Moguet v2.4.1 — Config Sample & TOML Help Clarity

Moguet v2.4.1

This tracked file is the source of truth for release bodies. The English and
Japanese sections for each release describe the same scope.

English

Moguet v2.4.1 is a patch maintenance release that makes the strict TOML
user-configuration syntax easier to discover and provides a canonical
configuration example in both the repository and installed documentation.
It does not change the configuration schema, built-in defaults, or
fail-closed handling of malformed configuration.

Canonical configuration sample

• Add sample/config.toml containing the current schema-version 1 defaults:
  • review.pkgbuild = "prompt"
  • review.diff = "prompt"
  • build.mode = "normal"
• Install the example as:
  /usr/share/doc/moguet/examples/config.toml under the standard Arch package
  layout.
• README documentation points users to both the repository sample and
  installed example while retaining $XDG_CONFIG_HOME / HOME fallback
  ownership.

Clear TOML string syntax in help

• moguet --help now shows string enum values with TOML quotes:
  • review.pkgbuild = "prompt"|"skip"
  • review.diff = "prompt"|"skip"
  • build.mode = "normal"|"rebuild"|"clean"
• This prevents the previous help presentation from suggesting invalid bare
  TOML string values.
• The parser remains strict: malformed existing configuration still fails
  closed rather than being silently accepted or replaced with defaults.

日本語

Moguet v2.4.1は、strict TOML user configurationの正しいsyntaxを見つけやすくし、
repositoryとinstalled documentationの双方へcanonicalなconfiguration exampleを提供する
patch / maintenance releaseです。configuration schema、built-in default、malformed configに
対するfail-closed behaviorは変更しません。

canonical configuration sample

• current schema version 1 / defaultを示すsample/config.tomlを追加。
• standard Arch package layoutでは
  /usr/share/doc/moguet/examples/config.tomlとしてinstall。
• README英日からrepository sample / installed exampleを案内し、
  $XDG_CONFIG_HOMEとHOME fallbackのownershipを維持。

helpのTOML string syntax明確化

• moguet --helpのstring enumをquoted表記へ変更:
  • review.pkgbuild = "prompt"|"skip"
  • review.diff = "prompt"|"skip"
  • build.mode = "normal"|"rebuild"|"clean"
• bare TOML stringを書けるように見える旧presentationを解消。
• parser自体は変更せず、invalid existing configは引き続きfail closed。

Moguet v2.4.0 — Reviewed Source Workflow & CMake Migration

Moguet v2.4.0

This tracked file is the source of truth for release bodies. The English and
Japanese sections for each release describe the same scope.

English

Moguet v2.4.0 adds a reviewed-source workflow for AUR updates, an explicit
export parent for moguet -G, and clearer phase-level observations in
upgrade-all. It also completes the shared source-identity foundation and
repository build-infrastructure work: source/ avoids the root makepkg
workspace collision, while CMake / CTest now own the C++ build and test graph.
These changes preserve pacman / makepkg / Git ownership, existing make
developer entrypoints, and fail-closed safety boundaries; reviewed state is
explicit acknowledgement, not automatic security certification.

Reviewed AUR source revisions

• Moguet records the last AUR upstream revision explicitly accepted by the
  user as reviewed state at PackageBase scope. Fetched, reviewed, built, and
  installed revisions remain distinct, and reviewed state is independent of
  cache cleanup or recloning.
• For later updates, the review baseline is the previous reviewed commit to
  the exact fetched upstream commit, rather than the mutable cache HEAD.
  That pinned source revision is carried through review, safety preflight, and
  state publication.
• Review covers tracked repository content rather than a PKGBUILD-only
  extension whitelist. Added, changed, removed, and renamed content such as
  .install files, patches, service units, helper/config files, and other
  tracked files remains visible; binary or non-text changes are not treated as
  no change.
• Only explicit acceptance after successful review and preflight advances the
  reviewed state. Fetching, displaying a diff, building, installing,
  --nodiff, non-TTY operation, and --noconfirm do not manufacture review
  acceptance.
• When no reviewed state exists, including for existing users upgrading to
  this release, Moguet performs an initial full review from the empty tree to
  the exact target.
• If a recorded baseline object is unavailable, or current-schema state is
  invalid, corrupt, or source-mismatched, Moguet requires an explicit full
  rebaseline/rebind review rather than falling back to cache HEAD.
• Unsupported future state, unsafe history, store failures, and inconsistent
  observations fail closed instead of being treated as an empty diff or a
  reviewed result.
• This is a review-history and acknowledgement workflow for AUR source. It
  does not certify that an AUR package is safe or replace the user's review.

Explicit export destination for moguet -G

• Existing moguet -G <pkg> behavior remains compatible: without an option,
  the PackageBase is exported under the command-start current directory.
• moguet -G <pkg> --output-dir=DIR selects an existing export parent for
  that invocation. The attached --output-dir=DIR form is the public syntax;
  relative paths use the command-start current directory, and the PackageBase
  remains the direct-child destination.
• Existing destinations are never replaced. Parent identity, symlink, path
  containment, and other export safety checks remain fail-closed, and the
  option is operation-local rather than a persistent or global setting.

Clearer upgrade-all package-state observations

• Aggregate package-state semantics remain unchanged, while normal output now
  makes the system/source and AUR phase-level observations easier to
  distinguish alongside the aggregate result.
• A system/source Changed result with an AUR phase that is verified
  unchanged remains aggregate Changed, but is no longer as easy to read as
  an AUR update. Solver, update, and transaction semantics are unchanged.

Common source identity foundation

• A shared typed identity model now relates package children, PackageBases,
  source kind, repository/AUR/local source distinctions, and source revisions
  without flattening those identities into package names.
• This foundation is reused by the reviewed-source workflow and later
  profile/patch work. It does not itself add a public profile or PKGBUILD
  patch command.

Repository structure cleanup

• Moguet's production C++ tree moved from src/ to source/, with repository
  references updated consistently.
• The structure-only refactor avoids collision with makepkg's root-level
  src/ working directory and does not change runtime behavior or public CLI
  semantics.

CMake / CTest build infrastructure

• CMake is now canonical for the project-owned C++ compile, link, build, and
  install graph; CTest owns C++ test registration and execution. The PKGBUILD
  consumes the canonical CMake build/install path, while repository-specific
  validation remains with the Make frontend and scripts.
• The Makefile remains a thin developer shortcut and validation frontend, so
  the normal make workflow is retained. CMake presets and compile-database
  support provide the developer-facing build tooling.
• The project CMake minimum remains 3.18; direct configure retains that
  compatibility, while the tracked dev-debug preset requires CMake 3.19+.
  Ninja is an optional CMake generator, not a mandatory package dependency,
  and this migration does not change the public CLI contract.

日本語

Moguet v2.4.0は、AUR updateのreview済みsource revision workflow、
moguet -Gの明示的なexport親directory、upgrade-allのphase-level
observation明確化を追加します。さらに、common source identity foundationと
repository build infrastructureを整え、root makepkg work directoryとの衝突を
避けるsource/構成と、C++ build/test graphのCMake / CTest authorityを完成させます。
pacman / makepkg / Gitのownership、既存のmake developer entrypoint、fail-closed
safety boundaryは維持します。review済みstateは明示的なacknowledgementであり、
自動的なsecurity certificationではありません。

AUR sourceのreview済みrevision

• 利用者が明示的に受理したAUR upstreamの最後のrevisionを、PackageBase単位の
  review済みstateとして保持します。fetched、reviewed、built、installedのrevisionは
  分離され、review済みstateはcache cleanupやrecloneにも依存しません。
• 後続updateでは、mutableなcache HEADではなく、前回review済みcommitから今回の
  exact fetched upstream commitまでをreview baselineとします。このpinned source
  revisionをreview、安全preflight、state publicationまで一貫して使います。
• review対象はPKGBUILDだけのextension whitelistではなく、tracked repository
  content全体です。.install、patch、service unit、helper/config fileなどの追加・
  変更・削除・renameとその他tracked fileを保持し、binary / non-textの変更を変更なし
  として扱いません。
• reviewとpreflightが成功した後の明示的なacceptanceだけがreview済みstateを進めます。
  fetch、diff表示、build、install、--nodiff、non-TTY operation、--noconfirmから
  review acceptanceを暗黙に生成しません。
• review済みstateが存在しない場合は、既存利用者のupgrade後も含め、empty treeから
  exact targetまでのinitial full reviewを行います。
• 記録済みbaseline objectが利用不能な場合や、current-schema stateがinvalid / corrupt /
  source-mismatchedな場合は、cache HEADへfallbackせず明示的なfull rebaseline /
  rebind reviewを要求します。
• unsupported future state、unsafe history、store failure、inconsistent observationは、
  空のdiffやreview済み結果へ丸めずfail-closedで停止します。
• これはAUR sourceのreview history / acknowledgement workflowです。AUR packageの安全性を
  certifyするものでも、利用者自身のreviewを置き換えるものでもありません。

moguet -Gの明示的なexport先

• 既存のmoguet -G <pkg> behaviorは互換性を維持します。optionを指定しなければ、
  PackageBaseをcommand-start current directoryの下へexportします。
• moguet -G <pkg> --output-dir=DIRで、そのinvocationだけの既存export parentを選べます。
  公開syntaxはattached formの--output-dir=DIRで、relative pathはcommand-start current
  directory基準、PackageBaseは常にdirect-childのdestinationです。
• existing destinationは置換しません。parent identity、symlink、path containmentなどの
  export safety checkはfail-closedを維持し、このoptionはpersistent / global settingではなく
  operation-localです。

upgrade-allのpackage-state observation明確化

• aggregate package-state semanticsは変更せず、normal outputでsystem/sourceとAURの
  phase-level observationをaggregate resultと並べて区別しやすくします。
• system/sourceがChangedでAUR phaseが変更なしを確認済みの場合もaggregate Changedは
  維持しますが、AUR updateがあったようには読みにくくなります。solver、update、transaction
  semanticsは変更しません。

common source identity基盤

• package child、PackageBase、source kind、repository / AUR / local sourceの区別、source
  revisionの関係を、package nameへflattenしないshared typed identity modelで共通化します。
• このfoundationはreviewed-source workflowと後続のprofile / patch workで再利用しますが、
  それ自体でpublic profile commandやPKGBUILD patch commandを追加するものではありません。

repository structureの整理

• Moguetのproduction C++ treeをsrc/からsource/へ移し、repository内の参照を一貫して更新しました。
• structure-onlyのrefactorにより、makepkgがroot levelで使う作業用src/との名前衝突を避けます。
  runtime behaviorやpublic CLI semanticsは変更しません。

CMake / CTest build infrastructure

• project-ownedなC++ compile、link、build、install graphのcanonical authorityをCMakeへ移し、
  C++ testのregistration / executionをCTestが所有します。PKGBUILDはcanonicalなCMake
  build/install pathを利用し、repository固有validationはMake frontendとscriptsに残します。
• Makefileはthinなdeveloper shortcut / validation frontendとして維持し、通常のmake workflow
  を残します。CMake presetとcompile database supportにより、developer向けbuild toolingも整えます。
• projectのCMake minimumは3.18のままで、direct configureは3.18 compatibilityを維持します。
  tracked dev-debug presetはCMake 3.19+を必要とします。NinjaはoptionalなCMake generatorであり、
  mandatory package dependencyではありません。このmigrationによるpublic CLI contractの変更もありません。

Moguet v2.3.2

Moguet v2.3.2

This tracked file is the source of truth for release bodies. The English and
Japanese sections for each release describe the same scope.

English

Moguet v2.3.2 is a patch maintenance release that bounds file descriptor use
during large local-source workspace cleanup and corrects the presentation of
already-current split AUR targets in upgrade-all. The cleanup change preserves
the existing fail-closed safety invariants, and the presentation change remains
limited to authoritative typed UpToDate evidence.

Bounded local-source cleanup

• Large local source trees could build successfully but fail during cleanup
  with Too many open files under a constrained RLIMIT_NOFILE.
• Cleanup now uses bounded descriptor traversal instead of retaining one file
  descriptor per descendant. Ownership, symlink, filesystem-boundary, and
  concurrent-replacement checks remain fail-closed; opaque filesystem
  generation identity continues to reject inode-reuse ABA replacement.
• Regression coverage exercises successful cleanup of a large tree under a
  constrained file-descriptor limit.

Correct UpToDate split AUR presentation

• upgrade-all now projects a normal skip with authoritative typed
  AurUpdateExecutionReason::UpToDate evidence as VerifiedUnchanged, rather
  than NotObserved / ObservationNotPrepared.
• The requested split child and its PackageBase identity remain intact, but
  that identity difference alone no longer makes an authoritative UpToDate
  target attention-required.
• Genuine split Updated, Unsupported, Incomplete, failure, and other
  attention states remain visible, while standalone upgrade-aur typed-skip
  presentation is unchanged. This does not treat every skipped target as
  VerifiedUnchanged.

日本語

Moguet v2.3.2は、大規模local source workspace cleanupのfile descriptor使用量を
boundedにし、upgrade-allで既に最新のsplit AUR targetを正しく表示するpatch / maintenance
releaseです。cleanupの既存fail-closed safety invariantを維持し、presentation修正は
authoritativeなtyped UpToDate evidenceを持つ場合だけに限定します。

local source cleanupのFD bounded化

• 大規模local source treeではbuildが成功しても、制約されたRLIMIT_NOFILEの下でcleanupが
  Too many open filesにより失敗することがありました。
• cleanupはdescendantごとにfile descriptorを保持せず、boundedなdescriptor traversalを
  使います。ownership、symlink、filesystem boundary、concurrent replacementに対する
  fail-closed checkを維持し、opaqueなfilesystem generation identityによってinode再利用の
  ABA replacementも引き続き拒否します。
• 制約されたfile descriptor limitの下で大規模treeを正常にcleanupするregressionを
  coverageへ含めています。

UpToDate split AUR presentationの修正

• upgrade-allでは、authoritativeなtyped
  AurUpdateExecutionReason::UpToDate evidenceを持つnormal skipを、
  NotObserved / ObservationNotPreparedではなくVerifiedUnchangedへprojectします。
• requested split childとPackageBaseのidentityは維持し、そのidentity差だけを理由に
  authoritativeなUpToDate targetをattention-requiredにしません。
• 実際のsplit Updated、Unsupported、Incomplete、failure、その他attentionが必要な
  stateは引き続き表示し、standalone upgrade-aurのtyped skip presentationも変えません。
  すべてのskipped targetをVerifiedUnchangedにする変更ではありません。

v2.3.1

Moguet v2.3.1

This tracked file is the source of truth for release bodies. The English and
Japanese sections for each release describe the same scope.

English

Moguet v2.3.1 is a maintenance release that makes trusted source checkouts and
installed package-relation observations more reliable, gives Moguet-owned
confirmation and cancellation one consistent contract, and establishes
Discussions-first community routing. It preserves the existing ownership of
Git, pacman, libalpm, and makepkg and keeps ambiguous or malformed states
fail-closed.

Trusted Git fetch stability

• Managed source-repository fetches pass --no-auto-maintenance to Git so
  background automatic maintenance cannot race trusted-checkout revalidation
  after git fetch returns.
• Trusted cache, repository binding, descendant, and concurrent-replacement
  validation remain in place; the change does not relax checkout trust.

Valid libalpm Provides projection

• Installed and repository Provides projection accepts valid legacy ALPM
  SONAME v1 metadata instead of misclassifying the whole relation inventory as
  malformed.
• Unversioned and ordinary package-version equality semantics remain intact.
  Missing, unsupported, or genuinely malformed relation data still blocks
  unsafe planning and mutation.

Consistent confirmation and cancellation

• Moguet-owned [Y/n], [y/N], and [y/n] prompts share one grammar for
  affirmative, negative, cancel, empty-input, and EOF handling.
• Declined, cancelled, unavailable-input, input-failure, and actual operation
  failure outcomes remain distinct. Required declines and cancellations stay
  non-zero, while existing optional-skip behavior is preserved.

Discussions-first community entry

• README and contribution guidance route questions, suspected bugs, feature
  ideas, and design or workflow proposals to GitHub Discussions first, while
  Issues remain maintainer-managed concrete work items.
• A dedicated Bug Issue Form remains available for well-observed reproducible
  bugs, and a low-barrier Bug Discussion Form supports earlier triage.
• Security-sensitive reports continue to use GitHub Private vulnerability
  reporting rather than public Discussions or Issues. English and Japanese
  guidance describe the same routing.

日本語

Moguet v2.3.1は、trusted source checkoutとinstalled package relationの観測を
より確実にし、Moguetが所有するconfirmation / cancellationを一貫した契約へ統一し、
Discussions-firstのcommunity routingを整備するmaintenance releaseです。Git、pacman、
libalpm、makepkgの既存ownershipを維持し、ambiguousまたはmalformedなstateでは
fail-closedを保ちます。

trusted Git fetchの安定化

• managed source repository fetchではGitへ--no-auto-maintenanceを渡し、git fetch
  return後のbackground automatic maintenanceとtrusted checkout再検証のraceを防ぎます。
• trusted cache、repository binding、descendant、concurrent replacementのvalidationは
  維持し、checkout trustを緩和しません。

有効なlibalpm Provides projection

• installed / repositoryのProvides projectionは、有効なlegacy ALPM SONAME v1
  metadataをrelation inventory全体のmalformedとして誤判定せず受理します。
• unversioned relationと通常package-version equalityのsemanticsを維持します。
  missing、unsupported、または実際にmalformedなrelation dataは、unsafeなplanや
  mutationへ進む前に従来どおり停止します。

一貫したconfirmationとcancellation

• Moguetが所有する[Y/n]、[y/N]、[y/n] promptは、yes、no、cancel、empty input、
  EOFを1つのgrammarで扱います。
• Declined、Cancelled、input unavailable、input failure、実際のoperation failureを
  区別します。requiredなdecline / cancelはnon-zeroを維持し、既存のoptional skip
  behaviorも変えません。

Discussions-firstのcommunity入口

• READMEとcontribution guidanceは、質問、不具合かもしれない相談、機能要望、設計・
  workflow提案をまずGitHub Discussionsへ案内し、Issueはmaintainerが管理する具体的な
  work itemとして維持します。
• 観測・再現情報が十分なbugには専用Bug Issue Formを残し、早いtriageには投稿負担を
  抑えたBug Discussion Formを用意します。
• security-sensitiveな報告はpublic Discussion / Issueではなく、引き続きGitHub Private
  vulnerability reportingへ案内します。English / Japaneseで同じroutingを示します。

v2.3.0

Moguet v2.3.0

This tracked file is the source of truth for release bodies. The English and
Japanese sections for each release describe the same scope.

English

Moguet v2.3.0 strengthens release validation, unifies public CLI diagnostics,
and makes source builds safer for repository PackageBases and per-package
customization. It preserves pacman / libalpm as transaction authority and
stops fail closed when Moguet cannot establish a safe pre-transaction result.

Validation reliability and release-gate clarity

• Validation commands preserve producer failures instead of allowing later
  formatting or status work to mask them.
• Focused and incremental validation tracks dependencies and build signatures
  so stale binaries are not accepted as current evidence.
• The canonical release gate retains full host coverage without duplicating
  release-only checks, while host, offline/current-Arch container, and live
  provider / AUR / local lanes have explicit responsibilities.

Coherent public CLI and transaction diagnostics

• The parser, help, man pages, and Bash / Zsh / Fish completions derive their
  public operation and option surface from a shared authority.
• Source-aware diagnostics project typed readiness and outcomes through a
  consistent hierarchy of summary, attention, and necessary detail.
• Conflicts and Replaces receive a typed pre-transaction assessment against
  installed and planned packages, provided components, and applicable version
  relations. Unknown, invalid, or incomplete observations fail closed rather
  than being treated as absence.
• A matching replacement is shown as potential impact that requires review.
  Moguet does not automatically remove packages, choose replacements, or
  resolve conflicts; pacman / libalpm remain transaction authority.

Repository PackageBase artifact-selection safety

• Official-repository source builds require a strict repository package and
  PackageBase identity, build each PackageBase once, and validate every
  produced artifact.
• Only requested Explicit child packages are selected for installation;
  sibling and debug artifacts are not installed implicitly.
• Unknown, duplicate, or otherwise unsafe artifact identity fails closed. This
  allows multiple-artifact PackageBases such as OBS Studio to be handled
  without broadening install selection.

Effective per-package build customization

• build <pkg> [V=K...] supports either a package-specific complete override
  or a local modification layered on the existing makepkg.conf baseline.
• A tested one-off assignment can be carried into a persistent add-src
  preference without rewriting the system-wide makepkg.conf.
• Assignments are applied after makepkg loads its configuration so they remain
  effective overrides.
• Whether variables such as CFLAGS or CXXFLAGS affect a result still
  depends on the PKGBUILD and upstream build system; this release does not
  recommend any optimization flag.

日本語

Moguet v2.3.0はrelease validationを強化し、public CLI diagnosticを一貫させ、
repository PackageBaseとpackage単位customizationのsource buildをより安全にする
releaseです。package transactionのauthorityはpacman / libalpmに維持し、安全な
transaction前判定を確立できない場合はfail-closedで停止します。

validation reliabilityとrelease gateの明確化

• validation commandはproducer failureを保持し、後続のformattingやstatus処理に
  failureをmaskさせません。
• focused / incremental validationはdependencyとbuild signatureを追跡し、stale binaryを
  current evidenceとして受け入れません。
• canonical release gateはrelease-only checkを重複させずにfull host coverageを維持し、
  host、offline/current Arch container、live provider / AUR / local laneの責務を
  明確に分けます。

一貫したpublic CLIとtransaction前diagnostic

• parser、help、man page、Bash / Zsh / Fish completionは、public operation / option
  surfaceをshared authorityから導出します。
• source-aware diagnosticは、typed readinessとoutcomeをsummary、attention、必要なdetailの
  一貫した階層へ投影します。
• Conflicts / Replacesは、installed / planned package、provided component、適用可能な
  version relationに対してtransaction前にtyped評価します。Unknown、invalid、または
  incompleteなobservationはabsenceとして扱わずfail-closedにします。
• matching replacementはreviewが必要なpotential impactとして表示します。Moguetはpackageの
  remove、replacementの選択、conflict解決を自動化せず、pacman / libalpmをtransaction
  authorityとして維持します。

repository PackageBaseのartifact選択安全性

• official repository source-buildではstrictなrepository package / PackageBase identityを
  必須とし、各PackageBaseを1回buildして、生成された全artifactを検証します。
• install対象に選ぶのはrequested Explicit child packageだけで、sibling / debug artifactを
  暗黙にinstallしません。
• unknown、duplicate、その他unsafeなartifact identityはfail-closedになります。これにより
  OBS Studioのようなmultiple-artifact PackageBaseでもinstall選択を広げずに扱えます。

実際に有効になるpackage単位build customization

• build <pkg> [V=K...]では、package単位のcomplete override、または既存
  makepkg.conf baselineを継承したlocal modificationを指定できます。
• one-offで確認したassignmentをpersistentなadd-src preferenceへ移行でき、system-wideの
  makepkg.conf自体は書き換えません。
• assignmentはmakepkgがconfigを読み込んだ後に適用するため、effective overrideとして残ります。
• CFLAGS / CXXFLAGS等が実際の結果へ反映されるかはPKGBUILDとupstream build systemに
  依存し、このreleaseは特定のoptimization flagを推奨しません。

v2.2.0

Moguet v2.2.0

This tracked file is the source of truth for release bodies. The English and
Japanese sections for each release describe the same scope.

English

Moguet v2.2.0 extends package planning and execution safety while preserving
its pacman-first and fail-closed boundaries. It makes ambiguity visible,
validates version constraints across source observations, and provides one
human-readable plan for supported no-mutation workflows.

#388 — Ambiguous provider installed-state visibility

• Ambiguous provider candidates now show [installed] when a same-name
  installed package is observed.
• If installed-state lookup is unavailable or cannot be trusted, the candidate
  shows [installed state unknown] with a warning; an authoritative absence
  remains unmarked.
• Installed-state text is presentation-only. Provider selection policy,
  candidate order, numbering, explicit choice, and routing are unchanged; no
  provider is selected automatically.

#351 — Version constraint satisfiability

• Consumer requirements and provider capabilities are kept separate and
  evaluated as typed results: Unconstrained, Satisfied, Unsatisfied,
  Unknown, Invalid, or Conflicting.
• Repository, AUR, provider, and local observations retain their source-aware
  identity so version compatibility is not inferred from a name alone.
• Mutation routes perform the same production preflight before clone, fetch,
  build, install, or transaction work. Constraints that cannot be proven safe
  fail closed instead of being guessed or silently routed elsewhere.

#352 — Unified plan and global dry-run

• A unified human-readable plan describes the observations and decisions for
  supported Moguet-owned routes.
• Global --dry-run is supported for:
  -S install / system-update, fetch, remote build, local build, upgrade,
  upgrade-aur, and upgrade-all.
• Dry-run is no-mutation and unsupported routes fail closed. An actual
  execution revalidates the current state instead of reusing an observation as
  approval or execution capability.

日本語

Moguet v2.2.0は、pacman-firstかつfail-closedの境界を保ったまま、package
planningとexecution safetyを拡張するreleaseです。曖昧さを表示し、source
observationをまたぐversion constraintを検証し、supportedなno-mutation workflowを
1つのhuman-readable planで確認できるようにしました。

#388 — ambiguous providerのinstalled state表示

• ambiguous provider candidateと同名のinstalled packageが観測された場合、候補に
  [installed]を表示します。
• installed-state lookupが利用できない、または信頼できない場合は、候補に
  [installed state unknown]とwarningを表示します。authoritativeに未installと判定できる
  場合はsuffixを付けません。
• installed-state表示はpresentation-onlyです。provider selection policy、候補順、番号、
  明示選択、routingは変更せず、providerを自動選択しません。

#351 — version constraint satisfiability

• consumer requirementとprovider capabilityを分離し、Unconstrained、Satisfied、
  Unsatisfied、Unknown、Invalid、Conflictingのtyped resultとして評価します。
• repository、AUR、provider、localのobservationはsource-awareなidentityを保ち、nameだけ
  からversion compatibilityを推測しません。
• mutation routeではclone、fetch、build、install、transactionへ進む前に同じproduction
  preflightを実行します。安全を証明できないconstraintは推測や別経路への黙ったfallbackをせず、
  fail-closedになります。

#352 — unified planとglobal dry-run

• supportedなMoguet-owned routeのobservationとdecisionを、統一human-readable planで表示します。
• global --dry-runは、次のrouteに対応します。
  • -S install / system-update
  • fetch
  • remote build
  • local build
  • upgrade
  • upgrade-aur
  • upgrade-all
• dry-runはno-mutationで、unsupported routeはfail-closedです。actual executionはobservationを
  approvalやexecution capabilityとして再利用せず、current stateから再validationします。

Moguet v2.1.0

Moguet v2.1.0

This tracked file is the source of truth for the GitHub Release body. The
English and Japanese sections describe the same release scope.

English

Moguet v2.1.0 expands Moguet's source-aware AUR workflows while preserving its
pacman-first and fail-closed boundaries. It makes ambiguous choices explicit,
adds a local PKGBUILD entry point, and strengthens the validation lanes that
protect these workflows.

Package workflows

• When an AUR dependency has several providers, an interactive TTY now lists
  the source-aware candidates by number and requires one explicit choice. No
  provider is selected by default; non-TTY, EOF, --noconfirm, and cancellation
  remain fail-closed.
• moguet -S --select <query> provides interactive package discovery across
  official repositories and AUR. It supports explicit package numbers,
  multiple selections, inclusive ranges, and displayed official groups without
  guessing a default choice.
• Selected repository roots are installed first through one exact pacman
  transaction. Only then do selected AUR roots enter the source-build workflow,
  so source-aware install routing stays visible and a later AUR failure does
  not hide an already completed repository transaction.
• moguet build --local <directory> [V=K...] builds an explicitly selected
  local PackageBase without treating a path-like remote package operand as a
  local source. It preserves the user-owned source tree and validates the local
  metadata before build and installation.
• Local PKGBUILD builds can resolve their AUR dependencies, build the
  required PackageBases, and install the validated dependency and local package
  artifacts through the established build/install boundaries.

Validation and maintenance

• The Arch Docker offline lane validates a clean source snapshot without
  runtime network access. The live lane separately exercises real provider
  selection, AUR build/install, and local PKGBUILD end-to-end flows.
• The heavyweight integration-test binaries now use target-isolated object
  builds with dependency tracking and link firewalls, improving incremental
  validation without changing runtime behavior.
• Developers can opt into ccache for compilation and an optional linker such
  as mold through existing Make overrides; neither is a runtime or package
  requirement.
• TTY and locale authority handling is aligned across interactive selection,
  diagnostics, and gettext fallback, so non-interactive calls do not consume
  input intended for prompts.
• Obsolete production artifacts from the jpacker v1.16.0 transition have been
  removed. Historical migration guidance, fixtures, and license evidence remain
  available where they document the supported transition.

Repositories

• Canonical GitHub repository: https://github.com/seekerkrt/moguet
• GitLab mirror: https://gitlab.com/seekerkrt/moguet

日本語

Moguet v2.1.0は、pacman-firstかつfail-closedの境界を保ったまま、source-awareな
AUR workflowを拡張するreleaseです。曖昧な選択を明示化し、local PKGBUILDの入口を追加し、
これらのworkflowを守るvalidation laneを強化しました。

Package workflow

• AUR dependencyに複数providerがある場合、interactive TTYはsource-awareなcandidateを
  番号付きで表示し、1つの明示選択を求めます。default選択はなく、non-TTY、EOF、
  --noconfirm、cancelは引き続きfail-closedです。
• moguet -S --select <query>はofficial repositoryとAURをまたぐinteractive package
  discoveryを提供します。package番号、複数選択、inclusive range、表示済みofficial groupを
  明示的に選択でき、defaultを推測しません。
• 選択したrepository rootは、まず正確に1つのpacman transactionでinstallします。その後に
  選択したAUR rootだけがsource-build workflowへ入るため、source-awareなinstall routingは
  見通しを保ち、後続AUR failureが完了済みrepository transactionを隠すことはありません。
• moguet build --local <directory> [V=K...]は、pathのように見えるremote package operandを
  local sourceとして扱わず、明示したlocal PackageBaseをbuildします。user所有のsource treeを
  保持し、local metadataを検証してからbuild / installします。
• local PKGBUILD buildではAUR dependencyを解決し、必要なPackageBaseをbuildし、確立済みの
  build / install boundaryに従って検証済みのdependencyとlocal package artifactをinstallできます。

Validationとmaintenance

• Arch Docker offline laneはruntime network accessなしでcleanなsource snapshotを検証します。
  live laneはreal provider selection、AUR build / install、local PKGBUILDのend-to-end flowを
  個別に実行します。
• 重量級integration test binaryは、targetごとに分離したobject build、dependency tracking、
  link firewallを使用するようになり、runtime behaviorを変えずにincremental validationを改善しました。
• developerは既存のMake overrideにより、compileへccache、linkerへmoldなどを任意で使用できます。
  どちらもruntime / package requirementではありません。
• TTYとlocaleのauthorityをinteractive selection、diagnostic、gettext fallbackで整合させ、
  non-interactive callがprompt用inputを消費しないようにしました。
• jpacker v1.16.0移行に由来するobsoleteなproduction artifactを削除しました。supported
  transitionを説明するhistorical migration guidance、fixture、license evidenceは必要な範囲で
  保持しています。

Repository

• canonical GitHub repository: https://github.com/seekerkrt/moguet
• GitLab mirror: https://gitlab.com/seekerkrt/moguet

Moguet v2.0.1

Moguet v2.0.1

This tracked file is the source of truth for the GitHub Release body. The
English and Japanese sections describe the same release scope.

English

Moguet v2.0.1 is a narrow patch release that completes the XDG config storage
contract adopted for v2.0.0. It fixes the source-build preference storage issue
tracked in #335.

Fixed

• add-src, edit-src, list-src, del-src, and revert, together with the
  build and upgrade readers, now use
  ${XDG_CONFIG_HOME:-$HOME/.config}/moguet/source-build.d/ as their single
  authority.
• Source-build preference operations no longer require sudo or use a
  system-wide configuration store.
• An unset or empty XDG_CONFIG_HOME falls back to $HOME/.config. An explicit
  value must be an absolute, safe, existing base directory.
• Root execution uses root's own XDG context and never infers another user from
  SUDO_USER.
• The required Moguet directories are created safely when first needed, rather
  than during package installation.

Migration

• /etc/jpacker/package.build/ is now manual migration input only. Moguet does
  not create, read, write, fall back to, merge, copy, rewrite, or delete it at
  runtime.
• Existing preferences are not migrated automatically. Follow the
  English Migration Guide
  or Japanese Migration Guide.
• The published v2.0.0 tag, Release, and release body remain unchanged
  historical artifacts.

Repositories

• Canonical GitHub repository: https://github.com/seekerkrt/moguet
• GitLab mirror: https://gitlab.com/seekerkrt/moguet

Not included

Interactive package discovery, ambiguous AUR provider selection, shell
completion changes, and AUR package publication are outside this patch release.

日本語

Moguet v2.0.1は、v2.0.0で採用したXDG config storage契約を完成させる限定的な
patch releaseです。#335で追跡した
source-build preferenceの保存先問題を修正します。

修正内容

• add-src、edit-src、list-src、del-src、revertと、build / upgrade側の
  readerは、${XDG_CONFIG_HOME:-$HOME/.config}/moguet/source-build.d/だけを
  authorityとして使用します。
• source-build preference操作からsudoとsystem-wide config storeへの依存を
  撤去しました。
• XDG_CONFIG_HOMEがunsetまたはemptyの場合は$HOME/.configへfallbackします。
  明示値にはabsoluteかつ安全で、既存のbase directoryであることを要求します。
• root実行時はroot自身のXDG contextを使い、SUDO_USERから別userを推測しません。
• 必要なMoguet directoryはpackage installation時ではなく、最初に必要とする実行時に
  安全に作成します。

Migration

• /etc/jpacker/package.build/は手動migration専用のlegacy inputです。Moguetは
  runtimeでこれをcreate、read、write、fallback、merge、copy、rewrite、deleteしません。
• 既存preferenceは自動移行しません。
  English Migration Guideまたは
  日本語Migration Guideを
  参照してください。
• 公開済みv2.0.0のtag、Release、release bodyは変更しないhistorical artifactとして
  維持します。

Repository

• canonical GitHub repository: https://github.com/seekerkrt/moguet
• GitLab mirror: https://gitlab.com/seekerkrt/moguet

含めないもの

対話的package discovery、ambiguous AUR provider選択、shell completion変更、AUR package
publicationは、このpatch releaseのscope外です。

Moguet v2.0.0

Moguet v2.0.0

This tracked file is the source of truth for the GitHub Release body. The
English and Japanese sections describe the same release scope.

English

Moguet v2.0.0 is the breaking successor to jpacker v1.16.0. It preserves the
pacman-first execution base while changing the project, command, package,
storage, configuration, localization, documentation, and repository identity.

Highlights

• Renames the project and brand to Moguet, with moguet as the only
  command, binary, package, XDG application name, and gettext domain.
• Keeps package transactions with pacman, source package builds with makepkg,
  and repository transport with Git while retaining the existing fail-closed
  planning, artifact validation, and external-command visibility boundaries.
• Uses XDG user directories for Moguet config, state, and cache, with a typed
  read-only TOML configuration at moguet/config.toml.
• Provides English-authoritative CLI text and documentation with formal
  Japanese translations, locale catalogs, man pages, and shell completion.
• Ships a Moguet-only package payload with no jpacker command alias and no
  provides, conflicts, or replaces relationship with jpacker v1.16.0.

Breaking migration

• The command and package name change from jpacker to moguet.
• Moguet does not read /etc/jpacker/jpacker.conf as its normal configuration
  and does not copy, rewrite, or delete /etc/jpacker automatically.
• The production source-preference compatibility store remains
  /etc/jpacker/package.build/; the Moguet package does not create or own it.
• Moguet and jpacker v1.16.0 may coexist for migration and rollback, but their
  mutating operations must not run concurrently.
• Follow the English Migration Guide
  or Japanese Migration Guide
  before changing an installed system.

Repository and v1 maintenance

• Canonical GitHub repository: https://github.com/seekerkrt/moguet
• GitLab mirror: https://gitlab.com/seekerkrt/moguet
• The former seekerkrt/jpacker slugs remain redirect-only and must not be
  reused for another repository.
• The v1.16.0 tag and jpacker v1.16.0 Release remain available under their
  original identity. There is no permanent v1 maintenance branch; a critical
  fix branch, if needed, starts from the immutable v1.16.0 tag.

Not included

AUR package publication is not part of this release operation. No Moguet AUR
URL or old-package rename/deprecation action is implied by these notes.

日本語

Moguet v2.0.0は、jpacker v1.16.0の後継となるbreaking releaseです。pacman-firstな
実行基盤を維持しながら、project、command、package、storage、config、localization、
documentation、repositoryのidentityを変更します。

主な変更

• project / brandを Moguet へ変更し、command、binary、package、XDG application名、
  gettext domainをmoguetへ統一しました。
• package transactionはpacman、source package buildはmakepkg、repository transportは
  Gitへ委ね、既存のfail-closed plan、artifact validation、external command可視化の境界を
  維持します。
• Moguetのconfig / state / cacheをXDG user directoryへ配置し、
  moguet/config.tomlのtyped read-only TOML configを使用します。
• EnglishをCLI text / documentationのauthorityとし、日本語の正式翻訳、locale catalog、
  man page、shell completionを提供します。
• Moguet専用package payloadを提供します。jpacker command aliasはなく、jpacker v1.16.0
  に対するprovides、conflicts、replacesも宣言しません。

Breaking migration

• command / package名はjpackerからmoguetへ変わります。
• Moguetは/etc/jpacker/jpacker.confを通常configとして読まず、/etc/jpackerを自動で
  copy、rewrite、deleteしません。
• productionのsource-preference compatibility storeは
  /etc/jpacker/package.build/に残り、Moguet packageは作成・所有しません。
• migration / rollback中はMoguetとjpacker v1.16.0をcoexistできますが、両者のmutating
  operationを同時実行しないでください。
• installed systemを変更する前に
  English Migration Guideまたは
  日本語Migration Guideを
  確認してください。

Repositoryとv1 maintenance

• canonical GitHub repository: https://github.com/seekerkrt/moguet
• GitLab mirror: https://gitlab.com/seekerkrt/moguet
• 旧seekerkrt/jpacker slugはredirect専用として保持し、別repositoryへ再利用しません。
• v1.16.0 tagとjpacker v1.16.0 Releaseは元のidentityで保持します。permanentなv1
  maintenance branchは作らず、重大修正が必要な場合だけimmutableなv1.16.0 tagから
  branchを作成します。

含めないもの

AUR package publicationは今回のrelease operationに含めません。このrelease noteはMoguetの
AUR URL、旧packageのrename / deprecationを示すものではありません。

jpacker v1.16.0

概要

jpacker v1.16.0をリリースします。

このreleaseでは、installed AUR packageを更新するupgrade-aurと、system package・registered source package・remaining installed AUR packageを順に扱うupgrade-allを追加します。

あわせて、separated source-build lifecycleをPackageBase単位のmultiple artifactへ拡張し、split packageのrequired childをmetadata identityで選択してtyped pacman -U transactionへ渡します。v1.xで安全にownershipを証明できない--rmdepsは、source routeのexternal mutation前にfail closedとする正式なunsupported contractへ統一しました。

Included PRs

Installed AUR update workflow

• #273、#274、#275: installed AUR inventory、AUR RPC query、update planning
• #276、#277、#278: typed preflight、provider origin、strict source preference
• #279、#280、#282、#283: preparation、runner、result propagation、upgrade-aur CLI

Unified upgrade workflow

• #284、#285、#286、#287、#288: mutation-free planning、system/source phase、filtered AUR phase、typed aggregate result、upgrade-all CLI

Split package artifact lifecycle

• #291、#292、#293: required-child selection、multiple artifact workspace、artifact identity correlation
• #294、#295、#296: PackageBase install preparation、BuildPlan coverage、production split package support

Release safety and audit

• #298: v1.xの--rmdeps unsupported policyを正式化
• #299: v1.16.0 final release audit修正

主な変更

Installed AUR package update / upgrade-aur

jpacker upgrade-aurは、local package databaseのinstalled foreign inventoryから、現在もAURのexact packageとして解決できるpackageだけを更新します。official repository packageとnon-AUR foreign packageは対象にせず、pacman -Syuも実行しません。

• AUR RPC queryとupdate planningで更新対象とversionをtyped dataとして保持
• update plan全体をsource mutation前に検証するtyped preflight
• prepared PackageBase work itemを順に扱うpreparation / runner境界
• child単位のselected artifact、install reason、outcomeを保持するresult propagation
• 最初のfailureで停止し、完了済みtargetとnot attempted targetを区別
• no-update時は成功し、git、makepkg、pacman、sudoを起動しない
• partial completion、build / install failure、transaction成功後のcleanup failureはnon-zero

Unified upgrade workflow / upgrade-all

jpacker upgrade-allは、次のphaseをtargetなしのaggregate operationとして扱います。

system package upgrade
  → registered source package processing
  → fresh foreign package inventory
  → remaining AUR package update

explicit source preferenceはautomatically detected AUR targetより優先され、同じpackageまたはPackageBaseを二重にbuild / installしません。このoperationはsingle atomic transactionではありません。各phaseは最初のfailureまたはcleanup failureで停止し、完了済みpackageを自動rollbackせず、後続phaseとwork itemをnot attemptedとして報告します。partial completionとcleanup failureはいずれもnon-zeroです。

Separated source-build lifecycle

AUR BuildPlan-backed source buildは、次のownershipと順序を使用します。

PackageBase plan
  → invocation-owned fresh PKGDEST
  → makepkg --packagelist
  → build-only makepkg
  → aggregate artifact validation
  → metadata identityによるrequired-child selection
  → typed sudo pacman -U transaction

• repository checkout、build、workspace、install transactionをPackageBase単位で処理
• 1 PackageBaseを1回buildし、selected childrenを1回のpacman -U transactionへ渡す
• makepkgはsource artifactのbuild、pacmanは検証済みartifactのinstallを所有
• jpackerはfresh workspace、artifact validation / selection、install policyを所有
• retained workspaceやartifactを後続invocationで自動再利用しない

--rmdeps

v1.xのseparated AUR / source-build lifecycleでは、--rmdepsを正式にunsupportedとします。jpackerは、現在のinvocationだけが新規導入したmake / check dependencyのexact setをauthoritativeに証明できません。

• source routeでは既存のroute-specific boundaryに従い、external mutation前にfail closed
• --rmdepsをmakepkg -rへ変換しない
• pacman -Rns、pacman -Qdt、独自orphan cleanupを実行しない
• automatic rollbackや削除対象を推測しない
• --noconfirmでguardを迂回できない
• configのRMDEPS=true / 1 / yesも同じguardへ接続

pacman-only routeでは、このoptionはjpacker global optionとして消費されますが、作用せずpacmanへも転送されません。

Split package / artifact install

• 1つのsplit PackageBaseが生成する複数artifactをordered aggregateとして検証
• package filenameの推測ではなくpackage metadata identityでrequired childを選択
• BuildPlanが必要とする複数childをrequired-target orderで1 transactionへ渡す
• expectedだがrequiredでないsibling / debug artifactをunselected resultとして保持
• stale、ambiguous、missing、duplicate、mismatched artifactはinstall前にfail closed
• transaction failure時にchildごとのpartial successを推測しない

Final release audit fixes

• cache rootをprivate modeで作成し、Git mutation前のvalidationを強化
• pacman-managed configのbackup=('etc/jpacker/jpacker.conf') metadataを追加
• help、man page、Bash / Zsh / Fish completionのparityを修正
• config RMDEPSからunsupported guardまでのregression coverageを追加
• libcurl callback境界でC++ exceptionをcontain
• AUR RPCのencode failureがsilent skipされないように修正
• release version、package metadata / payload、license、Markdown local linkのrelease checksを強化

jpacker v1 / pactune v2 positioning

v1.16.0 is expected to be the final feature release under the jpacker name and the v1 series.

Future development is planned to continue in the v2 series under the new pactune name.

A further v1 maintenance release may still be published if a critical bug, safety issue, or compatibility problem is discovered.

Migration guidance for jpacker v1 users is planned to be provided when pactune v2.0.0 is released.

Version

• VERSION: 1.15.0 → 1.16.0
• generated man page: jpacker 1.16.0

Validation

• make clean && make -j2: PASS
• compiler warning: 0
• make test: PASS
• make release-check: PASS
• ./jpacker --version: jpacker v1.16.0
• help header: jpacker v1.16.0
• generated man pageとtemplate / VERSIONの一致: PASS
• groff -ww -man -Tutf8 man/jpacker.8: PASS
• Bash / Zsh / Fish completion syntax: PASS
• bash -n PKGBUILD: PASS
• makepkg --printsrcinfo: pkgver = 1.16.0、source tag v1.16.0、config backup metadataを確認
• package metadata / payload check: PASS
• GPL / legacy MIT / third-party license compliance: PASS
• tracked Markdown local link check: PASS
• git diff --check: PASS

実行していないもの:

• real sudo pacman
• package install / remove
• system upgrade、sync database refresh / mutation
• tag、GitHub Release、GitLab Release mirrorの作成または更新

Compatibility / safety boundaries

• current project nameとこのreleaseのidentityはjpackerのまま維持
• pactune v2のrename、implementation、release時期をこのreleaseでは確定しない
• existing CLI、config format、/etc/jpacker layoutを自動移行または削除しない
• system package transactionはpacman、source artifact buildはmakepkgが所有
• validated source artifact installはtyped pacman -Uへ委譲
• upgrade-aurとupgrade-allはfailure後のautomatic rollbackを行わない
• separated source routeの--rmdepsはdependency removalへ変換しない
• v1.14.0以前のreleaseはMIT Licenseを維持し、v1.15.0以降はGPL-3.0-or-later