@weftlet/toolkit 0.2.1 → 0.3.0

package/docs/RELEASING.md

@@ -1,6 +1,17 @@
 # Weftlet npm releases
 
-`@weftlet/core@0.2.0` and `@weftlet/toolkit@0.2.0` are published through GitHub OIDC.
+`@weftlet/core@0.2.1` and `@weftlet/toolkit@0.2.1` are published through GitHub OIDC.
+[Run 40382864083](https://github.com/jchewitt/weftlet/actions/runs/40382864083) completed
+preparation, publication and release records on its first attempt at commit
+`5d1db91bf19ed493a20849b2d0f92d3aeac35dfe`. Registry archives match the reviewed archives;
+provenance and package tags identify that commit. A fresh public-registry installation passes
+the identity regression, real SCIP/RDF/SHACL, querying and repeat artifact reuse without live
+model calls. [Fix PR #15](https://github.com/jchewitt/weftlet/pull/15) and
+[release PR #16](https://github.com/jchewitt/weftlet/pull/16) record the change. Genuine consumer
+acceptance remains pending in the [1.0 plan](RELEASE-1.0-PLAN.md); detailed upstream evidence
+is in [validation](VALIDATION.md).
+
+The earlier 0.2.0 release also used GitHub OIDC.
 [Run 40344526047](https://github.com/jchewitt/weftlet/actions/runs/40344526047) completed at
 commit `ffe7f1d81f0421b35220bd7ba5b1555246c7a0e1`, including registry integrity checks,
 package tags and GitHub Releases. The first attempt published core, then toolkit publication
@@ -34,8 +45,8 @@ preparation route; native Windows has focused CI coverage. See [validation](VALI
    **before** npm publication. Do not manually bump manifests or edit the generated plan.
 4. The plan change triggers **Weftlet release**. It validates and prepares both archives, publishes
    core followed by toolkit using npm trusted publishing, then verifies registry integrity.
-5. After both versions are verified, a separate job creates tags such as `@weftlet/core@0.2.0`
-   and `@weftlet/toolkit@0.2.0`, plus corresponding GitHub Releases, at that exact source commit.
+5. After both versions are verified, a separate job creates tags such as `@weftlet/core@0.2.1`
+   and `@weftlet/toolkit@0.2.1`, plus corresponding GitHub Releases, at that exact source commit.
    Existing tags are never moved. The publication job does not commit back to main.
 
 The bot uses GitHub's built-in token, not a personal access token. GitHub may require Settings →
@@ -148,7 +159,7 @@ Package-specific tags identify the exact published source, for example:
 
 ```sh
 git fetch --tags
-git switch --detach '@weftlet/toolkit@0.2.0'
+git switch --detach '@weftlet/toolkit@0.2.1'
 ```
 
 Tags support inspection and reproduction, not mutation of npm history. To roll a consumer back,
@@ -158,8 +169,8 @@ Verify a new public release in a fresh disposable project, substituting its vers
 
 ```sh
 npm init -y
-npx --yes @weftlet/toolkit@0.2.0 init --yes
-npx --yes @weftlet/toolkit@0.2.0 config validate
+npx --yes @weftlet/toolkit@0.2.1 init --yes
+npx --yes @weftlet/toolkit@0.2.1 config validate
 ```
 
 Check registry hashes, transitive core resolution and provenance. Deprecating the previous

package/docs/ROADMAP.md

@@ -1,15 +1,37 @@
 # Delivery roadmap
 
+Source checkpoint: 2026-10-26, before the planned 0.3.0 release. Publication evidence is
+recorded separately in [validation](VALIDATION.md); this roadmap is not a live registry status.
+
 Project: `jchewitt/weftlet`. Extraction provenance is recorded in the
 [source inventory](SOURCE-INVENTORY.md).
 
 Forward direction is captured in the [Weftlet 2.0 product plan](WEFTLET-2.0-PLAN.md):
 consumer hardening, cited code-derived drafts, scoped approvals and reconciliation, an optional
 review website, source publication, managed AI and guided setup. “2.0” is a planning label;
-the published packages remain 0.2.0. The received consumer findings are tracked in the
-[consumer hardening and 1.0 task list](RELEASE-1.0-PLAN.md): first release the blocking
-document-identity patch, then address setup, reuse, diagnostics and document coverage before
-official 1.0 acceptance. The 2.0 plan distinguishes proposed work from delivered capability.
+the published packages are 0.2.1. The received consumer findings are tracked in the
+[consumer hardening and 1.0 task list](RELEASE-1.0-PLAN.md): the document-identity patch is
+published and passes upstream checks; genuine consumer acceptance remains pending. T02's
+no-model preview is implemented in development source but is not in published 0.2.1. Cache reuse,
+diagnostics and document coverage remain open before official 1.0 acceptance.
+The 2.0 plan distinguishes proposed work from delivered capability.
+
+T05 now blocks adoption: the maintainer reports SHACL pushing generation past a 30-minute
+timeout before graph publication. T02 merged in [PR #18](https://github.com/jchewitt/weftlet/pull/18)
+after local and hosted Ubuntu/Windows checks. The focused T05 cold-validation optimization is
+implemented in development source, awaiting validation/release; the other 1.0 features must not
+delay it. Neither increment is in the published 0.2.1 packages.
+
+[Hydration planning](ADR-016-hydration-preview.md) shares committed selection and semantic cache
+identity with execution, reports human/JSON scope and work estimates, and preserves source versus
+assertion authority. It performs no model work or graph writes. The current JavaScript validator
+still checks the complete in-memory N3 graph on each hydration; saved queries do not repeat
+validation. [The T05 union optimization](ADR-017-shacl-validation-union.md) indexes all SPO triples
+in one temporary validation graph, preserving the same shapes and canonical named evidence.
+Bounded public experiments measured substantial cold-path improvement, alongside about 1.3 GiB
+RSS at 10,000 unique-node facts. They do not reproduce the private consumer's overall timeout.
+Early checks, in-phase progress, result reuse and incremental validation remain open; no Rust
+engine, graph database or validation-result cache is introduced by this focused release.
 
 | Milestone | Delivered and checked | Remaining limits |
 | --- | --- | --- |
@@ -97,7 +119,7 @@ preparation/publication under `@launch-echo`; the maintainer completed the 0.1.0
 source-application reintegration remain outside the authorized scope. See [release instructions](RELEASING.md).
 
 The maintainer authorized the Weftlet migration on 2026-10-21. Both `@weftlet/core` and
-`@weftlet/toolkit` are published at 0.2.0 through GitHub OIDC; the publication and verification
+`@weftlet/toolkit` are published at 0.2.1 through GitHub OIDC; the publication and verification
 record is in [validation](VALIDATION.md). Changesets prepares reviewed version PRs for the fixed package group;
 merging a release plan triggers publication and package-specific tags/GitHub Releases.
 See [ADR 009](ADR-009-release-automation.md) and [release instructions](RELEASING.md).

package/docs/VALIDATION.md

@@ -8,7 +8,101 @@ The milestone entries below record the original cloud checks. Subsequent
 establishes live Codex success on Windows and the full deterministic checks on WSL,
 while identifying remaining native Windows issues.
 
-## Repository document identity patch, 2026-10-26
+## T05 cold SHACL validation improvement, 2026-10-26
+
+Implemented in development source following the T02 preview merge. Published npm packages
+remain 0.2.1 until a separately recorded release succeeds. [ADR 017](ADR-017-shacl-validation-union.md)
+records the measured graph-wildcard lookup cost and the temporary all-triples union used by the
+unchanged JavaScript SHACL validator. The canonical named dataset and every assertion remain intact.
+
+Public synthetic production measurements use Linux/Node 24.19.0, N3 2.7.2 and
+rdf-validate-shacl 0.6.5. Each case ran once in a fresh child process with a 45-second hard deadline:
+
+| Facts / topology | Nodes / original quads | Canonical construction | Production validation, including union | Whole-process maximum RSS |
+| --- | --- | ---: | ---: | ---: |
+| 2,000 unique | 4,000 / 56,003 | 0.194 s | 0.779 s | 490 MiB |
+| 10,000 unique | 20,000 / 280,003 | 1.091 s | 2.920 s | 1,638 MiB |
+
+Both production cases conform and retain the exact before/after serialized dataset digest.
+The original-path public experiment measured 31.502 seconds of SHACL for the 2,000-fact unique
+case; its 5,000-fact shared case produced no verdict before the 45-second process deadline.
+The ADR records those separate prototype measurements and their boundaries. These are single-run
+measurements, not latency guarantees or a reproduction of the consumer's complete 30-minute run.
+Memory includes libraries, fixture generation and before/after serialization; the production
+harness peaked near 1.6 GiB at 10,000 unique facts. Its legacy comparison also reparses a second
+named store, so its RSS must not be treated as an old-versus-new production memory comparison.
+
+Reproduce from a built source checkout with
+`pnpm benchmark:shacl --counts 2000,10000 --topologies unique --modes optimized`.
+The bounded harness records runtime, build hashes, sizes, phase timings, conformance and
+serialization preservation. It exercises the public production validator; no private-store mutation,
+provider call or private consumer data is used. A small paired legacy/optimized smoke agreed;
+a 1 ms deadline probe killed the children and correctly reported no verdict.
+
+Local `pnpm context-graph:publication-check` passes: 264 deterministic tests (1 core,
+263 toolkit), one optional OML skip, 12 existing advisory architecture findings, source inventory,
+licenses and fresh packed-consumer CLI/npx/MCP, preview, real SCIP, RDF/SPARQL/SHACL and viewer
+checks. All 79 original source path/hash pairs remain unchanged. No architecture baseline or
+exception was added. The new internal shape module is required in the packed runtime inventory.
+
+The 25 new regressions compare complete normalized diagnostics with direct validation of the
+original named dataset. Cases cover empty/duplicate input, kinds, authorities, confidence and
+citation bounds/types/order, empty provenance fields and colliding fact IDs. Separate assertions
+preserve exact serialization, named-graph attributes/citations/review state and `facts()` through
+repeated validation. A 2,200-fact case detects the invalid final assertion without timing gates.
+The existing full hydration integration still verifies that failed SHACL preserves the last head.
+The shape Turtle is byte-for-byte unchanged from the T02 merge; no shape or assertion was dropped.
+
+Hosted checks and release status remain pending at this source checkpoint.
+Early identity preflight, in-phase progress, validation-result reuse and incremental validation
+remain separate work. Each hydration still performs full SHACL before publishing; saved queries
+do not repeat validation. Private consumer full hydration/repeat acceptance remains pending.
+
+## T02 no-model hydration preview, 2026-10-26
+
+Implemented in development source; published npm packages remain 0.2.1. See
+[ADR-016](ADR-016-hydration-preview.md) for source, cache and readiness semantics.
+
+[PR 18](https://github.com/jchewitt/weftlet/pull/18) merged at
+`63c70f85b26a6cc60f8bc0615a86f6042a61ecd0`. Its final head
+`6711362f9ff234d65ac3101dcf3ec0b0033519ec` passed hosted Ubuntu and Windows checks in
+[run 40400487168](https://github.com/jchewitt/weftlet/actions/runs/40400487168) and
+[run 40400478490](https://github.com/jchewitt/weftlet/actions/runs/40400478490).
+An earlier Ubuntu run exposed a temporary-fixture cleanup race; disabling automatic Git
+maintenance in that fixture and bounded cleanup retries resolved it before merge.
+
+- Local `pnpm context-graph:publication-check` passed: 239 deterministic tests (1 core,
+  238 toolkit), one optional OML skip, 12 advisory architecture findings, inventory, licenses
+  and fresh packed-consumer checks. No additional architecture baseline or exception was added.
+- Ten independent-repository planner cases cover exact committed bytes despite dirty/untracked
+  files, unchanged Git index and filesystem hashes, approved sources versus unreviewed assertions,
+  explicit evidence-root classification, empty selection, cold/warm/forced cache, malformed or
+  unreadable artifacts, output-digest corruption, budgets, duplicate IDs, missing selectors and
+  historical agent selection with explicit omissions. The warm test independently checks the
+  literal released 0.2.1 key formula, then verifies actual SemanticHydrator reuse.
+- Two real-process CLI cases cover human/JSON output, blocked and warning-only exit codes,
+  historical refs and force preview. Side-effecting provider/adapter modules are never imported;
+  unavailable Codex/SCIP/OML configuration does not prevent planning. Source bodies/raw provider
+  output are excluded from the plan. No snapshot or artifact directory is created by preview.
+- Existing hydration rename/delete tests still pass, including removal of the last document.
+  Explicit empty semantic scope now performs zero semantic extraction even with committed docs
+  present. New graph-v6 snapshots remain distinct from old assemblies; valid semantic cache keys
+  and output digests retain the 0.2.1 contract.
+- A fresh packed consumer exercises installed `hydrate --plan --json` with absent provider and
+  repository adapter modules, selects its committed document, reports one expected extraction,
+  and creates no graph storage. The public planner export and every runtime helper are present.
+  The remaining installed smoke covers real SCIP, RDF/SPARQL/SHACL, visualization and MCP.
+- Independent review found and resolved an initial selector-gating regression: unmatched selectors
+  are warnings, preserving deletion behavior. Incomplete preview scope needs review and exits 1;
+  it does not establish a new execution policy. No blocking review finding remains.
+
+No paid/live model call, npm publication or private source-application change was made for T02.
+Recursive document coverage and operational-config cache reuse remain separate. This increment
+does not optimize SHACL. The maintainer's report that validation pushes generation past a
+30-minute timeout makes [T05](RELEASE-1.0-PLAN.md#t05--detect-inexpensive-conflicts-early-and-explain-validation-work)
+the next focused release priority; no consumer timing diagnosis is claimed here.
+
+## Weftlet 0.2.1 document identity patch, 2026-10-26
 
 The public reproduction confirms the reported 0.2.0 defect: two unchanged semantic
 assertions give one repository document ID different kinds and fail single-kind SHACL.
@@ -16,6 +110,23 @@ assertions give one repository document ID different kinds and fail single-kind
 cache contract and immutable snapshot migration. The consumer follow-ups are tracked in
 the [1.0 plan](RELEASE-1.0-PLAN.md).
 
+[Fix PR 15](https://github.com/jchewitt/weftlet/pull/15) was validated at
+`42ba9b79dc0562a412cd5a048e42b77234530d94` by both hosted Ubuntu/Windows runs
+[40381728487](https://github.com/jchewitt/weftlet/actions/runs/40381728487) and
+[40381772577](https://github.com/jchewitt/weftlet/actions/runs/40381772577).
+[Release PR 16](https://github.com/jchewitt/weftlet/pull/16) advanced both package versions
+to 0.2.1. Its exact head `da07772110d4c762e3178a7345b426263e14a22f` passed local
+`pnpm release:prepare` and the explicitly dispatched
+[Ubuntu/Windows checks](https://github.com/jchewitt/weftlet/actions/runs/40382270147).
+The bot PR's separate automatic run required GitHub approval; the dispatched run tested
+that same commit and completed successfully.
+
+[Trusted-publishing run 40382864083](https://github.com/jchewitt/weftlet/actions/runs/40382864083)
+completed on attempt 1 at merged commit `5d1db91bf19ed493a20849b2d0f92d3aeac35dfe`.
+Both public npm `latest` tags resolve to 0.2.1. Package tags `@weftlet/core@0.2.1`
+and `@weftlet/toolkit@0.2.1`, plus their GitHub Releases, identify that exact commit.
+Main's package versions match the publication.
+
 - Local `pnpm context-graph:publication-check` passed: 227 deterministic tests (1 core,
   226 toolkit), one optional OML skip, 12 advisory architecture findings, inventory,
   licenses and a fresh packed-consumer CLI/npx/MCP, real SCIP and RDF/SHACL smoke.
@@ -31,12 +142,31 @@ the [1.0 plan](RELEASE-1.0-PLAN.md).
   mentioned in plain prose retains a cited implementation-gap diagnostic.
 - Independent review found and resolved that missing-path diagnostic regression. No blocking
   findings remained. All 79 original imported source paths and source hashes are preserved.
+- Independent release review inspected the actual core/toolkit archives (11/184 file entries),
+  generated versions, changelogs and plan. Runtime assets, public examples and licenses/notices
+  are present; no Git history, credentials, caches or private consumer report data were included.
+  The packed toolkit dependency is `@weftlet/core: ^0.2.1`.
+- Public npm archives match the hosted prepared archives and locally reviewed archives byte
+  for byte. Public SLSA provenance subjects match the SHA-512 archive hashes and identify this
+  source commit, repository, `publish.yml` and workflow attempt. This checks provenance content
+  and source identity, not a separate cryptographic signature audit.
+- A fresh Linux/Node 24.19.0 public-registry consumer installed only toolkit 0.2.1 directly
+  (`npm install --ignore-scripts`); core resolved transitively to 0.2.1. Both package-lock
+  registry URLs and integrity hashes matched the reviewed archives. The installed CLI
+  initialized and validated an independent public fixture with two source documents. A
+  deterministic provider reproduced the legacy conflicting classifications: hydration retained
+  2 semantic facts within 17 total facts, including 4 real SCIP facts, and SHACL conformed.
+  Cold hydration extracted 2/reused 0; the repeat extracted 0/reused 2 with unchanged snapshot
+  identity, content digest and bytes. Impact returned 17 facts and SPARQL returned the four
+  canonical document references. Saved queries still worked after the provider was disabled.
+  No live model call was made.
 
 These are deterministic upstream checks, not live semantic-quality or private consumer
 acceptance results. The consumer's full hydration was stopped after its isolated reproduction;
 no complete consumer SHACL verdict or published snapshot is claimed. Full-graph validation
-latency remains a separate investigation. Release and hosted-check evidence will be recorded
-after the patch completes the normal publishing workflow.
+latency remains a separate investigation. The first refresh requires new semantic extraction;
+historical cache/snapshot files should be retained. T01's upstream patch is published, while
+genuine consumer acceptance and the remaining T02–T07 work are still pending.
 
 ## Weftlet 0.2.0 publication, 2026-10-26
 

package/docs/WEFTLET-2.0-PLAN.md

@@ -1,7 +1,8 @@
 # Weftlet 2.0 product plan
 
 Status: proposed direction captured at the maintainer's request on 2026-10-26.
-Baseline: published `@weftlet/core` and `@weftlet/toolkit` **0.2.0**, with release evidence in
+Planning baseline: published `@weftlet/core` and `@weftlet/toolkit` **0.2.0**. The consumer
+identity fix has since shipped in **0.2.1**, with release evidence in
 [VALIDATION.md](VALIDATION.md). **“2.0” names this product plan; it does not announce npm
 version 2.0.0, a delivery date, or a single large release.** Changes should ship through small,
 reviewed milestones using the existing Changesets workflow.
@@ -48,15 +49,15 @@ Existing gap reports do not establish completeness of a project's business requi
 
 The maintainer supplied a consumer integration report on 2026-10-26. The
 [consumer hardening and 1.0 task list](RELEASE-1.0-PLAN.md) records its seven items and acceptance
-criteria. First ship the blocking repository-document identity/kind fix as an isolated patch;
-then work through the other improvements toward an official 1.0. Ordinary reliability fixes
-ship independently of the companion platform described here.
+criteria. The repository-document identity/kind patch shipped in 0.2.1 and passes upstream
+regressions; genuine consumer acceptance remains pending. Work through the other improvements
+toward an official 1.0 independently of the companion platform described here.
 
 | Intake item | Status | Next action |
 | --- | --- | --- |
 | Consumer integration report | Received; task list recorded | Preserve private evidence with the consumer and use public-safe upstream reproductions |
-| Reproduction and severity | Identity/kind defect is the reported adoption blocker | Reproduce two-document conflict upstream; keep validation latency a separate investigation |
-| Fix/release mapping | Blocker patch in progress; remaining tasks planned | Release T01 first, then T02–T07 and genuine consumer acceptance before official 1.0 |
+| Reproduction and severity | Reported identity/kind blocker has a passing upstream regression | Obtain the genuine consumer re-run; keep validation latency a separate investigation |
+| Fix/release mapping | T01 upstream patch published in 0.2.1; T02–T07 remain open | Complete bounded follow-ups and genuine consumer acceptance before official 1.0 |
 
 For each finding, retain toolkit/version, repository SHA, relevant configuration and scope,
 exact command or MCP request, expected/actual behavior, logs/exit status, snapshot identity,
@@ -127,7 +128,7 @@ explicit migration ADR.
 
 | Milestone | Depends on | Deliverable and completion evidence |
 | --- | --- | --- |
-| **M0 — Consumer hardening** | Received report; [1.0 task list](RELEASE-1.0-PLAN.md) | Ship the identity/kind blocker patch first, then bounded setup/reuse/diagnostics/coverage improvements and genuine consumer acceptance. Release independently of the companion platform. |
+| **M0 — Consumer hardening** | Identity patch 0.2.1 shipped; [1.0 task list](RELEASE-1.0-PLAN.md) | Complete bounded setup/reuse/diagnostics/coverage improvements and genuine consumer acceptance. Release independently of the companion platform. |
 | **M1 — Claims, lineage and approvals** | M0 triage | Versioned records, durable derivation, revision-scoped approvals, actor trust and explicit legacy handling. Prove generated documents cannot acquire approval through paths or repeated extraction. Verify persistence/RDF/projection/query equivalence and old-snapshot readability. |
 | **M2 — Code-derived drafts** | M1 | Opt-in generation for selected TypeScript modules using existing local Codex first; structured candidate claims and Markdown rendered from those claims. Demonstrate no-doc and partial-doc fixtures with citations, unknown rationale, bounded cost, cache reuse and rename/delete invalidation. |
 | **M3 — Decisions and reconciliation** | M1–M2 | Capture explicit accepted requirements/decisions, compare changes from code and documents, distinguish scope differences from conflicts, and propose focused amendments. Demonstrate a resolved documentation disagreement with a remaining implementation gap. |
@@ -273,7 +274,7 @@ Resolve these decisions in small ADRs as their milestones approach:
 
 ## Next handoff
 
-1. Resolve and publish the identity/kind blocker patch under M0, then obtain a genuine consumer re-run.
+1. Obtain a genuine consumer re-run of the published 0.2.1 identity/kind patch under M0.
 2. Complete the remaining [1.0 tasks](RELEASE-1.0-PLAN.md) and review acceptance without waiting for the website or managed AI.
 3. Design M1's minimal records and compatibility rules, then implement M2 on bounded public fixtures.
 4. Review real extraction/review results before committing to hosted scope, paid operation or more adapters.

package/docs/extraction-manifest.json

@@ -108,7 +108,7 @@
       "destinationPath": "package.json",
       "sourceSha256": "a575dbb2fed8c554b95e8e9b3e03a0c21cab1be7249860bbebc18e046b2ff78d",
       "modified": true,
-      "destinationSha256": "897f14e438ff7e639f8a906c21fa8e436285180ef05dc6f3c5f73bb94c586ed6"
+      "destinationSha256": "95326a545b7d77607bfd841ff009ef58231b8f9c5ae3f2605e1dac95c9995c4d"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/LICENSE",
@@ -143,7 +143,7 @@
       "destinationPath": "packages/core/package.json",
       "sourceSha256": "2a29066eb8452f22fafcb06bb035a84dda93c5705dba32aba600a1b7e5aaf19c",
       "modified": true,
-      "destinationSha256": "96b88f6a7de48d24b24697fb8824bf46f340eec8723aed19b06684d21784c1fb"
+      "destinationSha256": "4fe851d728bc96fc25bb31295b4705560691f384d887e7ed714e943fae4e69b3"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/src/core.ts",
@@ -192,7 +192,7 @@
       "destinationPath": "scripts/check-publication.mjs",
       "sourceSha256": "88692c21d34cef2d2e5b20c92ab3ec26cbe6336889dbb7b534c681ded7f466b2",
       "modified": true,
-      "destinationSha256": "7db15ce23e217d8bc14772ff1287dfff0f81e9f402b3d8a5053d386736e8c078"
+      "destinationSha256": "5d68e9efc168600f8daaef5e1f34911990257972acc100e91875dcb194ef7cc2"
     },
     {
       "sourcePath": "tools/context-graph/scripts/generate-third-party-notices.mjs",
@@ -213,7 +213,7 @@
       "destinationPath": "src/application/agent-context.ts",
       "sourceSha256": "0a45ce6d878f3c2c19a1707b799e8c1d6e9e99ab5cb068aa73088b32f420aa23",
       "modified": true,
-      "destinationSha256": "97f16a8388bb7fbff228e83896bae4cd708d978ffb95135988a016e3ae6b0a5c"
+      "destinationSha256": "9c5778d66ed674c87a25ce132379e14805c00cd98ff76bc31f4e06151bec7430"
     },
     {
       "sourcePath": "tools/context-graph/src/application.test.ts",
@@ -241,7 +241,7 @@
       "destinationPath": "src/interfaces/cli.ts",
       "sourceSha256": "c68f5f35a5325cc03811b0d4ffb6d58c31a9b4e6115fcb2c5e4fda9560a34714",
       "modified": true,
-      "destinationSha256": "2dbb28c9ae609e6e988578fd3eb82e9ca51735b77d16e23ab0dd910030eac008"
+      "destinationSha256": "fef7af32de49f73c4ade5f48a84c3a5db1e52171949cfdcd84720bf5e194b901"
     },
     {
       "sourcePath": "tools/context-graph/src/config.test.ts",
@@ -297,7 +297,7 @@
       "destinationPath": "src/repository/git.ts",
       "sourceSha256": "484d3986633bb32ccc3b665f2144007a213c303df51b375c1d653729921d6d2c",
       "modified": true,
-      "destinationSha256": "66c9230d73e972ed1696880dbd31339a8e618b8cabcb2bfebbeeccc112d65768"
+      "destinationSha256": "2557d47d1c54a6bbefc61d16eac4a4d16f995adadb480130ea39f558ce3522f1"
     },
     {
       "sourcePath": "tools/context-graph/src/glob.ts",
@@ -311,21 +311,21 @@
       "destinationPath": "src/application/hydrator.test.ts",
       "sourceSha256": "95f20a526fe69ce3a506ef01da1c20827e09d631a34126e781a07979cc43de07",
       "modified": true,
-      "destinationSha256": "9baaacb29c863abdb48c96b054a7f430ce18784badfe585ec5ee88a17f21c0bd"
+      "destinationSha256": "d3c3e4e18adb571d7b9ef5232f10173344c1f6ae126ba76e50c2e32584782709"
     },
     {
       "sourcePath": "tools/context-graph/src/hydrator.ts",
       "destinationPath": "src/application/hydrator.ts",
       "sourceSha256": "bb41c5b53b26da10274d8b967b99c78ff12b485df16bfc66445252e35c94fb9d",
       "modified": true,
-      "destinationSha256": "356dcec76c68e76492a56fd17017e1809f8cc30f237bfe540c827ade8337ad88"
+      "destinationSha256": "1bb8c8481706590f1d994baf6d48818dc76dec014d9e583ee3ae5b5c9aaa265f"
     },
     {
       "sourcePath": "tools/context-graph/src/index.ts",
       "destinationPath": "src/index.ts",
       "sourceSha256": "a3545649f67fc0bf0496298e3f1dca1e91aa7cb68ec112c34b99a5785fa83f3c",
       "modified": true,
-      "destinationSha256": "6d2e5a298c96013f45f102f44a87fd7390cbe2a3174410560bb6fc8cc24012ea"
+      "destinationSha256": "9f986584ecba26d9b78b52aff19b07f4c572686d35f4363e06fa70b17756e704"
     },
     {
       "sourcePath": "tools/context-graph/src/mcp-facade.ts",
@@ -451,7 +451,7 @@
       "destinationPath": "src/extraction/semantic.ts",
       "sourceSha256": "1a41fb3fc5a9508c76be59d1c50b74d70ec96411fcbb7f63b0e098c1813d8473",
       "modified": true,
-      "destinationSha256": "eb31d432f0cbb7bd6799562a7e514aa04bbbd2df221f4ef916989eeeea3997f0"
+      "destinationSha256": "214d0378b75af7d4960b06981b165da19a37c2ebccb34f8ffa485ca86776f94f"
     },
     {
       "sourcePath": "tools/context-graph/src/snapshot-checks.test.ts",
@@ -608,6 +608,8 @@
     "docs/ADR-013-relative-module-requests.md",
     "docs/ADR-014-routing-declarations.md",
     "docs/ADR-015-repository-document-identity.md",
+    "docs/ADR-016-hydration-preview.md",
+    "docs/ADR-017-shacl-validation-union.md",
     "docs/CLOUD-ENVIRONMENT.md",
     "docs/CONSUMER-TRIAL.md",
     "docs/ENVIRONMENT-VALIDATION.md",
@@ -700,6 +702,7 @@
     "reviewed-licenses.json",
     "runtime-check.d.mts",
     "runtime-check.mjs",
+    "scripts/benchmark-shacl.mjs",
     "scripts/check-release-plan.mjs",
     "scripts/check-restoration.mjs",
     "scripts/clean-build.mjs",
@@ -731,6 +734,7 @@
     "scripts/update-inventory.mjs",
     "scripts/version-packages.mjs",
     "scripts/version-packages.test.ts",
+    "src/application/hydration-plan.ts",
     "src/application/overlay.test.ts",
     "src/application/overlay.ts",
     "src/application/saved-evidence.ts",
@@ -752,16 +756,21 @@
     "src/extraction/routing.ts",
     "src/extraction/scip-project.test.ts",
     "src/extraction/scip-project.ts",
+    "src/extraction/semantic-cache.ts",
+    "src/extraction/semantic-identity.ts",
     "src/extraction/semantic-process.test.ts",
     "src/extraction/semantic-process.ts",
+    "src/extraction/semantic-sources.ts",
     "src/governance/governance.test.ts",
     "src/governance/governance.ts",
     "src/graph/authority.ts",
     "src/graph/ranking.test.ts",
     "src/graph/ranking.ts",
     "src/graph/rdf.ts",
+    "src/graph/shacl-shapes.ts",
     "src/infrastructure/module-resolution.ts",
     "src/interfaces/doctor.ts",
+    "src/interfaces/hydration-plan.test.ts",
     "src/interfaces/init.test.ts",
     "src/interfaces/init.ts",
     "src/mcp.ts",
@@ -773,12 +782,14 @@
     "src/telemetry.ts",
     "src/visualization/viewer-interaction.ts",
     "tests/architecture.test.ts",
+    "tests/hydration-plan.test.ts",
     "tests/module-boundaries.test.ts",
     "tests/rdf-ontology.test.ts",
     "tests/rdf.test.ts",
     "tests/routing.test.ts",
     "tests/runtime.test.ts",
     "tests/semantic-identity.test.ts",
+    "tests/shacl-validation.test.ts",
     "tests/snapshot-lifecycle.test.ts"
   ],
   "publicationAuthorization": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weftlet/toolkit",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Evidence-backed context graphs for AI development agents: product intent, contracts, code, tests and runtime behavior",
   "license": "Apache-2.0",
   "type": "module",
@@ -63,7 +63,7 @@
     "n3": "2.7.2",
     "rdf-validate-shacl": "0.6.5",
     "sparqljs": "3.7.4",
-    "@weftlet/core": "^0.2.1"
+    "@weftlet/core": "^0.3.0"
   },
   "devDependencies": {
     "@changesets/cli": "3.0.3",
@@ -118,6 +118,7 @@
     "release:publish": "node scripts/release.mjs --publish",
     "govern": "tsx src/cli.ts govern --policy architecture.policy.json --output .context-graph/architecture-report.json",
     "evaluate:impact": "tsx scripts/evaluation/run.ts",
+    "benchmark:shacl": "node scripts/benchmark-shacl.mjs",
     "weftlet": "tsx src/cli.ts",
     "changeset": "changeset",
     "release:version": "node scripts/version-packages.mjs"