@mnstry/atelier v0.2.0-alpha.5

@mnstry/atelier 0.2.0-alpha.5 is the assurance and portability hardening release.

Highlights:

• Boundary, disclosure, repository, and release scans now fail closed on incomplete, binary, invalid-UTF-8, malformed, or unscannable evidence.
• Release publication is bound to one retained npm pack artifact and its SHA-256 digest through audit, consumer, distribution, and trusted-publishing gates.
• Collaboration records now use content-bound canonical event identifiers, bounded reads, state-leaf identity checks, locking, and explicit compaction.
• The local sidecar is loopback-only and validates its manifest, paths, hosts, fetch metadata, origins, methods, and nonces.
• Public API compatibility is pinned to the registry-verified 0.2.0-alpha.4 baseline: 20 subpaths and 212 named exports.
• Portable disclosure checking, repository sweeps, client-zero identity checks, public agent instructions, and managed local-service contracts are included.

Release proof:

• Reviewed source candidate: d57087279f8e0ca9009392f0a02b0d0923ad53a1
• Merged and tagged commit: 18e8c72eefb0c4f7f29789a509404e1c6bee6af2
• Published tarball SHA-256: 230e03566a2313112c83e69d1f1569fe846886b2fbe718cbf797180a28e3cba1
• Published tarball SHA-1: 9383361f4c230545fe9dafad29e18b48f81163aa
• 279 files; 598 tests; 7 mutation-smoke controls; macOS and Windows portability checks passed.
• Exact-SHA security, maintainability, and failure-mode specialist reviews: clean.

Install the prerelease explicitly:

npm install @mnstry/atelier@0.2.0-alpha.5

See CHANGELOG.md for the complete change list and upgrade notes.