@weftlet/toolkit 0.6.1 → 0.7.1

package/docs/PRE-1.0-BASELINE.md

@@ -6,6 +6,18 @@ automatic rule-to-function discovery or complete agent exploration. The candidat
 available for TradePilot acceptance while the work below is assessed. No new release is
 announced by this plan.
 
+Consumer update: the physical artifact filename blocker shipped in **0.6.1**, with native
+Windows traversal → unchanged repeat → clean comparison passing. Use 0.6.1 for the private
+rerun; [validation](VALIDATION.md) records the public release evidence. This storage fix does
+not close any of B1–B6 below. Resume B1 and the bounded B2 evaluation after the blocker release.
+
+The maintainer now considers this the main reported consumer blocker and requests the next live
+TradePilot test after a new candidate. [The implementation queue](1.0-WORK-QUEUE.md) breaks B1–B6
+into bounded increments; B1a exact-node neighborhoods and B1b bounded paths are implemented for the next candidate.
+B2a's public comparison protocol is frozen; B2b's measured decision retains SCIP and improves its
+projection ([ADR 031](ADR-031-code-extractor-selection.md)). This schedules acceptance;
+it does not claim an additional private run or a full product-usefulness pass.
+
 The product goal is to let an agent starting with a task or code change retrieve the relevant
 product obligations, understand their connections across domains and asynchronous service
 boundaries, and inspect the implementations, contracts and evidence behind those connections.
@@ -61,10 +73,10 @@ blockers take priority when its report arrives. Do not modify or audit its appli
 | --- | --- | --- |
 | **B1** | **Exact graph exploration.** Specify and add bounded node lookup/neighbor expansion and dependency-path exploration through MCP and the shared query layer. | An agent can start from a returned stable node ID, select relation/direction and inspect another business area. Return citations, authority, snapshot identity, incomplete scope, pagination and remaining frontier. Test branches, cycles, ambiguous labels, deleted nodes and stale/mismatched continuations. Keep CLI/MCP/viewer on the same facts; preserve existing `impact.scan`. |
 | **B2** | **Evaluate Graphify and current SCIP representation.** Run the fixed public comparison in [the research note](GRAPHIFY-EVALUATION.md) before choosing a code extraction backend or symbol schema. | Compare the current projection, richer use of raw SCIP and pinned Graphify on identical committed inputs. Measure correct/missing/false links, provenance, identity stability, costs and packaging. Produce a keep/improve/replace decision with evidence. Parallel use during evaluation does not mandate shipping two indexers. |
-| **B3** | **Resolve business-to-implementation links at symbol/function level.** After B2, define canonical scoped code identities and resolve explicit document paths/symbol references to exact code entities. Evaluate a separate bounded inference pass only where explicit evidence is insufficient. | Named functions, methods, aliases, overloads, same-name symbols and renamed/deleted targets resolve correctly or remain unresolved. Separate a cited declared mapping, a proposed inferred mapping and evidence of actual behavior. Record both document and code revisions/spans for derived links. A reviewer can follow a rule to its implementation and back. Code inference never supplies approval; full automatic documentation generation remains 2.0. |
+| **B3** | **Resolve business-to-implementation links at symbol/function level.** After B2, define canonical scoped code identities, retain same-file occurrences and resolve explicit document paths/symbol references to exact code entities. Add bounded static call analysis as a separate increment; evaluate a separate bounded inference pass only where explicit mapping evidence is insufficient. | Named functions, methods, aliases, overloads, same-name symbols and renamed/deleted targets resolve correctly or remain unresolved. Meet the same-file acceptance boundary below. Separate a cited declared mapping, a proposed inferred mapping and evidence of actual behavior. Record both document and code revisions/spans for derived links. A reviewer can follow a rule to its implementation and back. Code inference never supplies approval; full automatic documentation generation remains 2.0. |
 | **B4** | **Cross-boundary obligations.** Represent and retrieve producer guarantees and consumer requirements through explicit data/event contracts, including applicable stage, domain, units, freshness and version where sources provide them. | Public cases cover a queue handoff, a write/read handoff, compatible differing limits with revalidation, a real documented incompatibility, missing links and same-name unrelated domains. Retrieve both sides and the implementation evidence. Potential model findings remain uncertain; hard failures require explicit approved deterministic rules. A graph link or SHACL pass is not a compatibility verdict. General reconciliation/approval UI remains 2.0. |
 | **B5** | **Monorepo selection and coverage.** Assess diagnostics for selected services, client, shared packages, source aliases and excluded/unresolved code; improve the gaps found. | A configured multi-package TypeScript/TSX fixture and the consumer report identify which projects were selected, indexed and actually connected. Test barrel exports, independent service code, external unresolved dependencies and omitted projects. Missing resolution cannot be reported as zero impact or complete coverage. Cross-repository federation is a separate scope decision. |
-| **B6** | **End-to-end product acceptance and release decision.** Combine the public evidence, B1–B5 decisions and TradePilot's actual 0.6.0 report; ship bounded candidate changes as needed. | Predeclare tasks, correct downstream business obligations/implementations, known unrelated matches and query budgets before measuring. Retain actual requests, follow-up decisions and citations. Assess helpfulness and misses separately from hydration success. Complete full hydration/repeat and supported release checks; review any remaining limitations before a versioned 1.0 publication. |
+| **B6** | **End-to-end product acceptance and release decision.** Combine the public evidence, B1–B5 decisions and TradePilot's next candidate report; ship bounded candidate changes as needed. | Predeclare tasks, correct downstream business obligations/implementations, known unrelated matches and query budgets before measuring. Retain actual requests, follow-up decisions and citations. Assess helpfulness and misses separately from hydration success. Complete full hydration/repeat and supported release checks; review any remaining limitations before a versioned 1.0 publication. |
 
 Order: retain this A1–A3 baseline; triage incoming consumer blockers; specify B1 and run the
 bounded B2 comparison; use that decision for B3; implement B4/B5 in independently testable
@@ -72,6 +84,41 @@ increments; close B6. Each implementation can ship in a minor candidate before 1
 retrieval semantics, extraction/cache identity or snapshot compatibility need explicit decisions
 and regression evidence; no silent migration or history rewrite.
 
+## Same-file exploration acceptance
+
+The maintainer explicitly identified large files with many internal calls as a 1.0 concern after
+the B2 comparison. Retain SCIP and address this gap without waiting for an application rewrite.
+The following requirements extend B3; they do not change the frozen B2 cases or scores and are
+not implementation or private consumer validation results.
+
+1. Preserve local/private functions, methods, same-file references and multiple occurrences of
+   the same reference. Return exact source spans and enclosing callable where established;
+   file membership alone must not imply a call or make every function relevant.
+2. In a separately testable call-analysis increment, distinguish a statically resolved direct
+   call from a type use, passing a function as a value, or registering a callback. Retain caller,
+   callee, callsite, resolution basis and uncertainty. A static edge does not prove runtime
+   execution; unresolved dispatch/callback targets remain explicit.
+3. Starting with one exact function, let an agent retrieve incoming references/callers and
+   outgoing references/callees, follow a helper chain and inspect applicable documented rules
+   through the shared bounded API/MCP queries. Preserve direction, citations, authority, scope
+   and continuation. Avoid requiring the entire containing file as the initial context response.
+4. Use an independently authored public fixture of roughly 3,000 lines with meaningful internal
+   helper chains, unrelated methods, private/local functions, recursion, shadowed names and
+   repeated callsites. Include a cross-file caller and a similar-looking implementation with a
+   distinct identity. Predeclare expected retrievals and query budgets before measuring; verify
+   extraction and actual agent-facing query results rather than hand-assembled edges. Record
+   bounded response size and misses. File length is a workload characteristic, not an
+   architectural violation or proof of modularity.
+5. Check edits, line shifts, rename/delete, dirty overlays, historical evidence, strict RDF/SHACL
+   and shared-query parity. Preserve explicit rule-binding authority. Similar code or names do
+   not establish equivalent business behavior or justify merging identities; existing duplication
+   signals still require semantic review. Duplicate-behavior detection is not added by this task.
+
+Implement richer entities/occurrences first, then explicit document bindings and the separate
+call-analysis increment. Select the call producer using focused evidence; this does not select
+Graphify as a dependency or promise complete call/data-flow analysis. Agent usefulness still
+needs B6's live consumer evaluation after the candidate is published.
+
 ## Consumer report to reconcile when available
 
 Retain the private configuration, documents, snapshots and transcripts with TradePilot. Share

package/docs/RELEASE-1.0-PLAN.md

@@ -4,8 +4,14 @@ Status: original T01–T10 engineering work complete; 0.6.0 candidate publicatio
 The maintainer has requested additional [business-context baseline work](PRE-1.0-BASELINE.md)
 before official 1.0: precise exploration, symbol-level implementation links, cross-boundary
 obligations, monorepo coverage and a measured Graphify/SCIP decision. Its A1–A3 public checks
-pass within recorded limits; B1–B6 remain open. Both npm packages remain available for
-TradePilot acceptance while this additional scope is assessed.
+pass within recorded limits; B1 query mechanisms are implemented for the next candidate, while
+B2's measured decision retains SCIP. B3a explicit bindings and B3b's deterministic gap assessment
+are complete; B3c static calls, B4a explicit obligations and B4b selected numeric comparison are
+implemented, along with B5's saved TypeScript/package coverage. Inference decisions and B6
+remain open. Both npm packages remain available for
+TradePilot acceptance while this additional scope is assessed. The maintainer requested the
+next live test after a new candidate; [the implementation queue](1.0-WORK-QUEUE.md) tracks
+the intervening B1–B6 work.
 **T08's upstream deterministic physical-file fix has shipped; the maintainer reports the consumer
 updated and working on 2026-10-27. Detailed full hydration/repeat evidence remains pending.** T04 was completed before
 the T08 fix as requested.
@@ -32,6 +38,12 @@ This is the near-term release task list. The [Weftlet 2.0 product plan](WEFTLET-
 remains a separate future direction for generation, approvals, a companion website and hosted
 AI. None of those platform features is a dependency of the fixes here.
 
+The subsequent consumer filename blocker shipped in **0.6.1** on 2026-10-28: bounded physical
+artifact/temp names, unchanged full logical identities/provenance, legacy reads and the requested
+Windows traversal → repeat → clean regression. Registry archives, provenance, tags and a fresh
+packaged CLI sequence are verified in [validation](VALIDATION.md). Use this patch for the next
+consumer rerun; B1–B6 and actual product acceptance remain open.
+
 ## Reported evidence and boundaries
 
 The consumer reported a cold extraction in which two source documents referred to the same

package/docs/RELEASING.md

@@ -202,14 +202,14 @@ Verify the matching public version in a fresh disposable project after publicati
 
 ```sh
 npm init -y
-npx --yes @weftlet/toolkit@0.6.1 init --yes
-npx --yes @weftlet/toolkit@0.6.1 config validate
+npx --yes @weftlet/toolkit@0.7.1 init --yes
+npx --yes @weftlet/toolkit@0.7.1 config validate
 ```
 
 For local installation, use both prepared archives from the same reviewed release:
 
 ```sh
-npm install --save-dev "/path/to/weftlet/.release/weftlet-core-0.6.1.tgz" "/path/to/weftlet/.release/weftlet-toolkit-0.6.1.tgz"
+npm install --save-dev "/path/to/weftlet/.release/weftlet-core-0.7.1.tgz" "/path/to/weftlet/.release/weftlet-toolkit-0.7.1.tgz"
 ```
 <!-- weftlet:release:end -->
 

package/docs/ROADMAP.md

@@ -1,16 +1,32 @@
 # Delivery roadmap
 
-Release checkpoint: 2026-10-28, after verified 0.6.0 candidate publication.
+Release checkpoint: 2026-10-28, after verified 0.6.1 consumer-blocker patch publication.
 Evidence is recorded in [validation](VALIDATION.md); this roadmap is not a live registry status.
 
 Project: `jchewitt/weftlet`. Extraction provenance is recorded in the
 [source inventory](SOURCE-INVENTORY.md).
 
 The maintainer's subsequent [pre-1.0 business-context baseline](PRE-1.0-BASELINE.md) records
-three bounded public acceptance checks and the additional B1–B6 task list. Exact-node exploration,
-function-level intent bindings, cross-boundary obligations, monorepo coverage and a measured
-[Graphify/SCIP evaluation](GRAPHIFY-EVALUATION.md) are open before the official release decision.
-The published 0.6.0 candidate remains available for the separate private consumer report.
+three bounded public acceptance checks and the additional B1–B6 task list. B1 exact neighborhoods
+and bounded paths are implemented for the next candidate. Explicit function-level intent bindings,
+cross-boundary numeric comparisons and saved TypeScript/package coverage are implemented.
+The inferred-mapping decision and candidate/live acceptance remain before the official release decision.
+The measured [Graphify/SCIP evaluation](GRAPHIFY-EVALUATION.md) selects a richer SCIP projection.
+The published 0.6.1 patch bounds physical artifact/temp names while retaining full logical
+identities, provenance and cache reuse. The requested Windows traversal → repeat → clean
+comparison regression passes. See [ADR 028](ADR-028-bounded-artifact-paths.md); the private
+consumer rerun is now scheduled after the next candidate. The [1.0 work queue](1.0-WORK-QUEUE.md)
+tracks the requested B1–B6 increments. B2a's public cases, pins, budgets and scoring rules are
+frozen and verified; B2b is measured with retained evidence and disclosed harness corrections.
+[ADR 032](ADR-032-scip-code-evidence.md) implements B3a's code entities and precise occurrences.
+Explicit document-to-symbol bindings are implemented in [ADR 033](ADR-033-document-symbol-bindings.md).
+[ADR 034](ADR-034-mapping-gaps.md) records the remaining mapping gaps and a bounded inference
+proposal; its evaluation/deferral decision remains open. [ADR 035](ADR-035-static-call-evidence.md)
+implements B3c's bounded static call evidence. [ADR 036](ADR-036-contract-obligation-declarations.md)
+adds B4a's explicitly cited producer/consumer declarations. [ADR 037](ADR-037-selected-contract-compatibility.md)
+adds B4b's advisory selected-constraint assessment and public acceptance. [ADR 038](ADR-038-monorepo-code-coverage.md)
+adds B5's saved source inventory, package/file pagination and shared coverage overview.
+The inference proposal decision remains before candidate qualification.
 
 T09 shipped in 0.5.0 with T05a work, accepting the consumer's approved
 `semantic.timeoutMs: 600000`. The default remains 120000 and retry/cancellation behavior is
@@ -20,7 +36,7 @@ deterministic checks do not establish that outcome. See [provider limits and rec
 Forward direction is captured in the [Weftlet 2.0 product plan](WEFTLET-2.0-PLAN.md):
 consumer hardening, cited code-derived drafts, scoped approvals and reconciliation, an optional
 review website, source publication, managed AI and guided setup. “2.0” is a planning label;
-the verified release at this checkpoint is 0.6.0. The received consumer findings are tracked in the
+the verified release at this checkpoint is 0.6.1. The received consumer findings are tracked in the
 [consumer hardening and 1.0 task list](RELEASE-1.0-PLAN.md): the document-identity patch is
 published and passes upstream checks; genuine consumer acceptance remains pending. T02's
 no-model preview and T05's cold-validation improvement shipped in 0.3.0. T03 operational cache
@@ -181,3 +197,8 @@ records are in [validation](VALIDATION.md). Changesets prepares reviewed version
 merging a release plan triggers publication and package-specific tags/GitHub Releases.
 See [ADR 009](ADR-009-release-automation.md) and [release instructions](RELEASING.md).
 Earlier Tently packages remain available and undeprecated.
+
+
+November 2: B3b bounded mapping proposals are implemented for review (ADR 039), with no-model
+planning and separately stored unreviewed results. Live public evaluation, candidate qualification
+and private consumer usefulness remain pending. No automatic inference or new release is enabled.