Changelog - 2026-10-17

VULCAN 0.2.0-0: the project contract, atlas reads other projects, hooks fail closed

Type: Breaking Change, Feature, Security

In one line. A project describes itself once in .configs/vulcan.config.ts, vulcan sync commits that description as a data manifest, and atlas serves any project that has one - its own and the ones it builds on.

Warning: A project upgrading from 0.1.0-x has migration steps: packages in the config, packages: in every changelog, a committed manifest, and renamed make targets. Follow Adopting VULCAN, steps 3 to 5.

What changed

• One config for everything. packages (npm names, paths, aliases, retired packages), knowledge.syncAreas, the whole okf section, atlas.sources and digest live in the config. okf and atlas carry no project's names.
• The project manifest. vulcan sync writes .agents/vulcan.manifest.json, data only, and you commit it. atlas reads the manifest, never the config and never the project's code.
• Package identity is the npm name. Tables, tool answers and changelogs name @venizia/ignis-kernel. A directory or an alias still works as input.
• Changelogs declare their packages. packages: [npm names] in each entry's frontmatter; vulcan x atlas changelogs migrate writes it. okf check --strict checks it.
• Releases from tags, symbols from .d.ts. atlas computes releases from the git tags and reads symbols from the built or installed .d.ts. reference/releases.json and symbols.json leave the project.
• atlas serves other projects. atlas.sources or --source owner/repo@ref: a cached git partial clone, an offline fallback, a GitHub tarball when git is missing. See the atlas guide.
• atlas ships code only. No packaged IGNIS corpus, no snapshot mode. With nothing to serve it exits 2 and says how to get a source.
• Shipped hooks fail closed. A hook that cannot run (no node_modules, no bun) exits 2, so the write guard blocks instead of letting every Bash call through. A bare bun install still passes.
• vulcan sync --prune. Removes old VULCAN and plugin-era hook commands and dead skill links, never your own hooks. doctor reports what it would remove.
• Rule integrity. A V- ID in your rules must name a live base rule. After an upgrade, sync prints each base rule that was added, changed or removed.
• Concepts that name code. A concept's symbols: are locked by signature with vulcan x atlas concepts stamp; concepts check fails when one is gone or changed.
• Smaller fixes. Skill links survive upgrades, vulcan.mk targets carry descriptions, the session digest reads bold rows and a minimap block, <command> --help prints help, and an unknown argument is an error.
• Releases no longer wait for npm. The release run ends once it tags. A fresh version can take minutes to download; confirm with npm view @venizia/vulcan versions.

Commands and keys

Name	Kind	Meaning
packages	config	every package in release order: dir, name, path, aliases, retired
atlas.sources	config	other projects atlas serves: name, repo, ref
digest.oftenDropped	config	the rule IDs the session digest repeats
vulcan sync --prune [--dry-run]	command	removes stale hook commands and dead skill links
vulcan x atlas changelogs migrate [--dry-run]	command	writes packages: into changelog entries
vulcan x atlas pull [--source <name>]	command	fetches sources now
vulcan x atlas concepts stamp|check	command	locks and checks the symbols concepts name
make atlas-symbols, atlas-releases, changelogs-migrate, knowledge-symbols-check	make	replace symbols-gen|check and releases-gen|check

Who is affected

• IGNIS, ARDOR, BANA. Migrate once: Adopting VULCAN, steps 3 to 5, then sync --prune.
• A CI job calling symbols-* or releases-* make targets. It fails once; call the new targets.
• A project reading another project through atlas. That project must run VULCAN 0.2.0-0 and commit its manifest first.