@weftlet/toolkit 0.5.0 → 0.6.1

package/docs/VALIDATION.md

@@ -8,6 +8,396 @@ The milestone entries below record the original cloud checks. Subsequent
 establishes live Codex success on Windows and the full deterministic checks on WSL,
 while identifying remaining native Windows issues.
 
+## Physical artifact filename fix, 2026-10-28
+
+The consumer requested bounded physical artifact/temp names while retaining logical snapshot
+identity and provenance. [ADR 028](ADR-028-bounded-artifact-paths.md) records the fix and migration
+boundary. The public traversal → unchanged repeat → clean-comparison regression reproduced an
+overlong SCIP staging basename before the change and passes locally after it. Physical names are
+bounded; full IDs, cited facts, cache keys and content digests remain unchanged. Legacy saved files
+remain readable and immutable. The same traversal test and added storage cases run in native
+Windows CI. Local release checks passed: build, 698 deterministic tests (17 core + 681 toolkit;
+one optional OML integration skipped), architecture with 14 advisory findings, inventory,
+licenses and fresh packed-consumer smoke. Hosted outcomes and patch publication are pending
+at this source revision.
+
+This is a focused consumer blocker ahead of [B1–B6](PRE-1.0-BASELINE.md). No private consumer
+rerun, paid/model work or live optional OML compilation is claimed.
+
+## Business-context baseline assessment, 2026-10-28
+
+The maintainer requested checks for business relationships across asynchronous/stored-data
+boundaries, progressive agent exploration and multiple service/client projects in a monorepo.
+[The assessment and new task list](PRE-1.0-BASELINE.md) explicitly extend the original T01–T10
+scope; the historical completion statements below concern that original list.
+
+Against unchanged runtime at `9b4acffe1c4d35f9fd2f91132c576f8934658677`, 24 existing focused
+tests and three new public acceptance tests pass on Linux, Node 24.19.0 / pnpm 10.18.2.
+[Recorded results](assessments/pre-1.0-2026-10-28.json) identify test files, cases, source hashes
+and commands. The new fixture uses real Git, SCIP, semantic-provider plumbing, RDF/SHACL and
+the application/MCP facade. Its small deterministic prose parser is not a live model.
+
+The control already reads the two disconnected services' documents. Adding only a documented
+stored-data handoff makes downstream implementations and tests reachable while retaining both
+freshness rules and excluding a same-label unrelated domain. One changed document is extracted,
+four are reused; the next repeat reuses all five with unchanged identity/content. Small result
+pages exhaust to the larger scan exactly; focused follow-up works and depth truncation stays
+explicit. Workspace aliases resolve a shared re-exported contract across API and TSX files.
+
+These are mechanism passes. They do not establish actual broker/database delivery, automatic
+rule compatibility or function binding, autonomous-agent usefulness, Expo/service builds, live
+semantic quality or private TradePilot acceptance. Exact-node exploration remains open.
+Graphify source/document review is pinned in [the evaluation note](GRAPHIFY-EVALUATION.md);
+no comparative benchmark, new runtime dependency or backend replacement is claimed.
+
+## Published 0.6.0 acceptance candidate, 2026-10-28
+
+Both `@weftlet/core@0.6.0` and `@weftlet/toolkit@0.6.0` are published and were verified as
+the registry `latest` versions. [Release PR 36](https://github.com/jchewitt/weftlet/pull/36)
+merged at `b4c808b9221c5c82f9f7326a310e966d1fee2888`; package versions were committed to main
+before publication. [Release run 40742010093](https://github.com/jchewitt/weftlet/actions/runs/40742010093)
+completed preparation, both trusted npm uploads and GitHub release records on its first attempt.
+No npm token was supplied to this cloud. Public provenance statements and both package-specific
+Git tags identify that exact source commit; both GitHub Releases exist.
+
+The version PR's exact head `944b66a7ac9d119b650b7341dc982e12ea45a75b` passed
+[hosted Ubuntu and Windows checks](https://github.com/jchewitt/weftlet/actions/runs/40715307427).
+Frozen local installation/build, package preparation and dry runs passed before merging. Reviewed
+exports contain 13 files in core and 252 in toolkit, including applicable license notices and no
+source history, credentials, caches or native benchmark binary. All 79 original source path/hash
+pairs remain intact. Downloaded public npm archives match the reviewed local archives and the
+workflow's prepared archives byte for byte:
+
+| Package | Verified SHA-512 integrity |
+| --- | --- |
+| `@weftlet/core@0.6.0` | `sha512-2o2WO4DyhudgcsGQ//j0mXfXBvyqBHoYPnI52ZiqZSr5qqjCayw7njsRqCxOEIL6dseUYoICsnlkSYrRSDHKKw==` |
+| `@weftlet/toolkit@0.6.0` | `sha512-d7Q9gNdpwWUdkJLhGtY6xpi+gfg3CsLM5BqJqmVH9xgNwtc5e5kDpTwMSv4jq/+gybiXbQOOSsI7x7c+m1W1xA==` |
+
+A fresh public-registry consumer on Linux / Node 24.19.0 installed both exact versions, ran the
+documented npx initialization and config validation, imported public APIs, checked canonical file
+nodes, lossless RDF projection, SPARQL and positive/negative strict SHACL, and initialized MCP.
+`impact.scan` discovery and honest missing-snapshot reporting passed without model calls. This
+registry smoke is separate from the release gate's full deterministic/packed-consumer checks;
+neither is a private TradePilot hydration, live model-quality evaluation or browser interaction.
+
+T06, T07 and T10 are now available in the published candidate, alongside the T05 evaluation and
+earlier fixes. The planned 1.0 engineering work is complete. TradePilot should use these published
+versions for the [consumer acceptance checklist](RELEASE-1.0-PLAN.md#official-10-acceptance);
+official 1.0 remains conditional on that acceptance and any resulting blocker fixes. Previously
+tentative browser/live-auth work remains explicitly separate. No 1.0 release is claimed.
+
+## T05 validation closeout, 2026-10-28
+
+[ADR 027](ADR-027-validation-closeout.md) records the engineering decision to retain full direct
+validation after public cold/repeat/changed-input, worker, exact-key, incremental-dependency and
+Rust evaluations. No runtime validation code, shapes, policy, baseline, cache identity or production
+dependency changed. No assertion/provenance/authority was dropped or promoted. All 79 original
+source path/hash pairs are intact. The original 23-case SHACL corpus is shared with the optional
+native probe; its original named-dataset equivalence assertions still pass.
+
+[Raw reports](benchmarks/validation-2026-10-28/README.md) record 258 completed direct/worker cases
+and 18 paired sample groups with identical verdicts/canonical input. Three-sample cold direct
+medians at 10,000 facts are 2.86 seconds for unique identities and 5.67 seconds for dense source
+metadata. Direct whole-process peak RSS reached 1.72 GiB; one worker case reached 2.99 GiB.
+These are public fixture measurements, not private consumer performance or capacity guarantees.
+The actual six-stage public extraction uses an offline runner through the Codex adapter and real
+SCIP; all six semantic sources are reused on repeat. Prototype cancellation returns no accepted
+verdict and attempts no publication. Exact-key costs/misses and a changed-facts-only false pass
+support the decisions to keep full validation without introducing receipts or incrementality.
+
+Rudof 0.3.35, Apache-2.0, was evaluated from its checksum-verified official Linux GNU binary
+outside the repository. All 29 conformance/location cases agree; diagnostic counts differ on two
+malformed citation cases, retained explicitly in the report. All 12 native timing cases complete,
+with no clear overall file-transfer performance/resource benefit. The probe deliberately exits 1
+for the diagnostic mismatch; it is not a passed replacement-equivalence gate. It is optional
+development tooling, with no native binary download or dependency in package/CI installation.
+
+The local build and **691 deterministic tests** (17 core + 674 toolkit), one optional OML skip,
+architecture (14 advisory findings), inventory, licenses, release-documentation and fresh packed
+npm/npx/consumer smoke all passed. Hosted Ubuntu also passed at `10082e2` in the
+[push run](https://github.com/jchewitt/weftlet/actions/runs/40710918759) and
+[PR run](https://github.com/jchewitt/weftlet/actions/runs/40710994196). Initial native Windows
+checks passed the existing 561 tests but could not import the new benchmark: CRLF conversion of
+its shebang triggered a Vitest syntax error. The same CRLF failure was reproduced locally;
+removing the unnecessary shebangs from these Node-invoked scripts made all six study tests pass
+with CRLF content. A final harness correction also preserves the extractor's original content
+digest during timestamp-only scenarios. Those six checks pass locally. Corrected-head hosted
+outcomes are tracked in [PR 46](https://github.com/jchewitt/weftlet/pull/46/checks).
+No paid/live model, private TradePilot run, browser interaction, fresh-cloud restoration, npm upload
+or official 1.0 acceptance is claimed. The next gate is the reviewed minor candidate, then genuine
+consumer hydration/repeat acceptance and the separate official 1.0 release decision.
+
+## T07c traversal hydration, 2026-10-28
+
+[ADR 026](ADR-026-traversal-hydration.md) connects canonical coverage and source classification to
+opt-in `documentTraversal` hydration, its no-model plan, cache adoption and draft overlays.
+Direct configurations retain their existing selection and identity. Validation sources receive
+presence/reference evidence without model extraction. Coverage/read-limit/role-ambiguity and
+semantic-budget failures stop new model work while retaining previous evidence. Ownership gaps
+remain explicit diagnostics; neither source classification nor owner mappings approve assertions.
+
+The local publication gate passed **685 deterministic tests** (17 core, 668 toolkit), including
+11 added regressions, and one optional OML skip. Inventory, licenses, release documentation and
+fresh npm/npx/packed-consumer checks passed. Final small cache-adoption/read-limit-reporting edits
+were followed by a rebuilt toolkit, all 32 affected integration/cache-adoption/CLI tests, governance
+and inventory checks; the installed-package smoke was repeated against that rebuild. Governance
+reports 14 advisory findings at existing finding locations, including the prior fixture-setup
+clone signal. No architecture policy, baseline or exception was changed. All 79 original source
+path/hash pairs are preserved.
+
+Public tests use the unchanged Codex adapter with an offline prose parser through its real prompt,
+JSON and citation checks, plus real SCIP, strict SHACL and lossless RDF projection. The six-stage
+queue-boundary pipeline reaches downstream implementation/tests. An unchanged repeat reuses all
+six eligible semantic sources, with identical snapshot identity and content digest; two validation
+documents remain in the graph. Other regressions cover Codex activation/policy reuse without
+artifact rewriting, actual module-provider isolation/reuse in workspace and user storage,
+rename/delete/reachability, changed owners, incomplete draft coverage, saved-history queries and
+current-diff rejection. Installed CLI hydration/query/repeat tests use a deterministic module,
+real indexing and packaged assets; a blocked refresh preserves the committed head.
+
+The chat's managed executor disconnected during development and later reconnected with the
+uncommitted work intact. This is recovery of this workspace, not a fresh-cloud restoration test.
+No live/paid model request, browser interaction, private TradePilot acceptance or npm publication
+is claimed. [PR 44](https://github.com/jchewitt/weftlet/pull/44) merged at
+`b44053f08e4342ec1502046acc5b85a0efd08ea1`. Exact feature head
+`fd89410108e7be75524b54a4e02d53459afbcd20` passed both the
+[push run](https://github.com/jchewitt/weftlet/actions/runs/40690845708) and the
+[PR run](https://github.com/jchewitt/weftlet/actions/runs/40690905937). Hosted Ubuntu passed
+all 685 deterministic tests and the full publication gate; native Windows passed all 561 selected
+tests, inventory and licenses, including all new traversal hydration regressions. These are source
+validation results, not a new npm release. Release PR 36 remains unmerged.
+T05 performance/validation closeout remains the next engineering workstream, followed by the
+reviewed minor candidate, consumer acceptance and the separate official 1.0 decision.
+
+## T07b document classification and evidence, 2026-10-27
+
+[ADR 025](ADR-025-document-classification.md) records explicit document roles and SOT owner
+mappings, the operation-level `documents plan --document-policy` input, and the public deterministic
+document-evidence extractor. These are prospective APIs: current hydration selection, semantic
+artifacts, configuration/extractor/assembly identities and historical snapshots remain unchanged.
+Traversal-driven hydration and default validation-document separation remain T07c.
+
+Public fixtures exercise real committed document/file extraction, empty validation documents,
+reference definition/use citations, approved validation reports, unapproved owned plans, ambiguous
+roles/owners, scope changes, renames/deletes and historical re-extraction. Presence and reference
+facts remain inferred structural evidence; neither written “PASS” text nor an owner mapping creates
+test-success evidence or approved assertions. Strict SHACL, exact RDF/SPARQL projection, API/MCP,
+Markdown and HTML/SVG/DOT preserve per-fact roles, policy identity, ownership and provenance.
+
+Preview and extraction checks use unavailable provider/adapter sentinels and retain source bytes,
+Git index, hydration plans and seeded cache artifacts. Classification gaps are separate from the
+preview's traversal/budget `ready` field. Independent review found that an approved validation
+document must be ineligible as an intent owner, and that a frontier exceeding 10,000 discovered
+documents must survive the classifier's per-call bound; both have focused regressions.
+
+Local `pnpm context-graph:publication-check` passed: **674 deterministic tests** (17 core,
+657 toolkit), including 111 new regressions, and one optional OML skip. Release documentation,
+inventory, licenses and fresh packed-consumer checks passed, including the new public policy and
+document-evidence APIs, installed CLI policy loading, real SCIP, RDF/SHACL, rendering and MCP.
+All 79 original source path/hash pairs are intact. Architecture checks passed with 14 advisories:
+13 existing findings and one new clone signal for independent Git test-fixture setup. Review found
+shared setup mechanics, not duplicated product rules; no policy, debt baseline or exception changed.
+Independent review found no remaining blocker after the two corrections above.
+
+[PR 42](https://github.com/jchewitt/weftlet/pull/42) merged at
+`6c59746118c910d850427c5c6c48e8b52eefcad7`. Exact feature head
+`72f554cb9accd32b4b992581d06c685f7e5c0e54` passed hosted Ubuntu/native Windows in
+[run 40557348341](https://github.com/jchewitt/weftlet/actions/runs/40557348341) and the
+[independent PR run](https://github.com/jchewitt/weftlet/actions/runs/40557375964).
+Ubuntu passed all 674 deterministic tests and the full publication gate. Windows passed all
+550 selected tests, inventory and licenses, including every new document-classification regression.
+
+The first push-run Windows attempt passed 549/550 tests but hit the existing 60-second timeout
+in the routing overlay rename/delete scenario. The independent PR run passed that scenario in
+21.9 seconds; the failed-job rerun passed it in 23.1 seconds and passed all 550 checks. Its prior
+T10 run took 22.8 seconds. No code or deadline changed between attempts. The first stall's phase
+and cause remain undiagnosed; these results do not establish a reproducible SHACL slowdown.
+
+T07b is merged with minor changesets; publication remains separate and npm's last verified release
+is 0.5.0. T07c and T05 closeout remain before the reviewed minor candidate and consumer acceptance.
+No model/provider request, browser interaction or private consumer acceptance is claimed.
+
+## T10 implementation coverage reporting, 2026-10-27
+
+The consumer reports returned code relationships with zero implementation coverage. The exact
+installed version/output was requested; no private source or artifact was accessed. Public
+regressions reproduced the defect with actual contract extraction (one production consumer counted
+as zero) and real SCIP (eight production relationships counted as zero). [ADR 024](ADR-024-implementation-coverage.md)
+records the reporting correction and metadata compatibility. It requires no hydration/model call
+and leaves snapshot bytes, extraction/cache identities, evidence authority and ranking unchanged.
+
+Focused public regressions cover real Git/extractors, strict SHACL, exact fact/provenance/authority
+round trips, API/MCP/Markdown/HTML consistency, pagination and retained source diagnostics. Negative
+cases distinguish document/model/test/runtime/draft facts from production implementation evidence.
+
+Local `pnpm context-graph:publication-check` passed: 563 deterministic tests (17 core, 546 toolkit),
+including 26 new coverage regressions, one optional OML skip, 13 existing advisory findings,
+release documentation, inventory, licenses and fresh packed-consumer checks. The installed query
+counts real SCIP production facts in both implementation and contract coverage; visualization uses
+the same actual Context Pack. All 79 original source path/hash pairs are intact. Independent review
+found no remaining blocker; Markdown and HTML share the coverage explanation and page-scoped wording.
+
+[PR 40](https://github.com/jchewitt/weftlet/pull/40) merged at
+`d3fe532f3c10869eee72a023c4682601559f0f9e`. Exact feature head
+`d324a1c56a40d069dca3f5201ceb12b55fceecc2` passed hosted Ubuntu/native Windows in
+[run 40541223960](https://github.com/jchewitt/weftlet/actions/runs/40541223960) and the
+[PR run](https://github.com/jchewitt/weftlet/actions/runs/40541230905).
+Ubuntu passed the full publication gate and all 563 deterministic tests. Windows passed all 439
+selected tests plus inventory and licenses, including real SCIP and the new reporting regressions.
+T10 is merged with patch changesets; npm publication remains separate. No private consumer
+acceptance or model/provider request is claimed.
+
+## T07a prospective document coverage, 2026-10-27
+
+Implemented after T06; no npm publication is claimed here. [ADR 023](ADR-023-document-coverage-preview.md)
+records the standalone `documents plan` command/API, committed-link coverage and limits. Current
+hydration selection, cache estimates and configuration/extractor/assembly identities are unchanged.
+
+Focused tests exercise actual Markdown, Git objects and a public ten-document discovery → analysis
+→ admission → planning → execution → outcomes flow, with shared queue-contract links, cycles,
+unapproved drafts and validation references. They distinguish prospective coverage from the actual
+hydration plan, retain exact committed digests/citations, preserve authority, and verify no source
+bodies, provider/adapter imports, cache/snapshot writes or checkout/index changes. Rename/delete
+and historical refs, duplicate definitions, scope boundaries, unsafe paths, symlinks/submodules,
+read-limit frontiers and complete closure above extraction budgets are covered. Native file
+symlink privileges are not required by the Git boundary fixtures.
+
+Local `pnpm context-graph:publication-check` passed: 537 deterministic tests (17 core,
+520 toolkit), including 96 new coverage cases, one optional OML skip, 13 unchanged advisory
+architecture findings, release documentation, inventory, licenses and fresh packed-consumer checks.
+The installed CLI/API produced matching prospective coverage digests and explicit read-limit
+frontiers while the configured provider and adapter were unavailable. Existing real TypeScript
+SCIP, RDF/SPARQL/SHACL, visualization and MCP checks also passed. All 79 original source
+path/hash pairs are intact. Independent review found a `./` evidence-root labeling edge case;
+the fix and both `.`/`./` regressions pass.
+
+The first hosted Windows attempt passed 412 checks and failed one fixture setup: Git for Windows
+rejects tab/newline paths even through `update-index`. The fixture now writes those nested Git
+tree/commit objects directly, preserving unusual-path coverage without checkout or safety-setting
+changes. All seven focused Git tests pass locally after this fixture-only correction.
+
+[PR 38](https://github.com/jchewitt/weftlet/pull/38) merged at
+`35de52e42b51728af43d9bb74cb9b338cf3c1ece`. Final feature head
+`0969e109409aa6fb86827cb6a70ffdd0bcc34bc7` passed hosted Ubuntu and native Windows in
+[run 40537179020](https://github.com/jchewitt/weftlet/actions/runs/40537179020) and the
+[PR run](https://github.com/jchewitt/weftlet/actions/runs/40537186133).
+Ubuntu passed all 537 deterministic tests and the full publication gate, with one optional OML
+skip and 13 advisory findings. Windows passed all 413 selected tests, inventory and license checks,
+including the corrected whitespace-path fixture. T07a is merged with a minor changeset;
+the verified npm release remains 0.5.0.
+
+A no-model self-repository probe started from `docs/RELEASE-1.0-PLAN.md` at committed source
+`6a6a19cd8ba8c22c64c4158e38e0a3a57f350ab2`, with root `.` and the evaluation configuration.
+It read the complete supported closure: 28 documents, 332,658 bytes and 208 link occurrences.
+It correctly reported `ready: false`: all 28 candidates exceed the six-document budget, and
+`docs/VALIDATION.md` exceeds the 65,536-byte per-source budget. No candidate was silently dropped.
+
+This is document selection/coverage evidence, not extracted business-rule quality or new graph
+relationships. Validation documents remain candidates in this preview; their separate deterministic
+evidence path and traversal-driven extraction remain T07b/T07c. No model/provider request or npm
+publication is claimed; the consumer's live ten-minute retry remains unrun.
+
+## T06 release-documentation consistency, 2026-10-27
+
+Implemented after 0.5.0; publication remains separate. [ADR 022](ADR-022-release-documentation.md)
+records the generated sections and explicit operational-document scope. The source/packed checks
+use Node built-ins and run before publishing either package. Historical records, feature versions,
+graph semantics, extraction identities and consumer caches are unchanged.
+
+Focused checks passed: 33 release-documentation cases and three existing release-version cases.
+They cover stale source/packed instructions, wrong package/archive/dependency versions, missing
+documents, malformed markers, historical and CRLF preservation, multiline/inline examples,
+dependency-free CLI operation from another cwd, and real Changesets patch/minor regeneration.
+The actual release guide's marker-name explanation has its own regression. Independent review
+also identified shared npx-cache reuse in the old smoke; the updated smoke isolates its npm cache,
+requires both archive endpoints to be fetched, installs the documented archive pair and verifies
+the resulting lockfile SHA-512 values against the prepared bytes.
+
+Local `pnpm context-graph:publication-check` passed: 441 deterministic tests (17 core,
+424 toolkit), one optional OML skip, 13 unchanged advisory architecture findings, source and
+packed documentation, inventory, licenses and fresh packed-consumer checks. The smoke fetched
+both prepared packages through its isolated npm/npx cache, ran the checked setup/config commands,
+and installed the documented archive pair with matching lockfile versions and SHA-512 values.
+Existing real TypeScript SCIP, RDF/SPARQL/SHACL, visualization and MCP checks also passed.
+Independent implementation/integration review found no remaining blocker. All 79 original
+source path/hash pairs are intact. No model/provider request, private consumer run or public npm
+publication is claimed by this checkpoint.
+
+[PR 35](https://github.com/jchewitt/weftlet/pull/35) merged at
+`eb7a234479801ac3bca0b27974b8f729aff1c13a`. Exact feature head
+`33b9cd38355e483c11f7fec1fcaf02dfd222da38` passed hosted Ubuntu and native Windows checks in
+[run 40528744057](https://github.com/jchewitt/weftlet/actions/runs/40528744057).
+Windows includes the new documentation regressions; the full packed-consumer gate ran on Ubuntu.
+T06 is merged with a patch changeset; the verified npm release remains 0.5.0.
+
+## 0.5.0 publication and installed-package acceptance, 2026-10-27
+
+Published `@weftlet/core@0.5.0` and `@weftlet/toolkit@0.5.0` include T09
+ten-minute timeout support and T05a identity preflight/validation phase timing.
+`semantic.timeoutMs: 600000` is accepted; the default remains 120000. Retry limits,
+cancellation, five-second authentication/discovery bounds and semantic artifact identities
+are unchanged. This does not extend an outer CI/job timeout. The consumer's approved
+ten-minute retry has **not run**; no live extraction result is claimed.
+
+[Release PR 31](https://github.com/jchewitt/weftlet/pull/31) merged at
+`55770d5ff83737131fcfd17ddba5b87dc22daca3`.
+[Trusted publication run 40506053168](https://github.com/jchewitt/weftlet/actions/runs/40506053168)
+completed preparation, publication and release records on attempt 1. Both versions are public
+and tagged `latest`; downloaded registry archives are byte-identical to the reviewed archives.
+npm provenance payloads identify the release commit and workflow attempt and match the archive
+digests; this check does not claim separate cryptographic signature verification. The
+[core](https://github.com/jchewitt/weftlet/releases/tag/%40weftlet/core%400.5.0) and
+[toolkit](https://github.com/jchewitt/weftlet/releases/tag/%40weftlet/toolkit%400.5.0)
+package tags and GitHub Releases resolve to the same commit. Hosted Ubuntu and Windows also
+passed on that merged release commit in
+[run 40506053117](https://github.com/jchewitt/weftlet/actions/runs/40506053117).
+
+Completed upstream checks:
+
+- Exact reviewed head `370f18a506a948c3148b50a3c3364383e1b88c32` passed `pnpm release:prepare`:
+  408 deterministic tests (17 core, 391 toolkit), one optional OML skip, 13 unchanged advisory
+  architecture findings, inventory, licenses and fresh packed-consumer checks. Hosted Ubuntu and
+  Windows passed in [run 40504871916](https://github.com/jchewitt/weftlet/actions/runs/40504871916).
+- Timeout fix [PR 33](https://github.com/jchewitt/weftlet/pull/33) merged at
+  `795c67a24c5fffdb9c5c4d0cd1edab0ea2ae14bf`; exact source head
+  `68be50451d522590a7fd9626c1f6d3edd1acf5ca` passed
+  [run 40504193435](https://github.com/jchewitt/weftlet/actions/runs/40504193435).
+- Independent export review approved both archives: core 13 files/8,215 compressed bytes,
+  toolkit 218 files/254,008 compressed bytes. All 229 non-manifest files match reviewed
+  source/build bytes; 293 relative module references resolve. Compiled configuration contains
+  the 600000 ceiling, and T05a assets and exports are present. Core has no runtime dependencies;
+  toolkit requires core `^0.5.0`. Licenses/NOTICE/third-party attribution and all 79 original
+  source path/hash pairs are intact. No forbidden local-state entries or credential-signature
+  matches were found.
+- Hosted artifact `12734837678` from release commit `55770d5ff83737131fcfd17ddba5b87dc22daca3`
+  contains package archives byte-identical to those independently reviewed locally.
+- An offline Linux/Node 24.19.0 rehearsal installed the exact reviewed archives with lifecycle
+  scripts disabled. Its deterministic local provider received timeout 600000, with real SCIP
+  and full SHACL. It produced 54 total facts including 24 SCIP facts, and 53 impact-query facts.
+  Cold hydration extracted two artifacts; repeat hydration reused both with unchanged snapshot
+  identity, content digest and stored bytes. T05a positive/negative preflight and SHACL, exact
+  attribution, phase events and provider-unavailable saved queries/preview passed.
+- Fresh public-registry installation passed on Linux/Node 24.19.0 with lifecycle scripts disabled.
+  Both lockfile registry URLs and SHA-512 values match the reviewed archives. The installed CLI
+  accepted 600000 and the deterministic module verified receiving it. The committed public fixture
+  produced 54 total facts, including two semantic facts, four contract consumers, 24 real SCIP facts and
+  two public adapter facts; the impact query returned 53 facts. Cold hydration extracted two
+  artifacts; repeat hydration extracted zero and reused both with identical snapshot identity,
+  content digest and stored bytes. Positive/negative preflight and full SHACL, exact attribution
+  without mutation, and phase events passed. Removing the provider module preserved no-model
+  preview and saved queries with no additional provider calls. Fixture commit:
+  `f61e05a8f437097ebc6eeb966f6eda2b8bb12008`; content digest:
+  `d975795c1324795ef4d144ca803d225c5059c229063c9f0514c006ed310378c4`.
+
+The fixture does not run Codex/API requests, wait ten minutes or establish private consumer
+acceptance. T06/T07 and broader T05 work remain open. Entries below are historical checkpoints;
+their publication status and counts describe the time of each check.
+
+| Package | Reviewed and public SHA-512 integrity |
+| --- | --- |
+| `@weftlet/core@0.5.0` | `sha512-JM+wBBaGQewwlEHtVDW1bBqMdeTNTnoR9JoqRkJ8t2onK4UPZsoEWho65wtX7UlPlIL/tu975VovJps9xmjuhA==` |
+| `@weftlet/toolkit@0.5.0` | `sha512-7CgqoFX7qjTtK4SEX3+EYC30L0vE69H1gVGPLqbeSwVp176QIrAMA9qsjFzevdLVyPk/mLMp5of4vUXWyobITQ==` |
+
 ## Ten-minute timeout blocker, 2026-10-27
 
 The maintainer reports that published 0.4.0 rejects the approved `semantic.timeoutMs: 600000`.

package/docs/assessments/pre-1.0-2026-10-28.json

@@ -0,0 +1,200 @@
+{
+  "schemaVersion": 1,
+  "date": "2026-10-28",
+  "runtimeSourceCommit": "9b4acffe1c4d35f9fd2f91132c576f8934658677",
+  "releaseSourceCommit": "b4c808b9221c5c82f9f7326a310e966d1fee2888",
+  "packageVersions": {
+    "@weftlet/core": "0.6.0",
+    "@weftlet/toolkit": "0.6.0"
+  },
+  "environment": {
+    "os": "Linux",
+    "node": "24.19.0",
+    "pnpm": "10.18.2"
+  },
+  "fixtureProvider": {
+    "path": "tests/fixtures/business-context-provider.mjs",
+    "sha256": "4261c3261ca2959c89bdec73eda0f6aa5c40ffcb75db4aa64442f67534d8b2f7",
+    "mode": "deterministic public prose grammar; no model requests"
+  },
+  "boundaries": [
+    "New test files use unchanged runtime from the recorded source commit.",
+    "Real Git and TypeScript SCIP; actual application hydration, RDF/SHACL and MCP facade.",
+    "No live provider, actual broker/database execution, service build or private consumer acceptance.",
+    "No automatic business compatibility verdict or exact-function binding established.",
+    "No autonomous agent trial or new MCP transport exercise.",
+    "Graphify source review is separate; no comparative execution."
+  ],
+  "runs": [
+    {
+      "name": "existing-regressions",
+      "command": "pnpm exec vitest run tests/rdf.test.ts tests/routing.test.ts src/extraction/routing.test.ts src/extraction/scip-project.test.ts src/graph/query.test.ts",
+      "success": true,
+      "passed": 24,
+      "failed": 0,
+      "pending": 0,
+      "suites": [
+        {
+          "path": "tests/rdf.test.ts",
+          "sha256": "2b0f0fd6314ac28d4c64422d5650d56b540c9d391adab5eac0d24ed06a592397",
+          "status": "passed",
+          "cases": [
+            {
+              "name": "unified evidence graph extracts public prose and real TypeScript across queue boundaries, with SPARQL/projection equivalence",
+              "status": "passed"
+            }
+          ]
+        },
+        {
+          "path": "tests/routing.test.ts",
+          "sha256": "bac6081701ada81f422e1b7641a212a3f51b0c44a94bc88deb93d610b4a65c34",
+          "status": "passed",
+          "cases": [
+            {
+              "name": "committed routing declarations in independent repositories links a typed upstream change across an explicit boundary without shared-channel cross products",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations in independent repositories replaces routing edges for source renames/deletions and routing-manifest edits/deletions in drafts",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations in independent repositories preserves the last valid saved graph when a committed routing manifest is malformed or absent",
+              "status": "passed"
+            }
+          ]
+        },
+        {
+          "path": "src/extraction/routing.test.ts",
+          "sha256": "7b72aefa770bd217435220fa85bf21d5297e01cbf5e23d3765aed549b9300681",
+          "status": "passed",
+          "cases": [
+            {
+              "name": "committed routing declarations joins document, test and production endpoints with actual neutral file and document facts",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations extracts exact cited bindings with inferred authority while ignoring dirty declarations",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations keeps binding, scope, case and repository identities separate despite equal channel labels",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations suppresses every duplicate scoped binding across files, including identical duplicates",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations does not guess case, extensions or directories, and suppresses the complete missing-endpoint pair",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations reads Unicode and spaced paths exactly from a nested repository root despite Git quoting",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations accepts executable blobs but rejects committed symlink modes without creating host symlinks",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations invalidates deleted or renamed endpoints until the mapping is updated, leaving historical results intact",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations fails closed on missing source files except explicit draft deletion diagnostics",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations rejects malformed, ambiguous and unsupported schemas or path forms",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations enforces file-count, combined declaration-count and source-byte bounds",
+              "status": "passed"
+            }
+          ]
+        },
+        {
+          "path": "src/extraction/scip-project.test.ts",
+          "sha256": "8a92ffd963ca5818c102aec3487ea21405d75bbaf593b13e2256b6f5a1914b23",
+          "status": "passed",
+          "cases": [
+            {
+              "name": "links committed workspace contracts and excluded tests through real SCIP, preserving dirty bytes and rename/delete boundaries",
+              "status": "passed"
+            },
+            {
+              "name": "fails before indexing on absent aliases, empty/oversized scopes and reserved generated paths",
+              "status": "passed"
+            }
+          ]
+        },
+        {
+          "path": "src/graph/query.test.ts",
+          "sha256": "7b6653f767c2e7445ec19f0cafc9d3fe97494ae139835ec63d335a7210e62c6c",
+          "status": "passed",
+          "cases": [
+            {
+              "name": "impact scan facade rejects snapshot traversal before the service can read outside snapshot storage",
+              "status": "passed"
+            },
+            {
+              "name": "impact scan facade returns the same bounded Context Pack through the application service used by CLI and MCP",
+              "status": "passed"
+            },
+            {
+              "name": "impact scan facade keeps skill command names aligned with the MCP facade and generic template",
+              "status": "passed"
+            },
+            {
+              "name": "impact scan facade expands changed code files through symbols without traversing the project hub",
+              "status": "passed"
+            },
+            {
+              "name": "impact scan facade returns the broader Fulfillment policy, PM, execution, worker, and validation purpose chain",
+              "status": "passed"
+            },
+            {
+              "name": "impact scan facade uses the owner document as the traversal anchor and task terms to rank connected context",
+              "status": "passed"
+            },
+            {
+              "name": "impact scan facade shows observed runtime behavior beside declared intent and flags unmapped observations",
+              "status": "passed"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "business-context-acceptance",
+      "command": "pnpm exec vitest run tests/business-context-acceptance.test.ts",
+      "success": true,
+      "passed": 3,
+      "failed": 0,
+      "pending": 0,
+      "suites": [
+        {
+          "path": "tests/business-context-acceptance.test.ts",
+          "sha256": "c5e196db080cc798dc3abb21fb2cdb4ac3ecb07b4307cc3aa6764f04f60bb9cb",
+          "status": "passed",
+          "cases": [
+            {
+              "name": "public business-context acceptance boundaries bridges isolated service code only after the stored-data handoff is documented, retaining both rules and authority",
+              "status": "passed"
+            },
+            {
+              "name": "public business-context acceptance boundaries supports bounded MCP-facade pagination and focused follow-up without hiding depth exhaustion",
+              "status": "passed"
+            },
+            {
+              "name": "public business-context acceptance boundaries resolves shared contracts across separate workspace packages and TSX, with source and repeat identity intact",
+              "status": "passed"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/docs/benchmarks/validation-2026-10-28/README.md

@@ -0,0 +1,25 @@
+# T05 validation measurements, 2026-10-28
+
+See [ADR 027](../../ADR-027-validation-closeout.md) for decisions, units, methodology and limits.
+These files are public metric reports, not graph snapshots. They contain no private consumer data.
+
+| Report | Command after `pnpm build` | Source identity |
+| --- | --- | --- |
+| [lifecycle.json](lifecycle.json) | `node scripts/validation-benchmark/run.mjs --counts 2000 --samples 3` | Runtime `174f2ae`; harness subsequently committed at `3a7e24d`, per-file hashes in report. That version selected pipeline/shared/unique and ten scenarios. |
+| [rich.json](rich.json) | `node scripts/validation-benchmark/run.mjs --counts 2000 --fixtures document-rich --samples 3` | Base `3a7e24d` plus recorded dirty harness paths, subsequently committed at `4e93837`. Adds manifest-only and dense metadata cases. |
+| [large.json](large.json) | `node scripts/validation-benchmark/run.mjs --counts 10000 --fixtures unique,document-rich --samples 3 --scenarios cold` | Clean harness commit `4e93837`. |
+| [native.json](native.json) | `node --import tsx scripts/validation-benchmark/native.ts /explicit/path/to/rudof` | Base `4e93837` plus recorded probe/fixture paths; exact probe and shared-fixture SHA-256 recorded. |
+
+For the first report with the current harness, explicitly select
+`--fixtures pipeline,shared,unique --scenarios cold,repeat,rebuild,insert,update,delete,rename,invalid-confidence,invalid-shared-kind,repair-delete`.
+The current default additionally includes dense metadata and manifest-only inputs. Tests contain
+no latency thresholds. All measurements use public synthetic inputs or the actual public pipeline
+extractor fixture; no paid/model work is performed. Reports preserve all completed case outcomes.
+
+The optional native probe requires Linux, Python 3 and the explicit official
+[`rudof_0.3.35_x86_64_linux_gnu` release asset](https://github.com/rudof-project/rudof/releases/tag/0.3.35).
+SHA-256: `d9d230e27e594ab5d7927cc021fbdc8b907a014cebfa13722a5521a65ce9ff66`.
+The script does not download/install it. The experiment exits **1** because two diagnostic-count
+comparisons differ, even though all 29 conformance/location comparisons and all 12 timing cases
+complete as expected. That is an explicitly recorded compatibility gap, not an accepted replacement
+or a successful exact-parity gate. No native binary/service is required for tests or package use.