weavatrix 1.16.1 → 1.16.3

package/README.md

@@ -9,13 +9,18 @@
 
 **Give your coding agent repository evidence before it starts guessing.**
 
-Weavatrix is the native MCP product for repository intelligence. It gives
-Codex, Claude Code, and other coding agents 64 read-only operations over one
-revision-bound evidence graph: impact, architecture, APIs, Git history,
-duplicates, dead code, search, semantic links, temporal memory, exported
-n8n workflows, Dify YAML apps, Agent packages, Mermaid flowcharts, and
-Web3 ABI/consumer impact. Those parsers are domains on Weavatrix
-Core, not new MCP products. See
+Weavatrix answers the questions agents otherwise invent: what breaks if this
+file changes, who consumes this n8n field, whether an MCP schema still
+accepts yesterday’s request, which viem call sites follow an ABI layout
+change, and whether `.weavatrix/architecture.json` still holds. **64
+read-only operations**, one revision-bound graph, no LSP and no prompt pack.
+
+Codex, Claude Code, Cursor, and Grok get impact, architecture, APIs, Git
+history, duplicates, dead code, search, semantic links, temporal memory,
+exported n8n workflows (`n8n_*`), Dify YAML apps (`dify_*`), Agent
+Plugins/Skills/MCP catalogs (`agent_*`), Mermaid flowcharts (`diagram_*`),
+and Web3 ABI/consumer impact (`web3_*`). Those parsers are domains on
+Weavatrix Core, not new MCP products. See
 [n8n](https://weavatrix.com/n8n), [Dify](https://weavatrix.com/dify), and
 [parsers](https://weavatrix.com/parsers).
 
@@ -53,7 +58,7 @@ weavatrix mcp .
 ```toml
 [mcp_servers.weavatrix]
 command = "npx"
-args = ["-y", "weavatrix@1.16.1", "mcp", "."]
+args = ["-y", "weavatrix@1.16.3", "mcp", "."]
 ```
 
 Pass an absolute repository path when the Codex process cwd is not the project
@@ -62,7 +67,7 @@ you intend to analyze.
 ### Claude Code
 
 ```sh
-claude mcp add weavatrix -- npx -y weavatrix@1.16.1 mcp .
+claude mcp add weavatrix -- npx -y weavatrix@1.16.3 mcp .
 ```
 
 ### Cursor
@@ -75,7 +80,7 @@ the plugin for the same server name:
   "mcpServers": {
     "weavatrix": {
       "command": "npx",
-      "args": ["-y", "weavatrix@1.16.1", "mcp", "${workspaceFolder}"]
+      "args": ["-y", "weavatrix@1.16.3", "mcp", "${workspaceFolder}"]
     }
   }
 }
@@ -84,14 +89,14 @@ the plugin for the same server name:
 Profiles expose bounded views of the same engine:
 
 ```sh
-npx -y weavatrix@1.16.1 mcp . --profile=all
-npx -y weavatrix@1.16.1 mcp . --profile=code
-npx -y weavatrix@1.16.1 mcp . --profile=seo
-npx -y weavatrix@1.16.1 mcp . --profile=n8n
-npx -y weavatrix@1.16.1 mcp . --profile=dify
-npx -y weavatrix@1.16.1 mcp . --profile=agent
-npx -y weavatrix@1.16.1 mcp . --profile=diagram
-npx -y weavatrix@1.16.1 mcp . --profile=web3
+npx -y weavatrix@1.16.3 mcp . --profile=all
+npx -y weavatrix@1.16.3 mcp . --profile=code
+npx -y weavatrix@1.16.3 mcp . --profile=seo
+npx -y weavatrix@1.16.3 mcp . --profile=n8n
+npx -y weavatrix@1.16.3 mcp . --profile=dify
+npx -y weavatrix@1.16.3 mcp . --profile=agent
+npx -y weavatrix@1.16.3 mcp . --profile=diagram
+npx -y weavatrix@1.16.3 mcp . --profile=web3
 ```
 
 The package contains native binaries for Windows x64/arm64, macOS x64/arm64,
@@ -117,6 +122,17 @@ same, and a call that names its own `output_format` still wins.
 `json` is the default and keeps the mirror, because a client that ignores
 `structuredContent` would otherwise see an empty result.
 
+### What the new domains actually answer
+
+| Ask | Tool | Honest limit |
+| --- | --- | --- |
+| Will this MCP schema still accept yesterday’s request? | `agent_change_impact` | `string` → `integer` is incompatible. A missing tool in a partial catalog is `unconfirmed`, not removed. |
+| Who calls this ABI after an event layout change? | `web3_impact` | Comment/string “calls” are not consumers. ABI equality is not a live deployment. |
+| Who reads this field in an exported n8n workflow? | `n8n_trace` | Secrets stay off the graph. |
+| Which Dify nodes consume `start_node.query`? | `dify_trace` | Conversation variables are directed edges, not string presence. |
+| Does this Mermaid arrow prove a code call? | `diagram_*` | Arrows are `declared_architecture`, never `Calls`. |
+| Does `.weavatrix/architecture.json` still hold? | `verify_architecture` | Unknown rules fail closed. |
+
 ## What an agent can ask
 
 ```text
@@ -131,6 +147,9 @@ Build the smallest source bundle needed to edit this symbol safely.
 Show me this file as it was two commits ago, without a checkout.
 If I change the email recipient in this exported n8n workflow, who reads it?
 If I change start_node.query in this Dify YAML, which nodes consume it?
+Did this MCP catalog make `id` an integer so old string requests fail?
+Which viem `decodeEventLog` sites still assume the old Deposit layout?
+Is this Mermaid arrow a real call, or only declared architecture?
 ```
 
 ## See it answer
@@ -216,6 +235,10 @@ instead of being decoded into garbage.
 | Change impact | `get_dependents`, `change_impact`, `select_tests`, `verified_change`, `prepare_change`, `graph_diff` |
 | Exact source context | `search_code`, `read_source`, `inspect_symbol`, `go_to_definition`, `find_references`, `context_bundle`, `map_stacktrace` |
 | Health and quality | `find_duplicates`, `find_dead_code`, `run_audit`, `coverage_map`, `hot_path_review`, `perf_attribution` |
+
+Need measured coverage from this MCP host? Run Weavatrix Quality first, then
+`coverage_map`. The host will not invent percentages from an empty search
+path. Quality publishes `.weavatrix/coverage/lcov.info`.
 | APIs and transports | `list_endpoints`, `trace_endpoint`, `trace_api_contract` |
 | Architecture | `get_architecture_contract`, `verify_architecture`, `verify_capabilities`, `explain_architecture_violation`, `propose_architecture_exception` |
 | Git and repositories | `git_history`, `git_read_blob`, `cross_repo_git`, `open_repo`, `list_known_repos`, `rebuild_graph` |
@@ -256,7 +279,7 @@ export in git → existing JSON/YAML parse → typed domain → inventory / trac
 | [Dify](https://weavatrix.com/dify) | `dify_inventory`, `dify_trace`, `dify_context` | Product 1.13.0 |
 | Agent packages | `agent_inventory`, `agent_trace`, `agent_context`, `agent_change_impact` | Product 1.14.0 |
 | Mermaid diagrams | `diagram_inventory`, `diagram_trace`, `diagram_context` | Product 1.14.0 |
-| Web3 integration | `web3_inventory`, `web3_trace`, `web3_impact`, `web3_context` | Product 1.16.1 |
+| Web3 integration | `web3_inventory`, `web3_trace`, `web3_impact`, `web3_context` | Product 1.16.3 |
 
 | Need | Use |
 | --- | --- |
@@ -276,11 +299,11 @@ coding agent
     |
     | MCP over stdio
     v
-weavatrix 1.16.1
+weavatrix 1.16.3
     profile catalog · refresh · watcher · MCP framing
     |
     v
-weavatrix-rust 2.16.1
+weavatrix-rust 2.16.3
     typed graph · analysis · 64 product operations including n8n, Dify, agent packages, Mermaid, and Web3
 ```
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "weavatrix",
-  "version": "1.16.1",
-  "weavatrixEngineVersion": "2.16.1",
+  "version": "1.16.3",
+  "weavatrixEngineVersion": "2.16.3",
   "description": "Native repository intelligence for coding agents: 64 read-only MCP operations backed by typed evidence graphs, impact, architecture, APIs, Git, search, semantics, memory, n8n workflows, Dify apps, agent packages, Mermaid diagrams, and Web3 ABIs.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
   "license": "MIT",

package/server.json

@@ -7,14 +7,14 @@
     "url": "https://github.com/Weavatrix/weavatrix",
     "source": "github"
   },
-  "version": "1.16.1",
+  "version": "1.16.3",
   "websiteUrl": "https://weavatrix.com",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "weavatrix",
-      "version": "1.16.1",
+      "version": "1.16.3",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/skill/SKILL.md

@@ -38,7 +38,12 @@ contracts. Do not call it merely because the server is available.
   `web3_trace` / `web3_impact` / `web3_context` for supplied ABI,
   artifacts, and static viem/wagmi consumers. Those paths are static graph
   evidence, not a live n8n, Dify, MCP, Mermaid, or blockchain runtime.
-5. Use repository-native tests or benchmarks for behavioral proof.
+5. Use repository-native tests or benchmarks for behavioral proof. For
+   measured line coverage, run Weavatrix Quality `quality_run` so it writes
+   `.weavatrix/coverage/lcov.info`, then call `coverage_map`. Do not start
+   with `coverage_map` — it never runs tests. A missing report is
+   unmeasured, not 0%. See
+   [references/tools/coverage_map.md](references/tools/coverage_map.md).
 
 Do not call `open_repo` "just in case". Cross-repository tools take explicit
 roots in their arguments. Multi-root retarget requires launching with
@@ -58,6 +63,7 @@ audit and coverage results.
 - Keep source spans, graph revision, relation type, extractor, and confidence
   attached to findings.
 - Treat static reachability and audit output as candidates, not runtime proof.
+  `coverage_map` is an ingest. Quality builds the LCOV file.
 - Preserve exact transport identity; do not merge Kafka, AMQP/RabbitMQ, NATS,
   SNS/SQS, JMS, GraphQL, and gRPC evidence because operation names match.
 - The core is local, offline, and read-only. Use `weavatrix-refactor` only for

package/skill/references/tool-routing.md

@@ -44,7 +44,7 @@ cannot silently switch to another repository. Pass an explicit
 - [`find_duplicates`](tools/find_duplicates.md) — Deterministic Type-1/2/3 clone families.
 - [`find_dead_code`](tools/find_dead_code.md) — Conservative unreferenced-symbol review queue.
 - [`run_audit`](tools/run_audit.md) — Repository structure and evidence completeness audit.
-- [`coverage_map`](tools/coverage_map.md) — Measured coverage discovery or explicit static reachability.
+- [`coverage_map`](tools/coverage_map.md) — Ingest a report Quality already built. Does not run tests. Missing report is unmeasured, not 0%.
 - [`hot_path_review`](tools/hot_path_review.md) — Rank functions by static complexity times resolved call fan-in.
 - [`perf_attribution`](tools/perf_attribution.md) — Correlate a measurement series with the declarations that changed between the revisions that produced it.
 - [`get_architecture_contract`](tools/get_architecture_contract.md) — Read or preview the local target-architecture contract.
@@ -112,7 +112,7 @@ engine `weavatrix-rust` 2.14.3.
 
 Local ABI JSON, supplied solc/Foundry artifacts, and static viem/wagmi
 sources only. Not a compiler, RPC client, or wallet. Requires engine
-`weavatrix-rust` 2.16.1.
+`weavatrix-rust` 2.16.3.
 
 - [`web3_inventory`](tools/web3_inventory.md) — List ABIs, artifacts, and static consumers.
 - [`web3_trace`](tools/web3_trace.md) — Walk proven ABI, artifact, and consumer bindings.

package/skill/references/tools/coverage_map.md

@@ -1,29 +1,69 @@
 # `coverage_map`
 
-Measured coverage discovery or explicit static reachability.
+Ingest a measured coverage report and hang it on graph nodes. This is not a
+test runner.
 
-## When to use
+## Do not get lost
 
-Attach measured coverage reports to graph nodes and keep static reachability separately labeled.
+| Product | Job |
+| --- | --- |
+| Weavatrix Quality (`quality_run` / `wvq run`) | **Build** the report with the project's own frozen runner and write `.weavatrix/coverage/lcov.info`. |
+| Weavatrix `coverage_map` | **Ingest** a report that already exists. Never spawn `cargo test`, Vitest, Jest, Bun, Go, or Playwright. |
 
-A missing measured report must not be described as clean coverage.
+Call Quality first when you need measured numbers. Then call `coverage_map`.
+Calling `coverage_map` alone on a repository that has no report is a successful
+empty ingest: `measured_coverage.present = false`, plus separately labeled
+static reachability. That is not 0% and not 100%.
 
-## Inputs
+Cortex Loom "coverage certificates" are packet facts. They are not line
+coverage and they do not feed this tool.
 
-- `output_format` ("text" | "json" | "structured", default "json") — text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is safe only where the client reads structuredContent.
-- `path` (string).
-- `top_n` (integer, min 0).
+## Search paths (first file wins)
 
-## Minimal call
+1. `lcov.info`
+2. `coverage/lcov.info`
+3. `.weavatrix/coverage/lcov.info` — the path Quality publishes
+4. `tarpaulin-report.json`
+5. `target/tarpaulin/tarpaulin-report.json`
+6. `target/llvm-cov/coverage.json`
+7. `coverage/coverage-final.json`
 
-```json
-{
-  "name": "coverage_map",
-  "arguments": {
-    "output_format": "text"
-  }
-}
-```
+## Arguments
 
-Use `output_format:"text"` for compact agent interaction. The live MCP
-`tools/list` schema remains authoritative for this installed version.
+- `path` — substring filter on report file paths
+- `top_n` — cap the returned file list
+
+## How to read the reply
+
+- `measured_coverage.present = true` — a report was parsed. `report` is the
+  repository-relative path. `source` states that Weavatrix did not execute
+  tests.
+- `measured_coverage.present = false` — none of the search paths existed.
+  `files` is empty. `static_reachability` may still list likely tests. The
+  `warning` field repeats that this is not measured coverage.
+- `status: COMPLETE` with `present = false` is not a green coverage gate.
+
+## Quality builds the report
+
+Weavatrix Quality does not invent a second test stack. Discovery uses what
+the repository already has:
+
+- Rust: `cargo llvm-cov` when that Cargo subcommand exists (skipped on
+  `windows-gnu`, which lacks `profiler_builtins`), else `cargo tarpaulin`,
+  else plain `cargo test` (no measured report).
+- JavaScript/TypeScript: Vitest with an already-declared coverage provider,
+  else Jest `--coverage`, else Bun `--coverage`. Playwright is used only
+  when no other JS runner owns the package.
+- Go: the registered `go-test` coverprofile is normalized and then published
+  as LCOV on the Weavatrix search path.
+
+Policy bindings may still say `cargo-test`. Discovery may upgrade the spawn
+to `cargo-llvm-cov` or `cargo-tarpaulin`. Mutation stays on `cargo-test` so
+each mutant is not measured as if it were a coverage run.
+
+## Agent sequence
+
+1. `quality_run` (or `wvq run`) on the same repository, **or** place one of
+   the files above yourself.
+2. `coverage_map` (optionally `path` / `top_n`).
+3. Treat `present = false` as "unmeasured", not as "uncovered" or "safe".