@weftlet/toolkit 0.1.1 → 0.1.2

package/README.md

@@ -11,7 +11,7 @@ supported capabilities and limitations.
 ## Set up a project
 
 Weftlet uses `@weftlet/toolkit`; its neutral `@weftlet/core` dependency is installed
-automatically. Both packages are available on npm at `0.1.0`; source now prepares `0.1.1`.
+automatically. Both packages are available on npm at `0.1.1`.
 See [release status](docs/RELEASING.md). Existing Tently users should follow
 the [migration guide](docs/MIGRATING-TO-WEFTLET.md).
 
@@ -149,8 +149,9 @@ Live provider tests are separate from deterministic CI. The maintainer authorize
 export and migration from the published `@launch-echo` names to `@weftlet`. Registry publication requires
 an authorized npm identity. Repository visibility changes require separate authorization.
 
-See [npm release instructions](docs/RELEASING.md) for prepared archives, integrity checks and
-the core-before-toolkit publication sequence.
+For changes that should ship, run `pnpm changeset` and commit the generated release note.
+The bot prepares a version PR; merging it publishes those committed versions and records release
+tags. See [npm release instructions](docs/RELEASING.md) for checks, trust settings and recovery.
 
 See [provider contract](docs/PROVIDERS.md) for bounded extraction and adapters, and
 [architecture policy](docs/architecture-policy.md) for deterministic governance.

package/docs/ADR-008-weftlet-packages.md

@@ -1,6 +1,7 @@
 # ADR 008: Weftlet package identity and publishing
 
-Status: accepted by the maintainer, 2026-10-21. Publication and trusted-publisher validation are pending.
+Status: accepted by the maintainer, 2026-10-21. Both packages are published; trusted publishing passed for 0.1.1.
+Release initiation/versioning is superseded by [ADR 009](ADR-009-release-automation.md).
 
 Use `@weftlet/core` for neutral contracts and `@weftlet/toolkit` for the implementation, CLI and
 MCP server. Both new package names start at 0.1.0; npm versions belong to each package name, so

package/docs/ADR-009-release-automation.md

@@ -0,0 +1,39 @@
+# ADR 009: Committed release versions and verified publication records
+
+Status: accepted by the maintainer, 2026-10-21.
+
+Contributors use Changesets to declare release intent. A bot opens a release PR containing
+versions, changelogs, lockfile updates and extraction inventory. Core and toolkit form a fixed
+release group while the publication process handles both together. This is a release policy;
+it does not merge their source or interface boundaries. Independent versioning would require
+an explicit change to publication selection and recovery.
+
+The toolkit lives at repository root. Include `.` explicitly in the pnpm workspace so Changesets
+sees both packages. The custom version command wraps the real Changesets CLI, records the
+previous/new versions in `.changeset/release-plan.json` and updates inventory after changeset
+consumption. Original extraction hashes are never regenerated from destination files.
+
+Merge the version PR before publishing. Main therefore records the intended npm version without
+a post-publication bot commit. The generated plan triggers the existing `publish.yml`, retaining
+npm's configured trusted-publisher identity and optional environment protection. Pending changesets
+or mismatched/non-advancing plans block publication. Failed releases may leave main ahead of npm;
+recover the same version rather than issuing another bump. No cross-system transaction is claimed.
+
+The version bot has contents, PR and workflow-dispatch permissions. It explicitly dispatches checks
+on its PR branch because GitHub suppresses ordinary workflow events from GITHUB_TOKEN writes.
+It never merges or approves PRs. Publication uses read-only source permissions plus OIDC; a separate
+job receives contents-write permission only after both public archive integrities match. That job
+creates package/version tags and GitHub Releases at the published commit. Existing tags are never
+retargeted and retries complete missing records idempotently.
+
+Retain per-attempt archives and acceptance receipts. A retry of the same run restores its latest
+earlier state before uploading; unreadable/expired/ambiguous recovery evidence fails explicitly.
+A new run does not inherit receipts. This preserves delayed-registry handling without treating
+authentication/network errors as absence. Publishing both packages and creating records are not
+atomic operations; the documented recovery route retains their exact source and archive identity.
+
+Deterministic fixtures exercise the actual CLI with root/core packages, patch/minor changes,
+changelogs, generated plan, lockfile and inventory. Record tests cover npm integrity failures,
+existing-tag conflicts, interrupted creation and repeated calls. Artifact-selection tests cover
+attempt ordering and expired/ambiguous state. Hosted bot operation and live publication evidence
+are recorded separately in [validation](VALIDATION.md); tests alone do not establish npm authorization.

package/docs/RELEASING.md

@@ -1,146 +1,156 @@
 # Weftlet npm releases
 
-The maintainer published `@weftlet/core@0.1.0` and `@weftlet/toolkit@0.1.0`; both versions
-and their archive integrity are verified against the public registry. Current source prepares
-`0.1.1` for both packages, with independent-project descriptions and updated documentation.
-The earlier `@launch-echo/tently-core@0.1.0` and `@launch-echo/tently@0.1.0`
-releases remain available and undeprecated; their public installation evidence is in
-[validation](VALIDATION.md). GitHub is now `jchewitt/weftlet`; npm and GitHub owner names need not match.
-
-Live Codex authentication validation is tentative and non-blocking for release, as accepted by
-the maintainer. Deterministic release checks still apply. Native Windows limitations remain
-recorded; use Linux or WSL for the full release gate. See [consumer migration](MIGRATING-TO-WEFTLET.md).
-
-## Trusted-publisher setup
-
-The initial manual publication is complete. Sign in to npm with package administration permission
-and configure **both** [core](https://www.npmjs.com/package/@weftlet/core) and
-[toolkit](https://www.npmjs.com/package/@weftlet/toolkit): Settings → Trusted Publisher →
-GitHub Actions, using the following identity:
+`@weftlet/core@0.1.1` and `@weftlet/toolkit@0.1.1` are published. Their first trusted
+publication passed in [run 39661957651](https://github.com/jchewitt/weftlet/actions/runs/39661957651)
+from commit `720a5f964fe3cb6c438be6d22b4aa8b4ad44de17`, with matching registry archive integrity,
+npm provenance and a fresh public CLI installation. Earlier Weftlet and `@launch-echo` releases
+remain available and undeprecated. GitHub and npm owner names need not match.
+
+Live Codex authentication follow-up remains tentative and non-blocking, as accepted by the
+maintainer. Deterministic release checks still apply. Linux/WSL is the validated full release
+preparation route; native Windows has focused CI coverage. See [validation](VALIDATION.md).
+
+## Normal development and release
+
+1. For a change that should ship, run `pnpm changeset`, choose patch/minor/major and write a short
+   user-facing description. Commit the generated Markdown with the change. The bump type is a
+   contributor decision, not inferred from commit messages. Documentation-only work that does not
+   need an npm release can omit a changeset.
+2. On main pushes, **Release version PR** opens or updates a bot PR. Core and toolkit are a fixed
+   release group: a release of either advances both to the same version. The PR contains package
+   versions, dependency/lockfile updates, changelogs, a generated `.changeset/release-plan.json`,
+   and an updated extraction inventory. Original source hashes remain unchanged.
+3. Review the version PR and its checks, then merge it. This commits the versions to `main`
+   **before** npm publication. Do not manually bump manifests or edit the generated plan.
+4. The plan change triggers **Weftlet release**. It validates and prepares both archives, publishes
+   core followed by toolkit using npm trusted publishing, then verifies registry integrity.
+5. After both versions are verified, a separate job creates tags such as `@weftlet/core@0.1.2`
+   and `@weftlet/toolkit@0.1.2`, plus corresponding GitHub Releases, at that exact source commit.
+   Existing tags are never moved. The publication job does not commit back to main.
+
+The bot uses GitHub's built-in token, not a personal access token. GitHub may require Settings →
+Actions → General → Workflow permissions → **Allow GitHub Actions to create and approve pull
+requests**. The workflow grants its own explicit permissions; the repository default need not
+be changed to write. The bot creates PRs; it does not approve or merge them. Since commits made
+with `GITHUB_TOKEN` do not trigger ordinary PR workflows, it explicitly dispatches `check.yml`
+on the release PR branch. Inspect the checks for the current PR commit before merging.
+
+Versioning is automatic once changesets are supplied; publication remains dependent on passing
+checks and configured environment rules. A failed publish can temporarily leave main ahead of
+npm. Retry that release at the same commit/version instead of generating another bump.
+
+## npm trust and GitHub environment
+
+Trust is configured separately for both [core](https://www.npmjs.com/package/@weftlet/core) and
+[toolkit](https://www.npmjs.com/package/@weftlet/toolkit), with these settings:
 
 | npm setting | Value |
 | --- | --- |
 | Organization or user | `jchewitt` |
 | Repository | `weftlet` |
-| Workflow filename | `publish.yml` (filename only) |
+| Workflow filename | `publish.yml` |
 | Environment name | `npm-release` |
-| Allowed action | Enable direct `npm publish` |
+| Allowed action | Direct `npm publish` enabled |
 
-On GitHub, create repository Settings → Environments → `npm-release`. Restrict deployment branches
-to `main` and configure a required reviewer. A sole maintainer must be allowed to approve their own
-release: leave **Prevent self-review** unchecked when approving your own runs. Do not rely on the YAML environment
-name alone: an automatically created environment has
-no review protection until you configure it. No npm token secret is required for OIDC publication.
-Keep npm account 2FA enabled. The package's repository metadata already identifies `jchewitt/weftlet`.
+The automation retains this identity, so existing npm trust needs no change. Keep npm account
+2FA enabled. No npm token secret is required. If configuring a new trust relationship, consult
+[npm's current requirements](https://docs.npmjs.com/trusted-publishers/), including its initial-use deadline.
 
-npm trusted-publisher setup is not validated merely by saving these settings. Test with a later,
-intentional versioned publication. Current npm documentation says a new trust configuration must
-be used within two days or it expires; configure it close to the intended release, and reconfirm
-that behavior in [npm's documentation](https://docs.npmjs.com/trusted-publishers/).
+`npm-release` is a GitHub deployment environment, not a machine or npm account. Its existing
+configuration has no required reviewer or branch rules. The workflow itself requires main.
+To add an approval pause, configure a required reviewer and main-only deployment branches under
+Settings → Environments → npm-release. A sole maintainer approving their own releases must leave
+**Prevent self-review** unchecked. The workflow honors those rules if configured; its YAML name
+alone does not create review protection.
 
-## Prepare reviewed archives
+## Validation and manual preparation
 
-Use Node 24 and pnpm 10.18.2 in a clean, committed checkout. The new namespace starts at 0.1.0;
-subsequent content changes require a new version for the affected packages. Update the lockfile
-when changing workspace dependency versions. Never overwrite or republish an existing version.
+Use Node 24 and pnpm 10.18.2. The full gate can run during ordinary development without a release plan:
 
 ```sh
-nvm install
-nvm use
 pnpm install --frozen-lockfile
-pnpm release:prepare
+pnpm context-graph:publication-check
 ```
 
-This runs build, deterministic tests, architecture checks, extraction inventory, license checks
-and a fresh packed-consumer smoke. The smoke uses a disposable registry for the two local packages,
-exercises npx inference and automatic core installation, and checks SCIP, RDF/SHACL, visualization
-and MCP. No live model or public npm upload is invoked.
+It runs build, deterministic tests, architecture, inventory, licenses and a fresh packed-consumer
+smoke. The smoke exercises setup/config, automatic core installation, real TypeScript SCIP,
+RDF/SHACL, visualization and MCP. No live model or public npm upload is invoked.
+
+After the generated release PR is committed, `pnpm release:prepare` also packs both packages,
+resolves workspace ranges, dry-runs unpublished versions and records source commit, versions and
+SHA-512 integrity in `.release/manifest.json`. Review the manifest, tarball file lists and extraction
+inventory. Preparation refuses pending changesets and stale release plans. It requires a clean
+checkout. An existing npm version must match exactly; different bytes stop the release.
+
+Actions → **Weftlet release** → **Run workflow** remains available on main. Leave **publish**
+unchecked for preparation only, or select it for an intentional release of the committed plan.
+The preparation job has read-only repository permissions and no OIDC permission. Its uploaded
+`weftlet-release-N` artifact (`N` is the run attempt) is the exact publication input. The publish
+job installs no project dependencies and performs no build. It alone has `id-token: write`;
+the separate release-record job has `contents: write` and no npm publishing permission.
+
+Actions and npm are pinned; npm 11.21.1 is used for OIDC. OIDC preconditions require the expected
+repository, main, a push/manual trigger, hosted runner and OIDC request variables. Ambient npm
+tokens are rejected and npm configuration is isolated. `npm whoami` is skipped because it cannot
+validate trusted publishing. npm verifies the identity and creates provenance. There is no token
+fallback. JavaScript pnpm and standalone `@pnpm/exe` are supported for local tooling.
+
+## Delayed visibility and failed releases
+
+Publication is sequential, not atomic across packages. Registry visibility and integrity of core
+are checked before toolkit is uploaded. An identical existing release is skipped. Only HTTP 404
+is treated as pending; authentication, network and integrity failures stop publication.
+
+After npm accepts an upload, the publisher writes a package/integrity-specific `.accepted.json`
+receipt and polls public metadata up to 21 times, 15 seconds apart. It never intentionally uploads
+an accepted version again. A process interruption between acceptance and receipt writing still
+requires inspection of npm state.
+
+For a failed GitHub run, use **Re-run failed jobs** on the original run. Each attempt saves
+`weftlet-publication-state-N` with exact archives and receipts, even on failure. The next attempt
+restores the latest earlier receipt artifact from that same run before publishing. Artifact lookup
+errors, expired latest receipts or ambiguous state fail instead of silently discarding evidence.
+Artifacts are retained for 30 days. Release-record creation is also idempotent: a retry completes
+missing records without moving tags or duplicating releases.
+
+Do not start a new workflow run while an accepted package is still processing: different runs do
+not share receipts. If artifacts expired, inspect npm and recover the original archives/receipts
+before proceeding. Do not bump versions to hide a partially published release. Once both versions
+are visible, exact integrity checks make retries safe. A newly prepared archive that differs from
+the original is an error, even if its package version is the same.
+
+For authorized local recovery, restore the original `.release/` at its manifest's commit, then:
 
-Preparation packs with pnpm, resolves workspace dependency ranges and records commit, names,
-versions and SHA-512 integrity in `.release/manifest.json`. Review it, the tarball file lists and
-`docs/extraction-manifest.json`. Existing versions must match the prepared archive exactly;
-unpublished versions receive an npm dry run. A dry run does not establish OIDC authorization.
+```sh
+npm login --registry=https://registry.npmjs.org
+pnpm release:publish
+```
 
-Both JavaScript pnpm and standalone `@pnpm/exe` are supported. The publisher must find npm's
-JavaScript entry point beside Node. The workflow pins npm 11.21.1; trusted publishing requires
-at least npm 11.5.1. Use the workflow's pinned tools when reproducing CI release preparation.
+Use an interactive terminal for npm browser/2FA challenges. Local publication uses normal login
+and disables CI provenance. `WEFTLET_NPM_TOKEN` (legacy `TENTLY_NPM_TOKEN`) remains available for
+an explicitly authorized token environment; never commit tokens or pass them to the OIDC workflow.
+Local publication does not create GitHub tags/releases automatically; the verified workflow's
+record job is the normal route.
 
-## Initial or local publication with npm login
+## Inspecting and consuming releases
 
-From the same clean checkout and reviewed archives, in an interactive terminal:
+Package-specific tags identify the exact published source, for example:
 
 ```sh
-npm login --registry=https://registry.npmjs.org
-npm whoami --registry=https://registry.npmjs.org
-pnpm release:publish
+git fetch --tags
+git switch --detach '@weftlet/toolkit@0.1.2'
 ```
 
-Complete npm's browser/2FA challenge when requested. Do not pipe or redirect the publication
-command: npm needs terminal input and output for the interactive flow. The default `login` mode
-retains npm's normal credentials and uses `whoami`; it does not silently select OIDC.
-
-For an authorized token environment, `WEFTLET_NPM_TOKEN` is supported through a temporary,
-restricted-permission npm configuration containing only the literal variable reference. Legacy
-`TENTLY_NPM_TOKEN` remains accepted if the new variable is absent. Never paste tokens in chat,
-commit them, or provide either token to the trusted-publishing workflow. No cloud secret is needed
-when publication happens from the maintainer's authenticated WSL session.
-
-## GitHub trusted publication
-
-The workflow `.github/workflows/publish.yml` is manually dispatched, main-branch only, and serialized.
-It does not run on pushes or pull requests. From GitHub Actions → **Weftlet release** → **Run workflow**:
-
-1. Select `main`. Leave **publish** unchecked for preparation only. Review the uploaded
-   `weftlet-release` artifact and manifest in the run summary.
-2. For an intentional release, select **publish**. The preparation job runs again on that exact
-   commit, without publishing credentials. Inspect that run's artifact before approving its
-   `npm-release` deployment; a different run's archive is not the approval target.
-3. After configured environment approval, the publish job checks out the same source, downloads
-   those artifacts and runs `node scripts/release.mjs --publish --auth=oidc`. It does not install
-   project dependencies or rebuild the packages. Only this job has `id-token: write`.
-
-Actions are pinned to commits. Neither job restores a dependency cache. OIDC mode requires a
-GitHub-hosted runner, the expected repository/ref/manual trigger and OIDC request variables;
-it rejects ambient npm token variables and isolates user/global npm configuration. npm performs
-actual identity validation against each package's trust settings. `npm whoami` is deliberately
-skipped in OIDC mode because it is not a trusted-publisher authorization check. Unsupported npm,
-missing trust or rejected identity must fail; there is no token fallback configured by this workflow.
-
-npm creates provenance for public packages published from this public repository through OIDC.
-Local publication explicitly disables CI provenance. Prepared artifacts and synthetic OIDC tests
-do not prove that a live trusted publish or provenance verification has succeeded.
-
-## Ordering, delayed visibility and recovery
-
-Before any upload, the publisher validates every archive hash and its source commit. It publishes
-core first, waits for registry visibility and verifies integrity, then publishes the toolkit. An
-existing identical release is skipped; different bytes at the same version stop publication.
-Publication across packages is not atomic.
-
-After npm accepts an upload it may remain invisible while processing. The publisher saves a
-package/integrity-specific `.accepted.json` receipt under `.release/` and retries only public
-metadata reads, up to 21 checks, 15 seconds apart. Only 404 is treated as pending. Never repeatedly
-upload an accepted version. Keep `.release/` and retry `release:publish` later to resume verification.
-A receipt cannot cover a process interruption before it is written; inspect registry state before
-recovery. Authentication, network and integrity errors are not treated as missing packages.
-
-The workflow uploads `weftlet-publication-state`, including receipts, even when publication fails.
-For a processing timeout, recover those exact archives and receipts into `.release/` at the
-manifest's source commit before an authorized local retry. Do not blindly rerun the whole workflow
-while an accepted upload is still processing: a new run starts without the old receipt. Once a
-release is visible, the normal integrity check safely skips its already published packages.
-
-## Verify public installation before retiring old names
-
-After successful publication, use a fresh disposable project:
+Tags support inspection and reproduction, not mutation of npm history. To roll a consumer back,
+install an earlier published version; fixes to a release need a new changeset/version.
+
+Verify a new public release in a fresh disposable project, substituting its version:
 
 ```sh
 npm init -y
-npx --yes @weftlet/toolkit@0.1.0 init --yes
-npx --yes @weftlet/toolkit@0.1.0 config validate
+npx --yes @weftlet/toolkit@0.1.1 init --yes
+npx --yes @weftlet/toolkit@0.1.1 config validate
 ```
 
-Use the actual release version for later releases. Verify registry versions and hashes, core's
-transitive resolution, CLI/MCP operation and provenance when applicable. Update release status
-only after those public checks pass. Deprecating the old `@launch-echo` names is a separate registry
-action after replacement verification; never unpublish the old releases.
+Check registry hashes, transitive core resolution and provenance. Deprecating the previous
+`@launch-echo` names is a separate action after replacement verification; never unpublish them.

package/docs/ROADMAP.md

@@ -48,8 +48,9 @@ destination to `jchewitt/tently` for local testing. The subsequent npm request a
 preparation/publication under `@launch-echo`; the maintainer completed the 0.1.0 release from WSL. Visibility changes and
 source-application reintegration remain outside the authorized scope. See [release instructions](RELEASING.md).
 
-The maintainer authorized the Weftlet migration on 2026-10-21. Current source targets
-`@weftlet/core` and `@weftlet/toolkit`, with a `weftlet` CLI and a manually dispatched trusted
-publishing workflow. Both Weftlet packages are published at 0.1.0; source prepares 0.1.1.
-npm trust configuration and a live OIDC publish remain external steps; the earlier Tently
-packages remain available and undeprecated.
+The maintainer authorized the Weftlet migration on 2026-10-21. Both `@weftlet/core` and
+`@weftlet/toolkit` are published at 0.1.1 through GitHub OIDC, with provenance and a fresh public
+installation verified. Changesets now prepares reviewed version PRs for the fixed package group;
+merging a release plan triggers publication and package-specific tags/GitHub Releases.
+See [ADR 009](ADR-009-release-automation.md) and [release instructions](RELEASING.md).
+Earlier Tently packages remain available and undeprecated.

package/docs/VALIDATION.md

@@ -528,3 +528,31 @@ and verifies name, version and archive integrity. Ambiguous/multiple records and
 remain errors. Two npm-command tests pass, including negative response-shape/identity/integrity
 cases, and both package archives pass real dry runs with npm 11.9.0 and 11.21.1. No live npm
 publication was attempted by this failed run.
+
+## Trusted 0.1.1 publication and release automation — 2026-10-21
+
+[Release run 39661957651](https://github.com/jchewitt/weftlet/actions/runs/39661957651) succeeded
+at `720a5f964fe3cb6c438be6d22b4aa8b4ad44de17`: credential-free preparation, both npm OIDC
+uploads, registry visibility and archive integrity checks. Public metadata confirms both packages
+at 0.1.1 with provenance. A fresh public installation passed CLI init and config validation.
+No npm token was supplied. The `npm-release` GitHub environment exists without reviewer/branch
+rules; the workflow main-branch guard remains active. Saving trust alone was not counted as a pass.
+
+Package-specific 0.1.1 Git tags and GitHub Releases were subsequently added at that exact commit,
+after rechecking both registry hashes against the original run's archive manifest. No 0.1.0 tag
+was guessed. npm versions or artifacts were not changed by this record backfill.
+
+For the Changesets automation increment, Linux Node 24.19.0 / pnpm 10.18.2 frozen install and the
+full publication gate passed: **165 deterministic tests** (1 core + 164 toolkit/example/script),
+with one optional Docker/OML test skipped. Build, architecture (12 advisory findings), extraction
+inventory, licenses and fresh packed-consumer smoke passed. The smoke covered setup/config,
+transitive core installation, runtime assets, real TypeScript SCIP, RDF/SPARQL/SHACL, HTML/DOT/SVG
+and MCP. Actionlint 1.7.7 passed all three workflows with shellcheck integration disabled.
+
+New deterministic tests run the actual Changesets CLI in disposable root/core workspaces, verify
+patch/minor fixed-group bumps, changelogs, plan/lockfile/inventory updates and consumed changesets,
+and reject stale or non-advancing plans. Release-record tests reject missing/mismatched registry
+archives and conflicting tags, and resume interrupted creation without duplicates. Recovery-state
+tests select earlier attempts and reject expired or ambiguous artifacts. No paid model call or
+new npm version was published by these tests. Hosted version-PR operation is checked separately;
+a future merged release remains the integration test of automatic publish and record creation.

package/docs/extraction-manifest.json

@@ -108,7 +108,7 @@
       "destinationPath": "package.json",
       "sourceSha256": "a575dbb2fed8c554b95e8e9b3e03a0c21cab1be7249860bbebc18e046b2ff78d",
       "modified": true,
-      "destinationSha256": "acc98f285f29b2b124cd863c391d575b87e8bdd51756223d76765a868e6ee805"
+      "destinationSha256": "017fe298662e434efa27d4f21a0adb0d857fa373a6199ed2d623a6c630c5b451"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/LICENSE",
@@ -143,7 +143,7 @@
       "destinationPath": "packages/core/package.json",
       "sourceSha256": "2a29066eb8452f22fafcb06bb035a84dda93c5705dba32aba600a1b7e5aaf19c",
       "modified": true,
-      "destinationSha256": "cfa4fb46c486bf3b06a72bb90adc8521fad1afd20b5cded9c5b0d177ffce0438"
+      "destinationSha256": "9dbd393a312bb6a992b53d2624279b62991e64609beb506744186614f9b194cf"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/src/core.ts",
@@ -577,11 +577,16 @@
     ".github/workflows/context-graph.yml"
   ],
   "authoredPaths": [
+    ".changeset/README.md",
+    ".changeset/config.json",
+    ".changeset/release-plan.json",
     ".github/workflows/check.yml",
     ".github/workflows/publish.yml",
+    ".github/workflows/version.yml",
     ".gitignore",
     ".npmrc",
     ".nvmrc",
+    "CHANGELOG.md",
     "CONTRIBUTING.md",
     "README.md",
     "SECURITY.md",
@@ -596,6 +601,7 @@
     "docs/ADR-006-provider-boundaries.md",
     "docs/ADR-007-toolkit-modules.md",
     "docs/ADR-008-weftlet-packages.md",
+    "docs/ADR-009-release-automation.md",
     "docs/CLOUD-ENVIRONMENT.md",
     "docs/ENVIRONMENT-VALIDATION.md",
     "docs/MIGRATING-TO-WEFTLET.md",
@@ -637,11 +643,13 @@
     "examples/pipeline/test/pipeline.test.ts",
     "examples/pipeline/tsconfig.json",
     "mcp-launcher.mjs",
+    "packages/core/CHANGELOG.md",
     "pnpm-lock.yaml",
     "pnpm-workspace.yaml",
     "reviewed-licenses.json",
     "runtime-check.d.mts",
     "runtime-check.mjs",
+    "scripts/check-release-plan.mjs",
     "scripts/check-restoration.mjs",
     "scripts/clean-build.mjs",
     "scripts/cloud-install.sh",
@@ -651,10 +659,19 @@
     "scripts/npm-command.test.ts",
     "scripts/package-manager.mjs",
     "scripts/package-manager.test.ts",
+    "scripts/publication-state.mjs",
+    "scripts/publication-state.test.ts",
+    "scripts/record-release.mjs",
     "scripts/registry-publication.mjs",
     "scripts/registry-publication.test.ts",
+    "scripts/release-plan.mjs",
+    "scripts/release-records.mjs",
+    "scripts/release-records.test.ts",
     "scripts/release.mjs",
+    "scripts/restore-publication-state.mjs",
     "scripts/update-inventory.mjs",
+    "scripts/version-packages.mjs",
+    "scripts/version-packages.test.ts",
     "src/application/overlay.test.ts",
     "src/application/overlay.ts",
     "src/application/saved-evidence.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weftlet/toolkit",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Evidence-backed context graphs for AI development agents: product intent, contracts, code, tests and runtime behavior",
   "license": "Apache-2.0",
   "type": "module",
@@ -62,9 +62,10 @@
     "n3": "2.7.2",
     "rdf-validate-shacl": "0.6.5",
     "sparqljs": "3.7.4",
-    "@weftlet/core": "^0.1.1"
+    "@weftlet/core": "^0.1.2"
   },
   "devDependencies": {
+    "@changesets/cli": "3.0.3",
     "@types/n3": "1.26.1",
     "@types/node": "20.19.11",
     "@typescript-eslint/parser": "8.72.0",
@@ -114,6 +115,8 @@
     "release:prepare": "pnpm context-graph:publication-check && node scripts/release.mjs --prepare",
     "release:publish": "node scripts/release.mjs --publish",
     "govern": "tsx src/cli.ts govern --policy architecture.policy.json --output .context-graph/architecture-report.json",
-    "weftlet": "tsx src/cli.ts"
+    "weftlet": "tsx src/cli.ts",
+    "changeset": "changeset",
+    "release:version": "node scripts/version-packages.mjs"
   }
 }