events/`, and `candidates/` directories. Roots must be real,
+disjoint directories confined to `opendomain/`; every governed semantic source
+must belong to exactly one domain group.
+
+Exposure is fixed from least to most restrictive:
+
+```text
+public < ecosystem < internal < private
+```
+
+A node may only depend on an equal or less restrictive target. Cross-product
+group dependencies also require the corresponding product dependency.
+`forbidden_dependencies` applies transitively and reports the dependency path.
+
+Validate for humans or automation:
+
+```bash
+opendomain validate
+opendomain validate --json
+```
+
+The JSON result adds `governance.dependency_graph` and
+`governance.publication_closures`, including manifest provenance, included
+nodes/files, and selection paths. Unknown schema versions/exposure values,
+cycles, missing targets, overlaps, unassigned sources, forbidden paths, and
+private-to-public leakage fail closed.
+
+Publication closure is rebuildable static evidence. It does not publish a
+repository, copy a public projection, grant access, modify Git, or prove that a
+release occurred. The npm package and standalone executable evaluate the same
+manifest without requiring EchoPath, AGW, a package-manager workspace, or a
+private sibling repository. If `governance.yaml` is absent, current canonical,
+legacy, and explicit-target behavior is unchanged.
+
+## Embed Core And Export Context
+
+Normal users can continue expressing intent to Codex. These interfaces are for
+Agent hosts, plugins, CI, and maintainers that need an observable context payload.
+
+Query current source without creating or reading a generated index:
+
+```bash
+opendomain query --id sales.order --json
+opendomain query --context sales --type domain_concept --json
+```
+
+Export the selected accepted sources, their semantic closure, evidence, review,
+source hashes, and related non-authoritative Candidate boundaries:
+
+```bash
+opendomain export context --id sales.order --json
+```
+
+Selectors are `--id`, `--context`, `--product`, `--domain-group`, `--owner`,
+`--lifecycle`, and `--type`. Multiple selectors use logical AND. At least one is
+required; an empty or unmatched request fails instead of exporting the whole
+workspace.
+
+In a governed canonical workspace, export one complete public proof with:
+
+```bash
+opendomain export context --product public_api --exposure public --json
+```
+
+Public export requires the current validated publication closure. It rejects an
+ungoverned workspace, non-public product, invalid graph, stale source mapping,
+or extra selector that would crop the proof. A passing payload is evidence only;
+it does not copy files, change Git, grant access, or publish anything.
+
+Node host and plugin authors may deliberately depend on the npm package and use
+the side-effect-free Core API:
+
+```js
+import {
+  CORE_API_VERSION,
+  validateWorkspace,
+  queryWorkspace,
+  exportContext
+} from "@echopath-labs/opendomain";
+
+const context = await exportContext({
+  cwd: process.cwd(),
+  selector: { id: "sales.order" }
+});
+```
+
+The package root and `@echopath-labs/opendomain/core` expose the same Core API
+`1.0`. Calls return structured results and do not write stdout/stderr, set a
+process exit code, create an index, mutate source, access Git/network, or manage
+EchoPath lifecycle. `opendomain.context-export.v1` contains full accepted
+Markdown content and workspace-relative provenance; Candidates remain only in
+`candidate_boundaries` with `authoritative: false`.
+
+Within Core v1, new named exports and optional result fields may be additive.
+Removing fields, changing selector conjunction, weakening Candidate isolation,
+or reinterpreting exposure proof requires a new API/export version and migration
+guidance. Ordinary project installation should still follow the Agent
+Installation Contract and must not add a host dependency merely to use the CLI.
+
 ## First Read-Only Domain Exploration
 
 Ask:
@@ -297,6 +445,9 @@ can continue expressing intent to Codex.
 | Validate Profiles | `opendomain integrations validate` |
 | Build a derived index | `opendomain index build` |
 | Query a domain ID | `opendomain index query <domain-id>` |
+| Query current source | `opendomain query --id <domain-id>` |
+| Export accepted context | `opendomain export context --id <domain-id> --json` |
+| Export a public closure | `opendomain export context --product <product-id> --exposure public --json` |
 
 ## ERP Example
 

USAGE.zh-CN.md

@@ -111,6 +111,142 @@ Codex 初始化会管理：
 受管区块外的既有内容仍由用户拥有。遇到同名用户 Skill 时，OpenDomain 会报告冲突，
 不会覆盖。
 
+## 多产品 Workspace 治理
+
+现有单产品布局仍是默认行为。当一个物理 `opendomain/` 根需要容纳多个独立 owner 的
+产品时，增加 `opendomain/governance.yaml`：
+
+```yaml
+schema_version: "1.0"
+products:
+  - id: public_api
+    owners: [api-team]
+    exposure: public
+    dependencies: [shared_contracts]
+    forbidden_dependencies: [desktop_private]
+  - id: shared_contracts
+    owners: [platform-team]
+    exposure: public
+    dependencies: []
+    forbidden_dependencies: []
+  - id: desktop_private
+    owners: [desktop-team]
+    exposure: private
+    dependencies: [public_api]
+    forbidden_dependencies: []
+domain_groups:
+  - id: public_api.core
+    product: public_api
+    source_root: products/public-api/core
+    owners: [api-team]
+    exposure: public
+    dependencies: [shared_contracts.core]
+    forbidden_dependencies: [desktop_private.context]
+  - id: shared_contracts.core
+    product: shared_contracts
+    source_root: products/shared-contracts/core
+    owners: [platform-team]
+    exposure: public
+    dependencies: []
+    forbidden_dependencies: []
+  - id: desktop_private.context
+    product: desktop_private
+    source_root: products/desktop-private/context
+    owners: [desktop-team]
+    exposure: private
+    dependencies: [public_api.core]
+    forbidden_dependencies: []
+```
+
+每个 `source_root` 继续使用普通的 `contexts/`、`concepts/`、`rules/`、
+`lifecycles/`、`events/` 与 `candidates/`。所有 root 必须是 `opendomain/`
+内部互不重叠的真实目录；每个受治理语义 source 必须且只能属于一个 domain group。
+
+exposure 从最公开到最严格固定为：
+
+```text
+public < ecosystem < internal < private
+```
+
+节点只能依赖相同或更公开的目标。跨产品 group 依赖还必须声明对应 product 依赖。
+`forbidden_dependencies` 会传递检查并返回完整依赖路径。
+
+面向人或自动化执行：
+
+```bash
+opendomain validate
+opendomain validate --json
+```
+
+JSON 会增加 `governance.dependency_graph` 和
+`governance.publication_closures`，包含 manifest provenance、纳入的节点/文件与
+selection path。未知 schema version/exposure、循环、缺失 target、root 重叠、未归属
+source、forbidden path 与 private-to-public 泄漏都会 fail closed。
+
+publication closure 是可重建的静态证据。它不会发布仓库、复制公开投影、授予权限、
+修改 Git 或证明 release 已发生。npm 包与独立 executable 使用相同规则，不依赖
+EchoPath、AGW、package-manager workspace 或私有 sibling。没有 `governance.yaml` 时，
+现有 canonical、legacy 与 explicit-target 行为保持不变。
+
+## 嵌入 Core 与导出 Context
+
+正常用户仍然可以直接向 Codex 表达意图。以下接口面向需要可观察 context payload 的
+Agent host、插件、CI 和维护者。
+
+直接查询当前 source，不创建或读取 generated index：
+
+```bash
+opendomain query --id sales.order --json
+opendomain query --context sales --type domain_concept --json
+```
+
+导出选中的 accepted sources、semantic closure、evidence、review、source hash 和相关但
+非权威的 Candidate boundaries：
+
+```bash
+opendomain export context --id sales.order --json
+```
+
+selector 包括 `--id`、`--context`、`--product`、`--domain-group`、`--owner`、
+`--lifecycle` 和 `--type`。多个 selector 使用逻辑 AND。请求至少要有一个 selector；
+空请求或无匹配请求会失败，不会回退成整个 workspace 导出。
+
+在受治理的 canonical workspace 中，可以导出一个完整 public proof：
+
+```bash
+opendomain export context --product public_api --exposure public --json
+```
+
+public export 必须使用当前验证通过的 publication closure。ungoverned workspace、非 public
+product、非法依赖图、无法映射的 source 或会裁剪 proof 的额外 selector 都会 fail closed。
+通过的 payload 也只是证据，不会复制文件、修改 Git、授予权限或发布任何内容。
+
+Node host 和插件作者可以有意把 npm 包作为依赖，并使用无副作用 Core API：
+
+```js
+import {
+  CORE_API_VERSION,
+  validateWorkspace,
+  queryWorkspace,
+  exportContext
+} from "@echopath-labs/opendomain";
+
+const context = await exportContext({
+  cwd: process.cwd(),
+  selector: { id: "sales.order" }
+});
+```
+
+package root 与 `@echopath-labs/opendomain/core` 暴露相同的 Core API `1.0`。调用只返回
+结构化结果，不写 stdout/stderr、不设置 process exit code、不创建 index、不修改 source、
+不访问 Git/network，也不管理 EchoPath lifecycle。`opendomain.context-export.v1` 包含完整
+accepted Markdown content 和 workspace-relative provenance；Candidate 只会出现在
+`candidate_boundaries`，并明确标记 `authoritative: false`。
+
+Core v1 内可以增加 named export 和可选结果字段。删除字段、改变 selector AND 语义、削弱
+Candidate 隔离或重新解释 exposure proof，都必须使用新的 API/export version 并提供迁移说明。
+普通项目仍应遵循 Agent 安装契约，不能只是为了使用 CLI 就给宿主项目增加依赖。
+
 ## 第一次只读了解业务
 
 可以说：
@@ -269,6 +405,9 @@ opendomain validate --json
 | 验证 Profile | `opendomain integrations validate` |
 | 构建派生 index | `opendomain index build` |
 | 查询 domain ID | `opendomain index query <domain-id>` |
+| 查询当前 source | `opendomain query --id <domain-id>` |
+| 导出 accepted context | `opendomain export context --id <domain-id> --json` |
+| 导出 public closure | `opendomain export context --product <product-id> --exposure public --json` |
 
 ## ERP 示例