weavatrix 0.2.13 → 0.2.14

package/docs/releases/v0.2.13.md

@@ -1,48 +0,0 @@
-# Weavatrix 0.2.13
-
-## Runtime-integrity and cross-language verification patch
-
-0.2.13 closes two failures found by dogfooding the live MCP on real JavaScript and Python
-applications. A live client could keep an older tool/schema snapshot after the checkout had advanced,
-and `verified_change` treated the absence of a Node manifest as a blocker even when no package test
-was requested. Neither failure is converted into a cosmetic pass: incomplete architecture, coverage,
-API or test evidence still produces `UNKNOWN` where appropriate.
-
-### Cross-language `verified_change`
-
-- An empty test request returns `NOT_REQUESTED` before looking for `package.json`.
-- Requested package tests with `run_tests:false` return `DISABLED` without pretending that they ran
-  or blocking a Python/Go/Java/Rust repository for lacking an npm manifest.
-- Actual execution still requires both `run_tests:true` and `WEAVATRIX_ALLOW_TEST_RUNS=1`, accepts
-  only existing test/check/verify package scripts and rejects shell-sensitive arguments.
-- Regression coverage exercises both plan and verify phases against a Python-only repository.
-
-### Packed-runtime and live-tool integrity
-
-- Release verification runs the packed npm artifact and portable MCPB stage as real stdio servers.
-- The smoke gate asserts 34 tools for the offline profile and all 38 for `hosted` / `full`, including
-  `trace_endpoint`, `trace_api_contract` and the local-only `preview_sync` approval step.
-- `graph_stats` and initialization diagnostics identify the running package version, enabled
-  capabilities and registered tool count. This separates an old client connection from a deliberately
-  restricted profile.
-- Existing security boundaries are unchanged: `offline` remains the no-HTTP default; `online` stays
-  a compatibility alias for `advisories,hosted`; `crossrepo` is not silently added to a custom list;
-  and no network tool is made available by default.
-
-MCP clients commonly snapshot `tools/list` for one connection. After upgrading, reconnect or start a
-new task. Expected counts are 31 (`pinned`), 34 (`offline`), 35 (`osv`) and 38 (`hosted` / `full`).
-
-### Skill and architecture workflow
-
-The bundled skill now covers non-HTTP entrypoints (CLI, worker, queue, cron and events), explains how
-to review and save a local starter contract, establish an explicit ratchet baseline, apply a reviewed
-exception, and classify generated/test/resource trees through `.weavatrix.json`. It also labels
-`shortest_path` as undirected connectivity rather than directional call proof, uses the correct
-`change_impact base` parameter, and avoids redundant symbol-context calls.
-
-## Compatibility
-
-- The 38 tool names, input schemas and `weavatrix.tool.v1` result envelope remain compatible.
-- Hosted sync payload v2/v3, confirmation-token consent and architecture-contract transport are
-  unchanged; no hosted application change is required.
-- The public MIT license and local-first network boundary are unchanged.