@weftlet/toolkit 0.1.0 → 0.1.1

package/README.md

@@ -1,17 +1,18 @@
 # Weftlet — Context Graph Toolkit
 
-An extracted Apache-2.0 toolkit for connecting product intent, contracts, implementation,
-tests and observed runtime evidence. Derived from LaunchEcho Context Graph; see
-[NOTICE](NOTICE) and the [source inventory](docs/SOURCE-INVENTORY.md).
+Weftlet is an open-source context-graph toolkit that helps AI development agents understand
+how a local change affects the broader product. It connects approved product intent, shared
+contracts, implementing code, downstream consumers, tests and observed runtime evidence.
 
-This standalone implementation uses small, recorded delivery milestones. See [roadmap](docs/ROADMAP.md) and
-[validation](docs/VALIDATION.md) for completed checks and limitations.
+Agents can query cited evidence and explore dependencies across module and asynchronous
+boundaries. See the [roadmap](docs/ROADMAP.md) and [validation](docs/VALIDATION.md) for
+supported capabilities and limitations.
 
 ## Set up a project
 
 Weftlet uses `@weftlet/toolkit`; its neutral `@weftlet/core` dependency is installed
-automatically. The initial Weftlet release targets `0.1.0`. Check [release status](docs/RELEASING.md)
-for public availability before using the npm commands below. Existing Tently users should follow
+automatically. Both packages are available on npm at `0.1.0`; source now prepares `0.1.1`.
+See [release status](docs/RELEASING.md). Existing Tently users should follow
 the [migration guide](docs/MIGRATING-TO-WEFTLET.md).
 
 From your TypeScript project's directory (Node 24+):
@@ -59,7 +60,8 @@ For a project-local dependency, install `npm install --save-dev @weftlet/toolkit
 the project's absolute configuration path. Pin a reviewed version for reproducible agent setup.
 
 Linux/WSL is the validated full-suite path. Native Windows has a recorded live Codex pass;
-archive-byte, snapshot replacement and MCP fixture fixes await native confirmation.
+the archive-byte, snapshot replacement and MCP startup regression suite also passes hosted
+Windows CI. Full native Windows release preparation remains separately unvalidated.
 See the [validation record](docs/VALIDATION.md).
 
 ## Development
@@ -103,7 +105,7 @@ Install the locally packed core and toolkit tarballs together. The installed com
 `weftlet`, `weftlet-mcp`, and the compatible `context-graph` / `context-graph-mcp` aliases. For example, after preparing a release:
 
 ```sh
-npm install --save-dev /path/to/tently/.release/weftlet-core-0.1.0.tgz /path/to/tently/.release/weftlet-toolkit-0.1.0.tgz
+npm install --save-dev /path/to/weftlet/.release/weftlet-core-0.1.1.tgz /path/to/weftlet/.release/weftlet-toolkit-0.1.1.tgz
 npx weftlet init
 ```
 
@@ -154,3 +156,8 @@ See [provider contract](docs/PROVIDERS.md) for bounded extraction and adapters,
 [architecture policy](docs/architecture-policy.md) for deterministic governance.
 
 See the [bounded viewer guide](docs/VIEWER.md) and [cloud setup](docs/CLOUD-ENVIRONMENT.md).
+
+## License and provenance
+
+Apache-2.0. See [LICENSE](LICENSE), [NOTICE](NOTICE), and the
+[source inventory](docs/SOURCE-INVENTORY.md) for attribution and extraction history.

package/docs/ENVIRONMENT-VALIDATION.md

@@ -12,6 +12,11 @@ ran checkout and the repository's composite action. That action selects Node 24
 packed-consumer smoke. It neither publishes packages nor invokes a live model. Codex/npm
 publication credentials and the managed cloud filesystem are not needed by this job.
 
+A subsequent hosted [run 39656137105](https://github.com/jchewitt/weftlet/actions/runs/39656137105)
+passed at `4cdc4e5bc8b53bde3b23ce0be550146ac6ae817c`: the full Ubuntu job and a focused
+Windows job covering storage contention, committed archive bytes and all original MCP startup
+cases. This Windows subset does not establish full Windows release-preparation readiness.
+
 ## Fresh cloud: requires a new task
 
 Before publishing the current environment snapshot:

package/docs/MIGRATING-TO-WEFTLET.md

@@ -1,8 +1,8 @@
 # Migrating from Tently to Weftlet
 
 The project is now Weftlet. LaunchEcho remains the maintainer; the GitHub repository remains
-[jchewitt/weftlet](https://github.com/jchewitt/weftlet). Check [release status](RELEASING.md) before
-installing the new names: source preparation is not proof of public npm availability.
+[jchewitt/weftlet](https://github.com/jchewitt/weftlet). Both new package names are published
+at 0.1.0; see [release status](RELEASING.md) for subsequent releases.
 
 | Previous package / command | Replacement |
 | --- | --- |
@@ -12,7 +12,7 @@ installing the new names: source preparation is not proof of public npm availabi
 | `context-graph` | Still supported; `weftlet` is the primary CLI |
 | `context-graph-mcp` | Still supported; `weftlet-mcp` is the primary MCP binary |
 
-After the new release is public, replace the old dependency using your package manager. For
+Replace the old dependency using your package manager. For
 an npm project that installed the toolkit as a development dependency:
 
 ```sh
@@ -51,4 +51,4 @@ Native Windows limitations remain documented in [validation](VALIDATION.md).
 
 The old `@launch-echo` releases remain immutable and usable. Do not unpublish them. Deprecation
 is a later registry action, only after both replacements and a fresh public installation are
-verified. This migration does not modify or reintegrate the original TradePilot repository.
+verified. Existing consumer integrations can migrate independently.

package/docs/PROVIDERS.md

@@ -21,9 +21,9 @@ Artifact storage contains model output and must remain private with the source r
 
 ## Codex authentication
 
-Status: implemented in unreleased source; live validation is **tentative and non-blocking for
-release**, as accepted by the maintainer. Follow-up is planned after publication and adoption into
-Banditrade using the maintainer's existing ChatGPT login; API-key testing may remain deferred.
+Status: included in `@weftlet/toolkit@0.1.0`; live validation is **tentative and non-blocking for
+release**, as accepted by the maintainer. Follow-up is planned in a consumer project using an
+existing ChatGPT login; API-key testing may remain deferred.
 The earlier `@launch-echo/tently@0.1.0` release does not contain this option. Both modes still use Codex CLI;
 this is not a direct OpenAI API provider or a fix for the managed-cloud filesystem issue.
 

package/docs/RELEASING.md

@@ -1,8 +1,9 @@
 # Weftlet npm releases
 
-Current source prepares the first `@weftlet/core@0.1.0` and `@weftlet/toolkit@0.1.0` release.
-The maintainer created the `weftlet` npm organization. Neither new package is claimed published
-by this document. The earlier `@launch-echo/tently-core@0.1.0` and `@launch-echo/tently@0.1.0`
+The maintainer published `@weftlet/core@0.1.0` and `@weftlet/toolkit@0.1.0`; both versions
+and their archive integrity are verified against the public registry. Current source prepares
+`0.1.1` for both packages, with independent-project descriptions and updated documentation.
+The earlier `@launch-echo/tently-core@0.1.0` and `@launch-echo/tently@0.1.0`
 releases remain available and undeprecated; their public installation evidence is in
 [validation](VALIDATION.md). GitHub is now `jchewitt/weftlet`; npm and GitHub owner names need not match.
 
@@ -10,12 +11,12 @@ Live Codex authentication validation is tentative and non-blocking for release,
 the maintainer. Deterministic release checks still apply. Native Windows limitations remain
 recorded; use Linux or WSL for the full release gate. See [consumer migration](MIGRATING-TO-WEFTLET.md).
 
-## First publication and maintainer setup
+## Trusted-publisher setup
 
-Creating an npm organization does not publish its packages or configure package-level trusted
-publishers. Use an npm account with permission to publish both names in `@weftlet`. The initial
-publication can use the normal npm login/2FA flow below. Once the packages exist, configure each
-package's Settings → Trusted Publisher with the following GitHub Actions identity:
+The initial manual publication is complete. Sign in to npm with package administration permission
+and configure **both** [core](https://www.npmjs.com/package/@weftlet/core) and
+[toolkit](https://www.npmjs.com/package/@weftlet/toolkit): Settings → Trusted Publisher →
+GitHub Actions, using the following identity:
 
 | npm setting | Value |
 | --- | --- |
@@ -27,7 +28,8 @@ package's Settings → Trusted Publisher with the following GitHub Actions ident
 
 On GitHub, create repository Settings → Environments → `npm-release`. Restrict deployment branches
 to `main` and configure a required reviewer. A sole maintainer must be allowed to approve their own
-release. Do not rely on the YAML environment name alone: an automatically created environment has
+release: leave **Prevent self-review** unchecked when approving your own runs. Do not rely on the YAML environment
+name alone: an automatically created environment has
 no review protection until you configure it. No npm token secret is required for OIDC publication.
 Keep npm account 2FA enabled. The package's repository metadata already identifies `jchewitt/weftlet`.
 

package/docs/ROADMAP.md

@@ -1,12 +1,12 @@
 # Delivery roadmap
 
-Destination: `jchewitt/weftlet`. Read-only source:
-`launchecho/tradepilot@fda97e0146099543aeaa6b338ef2b0e9fab0d1d6`.
+Project: `jchewitt/weftlet`. Extraction provenance is recorded in the
+[source inventory](SOURCE-INVENTORY.md).
 
 | Milestone | Delivered and checked | Remaining limits |
 | --- | --- | --- |
 | 1. Standalone | Explicit committed inventory, core/toolkit boundary, public examples, build/tests, packed independent consumer and real TypeScript indexing | GitHub exported; both @launch-echo packages published at 0.1.0 and public installation verified |
-| 2a. Saved evidence | Read/refresh separation, commit/config/scope metadata, dirty querying, isolated archives, atomic snapshots validated on Linux/WSL, failed-refresh preservation | Archive LF conversion and bounded atomic head-replacement fixes pass Linux regressions; native Windows confirmation pending; archives reject symlinks/submodules and sizes above 128 MiB |
+| 2a. Saved evidence | Read/refresh separation, commit/config/scope metadata, dirty querying, isolated archives, atomic snapshots validated on Linux/WSL, failed-refresh preservation | Archive LF conversion and atomic head-replacement regressions pass Linux and hosted Windows CI; archives reject symlinks/submodules and sizes above 128 MiB |
 | 2b. Draft overlays | Base/content identity, reindexed replacement, delete/rename handling, separate checkout/agent heads | Full implementation reindex; changed prose invalidated pending re-extraction |
 | 3. Unified graph | RDF/SPARQL, SHACL, lossless projection, bounded continuation, six-stage async cross-source fixture, negative extraction/linkage cases | Local SELECT only; 100,000-fact projection bound; no universal language support |
 | 4. Governance | Canonical approved rules, dependency-cruiser/ESLint/jscpd, scoped debt/expiry, transitive inference, optional OML ADR/parity | No active OWL reasoner; live formal compilation unverified; heuristics remain advisory |
@@ -23,14 +23,15 @@ The post-release module-organization increment is described in
 public entry points remain stable, and proposed internal dependency restrictions are advisory
 pending explicit owner approval. It does not publish a replacement for npm 0.1.0.
 
-The following unreleased increment adds explicit Codex authentication configuration: ChatGPT
+Weftlet 0.1.0 includes explicit Codex authentication configuration: ChatGPT
 login by default, API-key mode by opt-in, and presence-only API diagnostics. Validation is
 tentative and explicitly non-blocking for release. The maintainer plans follow-up after publication
-and adoption into Banditrade; API-key testing remains optional. No new live model results are claimed.
+and adoption into a consumer project; API-key testing remains optional. No new live model results are claimed.
 See [provider configuration](PROVIDERS.md#codex-authentication) and the validation record.
 
 Native Windows archive conversion, concurrent head-replacement and MCP file-symlink fixes are
-implemented with regression tests; a focused Windows CI job and HDesk rerun must confirm them.
+implemented with regression tests and pass focused hosted Windows CI. HDesk confirmation and
+full native Windows release preparation remain separate checks.
 Next work should be separate, reviewed increments: improve CRLF checkout integrity checks;
 run bounded semantic-quality evaluations; retain the passing hosted Ubuntu CI gate; validate fresh-cloud
 restoration; resolve the cloud-specific live provider block; add browser
@@ -45,9 +46,10 @@ Validation evidence and decisions are in `VALIDATION.md` and the ADR files. Sour
 model assertion review are distinct. On 2026-10-20 the user authorized pushing the reviewed
 destination to `jchewitt/tently` for local testing. The subsequent npm request authorizes release
 preparation/publication under `@launch-echo`; the maintainer completed the 0.1.0 release from WSL. Visibility changes and
-TradePilot reintegration remain outside the authorized scope. See [release instructions](RELEASING.md).
+source-application reintegration remain outside the authorized scope. See [release instructions](RELEASING.md).
 
 The maintainer authorized the Weftlet migration on 2026-10-21. Current source targets
 `@weftlet/core` and `@weftlet/toolkit`, with a `weftlet` CLI and a manually dispatched trusted
-publishing workflow. First publication, npm trust configuration and a live OIDC publish remain
-separate external steps; the earlier Tently packages remain available and undeprecated.
+publishing workflow. Both Weftlet packages are published at 0.1.0; source prepares 0.1.1.
+npm trust configuration and a live OIDC publish remain external steps; the earlier Tently
+packages remain available and undeprecated.

package/docs/VALIDATION.md

@@ -488,3 +488,43 @@ The Windows job does not replace the full Linux release gate. Native Windows exe
 fixes remains pending; simulated Windows errors on Linux are not a native pass. CRLF checkout
 inventory checking and npm Codex executable discovery remain separate follow-ups. No live model
 call or npm publication was performed. Use WSL for the validated full release-preparation route.
+
+
+## Weftlet publication and native Windows CI — 2026-10-21
+
+The maintainer reported successful publication. Public npm metadata independently confirms
+`@weftlet/core@0.1.0` and `@weftlet/toolkit@0.1.0`, both with `latest` pointing to 0.1.0 and
+repository metadata pointing to `jchewitt/weftlet`. Downloaded archives match their registry
+SHA-512 integrity values. The toolkit archive contains the Windows atomic-rename helper.
+This check verifies registry availability and archive integrity, not a fresh public consumer install.
+
+[Hosted run 39656137105](https://github.com/jchewitt/weftlet/actions/runs/39656137105) succeeded
+at `4cdc4e5bc8b53bde3b23ce0be550146ac6ae817c`. Both the full Ubuntu deterministic job and the
+focused `windows-storage-and-startup` job passed. The Windows job completed frozen installation,
+build, Git archive-byte checks, snapshot contention/failure checks and all three original MCP
+startup cases. This establishes a native hosted-Windows regression pass; full Windows release
+preparation, HDesk reruns, CRLF inventory checking and npm Codex discovery remain separate.
+
+Current source prepares 0.1.1 for both packages to update public descriptions and documentation.
+The project overview and core README describe Weftlet independently; original attribution,
+licenses and extraction provenance remain intact. npm trusted publishing still needs package-level
+configuration and a successful OIDC release. A manual publication does not validate OIDC.
+
+
+For the 0.1.1 documentation/metadata patch, frozen install and the full Linux publication gate
+passed again: 155 deterministic tests (one optional Docker/OML test skipped), build, architecture
+with 12 advisory findings, inventory, licenses and fresh packed-consumer smoke. No runtime code
+changed from 4cdc4e5. GitHub's About description was blank; an attempted metadata update returned
+HTTP 403, so no GitHub description change is claimed. No npm upload was made by the agent.
+
+
+## First trusted-release preparation attempt — 2026-10-21
+
+[Run 39660995763](https://github.com/jchewitt/weftlet/actions/runs/39660995763) on d82ebee
+passed the full release gate but stopped before uploading any package. npm 11.21.1 returns
+`publish --dry-run --json` results keyed by package name; the release script expected the
+flat record returned by npm 11.9.0. The preparation check now supports both observed formats
+and verifies name, version and archive integrity. Ambiguous/multiple records and mismatches
+remain errors. Two npm-command tests pass, including negative response-shape/identity/integrity
+cases, and both package archives pass real dry runs with npm 11.9.0 and 11.21.1. No live npm
+publication was attempted by this failed run.

package/docs/extraction-manifest.json

@@ -108,7 +108,7 @@
       "destinationPath": "package.json",
       "sourceSha256": "a575dbb2fed8c554b95e8e9b3e03a0c21cab1be7249860bbebc18e046b2ff78d",
       "modified": true,
-      "destinationSha256": "96a6cf7ae18dd4c976c6ec3cfca31ce37f44229dc6c9df46f58d6eae5de0e36d"
+      "destinationSha256": "acc98f285f29b2b124cd863c391d575b87e8bdd51756223d76765a868e6ee805"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/LICENSE",
@@ -129,7 +129,7 @@
       "destinationPath": "packages/core/README.md",
       "sourceSha256": "6044bf7b9a3dc793f41e2ff048546ed11938957d10a5b143eb1739ac4cd7477c",
       "modified": true,
-      "destinationSha256": "8f2d73048bcf7e1d411e0942505af58700ef6f4715b40de5efcd73afbb062be7"
+      "destinationSha256": "1cb03b2eb415ac35ef7a4405d3cbb415c59717fe6d088968533e3ac51658f7fb"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/THIRD_PARTY_NOTICES.md",
@@ -143,7 +143,7 @@
       "destinationPath": "packages/core/package.json",
       "sourceSha256": "2a29066eb8452f22fafcb06bb035a84dda93c5705dba32aba600a1b7e5aaf19c",
       "modified": true,
-      "destinationSha256": "ac71f77c54b9fa92c0304705154b1a24a2b4d69da410b34d04854215c7d1ca91"
+      "destinationSha256": "cfa4fb46c486bf3b06a72bb90adc8521fad1afd20b5cded9c5b0d177ffce0438"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/src/core.ts",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@weftlet/toolkit",
-  "version": "0.1.0",
-  "description": "Reusable commit-keyed semantic, implementation, runtime, and evidence graph toolkit",
+  "version": "0.1.1",
+  "description": "Evidence-backed context graphs for AI development agents: product intent, contracts, code, tests and runtime behavior",
   "license": "Apache-2.0",
   "type": "module",
   "files": [
@@ -62,7 +62,7 @@
     "n3": "2.7.2",
     "rdf-validate-shacl": "0.6.5",
     "sparqljs": "3.7.4",
-    "@weftlet/core": "^0.1.0"
+    "@weftlet/core": "^0.1.1"
   },
   "devDependencies": {
     "@types/n3": "1.26.1",