
Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
Declarative project maintenance for Taskflow: observe reality, reconcile drift, and run an existing Taskflow.
CharterArc keeps declared project promises true by selecting an existing Taskflow from observed reality:
satisfied or unknown;import { defineProject } from "charterarc";
import type { Taskflow } from "taskflow-core";
declare const repairTypes: Taskflow;
declare const repairTests: Taskflow;
export default defineProject({
desired: {
types: "TypeScript contracts stay valid",
tests: "Acceptance tests stay green",
},
observe: ({ cwd, signal }) => observeReality(cwd, signal),
maintain: {
types: repairTypes,
tests: repairTests,
},
});
The observer returns:
{
status: "drifted",
target: { desired: "types" },
facts: { diagnostic: "TS2322" },
summary: "packages/example.ts no longer typechecks"
}
facts is the explicit snapshot. A drifted snapshot must target one declared
desired key. An unbound or malformed target becomes unknown and starts no
Run. The selected Flow receives:
args.charterarc = {
selection: { desired: "types", flow: "repair-types" },
desired: "TypeScript contracts stay valid",
snapshot: observation,
};
For a genuinely large project, an optional Module narrows the same mechanism:
defineProject({
desired: {},
maintain: {},
modules: {
docs: {
desired: { catalog: "The phase catalog is complete" },
maintain: { catalog: repairDocs },
},
},
observe,
});
A Module is only a declaration scope. CharterArc adds no phase kind, DAG engine, FlowIR, scheduler, host process, daemon, persistence model, or model planner. Every selected Flow is statically verified and remains independently executable through Taskflow.
The application injects the existing Taskflow runtime:
import { runProject } from "charterarc";
import { discoverAgents } from "taskflow-core";
import { grokSubagentRunner } from "taskflow-hosts/grok";
import project from "./project.js";
const cwd = process.cwd();
const outcome = await runProject(project, {
taskflow: {
cwd,
agents: discoverAgents(cwd, "both").agents,
runTask: grokSubagentRunner.runTask,
usageAccounting: grokSubagentRunner.usageAccounting,
},
});
CharterArc itself uses Grok Build for self-evolution. The package remains host-neutral: other projects can inject any existing Taskflow runner.
outcome.status is the latest observed reality. outcome.selection records
which Flow was chosen, while outcome.run is the ordinary Taskflow result.
outcome.ok is true only when the latest observation is satisfied and the
Run, if one occurred, succeeded.
Healthy and unknown observations are fail-closed with respect to mutation: neither starts a Run. Three retained external projects remain migration candidates; none counts as active adoption until it uses this multi-Flow surface in an ordinary maintenance cycle.
Install a pre-stable build with npm install charterarc@experimental. This
dist-tag does not promise stable compatibility; publication remains paused
until the M1 product contract passes and a fresh execution checklist is
approved.
FAQs
Declarative project maintenance for Taskflow: observe reality, reconcile drift, and run an existing Taskflow.
The npm package charterarc receives a total of 0 weekly downloads. As such, charterarc popularity was classified as not popular.
We found that charterarc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.