@weftlet/toolkit 0.6.0 → 0.6.1

package/README.md

@@ -14,7 +14,7 @@ Proposed future capabilities are recorded in the [Weftlet 2.0 product plan](docs
 ## Set up a project
 
 <!-- weftlet:release:start -->
-Package versions in this checkout/archive: `@weftlet/toolkit@0.6.0` and `@weftlet/core@0.6.0`.
+Package versions in this checkout/archive: `@weftlet/toolkit@0.6.1` and `@weftlet/core@0.6.1`.
 <!-- weftlet:release:end -->
 
 Weftlet uses `@weftlet/toolkit`; its neutral `@weftlet/core` dependency is installed

package/dist/extraction/ontology.js

@@ -95,7 +95,7 @@ export class OpenCaesarOntologyCompiler {
             throw new Error('Optional openCAESAR requires projectPath and containerImage');
         }
         const source = resolve(this.repositoryRoot, this.config.projectPath);
-        const work = join(this.storageRoot, 'work', `ontology-${snapshotId}-${randomUUID()}`);
+        const work = join(this.storageRoot, 'work', `ontology-${randomUUID()}`);
         await rm(work, { recursive: true, force: true });
         await mkdir(dirname(work), { recursive: true });
         const sourceBuild = join(source, 'build');
@@ -155,7 +155,7 @@ export class DirectRdfOntologyCompiler {
         writer.addQuads(dataset.getQuads(null, null, null, null));
         const text = await new Promise((accept, reject) => writer.end((error, value) => error ? reject(error) : accept(value)));
         const content = text.split('\n').filter(Boolean).sort().join('\n') + '\n';
-        const root = join(this.storageRoot, 'work', `rdf-${snapshotId}-${randomUUID()}`);
+        const root = join(this.storageRoot, 'work', `rdf-${randomUUID()}`);
         await mkdir(root, { recursive: true });
         const path = join(root, 'semantic.nt');
         await writeFile(path, content);

package/dist/extraction/static.js

@@ -1,7 +1,6 @@
 // Modified for standalone extraction; see docs/extraction-manifest.json.
-import { randomUUID } from 'node:crypto';
 import { withCommittedTree } from "../repository/committed-tree.js";
-import { copyFile, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises';
+import { copyFile, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { dirname, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
@@ -13,6 +12,7 @@ import { moduleRequestNode } from './module-request.js';
 import { matchesRepositoryGlob } from "../repository/glob.js";
 import { runProcess } from "../infrastructure/process.js";
 import { sha256, stableJson } from "../infrastructure/util.js";
+import { physicalArtifactKey, temporaryArtifactPath } from '../infrastructure/artifact-paths.js';
 export class ScipTypeScriptIndexer {
     config;
     storageRoot;
@@ -26,9 +26,9 @@ export class ScipTypeScriptIndexer {
             assertSourceProjectInvocation(this.config.command, this.config.args);
         }
         const require = createRequire(import.meta.url);
-        const destination = join(this.storageRoot, 'scip', `${context.snapshotId}.scip`);
+        const destination = join(this.storageRoot, 'scip', `${physicalArtifactKey(context.snapshotId)}.scip`);
         await mkdir(join(this.storageRoot, 'scip'), { recursive: true });
-        const temporary = `${destination}.${randomUUID()}.tmp`;
+        const temporary = temporaryArtifactPath(destination);
         const command = this.config.command === 'bundled-scip-typescript' ? process.execPath : this.config.command;
         const args = this.config.command === 'bundled-scip-typescript'
             ? [
@@ -38,23 +38,28 @@ export class ScipTypeScriptIndexer {
                 temporary,
             ]
             : this.config.args;
-        await withCommittedTree(context.repositoryRoot, context.commitSha, async (worktreeRoot) => {
-            const project = this.config.sourceProject ? await prepareScipSourceProject(worktreeRoot, this.config.sourceProject, await new GitRepository(context.repositoryRoot).listAllFilesAt(context.commitSha)) : undefined;
-            await runProcess(command, project ? [...args, project] : args, worktreeRoot, {
-                ...process.env,
-                NODE_OPTIONS: process.env.NODE_OPTIONS ?? '--max-old-space-size=8192',
+        try {
+            await withCommittedTree(context.repositoryRoot, context.commitSha, async (worktreeRoot) => {
+                const project = this.config.sourceProject ? await prepareScipSourceProject(worktreeRoot, this.config.sourceProject, await new GitRepository(context.repositoryRoot).listAllFilesAt(context.commitSha)) : undefined;
+                await runProcess(command, project ? [...args, project] : args, worktreeRoot, {
+                    ...process.env,
+                    NODE_OPTIONS: process.env.NODE_OPTIONS ?? '--max-old-space-size=8192',
+                });
+                const source = this.config.command === 'bundled-scip-typescript'
+                    ? temporary
+                    : join(worktreeRoot, 'index.scip');
+                await stat(source);
+                if (source !== temporary)
+                    await copyFile(source, temporary);
+                // SCIP embeds this disposable checkout in metadata and inferred-type hover text.
+                // Store the normalized artifact itself so its digest still authenticates its bytes.
+                await writeFile(temporary, normalizeScipCheckout(await readFile(temporary), worktreeRoot));
             });
-            const source = this.config.command === 'bundled-scip-typescript'
-                ? temporary
-                : join(worktreeRoot, 'index.scip');
-            await stat(source);
-            if (source !== temporary)
-                await copyFile(source, temporary);
-            // SCIP embeds this disposable checkout in metadata and inferred-type hover text.
-            // Store the normalized artifact itself so its digest still authenticates its bytes.
-            await writeFile(temporary, normalizeScipCheckout(await readFile(temporary), worktreeRoot));
-        });
-        await rename(temporary, destination);
+            await rename(temporary, destination);
+        }
+        finally {
+            await rm(temporary, { force: true });
+        }
         return {
             path: destination,
             digest: sha256(await readFile(destination)),

package/dist/infrastructure/artifact-paths.d.ts

@@ -0,0 +1,4 @@
+/** Physical names only. Logical identities and evidence must retain the original value. */
+export declare function physicalArtifactKey(identity: string): string;
+/** Same-directory staging preserves atomic rename/link without repeating a long basename. */
+export declare function temporaryArtifactPath(destination: string): string;

package/dist/infrastructure/artifact-paths.js

@@ -0,0 +1,14 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { dirname, join } from 'node:path';
+/** Physical names only. Logical identities and evidence must retain the original value. */
+export function physicalArtifactKey(identity) {
+    if (/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(identity) &&
+        !/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(identity))
+        return identity;
+    // '~' is excluded from literal logical storage keys, so a digest cannot alias one.
+    return `~${createHash('sha256').update(identity).digest('hex')}`;
+}
+/** Same-directory staging preserves atomic rename/link without repeating a long basename. */
+export function temporaryArtifactPath(destination) {
+    return join(dirname(destination), `.${randomUUID()}.tmp`);
+}

package/dist/storage/storage.js

@@ -1,8 +1,8 @@
 // Modified for standalone extraction; see docs/extraction-manifest.json.
 import { mkdir, readFile, writeFile, link, rm } from 'node:fs/promises';
-import { randomUUID } from 'node:crypto';
-import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { atomicRename } from './atomic-rename.js';
+import { physicalArtifactKey, temporaryArtifactPath } from '../infrastructure/artifact-paths.js';
 async function readJson(path) {
     try {
         return JSON.parse(await readFile(path, 'utf8'));
@@ -13,9 +13,21 @@ async function readJson(path) {
         throw error;
     }
 }
+async function readWithLegacyPath(path, legacyPath) {
+    const current = await readJson(path);
+    if (current !== undefined || path === legacyPath)
+        return current;
+    // No old file could have this component on supported filesystems. Do not attempt an
+    // overlong fallback after a normal cache miss; other I/O/corruption errors still propagate.
+    if (Buffer.byteLength(basename(legacyPath)) > 255)
+        return undefined;
+    if (process.platform === 'win32' && /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(basename(legacyPath)))
+        return undefined;
+    return readJson(legacyPath);
+}
 async function atomicJson(path, value) {
     await mkdir(dirname(path), { recursive: true });
-    const temporary = `${path}.${randomUUID()}.tmp`;
+    const temporary = temporaryArtifactPath(path);
     try {
         await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', flag: 'wx' });
         await atomicRename(temporary, path);
@@ -29,7 +41,7 @@ function safeKey(key) {
         throw new Error('Unsafe storage identifier');
     return key;
 }
-function snapshotPath(root, snapshotId) {
+function snapshotPath(root, snapshotId, legacy = false) {
     if (snapshotId.length > 256 ||
         !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(snapshotId) ||
         snapshotId === '.' ||
@@ -37,7 +49,7 @@ function snapshotPath(root, snapshotId) {
         throw new Error('snapshotId must be a safe storage identifier');
     }
     const directory = resolve(root, 'snapshots');
-    const candidate = resolve(directory, `${snapshotId}.json`);
+    const candidate = resolve(directory, `${legacy ? snapshotId : physicalArtifactKey(snapshotId)}.json`);
     const pathFromDirectory = relative(directory, candidate);
     if (pathFromDirectory === '..' ||
         pathFromDirectory.startsWith(`..${sep}`) ||
@@ -53,8 +65,15 @@ export class FileSnapshotStore {
     }
     async write(snapshot) {
         const destination = snapshotPath(this.root, snapshot.manifest.snapshotId);
+        const prior = await this.read(snapshot.manifest.snapshotId);
+        if (prior) {
+            if (prior.manifest.contentDigest !== snapshot.manifest.contentDigest) {
+                throw new Error(`Refusing to overwrite immutable snapshot ${snapshot.manifest.snapshotId} with different content`);
+            }
+            return; // Preserve an existing legacy file without copying or rewriting its bytes.
+        }
         await mkdir(dirname(destination), { recursive: true });
-        const temporary = `${destination}.${randomUUID()}.tmp`;
+        const temporary = temporaryArtifactPath(destination);
         try {
             await writeFile(temporary, JSON.stringify(snapshot), { flag: 'wx' });
             // Linking a complete file publishes atomically without ever replacing a winner.
@@ -73,16 +92,17 @@ export class FileSnapshotStore {
         }
     }
     read(snapshotId) {
-        return readJson(snapshotPath(this.root, snapshotId));
+        return readWithLegacyPath(snapshotPath(this.root, snapshotId), snapshotPath(this.root, snapshotId, true));
     }
     async readHead(headName) {
-        const head = await readJson(join(this.root, 'heads', `${safeKey(headName)}.json`));
+        const key = safeKey(headName);
+        const head = await readWithLegacyPath(join(this.root, 'heads', `${physicalArtifactKey(key)}.json`), join(this.root, 'heads', `${key}.json`));
         return head ? this.read(head.snapshotId) : undefined;
     }
     async updateHead(headName, snapshotId) {
         if (!(await this.read(snapshotId)))
             throw new Error('Cannot point a head to an absent snapshot');
-        return atomicJson(join(this.root, 'heads', `${safeKey(headName)}.json`), { snapshotId });
+        return atomicJson(join(this.root, 'heads', `${physicalArtifactKey(safeKey(headName))}.json`), { snapshotId });
     }
 }
 export class SemanticArtifactStore {
@@ -97,18 +117,26 @@ export class SemanticArtifactStore {
     }
     /** Only explicitly supplied roots are consulted; never enumerate other consumers' profiles. */
     async readEntry(key) {
-        const filename = `${safeKey(key)}.json`;
+        const filename = `${physicalArtifactKey(safeKey(key))}.json`;
         for (const [index, root] of [this.root, ...this.legacyRoots].entries()) {
-            const artifact = await readJson(join(root, 'artifacts', 'semantic', filename));
+            const artifact = await readWithLegacyPath(join(root, 'artifacts', 'semantic', filename), join(root, 'artifacts', 'semantic', `${key}.json`));
             if (artifact !== undefined)
                 return { artifact, origin: index === 0 ? 'primary' : 'legacy' };
         }
         return undefined;
     }
     async write(artifact) {
-        const path = join(this.root, 'artifacts', 'semantic', `${safeKey(artifact.key)}.json`);
+        const key = safeKey(artifact.key);
+        const path = join(this.root, 'artifacts', 'semantic', `${physicalArtifactKey(key)}.json`);
+        const prior = await readWithLegacyPath(path, join(this.root, 'artifacts', 'semantic', `${key}.json`));
+        if (prior) {
+            if (prior.outputDigest !== artifact.outputDigest) {
+                throw new Error('Concurrent semantic artifact differs; retry with explicit force refresh');
+            }
+            return;
+        }
         await mkdir(dirname(path), { recursive: true });
-        const temporary = `${path}.${randomUUID()}.tmp`;
+        const temporary = temporaryArtifactPath(path);
         try {
             await writeFile(temporary, JSON.stringify(artifact), { flag: 'wx' });
             await link(temporary, path);

package/docs/ADR-028-bounded-artifact-paths.md

@@ -0,0 +1,58 @@
+# ADR 028: bounded physical artifact names
+
+Status: implemented; release status is recorded in [validation](VALIDATION.md).
+
+The consumer reported that long physical artifact/temp names block the traversal → unchanged
+repeat → clean-comparison sequence on Windows. A public regression using traversal, routing and
+an empty runtime-evidence revision reproduces `ENAMETOOLONG` in real SCIP during clean comparison
+on Linux too. Appending `.scip.<UUID>.tmp` to the complete logical identity exceeds the common
+255-byte filename-component limit. RDF and optional OML work directories also embedded the entire
+identity. This is a physical storage defect, not a graph identity, business-rule or SHACL defect.
+
+## Physical names and compatibility
+
+Keep portable literal artifact keys of at most 128 ASCII characters. Longer/nonportable keys
+use `~` followed by the full SHA-256 of the logical key. The `~` namespace is excluded from
+literal logical storage identifiers, preventing a hash from aliasing a user-supplied short key.
+Windows device names are also hashed. Existing logical identifier validation and its 256-character
+limit remain intact; no snapshot, fact, provenance, extractor or cache identity is shortened.
+
+Snapshot JSON, heads, semantic cache storage and SCIP output use this mapping. Generated semantic
+cache keys are already 64-character digests and retain their names. Snapshot reads fall back to
+the old literal filename if the bounded path is absent. Semantic reads retain explicit legacy
+root handling. Skip legacy components that cannot exist within the filename limit (and Windows
+device names on Windows), but propagate other I/O and corrupt-JSON errors.
+
+Existing legacy immutable snapshots/artifacts are checked before publication and retained byte
+for byte. A different content/output digest for the same identity remains an error. Updating a
+long legacy head writes the new bounded head and gives it precedence without modifying history.
+No bulk cache migration, forced extraction or automatic deletion is required. Older toolkit
+versions cannot necessarily read newly hashed long-name entries; use supported store/CLI queries
+with the full logical ID rather than constructing a filename from it.
+
+Staging names are independent UUIDs in the destination directory, preserving same-filesystem
+atomic link/rename publication. Cross-process immutable winner and head replacement semantics
+remain unchanged. SCIP staging files are cleaned after success or failure. RDF/optional OML work
+directories need only a backend prefix and UUID; RDF output digests do not depend on their names.
+The optional OML generated document filenames remain their existing semantic digest keys.
+
+This bounds toolkit-generated components; it does not promise that arbitrary storage-root lengths
+or user source filenames work with every external program's total-path restrictions. The original
+working checkout is not moved or cleaned. Full logical IDs remain in snapshots, head records,
+facts and query responses, and saved evidence remains queryable without providers.
+
+## Validation boundary
+
+The public sequence uses the unchanged Codex adapter with its offline grammar runner, real SCIP,
+RDF/SHACL, document traversal, configured routing and an injected empty runtime provider. First
+hydration extracts six semantic documents; repeat and clean comparison reuse all six. The clean
+identity retains traversal/clean/runtime suffixes and exceeds 215 characters. Content digests and
+all facts/provenance except the containing snapshot ID agree; the original head stays unchanged.
+Generated components are bounded and no staging files remain. The exact sequence is part of the
+existing native Windows traversal suite as well as the Linux suite.
+
+Storage regressions cover 256-character snapshot/artifact/head keys, concurrent immutable writes,
+concurrent head replacement, legacy reads without rewriting bytes, legacy cache roots, collisions
+and unsafe input rejection. Existing cross-process publication tests remain required. Live provider
+calls, private TradePilot acceptance and live openCAESAR compilation are separate; this patch does
+not claim them or change validation constraints, graph semantics or evidence authority.

package/docs/CONSUMER-TRIAL.md

@@ -134,10 +134,12 @@ does not establish what the agent saw. Also retain a short account of what the a
 in its implementation or test plan because of these results, and the actual test outcomes.
 
 Retain the selected immutable snapshot, not just the mutable head pointer. With workspace
-storage, it is `<repositoryRoot>/<storagePath>/snapshots/<snapshotId>.json`; the default
-`storagePath` is `.context-graph`. `storageScope: "user"` instead uses a configuration/checkout
-hash directory under `~/.cache/context-graph`. Preserve the original store and exact
-configuration if its resolved path is uncertain. Semantic artifacts under `artifacts/semantic/`
+storage, snapshots are under `<repositoryRoot>/<storagePath>/snapshots/`; the default
+`storagePath` is `.context-graph`. Long physical filenames are hashed: identify the selected
+record by its full `manifest.snapshotId`, not by constructing a filename from that ID.
+`storageScope: "user"` instead uses a configuration/checkout hash directory under
+`~/.cache/context-graph`. Preserve the original store and exact configuration if its resolved
+path is uncertain. Semantic artifacts under `artifacts/semantic/`
 contain model output; keep them locally if extraction debugging is needed. They are not
 required to query an existing snapshot. Do not copy credentials or whole account directories.
 

package/docs/GRAPHIFY-EVALUATION.md

@@ -0,0 +1,70 @@
+# Graphify evaluation for the pre-1.0 baseline
+
+Status: preliminary source/document review on 2026-10-28. **No comparative execution or
+replacement decision yet.** This is B2 of the [baseline plan](PRE-1.0-BASELINE.md).
+No Graphify dependency, code, binary, skill or service was installed into Weftlet. Public source
+was read at a pinned revision outside the repository; no private consumer material was used.
+
+## Reviewed candidate
+
+- Repository: [Graphify-Labs/graphify](https://github.com/Graphify-Labs/graphify).
+- Reviewed commit: `0a8cd4e1e342235fe53e881fb5d591bf0460071f` on its `v8` branch.
+- That commit's [package manifest](https://github.com/Graphify-Labs/graphify/blob/0a8cd4e1e342235fe53e881fb5d591bf0460071f/pyproject.toml)
+  identifies distribution `graphifyy`, version `0.9.97`, Python >=3.10 and Apache-2.0 licensing.
+  This is source metadata, not verification that a particular registry archive matches it.
+
+The [README](https://github.com/Graphify-Labs/graphify/blob/0a8cd4e1e342235fe53e881fb5d591bf0460071f/README.md)
+describes local tree-sitter extraction, broader language coverage, document/rationale extraction,
+paths and agent integration. Marketing/benchmark claims are not adopted as Weftlet measurements.
+The code inspected below supports evaluating it as a richer code-evidence producer; it does not
+establish that it is more accurate than compiler-backed TypeScript indexing on our tasks.
+
+## Findings from source inspection
+
+| Area | Observed at the pinned revision | Implication for an experiment |
+| --- | --- | --- |
+| Code granularity | [Extractor models](https://github.com/Graphify-Labs/graphify/blob/0a8cd4e1e342235fe53e881fb5d591bf0460071f/graphify/extractors/models.py) represent function/call syntax, declarations, imports, aliases, exports and symbol uses. The [engine](https://github.com/Graphify-Labs/graphify/blob/0a8cd4e1e342235fe53e881fb5d591bf0460071f/graphify/extractors/engine.py) emits code relationships and source locations. | Evaluate function/method/call relationships that our current file/shared-symbol projection does not expose. AST structure alone does not establish complete dynamic calls or data flow. |
+| Workspace resolution | [Resolution code](https://github.com/Graphify-Labs/graphify/blob/0a8cd4e1e342235fe53e881fb5d591bf0460071f/graphify/extractors/resolution.py) handles TypeScript aliases, project references, workspace/import/export origins and ambiguous barrel candidates. Its comments explicitly describe skipped npm-package tsconfig extensions. | Exercise our actual alias/barrel/same-name/TSX cases rather than assuming all pnpm projects resolve. Preserve unresolved and ambiguous outcomes. |
+| Identity | [Base identity helpers](https://github.com/Graphify-Labs/graphify/blob/0a8cd4e1e342235fe53e881fb5d591bf0460071f/graphify/extractors/base.py) derive file/symbol prefixes from paths; comments describe a later repository-relative remap. | Test roots, collisions, repeated names, rename/delete and clean/dirty isolation. Map imported entities into Weftlet's canonical identity and snapshot provenance instead of adopting labels as join keys. |
+| Evidence semantics | Extracted edges carry source file/location and `EXTRACTED` or `INFERRED` tags. | These tags do not mean owner-approved intent, observed runtime behavior or successful test execution. Measure citation precision and retain derivation when transforming facts into RDF. |
+| Deployment | The manifest depends on Python, NetworkX and multiple tree-sitter grammars; its optional services/providers are separate features. | Account for installation, platform support, artifact sizes, process boundaries, licensing and maintenance. Do not introduce hosted services or paid inference to compare static code extraction. |
+
+Graphify already covers documents and rationale too. The comparison initially isolates code
+extraction so that changing document inputs/providers cannot explain an apparent code improvement.
+Its [published benchmark](https://github.com/Graphify-Labs/graphify/blob/0a8cd4e1e342235fe53e881fb5d591bf0460071f/BENCHMARKS.md)
+reports an ERPNext six-question evaluation and a small FastAPI inferred-edge audit, including
+noisier same-name test helpers. Those are upstream-reported results, not a TypeScript comparison
+against Weftlet or SCIP and not evidence for complete asynchronous or business-rule linkage.
+
+## Fixed comparison protocol
+
+1. Freeze public source commits, expected relationships, negative cases, query/page budgets,
+   platform, versions and resource ceilings before measurement. Reuse the A1–A3 fixtures and
+   the existing dispatch negative case; add function-level examples without changing old labels.
+2. Compare **the current Weftlet SCIP projection**, **a bounded richer projection of raw SCIP**,
+   and **pinned Graphify static extraction**. Record raw index coverage separately from what
+   each adapter exposes. Do not attribute information discarded by our projection to SCIP itself.
+3. Include exact symbols, local/private functions, aliases, barrel exports, overloads, duplicate
+   names in separate domains, test mocks, TSX and service packages. Include a declared queue
+   boundary, a stored-data handoff and an undeclared boundary. The expected result for an
+   unsupported boundary is an explicit gap, not a guessed edge based only on a matching string.
+4. Hold business documents and their approved source classifications fixed. Check that the same
+   business-to-code links survive, then evaluate any finer function bindings separately. Keep
+   inferred mappings, source approval and reviewed assertions distinct.
+5. Measure precision/recall against predeclared edges, correct task-level consumers, false joins,
+   unresolved targets, citation validity, identity stability, cold/repeat/edit time and peak memory.
+   Compare same-process and subprocess measurements honestly. Count install/transfer overhead.
+6. Exercise deletion/rename, repeated clean runs, isolated committed materialization and dirty
+   queries. Retain old snapshots. Prove RDF/SPARQL/traversal equivalence for imported facts;
+   reject incompatible identities rather than weakening SHACL or dropping contradictory evidence.
+7. Run in a disposable tool environment with model calls disabled. Record reproducible commands
+   and sanitized outputs. Any live semantic experiment needs a separate bounded budget and
+   authorization before substantial paid usage. No private application checkout is modified.
+8. Produce an ADR choosing to keep SCIP, improve its projection, add an optional supported
+   producer, or replace the default. Replacement is a valid outcome if evidence supports it;
+   two permanently required indexers are not a prerequisite. If a change is selected, implement
+   compatibility/versioning and fresh-install tests as a separate milestone before publication.
+
+Graphify does not become a second authority for product intent merely by importing its graph.
+Neither tool can establish an undocumented business mapping from graph density alone. B3/B4
+must address those evidence and meaning questions independently of the code backend decision.

package/docs/PRE-1.0-BASELINE.md

@@ -0,0 +1,94 @@
+# Business-context baseline before 1.0
+
+Status: added at the maintainer's request on 2026-10-28 after publication of the 0.6.0
+candidate. This extends the original T01–T10 task list; its completion did not establish
+automatic rule-to-function discovery or complete agent exploration. The candidate remains
+available for TradePilot acceptance while the work below is assessed. No new release is
+announced by this plan.
+
+The product goal is to let an agent starting with a task or code change retrieve the relevant
+product obligations, understand their connections across domains and asynchronous service
+boundaries, and inspect the implementations, contracts and evidence behind those connections.
+The agent must be able to investigate further without confusing a bounded response with
+complete coverage. A functioning extraction/publication pipeline is necessary but insufficient.
+
+## What we checked now
+
+Runtime source baseline: `9b4acffe1c4d35f9fd2f91132c576f8934658677`, the documentation follow-up
+to release source `b4c808b9221c5c82f9f7326a310e966d1fee2888`. Both package versions are 0.6.0.
+New acceptance tests use that unchanged runtime. Results and commands are recorded in
+[the assessment](assessments/pre-1.0-2026-10-28.json) and [validation](VALIDATION.md).
+
+| Acceptance case | Current result | What remains unproven or missing |
+| --- | --- | --- |
+| **A1 — Business context across an asynchronous or stored-data boundary** | **Bounded mechanism PASS.** An upstream file has no code/symbol connection to the downstream service in the control. Adding a cited workflow handoff makes execution, notifications, mobile and a test reachable. Both producer and consumer freshness obligations survive with their citations and unreviewed assertion authority. An unrelated domain with the same rule label stays excluded. | This is extraction from a deterministic public prose grammar. No live semantic comprehension, actual database/BullMQ delivery, automatic business compatibility verdict or private consumer acceptance is established. |
+| **A2 — Progressive agent exploration** | **Existing operations PASS; requested experience PARTIAL.** Small pages through the actual MCP facade exhaust to exactly the larger scan without duplicates. A focused follow-up retrieves the downstream rule. Depth exhaustion is explicit; changing the query rejects an old continuation. | No dedicated exact-node neighbor/path MCP operation with relation/direction filters or explicit unexplored neighbor inventory. Scripted facade requests are not an autonomous-agent usefulness study or a new transport test. |
+| **A3 — Multiple services and client packages in one monorepo** | **Configured public fixture PASS.** Real SCIP resolves a re-exported workspace contract used by API and TSX client code. Document relationships connect separately located API, execution and notification services and the client. Repeat hydration reuses all five documents with unchanged snapshot identity/content. | A synthetic pnpm workspace uses explicit source includes/aliases in one indexing program. This is not a full pnpm installation, multiple service builds, Expo validation, automatic workspace discovery or a run against TradePilot. Per-service coverage and real package resolution still need consumer evidence. |
+
+The [three new tests](../tests/business-context-acceptance.test.ts) hydrate an independent Git
+repository through the real application, semantic-provider contract, SCIP, document linker,
+RDF/SHACL, saved storage and query path. The fixture provider parses only its documented small
+grammar; it makes no model request and does not inspect implementation bodies. The control
+already includes both sides' documents. The only added source evidence is the collection-to-
+execution handoff. It re-extracts one document and reuses four; the next unchanged hydration
+extracts zero and reuses five. Prior snapshots remain intact. No facts are manually spliced into
+the assembled graph to obtain the positive result.
+
+The two freshness limits (600 seconds at collection, 60 seconds at execution) are deliberately
+different. They can be compatible when the consumer checks freshness. The test asserts retrieval
+of both obligations and **does not assert a conflict or compliance verdict**. Runtime evidence
+and evaluated business invariants are empty. Source approval never approves the model assertion.
+
+Existing routing, query, RDF and workspace-indexing tests were also rerun: **24 passed**, followed
+by **3 new acceptance tests passed**. Existing routing negatives reject false same-channel joins
+and ambiguous/missing endpoints. Existing indexing checks cover dirty inputs, renames and deletes.
+These results supplement, and do not replace, the published release's validation record.
+
+Reproduce the focused assessment from a configured development checkout:
+
+```sh
+pnpm exec vitest run tests/business-context-acceptance.test.ts tests/rdf.test.ts tests/routing.test.ts src/extraction/routing.test.ts src/extraction/scip-project.test.ts src/graph/query.test.ts
+```
+
+## Subsequent task list
+
+These are bounded pre-1.0 investigations and implementation tasks, not a claim that the features
+are delivered. Record decisions and exact acceptance evidence per task. Any deferral must be
+explicitly reviewed with the maintainer; do not convert missing evidence into a pass. TradePilot
+blockers take priority when its report arrives. Do not modify or audit its application here.
+
+| ID | Task / next action | Acceptance boundary |
+| --- | --- | --- |
+| **B1** | **Exact graph exploration.** Specify and add bounded node lookup/neighbor expansion and dependency-path exploration through MCP and the shared query layer. | An agent can start from a returned stable node ID, select relation/direction and inspect another business area. Return citations, authority, snapshot identity, incomplete scope, pagination and remaining frontier. Test branches, cycles, ambiguous labels, deleted nodes and stale/mismatched continuations. Keep CLI/MCP/viewer on the same facts; preserve existing `impact.scan`. |
+| **B2** | **Evaluate Graphify and current SCIP representation.** Run the fixed public comparison in [the research note](GRAPHIFY-EVALUATION.md) before choosing a code extraction backend or symbol schema. | Compare the current projection, richer use of raw SCIP and pinned Graphify on identical committed inputs. Measure correct/missing/false links, provenance, identity stability, costs and packaging. Produce a keep/improve/replace decision with evidence. Parallel use during evaluation does not mandate shipping two indexers. |
+| **B3** | **Resolve business-to-implementation links at symbol/function level.** After B2, define canonical scoped code identities and resolve explicit document paths/symbol references to exact code entities. Evaluate a separate bounded inference pass only where explicit evidence is insufficient. | Named functions, methods, aliases, overloads, same-name symbols and renamed/deleted targets resolve correctly or remain unresolved. Separate a cited declared mapping, a proposed inferred mapping and evidence of actual behavior. Record both document and code revisions/spans for derived links. A reviewer can follow a rule to its implementation and back. Code inference never supplies approval; full automatic documentation generation remains 2.0. |
+| **B4** | **Cross-boundary obligations.** Represent and retrieve producer guarantees and consumer requirements through explicit data/event contracts, including applicable stage, domain, units, freshness and version where sources provide them. | Public cases cover a queue handoff, a write/read handoff, compatible differing limits with revalidation, a real documented incompatibility, missing links and same-name unrelated domains. Retrieve both sides and the implementation evidence. Potential model findings remain uncertain; hard failures require explicit approved deterministic rules. A graph link or SHACL pass is not a compatibility verdict. General reconciliation/approval UI remains 2.0. |
+| **B5** | **Monorepo selection and coverage.** Assess diagnostics for selected services, client, shared packages, source aliases and excluded/unresolved code; improve the gaps found. | A configured multi-package TypeScript/TSX fixture and the consumer report identify which projects were selected, indexed and actually connected. Test barrel exports, independent service code, external unresolved dependencies and omitted projects. Missing resolution cannot be reported as zero impact or complete coverage. Cross-repository federation is a separate scope decision. |
+| **B6** | **End-to-end product acceptance and release decision.** Combine the public evidence, B1–B5 decisions and TradePilot's actual 0.6.0 report; ship bounded candidate changes as needed. | Predeclare tasks, correct downstream business obligations/implementations, known unrelated matches and query budgets before measuring. Retain actual requests, follow-up decisions and citations. Assess helpfulness and misses separately from hydration success. Complete full hydration/repeat and supported release checks; review any remaining limitations before a versioned 1.0 publication. |
+
+Order: retain this A1–A3 baseline; triage incoming consumer blockers; specify B1 and run the
+bounded B2 comparison; use that decision for B3; implement B4/B5 in independently testable
+increments; close B6. Each implementation can ship in a minor candidate before 1.0. Changes to
+retrieval semantics, extraction/cache identity or snapshot compatibility need explicit decisions
+and regression evidence; no silent migration or history rewrite.
+
+## Consumer report to reconcile when available
+
+Retain the private configuration, documents, snapshots and transcripts with TradePilot. Share
+only a sanitized report identifying package versions, source/adapter SHA, indexing/document
+scope, phase timings, full validation/publication, unchanged reuse and query coverage.
+
+For A1, choose one actual upstream-to-downstream queue or stored-data change and record how the
+graph witnesses the handoff, each side's obligations and the associated implementations. Note
+whether a relationship came from prose, an explicit mapping, code or an observed trace. For A2,
+retain the initial request, follow-up choices and all truncation/continuation states. For A3,
+record the expected service/client projects and which were indexed, reached or missing. Have a
+human assess business usefulness; an automated pass here is not a replacement.
+
+## Boundary with 2.0
+
+The [2.0 plan](WEFTLET-2.0-PLAN.md) still owns bulk code-derived documentation, durable approval
+workflows, cross-source reconciliation management, source-document backfill, the companion
+website, hosted AI/billing and unrelated source adapters. This baseline concerns connecting and
+exploring local evidence accurately. No service, provider billing, new dependency, source adapter,
+automatic write-back, package publication or product-policy change is introduced by this assessment.

package/docs/RELEASE-1.0-PLAN.md

@@ -1,6 +1,11 @@
 # Consumer hardening and the 1.0 release plan
 
-Status: maintainer-directed work; release checkpoint on 2026-10-27 after verified 0.5.0 publication.
+Status: original T01–T10 engineering work complete; 0.6.0 candidate publication verified on 2026-10-28.
+The maintainer has requested additional [business-context baseline work](PRE-1.0-BASELINE.md)
+before official 1.0: precise exploration, symbol-level implementation links, cross-boundary
+obligations, monorepo coverage and a measured Graphify/SCIP decision. Its A1–A3 public checks
+pass within recorded limits; B1–B6 remain open. Both npm packages remain available for
+TradePilot acceptance while this additional scope is assessed.
 **T08's upstream deterministic physical-file fix has shipped; the maintainer reports the consumer
 updated and working on 2026-10-27. Detailed full hydration/repeat evidence remains pending.** T04 was completed before
 the T08 fix as requested.
@@ -12,15 +17,16 @@ The consumer's approved ten-minute retry has not run; that outcome remains separ
 The original report concerned `@weftlet/toolkit@0.2.0`. T01's upstream document-identity patch
 shipped in 0.2.1; T02 and T05's focused cold-validation optimization shipped in 0.3.0.
 T03 operational cache reuse, T04 semantic failure diagnostics and T08's public core file factory
-shipped in 0.4.0. T09 and T05a shipped in 0.5.0. T06 documentation consistency is implemented
-for the next release. T07a prospective coverage is implemented separately from hydration;
+shipped in 0.4.0. T09 and T05a shipped in 0.5.0. T06, T07 and T10 shipped in 0.6.0.
+T07a prospective coverage is implemented separately from hydration;
 T07b classification and deterministic document evidence merged in PR 42 after local/hosted checks
 and independent review. T07c hydration/cache integration merged in PR 44 with local and hosted checks passed;
 T05's remaining engineering evaluation is recorded in
 [ADR 027](ADR-027-validation-closeout.md), retaining full direct validation after measurements.
-Complete source/release checks, publish a reviewed minor candidate, validate it in TradePilot,
-then review and publish official 1.0. These
-release/consumer gates are separate from the engineering count; none is already accepted.
+The reviewed 0.6.0 candidate is published with verified registry archives, provenance and tags.
+Validate it in TradePilot, address any acceptance blockers and the newly requested baseline
+tasks, then review official 1.0. Consumer acceptance and the additional baseline are not closed
+by completion of the original engineering task list.
 
 This is the near-term release task list. The [Weftlet 2.0 product plan](WEFTLET-2.0-PLAN.md)
 remains a separate future direction for generation, approvals, a companion website and hosted
@@ -47,7 +53,7 @@ integration. Consumer acceptance is reported separately from upstream determinis
 
 | ID | Task | Priority/status | Dependencies and release boundary |
 | --- | --- | --- | --- |
-| **T10** | Correct implementation coverage for returned code relationships | **Merged after T07a; local/hosted checks passed; publication pending** | Separate evidence counts from display groups; preserve facts, authority, ranking and saved snapshots; scope gaps to returned page |
+| **T10** | Correct implementation coverage for returned code relationships | **Shipped in 0.6.0; consumer acceptance pending** | Separate evidence counts from display groups; preserve facts, authority, ranking and saved snapshots; scope gaps to returned page |
 | **T09** | Accept the approved ten-minute extraction timeout | **Shipped in 0.5.0; consumer ten-minute retry unrun** | Raise only the config ceiling to 600000; preserve defaults/cache/retry behavior; consumer retry has not run |
 | **T08** | Canonical physical-file kinds and public adapter factory | **Shipped in 0.4.0; consumer reported working; detailed acceptance pending** | Public core factory and neutral producers agree; record consumer commit, adapter tests and full hydration/repeat evidence |
 | **T01** | Coherent repository-document identity and kind | **Upstream patch shipped in 0.2.1; consumer acceptance pending** | SHACL and assertions preserved; genuine consumer re-run is still required |
@@ -55,8 +61,8 @@ integration. Consumer acceptance is reported separately from upstream determinis
 | **T03** | Artifact reuse across operational configuration changes | Shipped in 0.4.0 | Built-in Codex user artifacts share five operational changes; custom providers remain conservative; exact legacy recovery without model calls |
 | **T04** | Actionable, privacy-safe timeout diagnostics | Shipped in 0.4.0 | Safe source IDs, settled counts, failure classification and T02/T03 recovery; no extraction/cache identity change |
 | **T05** | Early identity checks and validation progress/profiling | **Cold fix shipped in 0.3.0; T05a in 0.5.0; engineering closeout evaluated in ADR 027** | Cold/repeat/edits, worker, reuse, incremental and Rust evaluated; retain full direct validation; private consumer acceptance required |
-| **T06** | Packaged release-documentation consistency | **Implemented after 0.5.0; publication pending** | Generated current sections, checked actual tarballs, historical records preserved, fresh documented installation commands |
-| **T07** | Coverage-aware traversal from SOT/roadmap entry points | **T07a merged; T07b merged with local/hosted checks and review passed; T07c merged with local/hosted checks passed** | Committed closure, source roles/ownership, validation separation and draft invalidation implemented; npm publication pending |
+| **T06** | Packaged release-documentation consistency | **Shipped in 0.6.0** | Generated current sections, checked actual tarballs, historical records preserved, fresh documented installation commands |
+| **T07** | Coverage-aware traversal from SOT/roadmap entry points | **All three increments shipped in 0.6.0; consumer acceptance pending** | Committed closure, source roles/ownership, validation separation and draft invalidation implemented and published |
 
 T02 and the focused T05 fix shipped in 0.3.0; T03, T04 and T08 shipped in
 [0.4.0](https://github.com/jchewitt/weftlet/releases/tag/%40weftlet/toolkit%400.4.0), following
@@ -64,7 +70,7 @@ local/hosted checks, independent archive review and fresh packed/public-registry
 T09 timeout support and T05a identity preflight/phase timing shipped in
 [0.5.0](https://github.com/jchewitt/weftlet/releases/tag/%40weftlet/toolkit%400.5.0).
 Source, registry integrity, provenance and release tags are recorded in [validation](VALIDATION.md).
-T05 closeout measurements and decisions are recorded in ADR 027; T06 and T07 are implemented for the next candidate.
+T05 closeout measurements and decisions are recorded in ADR 027; T06 and T07 shipped in the 0.6.0 candidate.
 The consumer must migrate its framework adapter to the public core factory, then complete full
 hydration and repeat reuse; upstream fixtures do not establish that result.
 
@@ -97,8 +103,8 @@ avoiding forced re-extraction. Follow [provider limits and reuse](PROVIDERS.md#l
 Boundary, provider propagation, cancellation, cache reuse and packed/public-registry consumer checks passed;
 release evidence is in [validation](VALIDATION.md). The consumer's approved ten-minute retry
 has **not run**. No ten-minute wall-clock execution, paid/model call or private acceptance is
-claimed by these deterministic upstream checks. T06/T07 are now implemented with publication
-pending; T05 engineering evaluation is recorded separately in ADR 027.
+claimed by these deterministic upstream checks. T06/T07 shipped in 0.6.0;
+T05 engineering evaluation is recorded separately in ADR 027.
 
 ## T08 — Resolve deterministic physical-file kind conflicts
 
@@ -330,12 +336,12 @@ Consumer performance acceptance remains required; public fixtures do not silentl
 
 ## T06 — Keep packaged documentation consistent with the release
 
-Implemented after 0.5.0, with [ADR 022](ADR-022-release-documentation.md) defining the checked
+Shipped in 0.6.0, with [ADR 022](ADR-022-release-documentation.md) defining the checked
 scope. Changesets regenerates current-version sections in both READMEs and the release guide.
 The dependency-free checker verifies source instructions and both actual tarballs before
 publication; the fresh-consumer smoke exercises the checked pinned commands and archive pair
 with an isolated npm/npx cache. Historical records and feature-introduction versions stay intact.
-Source validation is recorded in [validation](VALIDATION.md); no new npm release is claimed here.
+Source and publication validation are recorded in [validation](VALIDATION.md).
 
 The original consumer installed 0.2.0 while its README still named 0.1.2 and some archive examples
 used 0.1.1. Release 0.2.1 removed README version pins. T06 adds automation and replaces the release
@@ -384,7 +390,7 @@ command. Entry points, document roots and read limits are operation arguments, w
 semantic budgets used only for comparison. No configuration/cache identity or hydration selection
 is changed. [PR 38](https://github.com/jchewitt/weftlet/pull/38) merged T07a with hosted Ubuntu
 and native Windows checks; exact source validation is recorded in [validation](VALIDATION.md).
-No npm publication is claimed by implementation status.
+All three increments are now published in 0.6.0; registry verification is recorded separately in [validation](VALIDATION.md).
 
 [ADR 025](ADR-025-document-classification.md) records T07b's shared classification contract
 and standalone deterministic document-evidence API. `documents plan --document-policy <json-file>`
@@ -418,6 +424,10 @@ Acceptance:
 
 ## Official 1.0 acceptance
 
+Also review the [A1–A3 assessment and B1–B6 task list](PRE-1.0-BASELINE.md), added after the
+0.6.0 candidate was published. The original list below remains necessary; a successful consumer
+hydration alone does not close the requested business-context and exploration improvements.
+
 With T01's upstream patch published, work through T02–T07 in bounded increments and record implementation
 PRs and validation evidence here or in the linked validation record. Review the exact 1.0 scope
 against completed evidence; any deferral needs an explicit maintainer decision and must remain

package/docs/RELEASING.md

@@ -202,14 +202,14 @@ Verify the matching public version in a fresh disposable project after publicati
 
 ```sh
 npm init -y
-npx --yes @weftlet/toolkit@0.6.0 init --yes
-npx --yes @weftlet/toolkit@0.6.0 config validate
+npx --yes @weftlet/toolkit@0.6.1 init --yes
+npx --yes @weftlet/toolkit@0.6.1 config validate
 ```
 
 For local installation, use both prepared archives from the same reviewed release:
 
 ```sh
-npm install --save-dev "/path/to/weftlet/.release/weftlet-core-0.6.0.tgz" "/path/to/weftlet/.release/weftlet-toolkit-0.6.0.tgz"
+npm install --save-dev "/path/to/weftlet/.release/weftlet-core-0.6.1.tgz" "/path/to/weftlet/.release/weftlet-toolkit-0.6.1.tgz"
 ```
 <!-- weftlet:release:end -->
 

package/docs/ROADMAP.md

@@ -1,11 +1,17 @@
 # Delivery roadmap
 
-Release checkpoint: 2026-10-27, after verified 0.5.0 publication.
+Release checkpoint: 2026-10-28, after verified 0.6.0 candidate publication.
 Evidence is recorded in [validation](VALIDATION.md); this roadmap is not a live registry status.
 
 Project: `jchewitt/weftlet`. Extraction provenance is recorded in the
 [source inventory](SOURCE-INVENTORY.md).
 
+The maintainer's subsequent [pre-1.0 business-context baseline](PRE-1.0-BASELINE.md) records
+three bounded public acceptance checks and the additional B1–B6 task list. Exact-node exploration,
+function-level intent bindings, cross-boundary obligations, monorepo coverage and a measured
+[Graphify/SCIP evaluation](GRAPHIFY-EVALUATION.md) are open before the official release decision.
+The published 0.6.0 candidate remains available for the separate private consumer report.
+
 T09 shipped in 0.5.0 with T05a work, accepting the consumer's approved
 `semantic.timeoutMs: 600000`. The default remains 120000 and retry/cancellation behavior is
 unchanged. The consumer's actual ten-minute retry has not run; upstream installation and
@@ -14,14 +20,14 @@ deterministic checks do not establish that outcome. See [provider limits and rec
 Forward direction is captured in the [Weftlet 2.0 product plan](WEFTLET-2.0-PLAN.md):
 consumer hardening, cited code-derived drafts, scoped approvals and reconciliation, an optional
 review website, source publication, managed AI and guided setup. “2.0” is a planning label;
-the verified release at this checkpoint is 0.5.0. The received consumer findings are tracked in the
+the verified release at this checkpoint is 0.6.0. The received consumer findings are tracked in the
 [consumer hardening and 1.0 task list](RELEASE-1.0-PLAN.md): the document-identity patch is
 published and passes upstream checks; genuine consumer acceptance remains pending. T02's
 no-model preview and T05's cold-validation improvement shipped in 0.3.0. T03 operational cache
 reuse, T04 timeout diagnostics and T08 deterministic physical-file consistency shipped in 0.4.0.
 T09 timeout support and T05a identity preflight/phase timing shipped in 0.5.0.
-T06 [release-documentation consistency](ADR-022-release-documentation.md) is implemented for the
-next release: generated current examples, actual archive checks and fresh documented installation.
+T06 [release-documentation consistency](ADR-022-release-documentation.md) shipped in 0.6.0:
+generated current examples, actual archive checks and fresh documented installation.
 T07a [prospective document coverage](ADR-023-document-coverage-preview.md) is implemented separately
 from hydration. It follows committed Markdown links and reports coverage/budget gaps without
 model calls or graph writes. T07b [document roles and ownership](ADR-025-document-classification.md)
@@ -32,16 +38,17 @@ approval. T07c [traversal hydration](ADR-026-traversal-hydration.md) connects th
 explicit configuration, a shared no-model plan, compatible artifact reuse and draft invalidation.
 Direct-mode configuration retains its existing behavior; validation sources are excluded from
 model work in traversal mode. T07c merged in PR 44 after local and hosted Ubuntu/Windows checks;
-exact evidence is in [validation](VALIDATION.md). npm publication remains pending.
-T10 [implementation coverage reporting](ADR-024-implementation-coverage.md) is merged for the next
-release: actual code relationships can count as both contract and implementation evidence while
+exact evidence is in [validation](VALIDATION.md). All three T07 increments shipped in 0.6.0.
+T10 [implementation coverage reporting](ADR-024-implementation-coverage.md) shipped in 0.6.0:
+actual code relationships can count as both contract and implementation evidence while
 display groups remain stable. Existing snapshots benefit without hydration; gaps are page-scoped.
 T05 [performance/validation closeout](ADR-027-validation-closeout.md) records the remaining
 engineering evaluations: cold/repeat/changed inputs, worker isolation, exact-result reuse,
 incremental dependencies and a bounded Rust comparison. Retain full direct validation; no worker,
-cache, incremental or native runtime capability is claimed. Complete source/release checks, publish
-a reviewed minor candidate, validate it in TradePilot, then review official 1.0. The candidate and consumer/final release gates remain
-separate acceptance work; the 2.0 plan remains a separate future direction.
+cache, incremental or native runtime capability is claimed. The original T01–T10 engineering
+work is complete and the reviewed 0.6.0 candidate is published. Validate it in TradePilot and
+address acceptance blockers alongside the newly requested B1–B6 baseline work before reviewing
+official 1.0. The 2.0 platform plan remains a separate future direction.
 
 The maintainer reported SHACL pushing generation past a 30-minute timeout before graph
 publication. T02 and the focused T05 optimization shipped together in 0.3.0 through
@@ -73,7 +80,7 @@ snapshots retain their full configuration identity. Exact legacy reads and expli
 adoption preserve prior artifacts; custom providers remain conservative.
 [T04 diagnostics](ADR-019-semantic-failure-diagnostics.md) shipped in the same release, adding
 safe failure reports, opaque source mapping and settled progress without changing extraction/cache
-identity. T05 engineering evaluation is recorded; T06 and T07 implementation are pending candidate publication.
+identity. T05 engineering evaluation is recorded; T06 and T07 shipped in the 0.6.0 candidate.
 
 [T08 physical-file kind consistency](ADR-020-canonical-physical-file-producers.md) also shipped in
 0.4.0 after local/hosted Ubuntu/Windows checks, independent archive review and fresh packed and

package/docs/VALIDATION.md

@@ -8,6 +8,84 @@ The milestone entries below record the original cloud checks. Subsequent
 establishes live Codex success on Windows and the full deterministic checks on WSL,
 while identifying remaining native Windows issues.
 
+## Physical artifact filename fix, 2026-10-28
+
+The consumer requested bounded physical artifact/temp names while retaining logical snapshot
+identity and provenance. [ADR 028](ADR-028-bounded-artifact-paths.md) records the fix and migration
+boundary. The public traversal → unchanged repeat → clean-comparison regression reproduced an
+overlong SCIP staging basename before the change and passes locally after it. Physical names are
+bounded; full IDs, cited facts, cache keys and content digests remain unchanged. Legacy saved files
+remain readable and immutable. The same traversal test and added storage cases run in native
+Windows CI. Local release checks passed: build, 698 deterministic tests (17 core + 681 toolkit;
+one optional OML integration skipped), architecture with 14 advisory findings, inventory,
+licenses and fresh packed-consumer smoke. Hosted outcomes and patch publication are pending
+at this source revision.
+
+This is a focused consumer blocker ahead of [B1–B6](PRE-1.0-BASELINE.md). No private consumer
+rerun, paid/model work or live optional OML compilation is claimed.
+
+## Business-context baseline assessment, 2026-10-28
+
+The maintainer requested checks for business relationships across asynchronous/stored-data
+boundaries, progressive agent exploration and multiple service/client projects in a monorepo.
+[The assessment and new task list](PRE-1.0-BASELINE.md) explicitly extend the original T01–T10
+scope; the historical completion statements below concern that original list.
+
+Against unchanged runtime at `9b4acffe1c4d35f9fd2f91132c576f8934658677`, 24 existing focused
+tests and three new public acceptance tests pass on Linux, Node 24.19.0 / pnpm 10.18.2.
+[Recorded results](assessments/pre-1.0-2026-10-28.json) identify test files, cases, source hashes
+and commands. The new fixture uses real Git, SCIP, semantic-provider plumbing, RDF/SHACL and
+the application/MCP facade. Its small deterministic prose parser is not a live model.
+
+The control already reads the two disconnected services' documents. Adding only a documented
+stored-data handoff makes downstream implementations and tests reachable while retaining both
+freshness rules and excluding a same-label unrelated domain. One changed document is extracted,
+four are reused; the next repeat reuses all five with unchanged identity/content. Small result
+pages exhaust to the larger scan exactly; focused follow-up works and depth truncation stays
+explicit. Workspace aliases resolve a shared re-exported contract across API and TSX files.
+
+These are mechanism passes. They do not establish actual broker/database delivery, automatic
+rule compatibility or function binding, autonomous-agent usefulness, Expo/service builds, live
+semantic quality or private TradePilot acceptance. Exact-node exploration remains open.
+Graphify source/document review is pinned in [the evaluation note](GRAPHIFY-EVALUATION.md);
+no comparative benchmark, new runtime dependency or backend replacement is claimed.
+
+## Published 0.6.0 acceptance candidate, 2026-10-28
+
+Both `@weftlet/core@0.6.0` and `@weftlet/toolkit@0.6.0` are published and were verified as
+the registry `latest` versions. [Release PR 36](https://github.com/jchewitt/weftlet/pull/36)
+merged at `b4c808b9221c5c82f9f7326a310e966d1fee2888`; package versions were committed to main
+before publication. [Release run 40742010093](https://github.com/jchewitt/weftlet/actions/runs/40742010093)
+completed preparation, both trusted npm uploads and GitHub release records on its first attempt.
+No npm token was supplied to this cloud. Public provenance statements and both package-specific
+Git tags identify that exact source commit; both GitHub Releases exist.
+
+The version PR's exact head `944b66a7ac9d119b650b7341dc982e12ea45a75b` passed
+[hosted Ubuntu and Windows checks](https://github.com/jchewitt/weftlet/actions/runs/40715307427).
+Frozen local installation/build, package preparation and dry runs passed before merging. Reviewed
+exports contain 13 files in core and 252 in toolkit, including applicable license notices and no
+source history, credentials, caches or native benchmark binary. All 79 original source path/hash
+pairs remain intact. Downloaded public npm archives match the reviewed local archives and the
+workflow's prepared archives byte for byte:
+
+| Package | Verified SHA-512 integrity |
+| --- | --- |
+| `@weftlet/core@0.6.0` | `sha512-2o2WO4DyhudgcsGQ//j0mXfXBvyqBHoYPnI52ZiqZSr5qqjCayw7njsRqCxOEIL6dseUYoICsnlkSYrRSDHKKw==` |
+| `@weftlet/toolkit@0.6.0` | `sha512-d7Q9gNdpwWUdkJLhGtY6xpi+gfg3CsLM5BqJqmVH9xgNwtc5e5kDpTwMSv4jq/+gybiXbQOOSsI7x7c+m1W1xA==` |
+
+A fresh public-registry consumer on Linux / Node 24.19.0 installed both exact versions, ran the
+documented npx initialization and config validation, imported public APIs, checked canonical file
+nodes, lossless RDF projection, SPARQL and positive/negative strict SHACL, and initialized MCP.
+`impact.scan` discovery and honest missing-snapshot reporting passed without model calls. This
+registry smoke is separate from the release gate's full deterministic/packed-consumer checks;
+neither is a private TradePilot hydration, live model-quality evaluation or browser interaction.
+
+T06, T07 and T10 are now available in the published candidate, alongside the T05 evaluation and
+earlier fixes. The planned 1.0 engineering work is complete. TradePilot should use these published
+versions for the [consumer acceptance checklist](RELEASE-1.0-PLAN.md#official-10-acceptance);
+official 1.0 remains conditional on that acceptance and any resulting blocker fixes. Previously
+tentative browser/live-auth work remains explicitly separate. No 1.0 release is claimed.
+
 ## T05 validation closeout, 2026-10-28
 
 [ADR 027](ADR-027-validation-closeout.md) records the engineering decision to retain full direct

package/docs/assessments/pre-1.0-2026-10-28.json

@@ -0,0 +1,200 @@
+{
+  "schemaVersion": 1,
+  "date": "2026-10-28",
+  "runtimeSourceCommit": "9b4acffe1c4d35f9fd2f91132c576f8934658677",
+  "releaseSourceCommit": "b4c808b9221c5c82f9f7326a310e966d1fee2888",
+  "packageVersions": {
+    "@weftlet/core": "0.6.0",
+    "@weftlet/toolkit": "0.6.0"
+  },
+  "environment": {
+    "os": "Linux",
+    "node": "24.19.0",
+    "pnpm": "10.18.2"
+  },
+  "fixtureProvider": {
+    "path": "tests/fixtures/business-context-provider.mjs",
+    "sha256": "4261c3261ca2959c89bdec73eda0f6aa5c40ffcb75db4aa64442f67534d8b2f7",
+    "mode": "deterministic public prose grammar; no model requests"
+  },
+  "boundaries": [
+    "New test files use unchanged runtime from the recorded source commit.",
+    "Real Git and TypeScript SCIP; actual application hydration, RDF/SHACL and MCP facade.",
+    "No live provider, actual broker/database execution, service build or private consumer acceptance.",
+    "No automatic business compatibility verdict or exact-function binding established.",
+    "No autonomous agent trial or new MCP transport exercise.",
+    "Graphify source review is separate; no comparative execution."
+  ],
+  "runs": [
+    {
+      "name": "existing-regressions",
+      "command": "pnpm exec vitest run tests/rdf.test.ts tests/routing.test.ts src/extraction/routing.test.ts src/extraction/scip-project.test.ts src/graph/query.test.ts",
+      "success": true,
+      "passed": 24,
+      "failed": 0,
+      "pending": 0,
+      "suites": [
+        {
+          "path": "tests/rdf.test.ts",
+          "sha256": "2b0f0fd6314ac28d4c64422d5650d56b540c9d391adab5eac0d24ed06a592397",
+          "status": "passed",
+          "cases": [
+            {
+              "name": "unified evidence graph extracts public prose and real TypeScript across queue boundaries, with SPARQL/projection equivalence",
+              "status": "passed"
+            }
+          ]
+        },
+        {
+          "path": "tests/routing.test.ts",
+          "sha256": "bac6081701ada81f422e1b7641a212a3f51b0c44a94bc88deb93d610b4a65c34",
+          "status": "passed",
+          "cases": [
+            {
+              "name": "committed routing declarations in independent repositories links a typed upstream change across an explicit boundary without shared-channel cross products",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations in independent repositories replaces routing edges for source renames/deletions and routing-manifest edits/deletions in drafts",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations in independent repositories preserves the last valid saved graph when a committed routing manifest is malformed or absent",
+              "status": "passed"
+            }
+          ]
+        },
+        {
+          "path": "src/extraction/routing.test.ts",
+          "sha256": "7b72aefa770bd217435220fa85bf21d5297e01cbf5e23d3765aed549b9300681",
+          "status": "passed",
+          "cases": [
+            {
+              "name": "committed routing declarations joins document, test and production endpoints with actual neutral file and document facts",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations extracts exact cited bindings with inferred authority while ignoring dirty declarations",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations keeps binding, scope, case and repository identities separate despite equal channel labels",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations suppresses every duplicate scoped binding across files, including identical duplicates",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations does not guess case, extensions or directories, and suppresses the complete missing-endpoint pair",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations reads Unicode and spaced paths exactly from a nested repository root despite Git quoting",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations accepts executable blobs but rejects committed symlink modes without creating host symlinks",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations invalidates deleted or renamed endpoints until the mapping is updated, leaving historical results intact",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations fails closed on missing source files except explicit draft deletion diagnostics",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations rejects malformed, ambiguous and unsupported schemas or path forms",
+              "status": "passed"
+            },
+            {
+              "name": "committed routing declarations enforces file-count, combined declaration-count and source-byte bounds",
+              "status": "passed"
+            }
+          ]
+        },
+        {
+          "path": "src/extraction/scip-project.test.ts",
+          "sha256": "8a92ffd963ca5818c102aec3487ea21405d75bbaf593b13e2256b6f5a1914b23",
+          "status": "passed",
+          "cases": [
+            {
+              "name": "links committed workspace contracts and excluded tests through real SCIP, preserving dirty bytes and rename/delete boundaries",
+              "status": "passed"
+            },
+            {
+              "name": "fails before indexing on absent aliases, empty/oversized scopes and reserved generated paths",
+              "status": "passed"
+            }
+          ]
+        },
+        {
+          "path": "src/graph/query.test.ts",
+          "sha256": "7b6653f767c2e7445ec19f0cafc9d3fe97494ae139835ec63d335a7210e62c6c",
+          "status": "passed",
+          "cases": [
+            {
+              "name": "impact scan facade rejects snapshot traversal before the service can read outside snapshot storage",
+              "status": "passed"
+            },
+            {
+              "name": "impact scan facade returns the same bounded Context Pack through the application service used by CLI and MCP",
+              "status": "passed"
+            },
+            {
+              "name": "impact scan facade keeps skill command names aligned with the MCP facade and generic template",
+              "status": "passed"
+            },
+            {
+              "name": "impact scan facade expands changed code files through symbols without traversing the project hub",
+              "status": "passed"
+            },
+            {
+              "name": "impact scan facade returns the broader Fulfillment policy, PM, execution, worker, and validation purpose chain",
+              "status": "passed"
+            },
+            {
+              "name": "impact scan facade uses the owner document as the traversal anchor and task terms to rank connected context",
+              "status": "passed"
+            },
+            {
+              "name": "impact scan facade shows observed runtime behavior beside declared intent and flags unmapped observations",
+              "status": "passed"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "business-context-acceptance",
+      "command": "pnpm exec vitest run tests/business-context-acceptance.test.ts",
+      "success": true,
+      "passed": 3,
+      "failed": 0,
+      "pending": 0,
+      "suites": [
+        {
+          "path": "tests/business-context-acceptance.test.ts",
+          "sha256": "c5e196db080cc798dc3abb21fb2cdb4ac3ecb07b4307cc3aa6764f04f60bb9cb",
+          "status": "passed",
+          "cases": [
+            {
+              "name": "public business-context acceptance boundaries bridges isolated service code only after the stored-data handoff is documented, retaining both rules and authority",
+              "status": "passed"
+            },
+            {
+              "name": "public business-context acceptance boundaries supports bounded MCP-facade pagination and focused follow-up without hiding depth exhaustion",
+              "status": "passed"
+            },
+            {
+              "name": "public business-context acceptance boundaries resolves shared contracts across separate workspace packages and TSX, with source and repeat identity intact",
+              "status": "passed"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/docs/extraction-manifest.json

@@ -108,7 +108,7 @@
       "destinationPath": "package.json",
       "sourceSha256": "a575dbb2fed8c554b95e8e9b3e03a0c21cab1be7249860bbebc18e046b2ff78d",
       "modified": true,
-      "destinationSha256": "f7da7073324381a463ddef7bbe1bbffa7f8ff3426b8738420cd41596d0f48332"
+      "destinationSha256": "86942a3aa4159f35199b68ebda97fb6998cd42491f724c6cfcf6ac3121ea243a"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/LICENSE",
@@ -129,7 +129,7 @@
       "destinationPath": "packages/core/README.md",
       "sourceSha256": "6044bf7b9a3dc793f41e2ff048546ed11938957d10a5b143eb1739ac4cd7477c",
       "modified": true,
-      "destinationSha256": "93afe33e737bc8f1d01d53361f6f4ef4b2856be6c2e977f3c3a494bedd2229bf"
+      "destinationSha256": "2fc3c2eedee047c100d9ea6b9b185ca9da18909549016e23a1f5359c458beb72"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/THIRD_PARTY_NOTICES.md",
@@ -143,7 +143,7 @@
       "destinationPath": "packages/core/package.json",
       "sourceSha256": "2a29066eb8452f22fafcb06bb035a84dda93c5705dba32aba600a1b7e5aaf19c",
       "modified": true,
-      "destinationSha256": "b8fe4bb56bdce5da3c5b09c281c185c836a17be941fa406482b2835d83c77467"
+      "destinationSha256": "030ba1501e8a94449494dfd28a3ee04333d3410a7437f681a6d1ebf698d0c63e"
     },
     {
       "sourcePath": "tools/context-graph/packages/core/src/core.ts",
@@ -367,7 +367,7 @@
       "destinationPath": "src/extraction/ontology.ts",
       "sourceSha256": "800fd0a0f8d7e43dcc598a168640563e26919fa2f1fcc871f0a842510b78f319",
       "modified": true,
-      "destinationSha256": "912041a3148f7bbc005218c4b70d331406b656d4e751555b32fa4fb04b859bdd"
+      "destinationSha256": "4e52ee6a41192ae60f98ada522f27668115e145525c7afb6ec373b034c902f24"
     },
     {
       "sourcePath": "tools/context-graph/src/portable-fixture.test.ts",
@@ -479,14 +479,14 @@
       "destinationPath": "src/extraction/static.ts",
       "sourceSha256": "f8dcff3e10361314c06911dc7cec1e2cb0f8d9af68a6c61a30b2a741c5c3a385",
       "modified": true,
-      "destinationSha256": "99147784d567ff9ccf2619a5452824fb13dc7b8061fc269c1fc90b36cdd96851"
+      "destinationSha256": "93dac6495ebe45baec5022aabf5c8515b1af3e6e64ec9e1be752220765662e7f"
     },
     {
       "sourcePath": "tools/context-graph/src/storage.ts",
       "destinationPath": "src/storage/storage.ts",
       "sourceSha256": "9e38af8e34dc84ccaed5322b37b485e60706c68542271926228fb6d4af3d1f71",
       "modified": true,
-      "destinationSha256": "48a4eabe1954f612b1d27f2ac56cb63ae064b0b957570c25c349154adfc2d34d"
+      "destinationSha256": "82945a91cc1e02970225e7f9247ee1e3526754462d0f29607a6543c9f07f1619"
     },
     {
       "sourcePath": "tools/context-graph/src/telemetry.test.ts",
@@ -620,11 +620,14 @@
     "docs/ADR-025-document-classification.md",
     "docs/ADR-026-traversal-hydration.md",
     "docs/ADR-027-validation-closeout.md",
+    "docs/ADR-028-bounded-artifact-paths.md",
     "docs/CLOUD-ENVIRONMENT.md",
     "docs/CONSUMER-TRIAL.md",
     "docs/ENVIRONMENT-VALIDATION.md",
+    "docs/GRAPHIFY-EVALUATION.md",
     "docs/IMPACT-EVALUATION.md",
     "docs/MIGRATING-TO-WEFTLET.md",
+    "docs/PRE-1.0-BASELINE.md",
     "docs/PROVIDERS.md",
     "docs/RELEASE-1.0-PLAN.md",
     "docs/RELEASING.md",
@@ -635,6 +638,7 @@
     "docs/WEFTLET-2.0-PLAN.md",
     "docs/architecture-baseline.json",
     "docs/architecture-policy.md",
+    "docs/assessments/pre-1.0-2026-10-28.json",
     "docs/benchmarks/validation-2026-10-28/README.md",
     "docs/benchmarks/validation-2026-10-28/large.json",
     "docs/benchmarks/validation-2026-10-28/lifecycle.json",
@@ -826,6 +830,7 @@
     "src/graph/rdf.ts",
     "src/graph/shacl-shapes.ts",
     "src/graph/validation-progress.ts",
+    "src/infrastructure/artifact-paths.ts",
     "src/infrastructure/module-resolution.ts",
     "src/interfaces/cache-adoption.test.ts",
     "src/interfaces/doctor.ts",
@@ -841,16 +846,19 @@
     "src/repository/git-entries.test.ts",
     "src/repository/working-content.test.ts",
     "src/repository/working-content.ts",
+    "src/storage/artifact-paths.test.ts",
     "src/storage/atomic-rename.test.ts",
     "src/storage/atomic-rename.ts",
     "src/telemetry.ts",
     "src/visualization/viewer-interaction.ts",
     "tests/architecture.test.ts",
+    "tests/business-context-acceptance.test.ts",
     "tests/cache-adoption.test.ts",
     "tests/document-coverage.test.ts",
     "tests/document-evidence.test.ts",
     "tests/document-source-rdf.test.ts",
     "tests/extractor-compatibility.test.ts",
+    "tests/fixtures/business-context-provider.mjs",
     "tests/fixtures/shacl.ts",
     "tests/fixtures/traversal.ts",
     "tests/hydration-failure.test.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weftlet/toolkit",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Evidence-backed context graphs for AI development agents: product intent, contracts, code, tests and runtime behavior",
   "license": "Apache-2.0",
   "type": "module",
@@ -63,7 +63,7 @@
     "n3": "2.7.2",
     "rdf-validate-shacl": "0.6.5",
     "sparqljs": "3.7.4",
-    "@weftlet/core": "^0.6.0"
+    "@weftlet/core": "^0.6.1"
   },
   "devDependencies": {
     "@changesets/cli": "3.0.3",