VULCAN

Appearance

Changelog - 2026-10-18 ​

VULCAN 0.2.0-8: atlas.packages removed, a concept lock that sees members, a self-explaining fresh clone ​

Type: Breaking Change, Enhancement, Bug Fix

In one line. The root fixes before the stable 0.2.0: the one breaking removal, a stronger concept lock, and a fresh clone that says what to do.

Breaking ​

  • atlas.packages is removed. The alias lived for one release. A config that still sets it fails with atlas.packages was removed - move the list to the top-level packages: [{ dir, name }]. Move each dir: name pair of the old map to a packages entry, in the same order:

    ts
    // before
atlas: { packages: { okf: '@venizia/vulcan-okf', cli: '@venizia/vulcan' } },
// after
packages: [
  { dir: 'okf', name: '@venizia/vulcan-okf' },
  { dir: 'cli', name: '@venizia/vulcan' },
],

  • .symbols.lock.json needs a new stamp. The lock now hashes the whole declaration (see below), so a lock from 0.2.0-7 or earlier is schemaVersion 1 and concepts check stops with run vulcan x atlas concepts stamp. Run it once, review the diff, commit it.

What changed ​

  • concepts check locks the whole declaration. A member added to an interface or class, or a parameter changed past the old 300-character signature cap, now fails the check. Comments and layout do not move the lock.
  • doctor says once that a clean checkout is not synced. When the gitignored adapters have never been written it prints one line, not synced yet - run 'bun x --no-install vulcan sync' (make agent-setup) first, instead of one stale (created) line per file. An adapter that exists and differs is still reported by name.
  • The Makefile init writes explains a missing vulcan.mk. With no node_modules, a shipped target such as okf-check-strict stops with run 'make install' (bun install) first instead of No rule to make target. Targets the project defines (install) are untouched.
  • init writes .mcp.json (the atlas server with --root .) when it is absent. An existing file is never overwritten; one without an atlas entry gets the entry printed.
  • changes offers declared packages. Its unknown package message lists every declared package, released or not.
  • A bare vulcan x atlas at a terminal prints the usage. A client still gets the MCP server, since its stdin is a pipe.
  • A remote-host guard. Set remoteHosts: { trusted, readOnly } and sync registers a hook that asks before a Bash command reaches a host not listed (ssh, scp, rsync, kubectl, nc and the rest, also behind sudo, bash -c or xargs). Hosts match by whole name or a * pattern, never by substring; a command whose target cannot be read asks. See the adopting guide.
  • The read-only git slot covers the whole write surface. V-W-01: read-only now denies 30 git verbs, each with and without arguments (add, rm, mv, restore, commit, push, pull, merge, rebase, reset, revert, cherry-pick, checkout, switch, branch, tag, stash, clean, apply, am, worktree, remote, config, submodule, update-ref, filter-branch, gc, init, clone, notes), up from 17. A project that added the rest by hand can delete its list. git remote and git config are denied whole, so their read forms are too.
  • okf.contents.files takes globs, such as .agents/skills/*/SKILL.md.
  • okf.coverage axes take exclude and denylist. exclude is a list of globs from the root and denylist a list of directory names, both for that axis only; the top-level okf.denylist still applies to every axis. An axis left with no directory fails.
  • The guide no longer lists fixed gaps. The TypeScript auto-install note (fixed in 0.2.0-6) and the one-line concept lock are gone from Known gaps; the shipped skills are marked as not evaluated against a model.

Who is affected ​

  • A project whose config sets atlas.packages. Move the list to packages (above).
  • A project whose concepts declare symbols:. Run vulcan x atlas concepts stamp once.
  • A project with git read-only for agents. The slot's deny list grew; nothing to change unless it needs git remote or git config reads, which it must now allow in its own settings.
  • A project that carries overrides for @venizia/vulcan-okf or @venizia/vulcan-atlas. Drop them. @venizia/vulcan names both siblings as workspace:* in the repository, and bun publish writes the exact version into the tarball (0.2.0-7 depends on @venizia/vulcan-okf 0.2.0-7 and @venizia/vulcan-atlas 0.2.0-7, not a caret range). This has held since 0.2.0-0, and every release run fails if a packed manifest names a sibling at any other version.
  • Everyone else. No action needed: upgrade, then vulcan sync.