@weftlet/toolkit 0.3.0 → 0.4.0

package/docs/VALIDATION.md

@@ -8,10 +8,218 @@ The milestone entries below record the original cloud checks. Subsequent
 establishes live Codex success on Windows and the full deterministic checks on WSL,
 while identifying remaining native Windows issues.
 
+## T08 deterministic physical-file kinds, 2026-10-26
+
+Implemented after 0.3.0; this checkpoint does not claim npm publication or private consumer
+acceptance. [ADR 020](ADR-020-canonical-physical-file-producers.md) separates the neutral fix from
+the consumer-owned framework adapter migration. The reported 120-ID partition is consumer
+evidence; the upstream tests below are independent public reproductions, not that private replay.
+
+- Local `pnpm context-graph:publication-check` passed: 384 deterministic tests (17 core,
+  367 toolkit), one optional OML skip, 13 advisory architecture findings, inventory, licenses and
+  fresh packed-consumer checks. No rule, baseline, exception or SHACL shape was relaxed.
+- Sixteen new core cases verify the exported pure physical-file mapping, exact path spelling,
+  document/test/production distinctions and absence of inferred existence or intent. The package
+  retains no runtime package dependencies. Its public JS/declaration assets are required in the archive.
+- Three public composition cases use actual file and contract extraction from committed Prisma
+  schema/production/spec/test/Markdown consumers, actual bundled SCIP indexing and document links.
+  They assert exact retained citations/digests, confidence, authority and conceptual contract IDs.
+  A kind-only historical control restores the old Component label on an actual test-consumer fact
+  and fails strict SHACL; unchanged current producer output conforms. This control is not claimed
+  as execution of the installed 0.3.0 package. A public adapter-shaped fixture imports only core's
+  factory for its physical nodes; it is not the private framework implementation.
+- The overlay case reindexes real source changes without routing configured, retains canonical
+  kinds/draft authority, and proves its new identity differs from the frozen 0.3.0 formula.
+  A separately labeled retained-inference fixture still fails strict SHACL when incompatible;
+  previous heads, snapshots and assertion bytes remain intact. It is neither rewritten nor suppressed.
+- Routing and governance regressions compose real producer facts with neutral extraction and
+  strict SHACL. They retain routing binding IDs, provenance/authority and architectural attributes;
+  document endpoints join canonical Document identities, test files remain Evidence, and business
+  module/contract identities stay separate. Governance analyzer 3 differs from the frozen prior ID.
+- Twelve compatibility cases reject old/missing assembly, contract, SCIP-fact and configured
+  routing metadata for current validation. Production application tests still query historical
+  facts unchanged at the same commit/configuration, label extraction incompatibility separately
+  from checkout staleness, and invoke no provider, indexer, hydration or graph refresh.
+- Existing hydration/reuse/rename/delete tests pass with graph-v7 and preserve older snapshot
+  records. Semantic artifact/provider/prompt identity stays unchanged; no model call or private
+  cache rewrite is required by this deterministic fix. Non-document model kinds remain unreviewed
+  assertions and can still fail strict SHACL; this increment does not silently reinterpret them.
+- Fresh packed installation checks a public `@weftlet/core` adapter import against actual neutral
+  contract test-consumer facts, strict SHACL, real SCIP, RDF/SPARQL projection, CLI/npx and MCP.
+  Independent review found no remaining blocker. All 79 original source path/hash pairs are intact.
+
+[PR 27](https://github.com/jchewitt/weftlet/pull/27) merged at
+`7b3b0a4af260a6fa70f1107b3c5c315826c22c0e`. Exact feature head
+`493c68faada31f35e4c7dd5d047e70ac5c96b2ad` passed hosted Ubuntu and native Windows checks
+in [push run 40420049204](https://github.com/jchewitt/weftlet/actions/runs/40420049204) and
+[PR run 40420084937](https://github.com/jchewitt/weftlet/actions/runs/40420084937).
+Publication is pending the separately reviewed 0.4.0 release. No private application files
+or installed consumer packages were modified. The consumer must upgrade both released packages,
+migrate/version its framework extractor, run composed adapter tests, then complete full hydration
+and repeat acceptance before its adoption blocker can be declared resolved.
+
+## T04 semantic failure diagnostics, 2026-10-26
+
+Implemented in development source after 0.3.0; no new npm publication is claimed.
+[ADR 019](ADR-019-semantic-failure-diagnostics.md) records the safe failure envelope, opaque
+source correlation, settled progress and recovery boundaries. T04 does not change prompts,
+artifact keys, source/assertion authority, timeout defaults or graph validation.
+
+- Local `pnpm context-graph:publication-check` passed: 351 deterministic tests (1 core,
+  350 toolkit), one optional OML skip, inventory, licenses and fresh packed-consumer checks.
+- 20 new application cases use committed public fixtures and real artifact/snapshot storage.
+  They cover retained completed work, resumed reuse, cache hits, timeout/root-cause ordering,
+  synchronous sibling cancellation, late provider results, in-flight writes, late storage failure,
+  cancellation between sources and final completed/remaining counts. The previous snapshot/head
+  remains intact after failure. An injected Codex runner verifies elapsed time across retries
+  is separate from the configured per-attempt limit; no real model is called.
+- Unknown provider messages, private abort reasons and unrecognized error codes are excluded
+  from public reports. Missing infrastructure, invalid output, unresolved mappings, low confidence
+  and cache problems retain distinct safe diagnoses. The existing RDF regression now checks the
+  typed unresolved-policy error and unchanged prior head; its positive, missing-link, contradiction
+  and full SHACL checks remain in place.
+- Four CLI subprocess cases cover actual module timeouts, unknown module errors, missing provider
+  infrastructure, source-ID mapping through local preview, progress/error privacy, empty failure
+  stdout, JSON-only stderr with `--quiet`, and preserved previous snapshot bytes. The installed
+  consumer verifies public error/helper exports, required runtime assets, matching preview IDs and
+  safe structured failure from an unavailable provider. Existing installed CLI/npx, real SCIP,
+  RDF/SPARQL/SHACL, viewer and MCP initialization/missing-snapshot checks pass.
+- Governance reports 13 advisory findings: the 12 prior findings plus a new `semantic.ts` size
+  signal (510 nonblank/noncomment lines against the 500-line threshold). Independent review
+  considered the addition; scheduling/reporting is separated into its own module. The warning
+  remains visible. No rule, baseline or exception was changed; line count is not proof of
+  modularity or a product violation.
+- Independent review found no remaining blocker. All 79 original source path/hash pairs are
+  unchanged. [PR 25](https://github.com/jchewitt/weftlet/pull/25) merged at
+  `a919b82eab35808985d5c497bbe59ccfcba8bfcb`. Exact feature head
+  `a755dcdd2c0f97a7507f02f64b907a231162bf78` passed hosted Ubuntu and native Windows checks
+  in [push run 40417172248](https://github.com/jchewitt/weftlet/actions/runs/40417172248)
+  and [PR run 40417209468](https://github.com/jchewitt/weftlet/actions/runs/40417209468).
+  Both runs completed successfully; the Windows suite includes the new application/CLI failure
+  tests and existing provider/process tests, plus inventory and license checks.
+
+These checks use public deterministic fixtures and local child processes, not live models or
+private consumer data. Genuine consumer acceptance remains separate. Native Windows is covered
+by the hosted runs above; the local run is Linux/Node 24.19.0/pnpm 10.18.2.
+Published packages remain at 0.3.0 at this checkpoint. Broader T05, T06 and T07 remain separate
+1.0 increments.
+
+## T03 operational semantic-cache reuse, 2026-10-26
+
+Implemented in development source after 0.3.0; no new npm publication is claimed here.
+[ADR 018](ADR-018-operational-semantic-cache.md) records the built-in Codex user-cache partition,
+the five operational settings that may share artifacts, and conservative custom-provider behavior.
+Snapshot profiles, full configuration digests, workspace paths and the 0.2.1/0.3.0 artifact-key
+contract remain unchanged. No credential environment values are read to construct cache identity.
+
+- [PR 22](https://github.com/jchewitt/weftlet/pull/22) merged at
+  `5b889854e8a4b3a84653770e3244dee39d4b7d37`. Exact feature head
+  `c92689699fb09c80246edd61b692fca086ff6e83` passed hosted Ubuntu and focused native Windows
+  checks in [push run 40411921483](https://github.com/jchewitt/weftlet/actions/runs/40411921483)
+  and [PR run 40411954882](https://github.com/jchewitt/weftlet/actions/runs/40411954882).
+  Both runs completed successfully; Windows includes all four new cache test suites plus
+  inventory and license checks. Independent review found no remaining blocker. All 79 original
+  source path/hash pairs remain unchanged.
+- Local `pnpm context-graph:publication-check` passed: 327 deterministic tests (1 core,
+  326 toolkit), one optional OML skip, 12 existing advisory architecture findings, inventory,
+  licenses and fresh packed-consumer checks. No new architecture baseline or exception was added.
+- 28 configuration cases distinguish supported operational/default settings from model/policy/
+  authentication descriptors, unknown fields, repository/checkout and custom-provider changes.
+  The full snapshot storage profile still changes when its configuration changes.
+- 11 integration/storage cases cover an interrupted run followed by a longer timeout: the
+  completed source is reused, the unfinished source is extracted, and the new snapshot records
+  the complete current configuration. Old-configuration evidence fails current snapshot checks;
+  a saved query can still label it as historical. An actual application hydration uses real
+  bundled SCIP and cached semantic artifacts with a tripwire against unexpected Codex calls.
+- Legacy fixtures independently reproduce the frozen 0.3.0 profile/key formulas. Planning
+  neither copies artifacts nor creates directories; hydration promotes only validated entries
+  from the exact compatible legacy profile. Unrelated profiles and incomplete temporary files
+  are ignored. Old artifact bytes, raw output and provenance remain intact.
+- 21 adoption cases exercise explicit previous-config recovery, dry-run/index/filesystem
+  preservation, current and historical agent scope, budgets, source changes and omitted coverage.
+  Incompatible policies, authentication descriptors, unknown fields, providers and checkouts are
+  refused. Corrupt, unreadable and conflicting entries are reported without overwriting them.
+- Concurrent-writer tests cover matching/different outputs and malformed identity metadata with
+  a deceptively matching output-digest field. Both adoption and hydration promotion fully inspect
+  the retained entry before claiming success. Forced extraction preserves the old artifact.
+- Three CLI subprocess cases verify that adoption runs before provider/adapter initialization,
+  preserves the active checkout, supports historical refs, rejects malformed invocation, and
+  returns structured nonzero results for cache or budget problems. The fresh packed consumer
+  checks the public API/runtime helpers and installed adoption command with unavailable provider
+  and adapter modules; its dry run selects the committed source without storage writes.
+
+These are public deterministic fixtures, including an injected Codex runner, not live model
+extractions or private consumer acceptance. Existing full SHACL and fresh snapshot publication
+remain required after cache reuse. Published packages remain at 0.3.0 at this checkpoint;
+the minor changeset is pending a separate release. T04 timeout diagnostics and the remaining
+1.0 work are separate increments.
+
+## Weftlet 0.3.0 preview and SHACL performance release, 2026-10-26
+
+T02 and the focused cold-validation portion of T05 shipped ahead of the remaining 1.0 work.
+Both `@weftlet/core@0.3.0` and `@weftlet/toolkit@0.3.0` are public npm `latest` at this
+checkpoint. Core advances with the fixed release group and has no code change in this release.
+
+- [Preview PR 18](https://github.com/jchewitt/weftlet/pull/18) merged at
+  `63c70f85b26a6cc60f8bc0615a86f6042a61ecd0`.
+  [SHACL PR 20](https://github.com/jchewitt/weftlet/pull/20) merged at
+  `e45fda59037293a6ded20da70b812bbd385500a5`. Its final head
+  `ec7bb87ea3287a6322eeb09fa72ba53b3f1eec4e` passed hosted Ubuntu and focused Windows
+  checks in [run 40402839679](https://github.com/jchewitt/weftlet/actions/runs/40402839679)
+  and [run 40402826889](https://github.com/jchewitt/weftlet/actions/runs/40402826889).
+- [Release PR 19](https://github.com/jchewitt/weftlet/pull/19) advanced both versions to 0.3.0.
+  Exact head `897e731222180cc58ccf8acfe9cc2cd6252245b5` passed local `pnpm release:prepare`
+  and [dispatched Ubuntu/Windows checks](https://github.com/jchewitt/weftlet/actions/runs/40403315203).
+  The bot's automatic PR run required GitHub approval and ran no jobs; the explicit dispatch
+  validated that same head. The version PR contains only generated release metadata/changelogs
+  and consumed changesets, with no implementation changes.
+- [Trusted-publishing run 40403950446](https://github.com/jchewitt/weftlet/actions/runs/40403950446)
+  completed preparation, publication and release records on attempt 1 at merged commit
+  `ffc332adb84b8f9e854370ff4799aab32e189356`. Both package-specific tags and GitHub Releases
+  identify that commit, and main's package versions agree with npm.
+- Local publication checks passed 264 deterministic tests (1 core, 263 toolkit), one optional
+  OML skip, 12 existing advisory architecture findings, inventory, licenses and fresh packed-consumer
+  CLI/npx/MCP, preview, real SCIP, RDF/SPARQL/SHACL and viewer checks. Independent code review
+  found no remaining blocker. No shape, assertion, baseline or exception was removed or added to
+  conceal a failure. The 79 original source path/hash pairs remain unchanged.
+- Independent archive review covered core's 11 entries and toolkit's 196 entries. Runtime assets,
+  declarations, examples, README, Apache license and attribution/notices are present. No Git state,
+  credentials, caches, private consumer payloads or compiled tests were included. Toolkit's packed
+  core dependency is `^0.3.0`. Public archives match both the hosted prepared archives and locally
+  reviewed archives byte for byte. Public SLSA provenance subjects match their SHA-512 hashes and
+  identify the expected source, repository, `publish.yml` and workflow attempt. This is a provenance
+  content/source check, not a separate cryptographic signature audit.
+- A fresh Linux/Node 24.19.0 consumer installed only toolkit 0.3.0 directly from npm with
+  `--ignore-scripts`; core resolved transitively to 0.3.0. Both package-lock registry URLs and
+  integrity hashes matched the reviewed archives. The public two-document fixture retained
+  2 semantic facts within 17 total facts, including 4 real SCIP facts. Impact returned 17 facts;
+  SPARQL returned four canonical document references. Cold hydration extracted 2/reused 0;
+  the repeat extracted 0/reused 2 with identical snapshot identity, content digest and bytes.
+- Installed cold/warm `hydrate --plan --json` worked with the provider module unavailable,
+  reported 2 expected extractions then 2 reusable artifacts, preserved source authority and
+  performed no preview storage writes or provider calls. Saved queries still worked with the
+  provider disabled. Hydration used a deterministic fixture provider; no external model calls
+  were made during these checks.
+
+The installed public `RdfEvidenceGraph.validate()` also passed bounded, fresh-process public
+synthetic checks, preserving exact canonical serialization:
+
+| Facts / topology | Original quads | Validation including union | Whole-process maximum RSS |
+| --- | ---: | ---: | ---: |
+| 2,000 unique | 56,003 | 0.632 s | 492 MiB |
+| 10,000 unique | 280,003 | 2.903 s | 1,640 MiB |
+
+These are single-run synthetic measurements. Memory includes imports, fixtures and serialization;
+the extra union has a material memory cost. This installed-package probe ran on Linux; hosted
+Windows covers the new parity tests separately. Neither establishes the private consumer's total
+generation time. Full consumer hydration/repeat acceptance, live semantic quality, broader T05
+progress/reuse work and the remaining [1.0 tasks](RELEASE-1.0-PLAN.md) remain open. The SHACL
+change preserves compatible 0.2.1 semantic artifacts and does not require forced re-extraction.
+
 ## T05 cold SHACL validation improvement, 2026-10-26
 
-Implemented in development source following the T02 preview merge. Published npm packages
-remain 0.2.1 until a separately recorded release succeeds. [ADR 017](ADR-017-shacl-validation-union.md)
+Pre-release source checkpoint following the T02 preview merge; npm was still at 0.2.1.
+The subsequent 0.3.0 publication is recorded above. [ADR 017](ADR-017-shacl-validation-union.md)
 records the measured graph-wildcard lookup cost and the temporary all-triples union used by the
 unchanged JavaScript SHACL validator. The canonical named dataset and every assertion remain intact.
 
@@ -53,14 +261,14 @@ repeated validation. A 2,200-fact case detects the invalid final assertion witho
 The existing full hydration integration still verifies that failed SHACL preserves the last head.
 The shape Turtle is byte-for-byte unchanged from the T02 merge; no shape or assertion was dropped.
 
-Hosted checks and release status remain pending at this source checkpoint.
+Hosted checks and release status were pending at this source checkpoint; their results are above.
 Early identity preflight, in-phase progress, validation-result reuse and incremental validation
 remain separate work. Each hydration still performs full SHACL before publishing; saved queries
 do not repeat validation. Private consumer full hydration/repeat acceptance remains pending.
 
 ## T02 no-model hydration preview, 2026-10-26
 
-Implemented in development source; published npm packages remain 0.2.1. See
+Pre-release source checkpoint, while npm was still at 0.2.1. Subsequent 0.3.0 publication is above. See
 [ADR-016](ADR-016-hydration-preview.md) for source, cache and readiness semantics.
 
 [PR 18](https://github.com/jchewitt/weftlet/pull/18) merged at

package/docs/extraction-manifest.json

@@ -108,7 +108,7 @@
       "destinationPath": "package.json",
       "sourceSha256": "a575dbb2fed8c554b95e8e9b3e03a0c21cab1be7249860bbebc18e046b2ff78d",
       "modified": true,
-      "destinationSha256": "95326a545b7d77607bfd841ff009ef58231b8f9c5ae3f2605e1dac95c9995c4d"
+      "destinationSha256": "1e5ae982ffbb2cb02071bbf6c4f8040836dcc451c5e478f10b07cc5646f0e1eb"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/LICENSE",
@@ -129,7 +129,7 @@
       "destinationPath": "packages/core/README.md",
       "sourceSha256": "6044bf7b9a3dc793f41e2ff048546ed11938957d10a5b143eb1739ac4cd7477c",
       "modified": true,
-      "destinationSha256": "1cb03b2eb415ac35ef7a4405d3cbb415c59717fe6d088968533e3ac51658f7fb"
+      "destinationSha256": "c929bd90f5d2bae73554df2dcd0af0ad1bfd45d0843cd7940bde90c42b1266b9"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/THIRD_PARTY_NOTICES.md",
@@ -143,21 +143,21 @@
       "destinationPath": "packages/core/package.json",
       "sourceSha256": "2a29066eb8452f22fafcb06bb035a84dda93c5705dba32aba600a1b7e5aaf19c",
       "modified": true,
-      "destinationSha256": "4fe851d728bc96fc25bb31295b4705560691f384d887e7ed714e943fae4e69b3"
+      "destinationSha256": "090d8d90cbf775e6edf1656215d75200f9961009ef75f2ab4de55fe5603814ea"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/src/core.ts",
       "destinationPath": "packages/core/src/core.ts",
       "sourceSha256": "cb3f4eb7bfe9f458494607406664445a276aad37235930a043d400ea9211ed16",
       "modified": true,
-      "destinationSha256": "0287d0640f2ff078da19be1439d02fcab22998262562d4af7b5f26ddca0839f4"
+      "destinationSha256": "00550f6cc7a8caa4120337ebc73e443b988bfdb72d05a2f828c88db502606fe3"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/src/index.ts",
       "destinationPath": "packages/core/src/index.ts",
       "sourceSha256": "6cbf51e60ac8c7b21b04870b50b92f6da0a1a3b2fa9dd21331e7e83e7beced05",
-      "modified": false,
-      "destinationSha256": "6cbf51e60ac8c7b21b04870b50b92f6da0a1a3b2fa9dd21331e7e83e7beced05"
+      "modified": true,
+      "destinationSha256": "d4edc3853d65cf55cd9b12ab17e3af2607f87f6d654556a25ac5253f975292ac"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/src/util.test.ts",
@@ -192,7 +192,7 @@
       "destinationPath": "scripts/check-publication.mjs",
       "sourceSha256": "88692c21d34cef2d2e5b20c92ab3ec26cbe6336889dbb7b534c681ded7f466b2",
       "modified": true,
-      "destinationSha256": "5d68e9efc168600f8daaef5e1f34911990257972acc100e91875dcb194ef7cc2"
+      "destinationSha256": "2b92ad80a6a193b4628d4caec2bd29b6fbf3c6c97066bda2fe91ceb173d06158"
     },
     {
       "sourcePath": "tools/context-graph/scripts/generate-third-party-notices.mjs",
@@ -227,21 +227,21 @@
       "destinationPath": "src/application/application.ts",
       "sourceSha256": "22e0fa1312c652f3e5ab2078d8c7e03d3b0235231e220df3349eb60622f78469",
       "modified": true,
-      "destinationSha256": "7b23a94ad1a0f3acb5c6b9b01f1f8255af9398d5ba4b79f692249a04eaac3b74"
+      "destinationSha256": "e163e5ec862dcceea43d8351c3c0a4d0626e870b718fc1107627ebad10874628"
     },
     {
       "sourcePath": "tools/context-graph/src/cache.ts",
       "destinationPath": "src/configuration/cache.ts",
       "sourceSha256": "c65c9803657762dbcfd482c58820950d938694a8432f38d65cc35a86eeca216d",
       "modified": true,
-      "destinationSha256": "bf4cd31b7469313d9483a15217be3c6041c1f3532bec144cf654a13aef1bb42b"
+      "destinationSha256": "676467260f107d5120c19c11a6a32d785acbf6a0f69c03f96074ccd2c5e05b32"
     },
     {
       "sourcePath": "tools/context-graph/src/cli.ts",
       "destinationPath": "src/interfaces/cli.ts",
       "sourceSha256": "c68f5f35a5325cc03811b0d4ffb6d58c31a9b4e6115fcb2c5e4fda9560a34714",
       "modified": true,
-      "destinationSha256": "fef7af32de49f73c4ade5f48a84c3a5db1e52171949cfdcd84720bf5e194b901"
+      "destinationSha256": "c333051df80a274410351b0ba1eef1a1e004f790fa457fd3ebb7909197c4ca29"
     },
     {
       "sourcePath": "tools/context-graph/src/config.test.ts",
@@ -283,7 +283,7 @@
       "destinationPath": "src/extraction/document.ts",
       "sourceSha256": "62a2da37d8cc0637b192b7e70ae7a0dce72244d335da9df0e0ad9b0eb7c4e1f1",
       "modified": true,
-      "destinationSha256": "0235abe0e2a7a0cb06495027c5dc240cf5b0658faabbdc01d0006fa3b456432c"
+      "destinationSha256": "1e9a5db4bf04455fa202d48fb20ac1de268d74179034cfcfa24d845cb4736bb3"
     },
     {
       "sourcePath": "tools/context-graph/src/git.test.ts",
@@ -311,21 +311,21 @@
       "destinationPath": "src/application/hydrator.test.ts",
       "sourceSha256": "95f20a526fe69ce3a506ef01da1c20827e09d631a34126e781a07979cc43de07",
       "modified": true,
-      "destinationSha256": "d3c3e4e18adb571d7b9ef5232f10173344c1f6ae126ba76e50c2e32584782709"
+      "destinationSha256": "e32e0af9596cbf036570e08033503c053a25ed401c3c999c48dab7b106274710"
     },
     {
       "sourcePath": "tools/context-graph/src/hydrator.ts",
       "destinationPath": "src/application/hydrator.ts",
       "sourceSha256": "bb41c5b53b26da10274d8b967b99c78ff12b485df16bfc66445252e35c94fb9d",
       "modified": true,
-      "destinationSha256": "1bb8c8481706590f1d994baf6d48818dc76dec014d9e583ee3ae5b5c9aaa265f"
+      "destinationSha256": "1833e788ca0c162947c626ff611f724d53f349b8d1dc019f204bd433726f9be9"
     },
     {
       "sourcePath": "tools/context-graph/src/index.ts",
       "destinationPath": "src/index.ts",
       "sourceSha256": "a3545649f67fc0bf0496298e3f1dca1e91aa7cb68ec112c34b99a5785fa83f3c",
       "modified": true,
-      "destinationSha256": "9f986584ecba26d9b78b52aff19b07f4c572686d35f4363e06fa70b17756e704"
+      "destinationSha256": "2dff4c9bca049dc1607cce7cf709494aae24a7f27b05fcb9353dd19de4546fac"
     },
     {
       "sourcePath": "tools/context-graph/src/mcp-facade.ts",
@@ -395,7 +395,7 @@
       "destinationPath": "src/graph/query.ts",
       "sourceSha256": "4d67f87ca660cefe9686fb5b775f86a997a25d539819ea81d321c8bd1e0aaa39",
       "modified": true,
-      "destinationSha256": "ead61dfde748cd1a02c8b1a14dc729173a6b85ec3b8213af2bd5169c60b70253"
+      "destinationSha256": "0cf5bf085aa71180447e7d5b35a19eba6b3e8d87cef550b8bcb996022a7618d8"
     },
     {
       "sourcePath": "tools/context-graph/src/request.test.ts",
@@ -451,21 +451,21 @@
       "destinationPath": "src/extraction/semantic.ts",
       "sourceSha256": "1a41fb3fc5a9508c76be59d1c50b74d70ec96411fcbb7f63b0e098c1813d8473",
       "modified": true,
-      "destinationSha256": "214d0378b75af7d4960b06981b165da19a37c2ebccb34f8ffa485ca86776f94f"
+      "destinationSha256": "aaac083e8eea8e9b6a7303b73f8beea3014c10711eb4afc0b0dd9d81424d5437"
     },
     {
       "sourcePath": "tools/context-graph/src/snapshot-checks.test.ts",
       "destinationPath": "src/application/snapshot-checks.test.ts",
       "sourceSha256": "a16c1676f3168fcc87c1fe095c4cb164c0a8738cc3610f1a92bb54ea75267400",
       "modified": true,
-      "destinationSha256": "68853d4560c45eb34c866fb520f12e0ad15a7179df09aeb972a310c9c73f897d"
+      "destinationSha256": "c6921040f8adcea8b9c8456a8be626cdaaaa5b45fa74cde1bfc3c312f1b9e05c"
     },
     {
       "sourcePath": "tools/context-graph/src/snapshot-checks.ts",
       "destinationPath": "src/application/snapshot-checks.ts",
       "sourceSha256": "3c8e01b886d49ce8323b6275019fd503ec3bbbb21671808e228880cc0f853d07",
       "modified": true,
-      "destinationSha256": "a12370053d346ec3d4afb2afb70192d14765922b9efb1e76d9daff65291f2409"
+      "destinationSha256": "db0d088932820a3e34af3b71e3722e0b6e4bd1e0b7d04534bd806ff79cd0811f"
     },
     {
       "sourcePath": "tools/context-graph/src/static.test.ts",
@@ -479,14 +479,14 @@
       "destinationPath": "src/extraction/static.ts",
       "sourceSha256": "f8dcff3e10361314c06911dc7cec1e2cb0f8d9af68a6c61a30b2a741c5c3a385",
       "modified": true,
-      "destinationSha256": "94190f11651b21372b2c3a834e30cde5d333893bfad0b66755e5f698608d2fdb"
+      "destinationSha256": "99147784d567ff9ccf2619a5452824fb13dc7b8061fc269c1fc90b36cdd96851"
     },
     {
       "sourcePath": "tools/context-graph/src/storage.ts",
       "destinationPath": "src/storage/storage.ts",
       "sourceSha256": "9e38af8e34dc84ccaed5322b37b485e60706c68542271926228fb6d4af3d1f71",
       "modified": true,
-      "destinationSha256": "1104a909c280209862b9615129487d4aeb647377b726819fcd1b8846ca19a3b7"
+      "destinationSha256": "48a4eabe1954f612b1d27f2ac56cb63ae064b0b957570c25c349154adfc2d34d"
     },
     {
       "sourcePath": "tools/context-graph/src/telemetry.test.ts",
@@ -521,7 +521,7 @@
       "destinationPath": "src/visualization/visualization.ts",
       "sourceSha256": "4839a5cfbd0a97bf3d338e59eca752a9b96812b464c0369da93a55d209120ab7",
       "modified": true,
-      "destinationSha256": "4ab2aecae28174b79fd8a0069540da0b091dc078be1075ebde51985089d36753"
+      "destinationSha256": "e55328ba9957201c2152fcf036c8cd3eb9ce96fcbbdb93408ded2f5becd2f268"
     },
     {
       "sourcePath": "tools/context-graph/templates/context-graph-development/SKILL.md",
@@ -610,6 +610,9 @@
     "docs/ADR-015-repository-document-identity.md",
     "docs/ADR-016-hydration-preview.md",
     "docs/ADR-017-shacl-validation-union.md",
+    "docs/ADR-018-operational-semantic-cache.md",
+    "docs/ADR-019-semantic-failure-diagnostics.md",
+    "docs/ADR-020-canonical-physical-file-producers.md",
     "docs/CLOUD-ENVIRONMENT.md",
     "docs/CONSUMER-TRIAL.md",
     "docs/ENVIRONMENT-VALIDATION.md",
@@ -697,6 +700,8 @@
     "examples/pipeline/tsconfig.json",
     "mcp-launcher.mjs",
     "packages/core/CHANGELOG.md",
+    "packages/core/src/repository-nodes.test.ts",
+    "packages/core/src/repository-nodes.ts",
     "pnpm-lock.yaml",
     "pnpm-workspace.yaml",
     "reviewed-licenses.json",
@@ -734,11 +739,18 @@
     "scripts/update-inventory.mjs",
     "scripts/version-packages.mjs",
     "scripts/version-packages.test.ts",
+    "src/application/cache-adoption.ts",
+    "src/application/extraction-identity.ts",
+    "src/application/hydration-failure.ts",
     "src/application/hydration-plan.ts",
     "src/application/overlay.test.ts",
     "src/application/overlay.ts",
     "src/application/saved-evidence.ts",
+    "src/application/semantic-artifact-store.ts",
+    "src/application/semantic-run.ts",
+    "src/application/semantic-scope.ts",
     "src/cli.ts",
+    "src/configuration/cache.test.ts",
     "src/configuration/scip-project.ts",
     "src/extraction/codex-auth.test.ts",
     "src/extraction/codex-auth.ts",
@@ -757,19 +769,23 @@
     "src/extraction/scip-project.test.ts",
     "src/extraction/scip-project.ts",
     "src/extraction/semantic-cache.ts",
+    "src/extraction/semantic-diagnostics.ts",
     "src/extraction/semantic-identity.ts",
     "src/extraction/semantic-process.test.ts",
     "src/extraction/semantic-process.ts",
     "src/extraction/semantic-sources.ts",
     "src/governance/governance.test.ts",
     "src/governance/governance.ts",
+    "src/governance/physical-file-kinds.test.ts",
     "src/graph/authority.ts",
     "src/graph/ranking.test.ts",
     "src/graph/ranking.ts",
     "src/graph/rdf.ts",
     "src/graph/shacl-shapes.ts",
     "src/infrastructure/module-resolution.ts",
+    "src/interfaces/cache-adoption.test.ts",
     "src/interfaces/doctor.ts",
+    "src/interfaces/hydration-failure.test.ts",
     "src/interfaces/hydration-plan.test.ts",
     "src/interfaces/init.test.ts",
     "src/interfaces/init.ts",
@@ -782,12 +798,17 @@
     "src/telemetry.ts",
     "src/visualization/viewer-interaction.ts",
     "tests/architecture.test.ts",
+    "tests/cache-adoption.test.ts",
+    "tests/extractor-compatibility.test.ts",
+    "tests/hydration-failure.test.ts",
     "tests/hydration-plan.test.ts",
     "tests/module-boundaries.test.ts",
+    "tests/physical-file-kinds.test.ts",
     "tests/rdf-ontology.test.ts",
     "tests/rdf.test.ts",
     "tests/routing.test.ts",
     "tests/runtime.test.ts",
+    "tests/semantic-cache-reuse.test.ts",
     "tests/semantic-identity.test.ts",
     "tests/shacl-validation.test.ts",
     "tests/snapshot-lifecycle.test.ts"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weftlet/toolkit",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Evidence-backed context graphs for AI development agents: product intent, contracts, code, tests and runtime behavior",
   "license": "Apache-2.0",
   "type": "module",
@@ -63,7 +63,7 @@
     "n3": "2.7.2",
     "rdf-validate-shacl": "0.6.5",
     "sparqljs": "3.7.4",
-    "@weftlet/core": "^0.3.0"
+    "@weftlet/core": "^0.4.0"
   },
   "devDependencies": {
     "@changesets/cli": "3.0.3",