@weftlet/toolkit 0.1.2 → 0.2.0

package/docs/VALIDATION.md

@@ -8,6 +8,325 @@ The milestone entries below record the original cloud checks. Subsequent
 establishes live Codex success on Windows and the full deterministic checks on WSL,
 while identifying remaining native Windows issues.
 
+## Development workspace recovery, 2026-10-23
+
+The existing Codex development workspace became executable again at repository commit
+`3617c71e29af869feccec1f5b1390c3082149b12`. Runtime status reported current observations and
+connected execution; shell access, the repository identity and its initially clean worktree
+were confirmed. The cause of the earlier executor failure was not established. A reported
+OAuth 404 from another project was not reproduced or attributed to the executor failure.
+
+Linux, Node 24.19.0, pnpm 10.18.2:
+
+- The existing restoration checkpoint passed `node scripts/check-restoration.mjs --verify`:
+  its snapshot digest was retained, ten facts were queried with an intentionally unavailable
+  provider, and the historical evidence remained ineligible for current-diff validation.
+  No checkpoint or saved evidence was regenerated to obtain that result. A build had already
+  run; verification preceded the new governance run.
+- The full deterministic publication gate passed again: **222 tests** (1 core + 221 toolkit),
+  one optional OML skip, build, 12 advisory architecture findings, inventory, licenses and
+  fresh packed-consumer installation/indexing/RDF/SHACL/viewer-generation/MCP checks.
+- The new [consumer-trial recipe](CONSUMER-TRIAL.md) was exercised in a separate public
+  dispatch Git repository using fresh npm installation of locally packed core/toolkit archives.
+  The documented Bash blocks ran with only the sample task/path replaced. The deterministic
+  zero-assertion provider produced three artifacts; the repeat extracted zero and reused three
+  with unchanged snapshot identity/content. Diagnostics, SHACL and two distinct 60-fact pages
+  passed. A deliberate exit-7 child retained its error/status and stopped the shell before a
+  subsequent marker could run. Independent review confirmed the corrected fail-fast handling,
+  captured-commit pinning and command compatibility. This is a command-recipe check, not a
+  live semantic-quality measurement. An initial source-workspace rehearsal stopped at npm's
+  `workspace:^` metadata handling; the successful check used the documented installed consumer.
+
+This was recovery within the existing conversation, not the new-task procedure in
+[environment validation](ENVIRONMENT-VALIDATION.md). It establishes neither fresh-cloud
+restoration nor live model/authentication recovery. No model request, source-application
+change or npm publication was part of these checks.
+
+## Explicit routing declarations, 2026-10-23
+
+[ADR 014](ADR-014-routing-declarations.md) adds opt-in committed source mappings for explicit
+producer/consumer bindings. Implementation `5b8d49679f48837fe2ea465940b8c852e543cf5d` was
+measured on input/protocol commit `e5510479c0545e38a41a902b65839529a3e66e73`, frozen before
+measurement. The original 27 dispatch inputs, cases and evaluator/ranking hashes are unchanged.
+The public-safe comparison is `evaluations/dispatch/routing-baseline.json`.
+
+Linux cloud, Node 24.19.0, pnpm 10.18.2:
+
+- The same-SHA no-routing control retains **15/16 expected files** on page one and within
+  three pages, with **0/7 labeled distractions**. Enabling the single authored declaration
+  retrieves **16/16 on page one and within three pages**, retaining **0/7 distractions**.
+  This measures use of a supplied mapping, not discovery or verification of a deployed route.
+- Hydration produces **227 control facts / 229 enabled facts**. Only two inferred,
+  deterministic routing facts are added; every non-routing fact field matches except its
+  containing snapshot ID. Diagnostics, SCIP digest and semantic artifact keys are unchanged.
+  Both runs reuse all three control artifacts with zero extraction/model calls. Repeating
+  enabled hydration retains snapshot identity/content and again reuses all three artifacts.
+- Full continuation returns **198 unique facts** (60/60/60/18), versus 183 reachable in the
+  control. All six archival implementation facts and seven archival test facts are reachable;
+  three implementation facts and one test fact appear on page one. A test-file relationship
+  does not assert test execution or delivery. No refund/audit distraction facts are returned.
+- Direct SPARQL returns the exact producer/binding/consumer pair with inferred authority.
+  SHACL conforms and RDF projection matches every fact field. The existing unresolved
+  Markdown reference remains a diagnostic; no approved intent or runtime evidence is added.
+- The final full publication gate passed **222 deterministic tests** (1 core + 221 toolkit),
+  one optional OML skip, build, 12 advisory architecture findings, inventory, licenses and
+  fresh packed-consumer installation. The installed smoke extracts a committed routing file
+  and includes its consumer in the complete SCIP/RDF/SHACL/query/viewer/MCP path.
+- Tests cover strict schemas/duplicate JSON keys, bounds, scoped identity, same-topic binding
+  isolation, exact regular Git blobs including Unicode/spaced paths, missing/ambiguous
+  endpoints, dirty committed querying, rename/delete, tracked-but-ignored manifests, repeated
+  overlays, draft authority, outside-scope endpoint rejection and failed-refresh preservation.
+  Secondary review found and resolved diagnostic ordering and draft freshness issues before
+  the final full gate. The isolated overlay now preserves all archived tracked inputs even
+  when `.gitignore` matches them.
+- Five historical snapshot files retain their recorded SHA-256 digests. Saved-only rescoring
+  of the latest dispatch and Weftlet graphs preserves their scores and reachability (15/16
+  and 24/24 first-page candidates respectively). All 79 original imported source paths/source
+  hashes remain intact. No source application was modified.
+
+Hosted Ubuntu/Windows results are attached to the implementation PR. Browser interaction,
+live provider authentication, broader semantic quality and actual deployment/runtime routing
+validation remain separate. This increment includes a minor changeset but no npm publication.
+
+## Relative module request identities, 2026-10-22
+
+[ADR 013](ADR-013-relative-module-requests.md) scopes generic relative imports to the
+importing directory. Implementation `26c47d5b55f9390fe38b4928d1a8274eaf893583` was measured
+against the frozen dispatch input and the existing Weftlet document-link input. Cases,
+configuration, budgets, evaluator and ranking bytes are unchanged. The public-safe record
+is `evaluations/dispatch/relative-imports-baseline.json`.
+
+Linux cloud, Node 24.19.0, pnpm 10.18.2:
+
+- Dispatch retains **15/16 expected candidates** on page one and within three pages.
+  Three-page labeled distractions fall from **7/7 to 0/7**; page one remains 0/7.
+  The reachable component shrinks from 214 to 183 facts. Full continuation returns all
+  183 unique facts (60/60/60/3), with no refund/audit distraction or archival consumer.
+  The archival file still has six local facts but no extracted operational route.
+- The Weftlet input retains **24/24 first-page and three-page candidates**, with 0/4
+  first-page and 1/4 three-page distractions. All scans still reach 3,648 facts and stop
+  at 180; telemetry remains a later-page distraction for atomic publication. These results
+  do not establish exhaustive precision or broader semantic quality.
+- Real SCIP/document/RDF/SHACL hydration retains 227 dispatch and 3,648 Weftlet facts.
+  SCIP and document facts match their prior versions in every field except containing
+  snapshot ID. Dispatch reused three semantic control artifacts and Weftlet reused six,
+  extracting zero. A repeated dispatch refresh preserves identity/content and reuses all
+  three again. No model calls, approved sources or runtime observations were added.
+- Snapshot assembly v4 and file extractor v2 coexist with old saved evidence. Draft
+  overlay publication identity also binds the extractor version, while capture-v2 digests
+  remain compatible. Tests cover old/new overlay coexistence, immutable committed heads,
+  repeated draft identity, rename/delete behavior and manifest versions.
+- The full publication gate passed **208 deterministic tests** (1 core + 207 toolkit),
+  one optional OML skip, build, 12 advisory architecture findings, inventory, licenses and
+  fresh packed-consumer installation. The installed smoke exercises the new relative-request
+  module alongside actual SCIP, RDF/SHACL, continuation, visualization and MCP checks.
+  Actionlint passed without shellcheck.
+- Independent review verified all 27 frozen dispatch input hashes, six evaluator hashes,
+  three legacy saved-snapshot byte hashes and their original scores/reachability. All 79
+  imported source paths/source hashes are preserved. Code review found no blockers; its
+  control-character coverage observation was corrected before the final full gate.
+
+Hosted Ubuntu/Windows results are attached to the implementation PR. Corrected extraction
+requires an explicit refresh; saved queries keep their original facts and do not rebuild.
+Browser interaction, live authentication and broader semantic quality remain separate.
+No npm publication is part of this increment.
+
+## Prospective dispatch evaluation, 2026-10-22
+
+Inputs, labels and protocol were committed at `fa902165a1f212a6d3245c847e1ab9b64a69715b`
+before any queries. Production ranking remains byte-identical to `proximity-diversity-v1`.
+The [evaluation protocol](IMPACT-EVALUATION.md#prospective-dispatch-evaluation) and
+`evaluations/dispatch/baseline.json` record the public-safe measurements and provenance.
+
+Linux cloud, Node 24.19.0, pnpm 10.18.2:
+
+- Real SCIP/document/RDF/SHACL hydration produced **227 facts**, with zero model assertions,
+  approved intent sources or runtime references. Repeat hydration extracted zero and reused
+  three control artifacts, retaining snapshot identity/content digest. Fixture TypeScript
+  checking and four exported behavior checks passed separately.
+- All three cases use the existing 60-fact/three-page/depth-32 budget. Candidate recall is
+  **15/16 on page one and within three pages**. No labeled distraction appears on page one;
+  **7/7 case-specific distraction labels** appear within three pages. These are synthetic
+  candidate-file measurements, not a quality gate or exhaustive precision result.
+- Supplemental full continuation returned 214 unique facts across four pages, with no
+  archival-file fact. Its local relationships exist but the expected operational route is
+  disconnected. SCIP distinguishes the two domain policy functions; cited generic import
+  witnesses show the cross-domain `./policy.js` connection. The intentionally unresolved
+  Markdown reference has a diagnostic and no guessed target.
+- Original Weftlet snapshots, suite, reachable counts, recall and distraction scores remain
+  unchanged. Both saved snapshot files match their recorded SHA-256 digests. All 79 original
+  imported source paths and source hashes are preserved.
+- Focused evaluator checks pass with a real independent Git repository and an unrelated cwd:
+  selected suite/config, separate evaluator/evidence commits, real indexing/document links,
+  saved-only scoring, immutable snapshot content, failed-report preservation, missing-snapshot
+  refusal and live-provider refresh refusal. Boundary tests also reject impostor modules and
+  repository/suite/configuration/draft mismatches. Fixture result scores are not CI thresholds.
+- The full publication gate passed **203 deterministic tests** (1 core + 202 toolkit),
+  one optional OML skip, build, 12 advisory architecture findings, inventory, licenses and
+  fresh packed-consumer installation/indexing/RDF/SHACL/MCP checks. Actionlint passed without
+  shellcheck; strict TypeScript checking of the evaluator also passed.
+
+Hosted Ubuntu/Windows outcomes are recorded with the implementation PR.
+No ranking/source-extraction change, live model call, browser result, authentication result
+or npm publication is part of this increment. Broader real-project and semantic-quality
+validation remain separate.
+
+## Impact ranking, 2026-10-22
+
+[ADR 012](ADR-012-impact-ranking.md) describes query ordering by weighted proximity and
+source diversity. Implementation `2e4a3bbc55bd3a15cf619f56827963a699a5b56b` was measured
+against two existing immutable snapshots, with no hydration or model calls. The public-safe
+record is `evaluations/weftlet/ranking-baseline.json`; cases, labels, budgets, configuration,
+snapshot bytes and reachable fact counts are unchanged.
+
+Linux cloud, Node 24.19.0, pnpm 10.18.2:
+
+- On the document-link snapshot, first-page candidate retrieval improved from **22/24 to
+  24/24**, retaining 24/24 within three pages. Labeled distractions fell from 1/4 to 0/4
+  on page one and from 3/4 to 1/4 within three pages. The query test and setup doctor now
+  appear on page one. Telemetry is a new later-page distraction for atomic publication;
+  the aggregate improvement does not mean that every case has less noise.
+- On the older source-project control, first-page retrieval improved from 15/24 to 19/24
+  and three-page retrieval from 18/24 to 19/24. The five missing document relationships
+  remain absent. Labeled distractions worsened from 0/4 to 1/4 within three pages, again
+  telemetry. These four cases from one repository do not establish generalization or
+  exhaustive precision. Every scan remains truncated after 180 facts with continuation.
+- The full publication gate passed: **197 deterministic tests** (1 core + 196 toolkit),
+  one optional OML skip, build, 12 advisory architecture findings, inventory, licenses
+  and fresh packed-consumer installation. The installed smoke now exhausts ranked
+  continuation over actual extracted facts, checking for duplicate or missing results.
+- Focused coverage includes large-source consumer diversity, deep asynchronous flows,
+  generic shared imports, citation-only anchors, stable ties across commit-derived IDs,
+  complete pagination, versioned continuation rejection and evaluator version drift.
+  The real TypeScript/RDF pipeline retains field-for-field projection equivalence.
+- The first full run omitted the cloud's writable cache/store settings, causing four
+  installation-fixture failures. Correcting the command environment produced the passing
+  full rerun above; no source workaround was needed. Actionlint passed without shellcheck.
+  All 79 original import paths and source hashes remain unchanged.
+
+Hosted Ubuntu/Windows outcomes are attached to the implementation PR. Ranking changes
+ordering only, preserving evidence authority, confidence, scope and current-diff eligibility.
+Saved snapshots need no refresh; old continuation tokens require restarting the scan.
+Browser interaction, live-provider/authentication checks and broader semantic quality remain
+deferred. No new source approval, runtime observation or npm publication is claimed.
+
+## Explicit document linkage, 2026-10-22
+
+[ADR 011](ADR-011-explicit-document-links.md) describes committed Markdown references,
+precise citations, authority boundaries, and the new snapshot assembly identity. Implementation
+`90726be3751cf23de7f1cdd595d1e9ddb151b139` is measured separately from the evidence inputs.
+The six documents' source mappings were committed at
+`dcef64001d8d47cd1aeb4c1434992612158a104a`, before the linker implementation.
+
+Linux cloud, Node 24.19.0, pnpm 10.18.2:
+
+- Full publication gate: **192 deterministic tests** (1 core + 191 toolkit), one optional
+  OML skip, build, 12 advisory architecture findings, inventory, licenses and fresh packed
+  consumer. The installed smoke now parses committed Markdown and combines its references
+  with real SCIP facts before RDF/SHACL validation. Actionlint passed without shellcheck.
+- Focused cases cover relative/root/reference-style/encoded Markdown destinations, CRLF
+  source citations, duplicate basenames without guessing, missing/deleted/renamed paths,
+  directories, URLs, code examples, and distinct source approval/assertion review. Real
+  pipeline hydration links a test using SCIP's Evidence identity, passes SHACL and retains
+  field-for-field RDF projection equivalence. Cached prose is rechecked against target
+  deletion, while the preceding immutable snapshot stays readable.
+- The original saved v2 evidence was queried without hydration: its digest and 15/24
+  first-page, 18/24 three-page scores remain unchanged. Fresh assembly uses a different
+  identity, binds the linker version, and reuses the existing semantic artifacts.
+- The fixed old-source control still returns 15/24 first-page and 18/24 three-page candidates.
+  With the new explicit source mappings, the measurement returns **22/24 first-page and
+  24/24 three-page candidates**. All five expected intent-document paths are retrieved.
+  This new input also contains the intervening source-indexing implementation; it is not
+  an isolated model-quality or ranking experiment. The original case labels and budgets
+  are unchanged. `evaluations/weftlet/document-links-baseline.json` records the evidence
+  identities, provenance witnesses, scores, noise and limitations.
+- Three of four labeled distractions appear within three pages, including one on the first
+  page. All scans remain truncated at 180 facts. Better candidate recall does not establish
+  precision, complete product understanding, or a safe change. Ranking is measured separately
+  in the subsequent increment above.
+- An initial real-document run caught false missing-file diagnostics for slash-separated
+  prose and package names. The final linker diagnoses unresolved explicit Markdown links;
+  unresolved literal mentions are ignored. Regression cases include the observed examples.
+  All 79 original import paths and source hashes remain unchanged.
+
+Hosted Ubuntu/Windows outcomes are attached to the implementation PR. No live model call,
+new source approval, browser interaction, runtime behavior or authentication result is claimed.
+The control provider returns no assertions. Browser and live-provider validation remain deferred.
+
+## Committed source-project indexing, 2026-10-22
+
+[ADR 010](ADR-010-committed-source-indexing.md) records the opt-in profile and its limits.
+Toolkit implementation `1c2c699` was evaluated against the same evidence commit
+`eeaaa342d62c11eeef44bfdf81fa8dedcfeb205d`, unchanged case labels and query budgets.
+`evaluations/weftlet/source-project-baseline.json` records the full implementation SHA,
+snapshot/configuration/index digests, scores, remaining misses and source coverage.
+
+Linux cloud, Node 24.19.0, pnpm 10.18.2:
+
+- First-page candidate retrieval improved from 13/24 to 15/24; three-page retrieval
+  improved from 16/24 to 18/24. Typed SCIP relationships now cover 33 test files, including
+  the lifecycle test, and link the shared core contract. Five expected intent documents
+  remain unlinked and the MCP file remains outside the query budget.
+- The new graph has 3,490 facts (2,970 SCIP and 520 repository-file facts). Repeated
+  hydration reused all six document-control artifacts with identical snapshot identity
+  and content digest `6f30f62900e37a6d2d266bcd3bba54941b1cab3997602eefef3320b0d0e66fc3`.
+  Rerunning the original profile preserved its prior snapshot, digest and scores.
+- Real SCIP regression fixtures prove committed contract/test linkage through a workspace
+  re-export, ignored/dirty-source isolation, repeat digest stability, rename/delete
+  replacement, and capture of draft changes outside ordinary code/evidence roots.
+  Invalid scopes/aliases fail before SCIP. Missing alias-definition selection was caught
+  during development; both entry points and definition files must be explicitly selected.
+- The full publication gate passed: 187 deterministic tests (1 core + 186 toolkit),
+  one optional OML skip, builds, 12 advisory architecture findings, inventory and licenses.
+  Fresh packed-consumer checks now also exercise a source alias and a test excluded by
+  its build config, along with the existing npx/RDF/SHACL/viewer-output/MCP checks.
+- Workflow syntax passed actionlint. All 79 original source import paths/hashes remain
+  unchanged. The Windows workflow includes the new real-indexing and overlay regressions;
+  hosted outcomes are attached to the implementation PR.
+
+No dependency installation in evidence archives, live model run, runtime observation,
+owner approval, browser interaction or new authentication result is claimed. This mode
+does not inherit build compiler settings or establish complete external dependency resolution.
+
+## Self-repository impact evaluation, 2026-10-21
+
+The [evaluation protocol](IMPACT-EVALUATION.md) and public-safe
+`evaluations/weftlet/baseline.json` record a deterministic control against committed
+Weftlet `eeaaa342d62c11eeef44bfdf81fa8dedcfeb205d`. The active checkout contained
+the new evaluator; its source/suite/configuration digests are recorded separately.
+No current working source bytes were substituted for that evidence commit.
+
+On Linux, Node 24.19.0 and pnpm 10.18.2:
+
+- Real SCIP, RDF/SHACL and publication produced 1,369 facts. Four fixed scenarios
+  retrieved 13/24 expected candidate files on the first page and 16/24 in three pages.
+  These are measurements, not a quality pass. Intent documents, workspace contracts,
+  test coverage and query ranking have the gaps described in the protocol.
+- Repeated hydration extracted zero and reused six document-control artifacts, retaining
+  snapshot identity and content digest
+  `5b4003c527b0f797d45814679326c59da995bc677d0706768a9d9b1b21aedb4f`.
+- Saved-snapshot scoring succeeded with the semantic-artifact directory temporarily
+  unavailable and returned identical recall. No hydration phases ran; artifacts were
+  restored afterward. Missing-snapshot and live-provider-refresh probes both failed
+  clearly without starting an indexer or model.
+- Five evaluator tests passed, covering first/later-page scores, extraction versus
+  bounded-retrieval misses, non-relationship exclusions, duplicate/drifting pages,
+  stale case paths and invalid budgets. Strict TypeScript checking of the evaluator passed.
+- The full publication gate passed: 183 deterministic tests (1 core + 182 toolkit),
+  one optional OML integration skipped, builds, 12 advisory architecture findings,
+  inventory, licenses and fresh packed-consumer installation/indexing/RDF/MCP smoke.
+  All 79 original import paths and source hashes remain unchanged.
+
+Hosted [checks for the initial evaluation commit
+8e82453d92357451e832f3bf16666a6bef89b6de](https://github.com/jchewitt/weftlet/actions/runs/39687986720)
+also passed on Ubuntu (full publication gate) and Windows (34 selected reliability tests,
+inventory and licenses). The full self-repository control run above was performed in Linux
+cloud; these hosted checks do not imply a Windows evaluation run or browser validation.
+
+No live semantic assertions, runtime traces, owner approvals, browser interactions or
+new authentication results are claimed. The control sends no model requests. Broader
+semantic quality still needs a separately bounded live run and human citation review.
+
 ## Milestone 1: standalone baseline
 
 Passed `pnpm context-graph:publication-check`:
@@ -556,3 +875,50 @@ archives and conflicting tags, and resume interrupted creation without duplicate
 tests select earlier attempts and reject expired or ambiguous artifacts. No paid model call or
 new npm version was published by these tests. Hosted version-PR operation is checked separately;
 a future merged release remains the integration test of automatic publish and record creation.
+
+## Automatic 0.1.2 release and Windows reliability — 2026-10-21
+
+[Release run 39672652013](https://github.com/jchewitt/weftlet/actions/runs/39672652013) completed
+preparation, npm trusted publication and release records at
+`3d8d1f38a9e70b38178921cdabf5e8714c417c1c`. Both registry `latest` tags now identify 0.1.2.
+Both package-specific Git tags resolve to that exact commit, and GitHub Releases were created.
+Versions were committed on main before publication. This validates the first merged Changesets
+release through the automatic push trigger; no post-publication version commit was required.
+
+The next Windows reliability increment adds common discovery for native Codex executables and
+standard global/project-local npm launchers. Tests use actual npm-created launchers with a
+synthetic public CLI to exercise diagnostics, login status and source-isolated extraction. They
+also cover PATH precedence, spaces/metacharacters, rejected/broken shims, secret filtering,
+discovery timeout/cancellation, and termination of a launcher with an active child. They make no
+live Codex request and do not validate real account authentication or model quality.
+
+Inventory tests use actual Git checkouts with core.autocrlf=true and explicit eol=crlf attributes.
+They check unchanged source hashes, checkout bytes, Git configuration and index; genuine edits
+still fail. Binary and -text imports retain exact bytes. Custom filters are rejected without
+execution. License checks accept CRLF formatting while still comparing complete notice text.
+All 79 original source paths/hashes remain unchanged.
+
+The full local publication gate passed on Linux, Node 24.19.0 / pnpm 10.18.2: **177 deterministic
+tests** (1 core + 176 toolkit/example/script), one optional OML test skipped, build, architecture
+(12 advisory findings), inventory, licenses and fresh packed-consumer smoke. Actionlint passed
+with shellcheck integration disabled. The Windows CI job now runs the added launcher, process,
+inventory and license checks; its native result is recorded separately after execution. Browser
+interaction and live authentication testing remain explicitly deferred by the maintainer.
+
+
+The first hosted Windows run at `6f2f83f` passed all **33** selected tests and the repository
+inventory check, including real npm launchers and process-tree cancellation. Its newly enabled
+license check caught CRLF conversion of a pinned reviewed notice. That check now shares the
+Git-aware content reader; the reviewed notice and its approved SHA-256 remain unchanged.
+Discovery time is included in existing probe/extraction timeout budgets. Updated hosted checks
+are required before merging this increment.
+
+
+PASS: [hosted run 39676848049](https://github.com/jchewitt/weftlet/actions/runs/39676848049)
+at `ef2f8e31cbcae402ca08979e90aff4f00fb91c77`. Ubuntu passed the full publication gate with **178 deterministic tests**
+(1 core + 177 toolkit/example/script), one optional OML test skipped, 12 advisory architecture
+findings, build, inventory, licenses and packed-consumer smoke. Native Windows passed **34**
+selected tests, including global/local npm launcher installation, discovery, login/extraction
+plumbing, process-tree cancellation, CRLF inventories, storage/Git and all original MCP startup
+cases. The repository inventory and complete license checks also passed natively. This is focused
+Windows coverage, not a full native Windows publication gate or a live Codex account/model test.

package/docs/VIEWER.md

@@ -4,6 +4,11 @@
 renders the same Context Pack returned by `impact.scan`. HTML is self-contained; DOT and SVG
 remain available. No CDN, service, model or alternative graph extraction is involved.
 
+[Visualization rendering](../src/visualization/visualization.ts) consumes the
+[impact-query result](../src/graph/query.ts). [Viewer interaction](../src/visualization/viewer-interaction.ts)
+handles page-local filtering and path selection. [Rendering tests](../src/visualization/visualization.test.ts)
+check generated output; interactive browser validation remains a separate check.
+
 Nodes are grouped by evidence lane, then module/layer metadata or node kind. Filter by cluster,
 authority or source text. Select a node (click or Enter) to inspect its relationships, confidence,
 extractor, source approval, extraction review state and commit-bound citations. The neighbor

package/docs/extraction-manifest.json

@@ -24,7 +24,7 @@
       "destinationPath": "THIRD_PARTY_NOTICES.md",
       "sourceSha256": "c98c42f3c3c74f4c4f38f45b785ea15de439ad6471d82040d13100b36616b01e",
       "modified": true,
-      "destinationSha256": "1c8bb26c7385fef7d391db9c89797b6f45bf6c5b102d7e832295783eb6c28d1a"
+      "destinationSha256": "cd1b40a873371c1fb20599ae8dc5d1131ea4ba650c1f4151415e2cb038339d8d"
     },
     {
       "sourcePath": "tools/context-graph/action/action.yml",
@@ -108,7 +108,7 @@
       "destinationPath": "package.json",
       "sourceSha256": "a575dbb2fed8c554b95e8e9b3e03a0c21cab1be7249860bbebc18e046b2ff78d",
       "modified": true,
-      "destinationSha256": "017fe298662e434efa27d4f21a0adb0d857fa373a6199ed2d623a6c630c5b451"
+      "destinationSha256": "c7a5cbf191d699a51a22fb961ba84e9f73521c0cc332c697f67a9267812de9ee"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/LICENSE",
@@ -143,14 +143,14 @@
       "destinationPath": "packages/core/package.json",
       "sourceSha256": "2a29066eb8452f22fafcb06bb035a84dda93c5705dba32aba600a1b7e5aaf19c",
       "modified": true,
-      "destinationSha256": "9dbd393a312bb6a992b53d2624279b62991e64609beb506744186614f9b194cf"
+      "destinationSha256": "b7ab260df2ff6005788e6891449205b9b9c9f96aca13b680578a4f776aa21b52"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/src/core.ts",
       "destinationPath": "packages/core/src/core.ts",
       "sourceSha256": "cb3f4eb7bfe9f458494607406664445a276aad37235930a043d400ea9211ed16",
       "modified": true,
-      "destinationSha256": "64a30913c01ff2f3e112a6bcafbc142cb91fc5482f01b2aa90fae9382252dbfa"
+      "destinationSha256": "0287d0640f2ff078da19be1439d02fcab22998262562d4af7b5f26ddca0839f4"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/src/index.ts",
@@ -192,21 +192,21 @@
       "destinationPath": "scripts/check-publication.mjs",
       "sourceSha256": "88692c21d34cef2d2e5b20c92ab3ec26cbe6336889dbb7b534c681ded7f466b2",
       "modified": true,
-      "destinationSha256": "6aa819a74fea8b161396b3a8c52e8e86ea2db856bc10ffbfdebaf22fa0af2cfe"
+      "destinationSha256": "546465bb9907051ebbae9f1c421b8b7be23414ce51c44891092d0fb793f67e8b"
     },
     {
       "sourcePath": "tools/context-graph/scripts/generate-third-party-notices.mjs",
       "destinationPath": "scripts/generate-third-party-notices.mjs",
       "sourceSha256": "42cd4996ecab49b008634958e47b0a9eadf9ea775678b8daaeeafea59eaabadf",
       "modified": true,
-      "destinationSha256": "5caf7a08a42e6c482a5c46d87e71413a6776a5af34685dbe98a16ba7035f5c0c"
+      "destinationSha256": "6e9ddb9a0985e2c39d8386168871efeb2589f6bc1bf8c24684cf6c546eced1b2"
     },
     {
       "sourcePath": "tools/context-graph/src/agent-context.test.ts",
       "destinationPath": "src/application/agent-context.test.ts",
       "sourceSha256": "cb87b9b7e18ae5d8ba39d4ebf1d45556479d6efb3ffa75276bc6164ee2bf30f1",
       "modified": true,
-      "destinationSha256": "f1ed006615ae0d07fb924c60fccad90a3f8cd4e5f12898d4a07db0a5fa65e7d5"
+      "destinationSha256": "c72ba1d20d1ad85ee295a7041e85a99cf973b6114eff21524d808997929e3184"
     },
     {
       "sourcePath": "tools/context-graph/src/agent-context.ts",
@@ -248,14 +248,14 @@
       "destinationPath": "src/configuration/config.test.ts",
       "sourceSha256": "70bcda6d6b48ff6fa03223c9420fe3e0e3e32c688e0a14f11034515e0707dee4",
       "modified": true,
-      "destinationSha256": "ae67cb42f86dbd72d09eac20a0755080bf9394e849dc4fdfdfe0a43b0296c6b2"
+      "destinationSha256": "ff4d15018ec35d21a95c589cf2c74bce2e340f9042b2d3ecaabca5889609e3aa"
     },
     {
       "sourcePath": "tools/context-graph/src/config.ts",
       "destinationPath": "src/configuration/config.ts",
       "sourceSha256": "e9ee8cf2134d274aa6f6a21545959fbec97e958181d9032c073293f28e04d6ca",
       "modified": true,
-      "destinationSha256": "ce6550967829b74147909121735c4dccf70982c3f9ee9ddc860b4f63535d5de0"
+      "destinationSha256": "5e34e4dfa38219570bd6f13239609b432830e76162f44a768a929895f66dc02a"
     },
     {
       "sourcePath": "tools/context-graph/src/core.ts",
@@ -283,7 +283,7 @@
       "destinationPath": "src/extraction/document.ts",
       "sourceSha256": "62a2da37d8cc0637b192b7e70ae7a0dce72244d335da9df0e0ad9b0eb7c4e1f1",
       "modified": true,
-      "destinationSha256": "819372a1ba01ed2204e2ed620d4afefb03ab8b7431e77e02f2b61bc605807124"
+      "destinationSha256": "de198e73b3b2c828c99bb35c806461dba06526df9ae94592926d26346fbefe79"
     },
     {
       "sourcePath": "tools/context-graph/src/git.test.ts",
@@ -311,14 +311,14 @@
       "destinationPath": "src/application/hydrator.test.ts",
       "sourceSha256": "95f20a526fe69ce3a506ef01da1c20827e09d631a34126e781a07979cc43de07",
       "modified": true,
-      "destinationSha256": "83ca72d394d9eac8eef5dbc9438c7914442dbad3bbaa07c33f1e756e6d11fd39"
+      "destinationSha256": "bbd264bf4224632f3e0fea81718910fab4dd5f8e79680faccf61059219bf9dde"
     },
     {
       "sourcePath": "tools/context-graph/src/hydrator.ts",
       "destinationPath": "src/application/hydrator.ts",
       "sourceSha256": "bb41c5b53b26da10274d8b967b99c78ff12b485df16bfc66445252e35c94fb9d",
       "modified": true,
-      "destinationSha256": "c95592ccb8626e8d3629f35d24e51d9d99be698c8ae270c794df47e4b3a46d14"
+      "destinationSha256": "8c751fe04922d1117728672b78a1de2d6f42f403e9d506f387c95661e641a5c0"
     },
     {
       "sourcePath": "tools/context-graph/src/index.ts",
@@ -388,14 +388,14 @@
       "destinationPath": "src/graph/query.test.ts",
       "sourceSha256": "ba07c52566da979fcbb451b0c0c99b466521993cb49415ff8b35df2b01d4ecaf",
       "modified": true,
-      "destinationSha256": "e0030981026a6643d8032174f37a0a41b17724ee6a86dae55e6b12c51f5de77f"
+      "destinationSha256": "68d7405765dec5975370f79caaf8708db42dd3dd464a7ec9c3919c796ee81b79"
     },
     {
       "sourcePath": "tools/context-graph/src/query.ts",
       "destinationPath": "src/graph/query.ts",
       "sourceSha256": "4d67f87ca660cefe9686fb5b775f86a997a25d539819ea81d321c8bd1e0aaa39",
       "modified": true,
-      "destinationSha256": "93e813d2e70d09522418e07f9ffeb36d71795c026099a8b57559b0c10b150a76"
+      "destinationSha256": "ead61dfde748cd1a02c8b1a14dc729173a6b85ec3b8213af2bd5169c60b70253"
     },
     {
       "sourcePath": "tools/context-graph/src/request.test.ts",
@@ -451,7 +451,7 @@
       "destinationPath": "src/extraction/semantic.ts",
       "sourceSha256": "1a41fb3fc5a9508c76be59d1c50b74d70ec96411fcbb7f63b0e098c1813d8473",
       "modified": true,
-      "destinationSha256": "64b4e55294ab37bc84a1c2ad0a8a563003d8ad2329e224ef0c6822965b14d257"
+      "destinationSha256": "9872f2b8ac3bd14f33194d76082fecf0fd34325a6e74b2397f538898aa8fe21e"
     },
     {
       "sourcePath": "tools/context-graph/src/snapshot-checks.test.ts",
@@ -479,7 +479,7 @@
       "destinationPath": "src/extraction/static.ts",
       "sourceSha256": "f8dcff3e10361314c06911dc7cec1e2cb0f8d9af68a6c61a30b2a741c5c3a385",
       "modified": true,
-      "destinationSha256": "39ada50a57e2130d27c22eb18531c3feb7160004b198eb5904950227e57012df"
+      "destinationSha256": "94190f11651b21372b2c3a834e30cde5d333893bfad0b66755e5f698608d2fdb"
     },
     {
       "sourcePath": "tools/context-graph/src/storage.ts",
@@ -602,8 +602,15 @@
     "docs/ADR-007-toolkit-modules.md",
     "docs/ADR-008-weftlet-packages.md",
     "docs/ADR-009-release-automation.md",
+    "docs/ADR-010-committed-source-indexing.md",
+    "docs/ADR-011-explicit-document-links.md",
+    "docs/ADR-012-impact-ranking.md",
+    "docs/ADR-013-relative-module-requests.md",
+    "docs/ADR-014-routing-declarations.md",
     "docs/CLOUD-ENVIRONMENT.md",
+    "docs/CONSUMER-TRIAL.md",
     "docs/ENVIRONMENT-VALIDATION.md",
+    "docs/IMPACT-EVALUATION.md",
     "docs/MIGRATING-TO-WEFTLET.md",
     "docs/PROVIDERS.md",
     "docs/RELEASING.md",
@@ -618,6 +625,47 @@
     "docs/licenses/lru-cache-11.5.3-BlueOak.md",
     "docs/licenses/negotiate-1.0.1-BSD.txt",
     "docs/licenses/spark-md5-3.0.2-MIT.txt",
+    "evaluations/dispatch/README.md",
+    "evaluations/dispatch/baseline.json",
+    "evaluations/dispatch/cases.json",
+    "evaluations/dispatch/context-graph.config.json",
+    "evaluations/dispatch/project/README.md",
+    "evaluations/dispatch/project/docs/delivery-flow.md",
+    "evaluations/dispatch/project/docs/dispatch-contract.md",
+    "evaluations/dispatch/project/docs/dispatch-policy.md",
+    "evaluations/dispatch/project/package.json",
+    "evaluations/dispatch/project/routing/dispatch.json",
+    "evaluations/dispatch/project/src/api/dispatch.ts",
+    "evaluations/dispatch/project/src/archive/consumer.ts",
+    "evaluations/dispatch/project/src/audit/consumer.ts",
+    "evaluations/dispatch/project/src/contracts/dispatch-plan.ts",
+    "evaluations/dispatch/project/src/contracts/dispatch-receipt.ts",
+    "evaluations/dispatch/project/src/contracts/dispatch-request.ts",
+    "evaluations/dispatch/project/src/dispatch/executor.ts",
+    "evaluations/dispatch/project/src/dispatch/outcomes.ts",
+    "evaluations/dispatch/project/src/dispatch/planner.ts",
+    "evaluations/dispatch/project/src/dispatch/policy.ts",
+    "evaluations/dispatch/project/src/dispatch/retry.ts",
+    "evaluations/dispatch/project/src/refund/planner.ts",
+    "evaluations/dispatch/project/src/refund/policy.ts",
+    "evaluations/dispatch/project/src/transport/queue.ts",
+    "evaluations/dispatch/project/test/archive.test.ts",
+    "evaluations/dispatch/project/test/dispatch.test.ts",
+    "evaluations/dispatch/project/test/policy.test.ts",
+    "evaluations/dispatch/project/test/refund.test.ts",
+    "evaluations/dispatch/project/tsconfig.json",
+    "evaluations/dispatch/relative-imports-baseline.json",
+    "evaluations/dispatch/routing-baseline.json",
+    "evaluations/dispatch/routing-protocol.md",
+    "evaluations/dispatch/routing.config.json",
+    "evaluations/weftlet/baseline.json",
+    "evaluations/weftlet/cases.json",
+    "evaluations/weftlet/context-graph.config.json",
+    "evaluations/weftlet/document-links-baseline.json",
+    "evaluations/weftlet/document-only.mjs",
+    "evaluations/weftlet/ranking-baseline.json",
+    "evaluations/weftlet/source-project-baseline.json",
+    "evaluations/weftlet/source-project.config.json",
     "examples/generic-typescript/context-graph.oml.config.json",
     "examples/pipeline/context-graph.config.json",
     "examples/pipeline/docs/admission.md",
@@ -653,6 +701,14 @@
     "scripts/check-restoration.mjs",
     "scripts/clean-build.mjs",
     "scripts/cloud-install.sh",
+    "scripts/evaluation/protocol.test.ts",
+    "scripts/evaluation/protocol.ts",
+    "scripts/evaluation/run.test.ts",
+    "scripts/evaluation/run.ts",
+    "scripts/evaluation/score.test.ts",
+    "scripts/evaluation/score.ts",
+    "scripts/git-content.mjs",
+    "scripts/inventory.test.ts",
     "scripts/npm-auth.mjs",
     "scripts/npm-auth.test.ts",
     "scripts/npm-command.mjs",
@@ -676,14 +732,28 @@
     "src/application/overlay.ts",
     "src/application/saved-evidence.ts",
     "src/cli.ts",
+    "src/configuration/scip-project.ts",
     "src/extraction/codex-auth.test.ts",
     "src/extraction/codex-auth.ts",
+    "src/extraction/codex-command.test.ts",
+    "src/extraction/codex-command.ts",
+    "src/extraction/document-references.ts",
+    "src/extraction/document.test.ts",
+    "src/extraction/module-request.test.ts",
+    "src/extraction/module-request.ts",
     "src/extraction/providers.test.ts",
     "src/extraction/providers.ts",
+    "src/extraction/routing.test.ts",
+    "src/extraction/routing.ts",
+    "src/extraction/scip-project.test.ts",
+    "src/extraction/scip-project.ts",
+    "src/extraction/semantic-process.test.ts",
     "src/extraction/semantic-process.ts",
     "src/governance/governance.test.ts",
     "src/governance/governance.ts",
     "src/graph/authority.ts",
+    "src/graph/ranking.test.ts",
+    "src/graph/ranking.ts",
     "src/graph/rdf.ts",
     "src/infrastructure/module-resolution.ts",
     "src/interfaces/doctor.ts",
@@ -701,6 +771,7 @@
     "tests/module-boundaries.test.ts",
     "tests/rdf-ontology.test.ts",
     "tests/rdf.test.ts",
+    "tests/routing.test.ts",
     "tests/runtime.test.ts",
     "tests/snapshot-lifecycle.test.ts"
   ],