@weftlet/toolkit 0.0.0-stage → 0.1.1

package/docs/architecture-baseline.json

@@ -0,0 +1,57 @@
+{
+  "sourceCommit": "479f3f5831229634c306c046a6b55c67d190f50f",
+  "kind": "advisory-inventory",
+  "approval": "Initial existing-debt inventory requested by extraction task; no hard-gate waivers",
+  "tools": {
+    "dependencyCruiser": "18.7.0",
+    "eslint": "10.13.0",
+    "jscpd": "5.4.1"
+  },
+  "findings": [
+    {
+      "category": "advisory",
+      "ruleId": "eslint:complexity",
+      "from": "src/cli.ts",
+      "to": "43",
+      "message": "Async function 'main' has a complexity of 23. Maximum allowed is 20. Size/complexity is a review signal, not proof of modularity.",
+      "fingerprint": "44fd67050497f68d00400c8d11246ed898daaa68fe6d13a5612cd208d7a42520",
+      "disposition": "new"
+    },
+    {
+      "category": "advisory",
+      "ruleId": "eslint:complexity",
+      "from": "src/config.ts",
+      "to": "87",
+      "message": "Function 'validateConfig' has a complexity of 36. Maximum allowed is 20. Size/complexity is a review signal, not proof of modularity.",
+      "fingerprint": "5936354742c2edc5b0318cd7bcb79fc9ce00d4d9a1179f904704dfb40ead9311",
+      "disposition": "new"
+    },
+    {
+      "category": "advisory",
+      "ruleId": "eslint:max-lines",
+      "from": "src/query.test.ts",
+      "to": "518",
+      "message": "File has too many lines (551). Maximum allowed is 500. Size/complexity is a review signal, not proof of modularity.",
+      "fingerprint": "cce159e6ca24eb0a5664fdae95979705904f8e1c69aae310dfb0a60beca6d13d",
+      "disposition": "new"
+    },
+    {
+      "category": "advisory",
+      "ruleId": "eslint:complexity",
+      "from": "src/telemetry.ts",
+      "to": "84",
+      "message": "Async method 'collect' has a complexity of 42. Maximum allowed is 20. Size/complexity is a review signal, not proof of modularity.",
+      "fingerprint": "f896c17c33d1a99ac4287c805f067a26f9fb8cf3cf9af10e8239b17abdb556ba",
+      "disposition": "new"
+    },
+    {
+      "category": "advisory",
+      "ruleId": "eslint:max-lines",
+      "from": "src/visualization.ts",
+      "to": "529",
+      "message": "File has too many lines (635). Maximum allowed is 500. Size/complexity is a review signal, not proof of modularity.",
+      "fingerprint": "8db629c5ab9aa7681f447b1acad521abccc3a2db5f79634c298b1741a9866cc4",
+      "disposition": "new"
+    }
+  ]
+}

package/docs/architecture-policy.md

@@ -0,0 +1,41 @@
+# Canonical architecture policy
+
+`architecture.policy.json` is the canonical executable definition. The graph, dependency rules
+and reports derive from it; skills do not define additional conflicting architecture policy.
+
+## Neutral core
+
+Approval source: the extraction request explicitly requires preserving the neutral core/toolkit
+boundary and keeping repository-specific behavior behind adapters. The core owns the shared graph
+contracts and must not import toolkit implementation. These are deterministic hard gates.
+
+Cycle, file-size, complexity and duplication findings are advisory until an owner approves a
+specific policy. Size does not prove modularity; textual clones do not prove equivalent logic.
+The tools provide candidates for semantic review.
+
+Toolkit responsibilities and public entry points are described in
+[ADR 007](ADR-007-toolkit-modules.md). The policy maps the internal directories separately;
+the proposed internal import restrictions are executable advisory checks, not newly approved
+CI gates. They check production import directions while allowing tests to assemble modules.
+Directory moves change finding fingerprints; the historical baseline is retained unchanged
+and no new finding is automatically waived.
+
+Baseline entries must name an exact finding fingerprint, a reason and an approval reference.
+Scoped exceptions additionally require rule/from/to and an expiry. The analyzer never writes or
+advances baselines. New rule violations remain new even when other debt is baselined.
+Missing source mappings, unresolved required imports and tool failures are separate report
+categories and prevent a clean result.
+
+Run `pnpm build` then `pnpm exec tsx src/cli.ts govern --policy architecture.policy.json`.
+Analysis tools are development dependencies; installed consumers must install the documented
+pinned tools to use governance. Missing tools produce infrastructure failures, not passing reports.
+
+The initial extraction commit's advisory debt is recorded in `architecture-baseline.json`,
+obtained by analyzing its isolated committed tree with the current tools. It is an informational
+inventory, not permission to waive later findings. The policy starts with no hard-rule waivers.
+Compare exact fingerprints; changed or new findings need review rather than an automatic baseline.
+
+Governance snapshots can be queried and rendered using `--config architecture.context-graph.config.json`
+and the `--snapshot` ID returned by `govern`. They contain the same dependency and policy facts used
+by the checks. Install development tools at the pinned versions in `package.json` for governance;
+Node 24 is the tested development runtime. Querying existing snapshots requires none of these tools.