weavatrix 1.16.2 → 1.16.4

package/README.md

@@ -58,7 +58,7 @@ weavatrix mcp .
 ```toml
 [mcp_servers.weavatrix]
 command = "npx"
-args = ["-y", "weavatrix@1.16.2", "mcp", "."]
+args = ["-y", "weavatrix@1.16.4", "mcp", "."]
 ```
 
 Pass an absolute repository path when the Codex process cwd is not the project
@@ -67,7 +67,7 @@ you intend to analyze.
 ### Claude Code
 
 ```sh
-claude mcp add weavatrix -- npx -y weavatrix@1.16.2 mcp .
+claude mcp add weavatrix -- npx -y weavatrix@1.16.4 mcp .
 ```
 
 ### Cursor
@@ -80,7 +80,7 @@ the plugin for the same server name:
   "mcpServers": {
     "weavatrix": {
       "command": "npx",
-      "args": ["-y", "weavatrix@1.16.2", "mcp", "${workspaceFolder}"]
+      "args": ["-y", "weavatrix@1.16.4", "mcp", "${workspaceFolder}"]
     }
   }
 }
@@ -89,14 +89,14 @@ the plugin for the same server name:
 Profiles expose bounded views of the same engine:
 
 ```sh
-npx -y weavatrix@1.16.2 mcp . --profile=all
-npx -y weavatrix@1.16.2 mcp . --profile=code
-npx -y weavatrix@1.16.2 mcp . --profile=seo
-npx -y weavatrix@1.16.2 mcp . --profile=n8n
-npx -y weavatrix@1.16.2 mcp . --profile=dify
-npx -y weavatrix@1.16.2 mcp . --profile=agent
-npx -y weavatrix@1.16.2 mcp . --profile=diagram
-npx -y weavatrix@1.16.2 mcp . --profile=web3
+npx -y weavatrix@1.16.4 mcp . --profile=all
+npx -y weavatrix@1.16.4 mcp . --profile=code
+npx -y weavatrix@1.16.4 mcp . --profile=seo
+npx -y weavatrix@1.16.4 mcp . --profile=n8n
+npx -y weavatrix@1.16.4 mcp . --profile=dify
+npx -y weavatrix@1.16.4 mcp . --profile=agent
+npx -y weavatrix@1.16.4 mcp . --profile=diagram
+npx -y weavatrix@1.16.4 mcp . --profile=web3
 ```
 
 The package contains native binaries for Windows x64/arm64, macOS x64/arm64,
@@ -249,6 +249,13 @@ Every operation is read-only with respect to the analyzed repository.
 Pagination and explicit limits bound large neighborhoods, histories, searches,
 and contract inventories.
 
+Need measured coverage? Run Weavatrix Quality first, then `coverage_map`.
+The host will not invent percentages from an empty search path. Quality
+publishes `.weavatrix/coverage/lcov.info`. Agent schema verdicts are a
+supported-subset proof: unsupported keywords stay `undetermined`, and
+skill hits are declared `allowed-tools`. Web3 consumers stay on the
+paired files; a missing candidate is `missing_input`.
+
 ## 24 repository surfaces
 
 | Group | Surfaces |
@@ -275,7 +282,7 @@ export in git → existing JSON/YAML parse → typed domain → inventory / trac
 | [Dify](https://weavatrix.com/dify) | `dify_inventory`, `dify_trace`, `dify_context` | Product 1.13.0 |
 | Agent packages | `agent_inventory`, `agent_trace`, `agent_context`, `agent_change_impact` | Product 1.14.0 |
 | Mermaid diagrams | `diagram_inventory`, `diagram_trace`, `diagram_context` | Product 1.14.0 |
-| Web3 integration | `web3_inventory`, `web3_trace`, `web3_impact`, `web3_context` | Product 1.16.2 |
+| Web3 integration | `web3_inventory`, `web3_trace`, `web3_impact`, `web3_context` | Product 1.16.4 |
 
 | Need | Use |
 | --- | --- |
@@ -295,17 +302,20 @@ coding agent
     |
     | MCP over stdio
     v
-weavatrix 1.16.2
+weavatrix 1.16.4
     profile catalog · refresh · watcher · MCP framing
     |
     v
-weavatrix-rust 2.16.2
+weavatrix-rust 2.16.4
     typed graph · analysis · 64 product operations including n8n, Dify, agent packages, Mermaid, and Web3
 ```
 
 This npm product owns MCP transport and native distribution. The
 [`weavatrix-rust`](https://github.com/Weavatrix/weavatrix-rust) crate is
 the reusable protocol-independent engine; it is not an MCP server.
+[`weavatrix-stream`](https://github.com/Weavatrix/weavatrix-stream)
+provides adapters for Weavatrix observations; this host does not take a
+runtime dependency on it.
 Its standalone diagnostic therefore reports `weavatrix-rust <engine-version>`,
 while this MCP product reports both its product and embedded-engine identities.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "weavatrix",
-  "version": "1.16.2",
-  "weavatrixEngineVersion": "2.16.2",
+  "version": "1.16.4",
+  "weavatrixEngineVersion": "2.16.4",
   "description": "Native repository intelligence for coding agents: 64 read-only MCP operations backed by typed evidence graphs, impact, architecture, APIs, Git, search, semantics, memory, n8n workflows, Dify apps, agent packages, Mermaid diagrams, and Web3 ABIs.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
   "license": "MIT",

package/server.json

@@ -7,14 +7,14 @@
     "url": "https://github.com/Weavatrix/weavatrix",
     "source": "github"
   },
-  "version": "1.16.2",
+  "version": "1.16.4",
   "websiteUrl": "https://weavatrix.com",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "weavatrix",
-      "version": "1.16.2",
+      "version": "1.16.4",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/skill/SKILL.md

@@ -38,7 +38,12 @@ contracts. Do not call it merely because the server is available.
   `web3_trace` / `web3_impact` / `web3_context` for supplied ABI,
   artifacts, and static viem/wagmi consumers. Those paths are static graph
   evidence, not a live n8n, Dify, MCP, Mermaid, or blockchain runtime.
-5. Use repository-native tests or benchmarks for behavioral proof.
+5. Use repository-native tests or benchmarks for behavioral proof. For
+   measured line coverage, run Weavatrix Quality `quality_run` so it writes
+   `.weavatrix/coverage/lcov.info`, then call `coverage_map`. Do not start
+   with `coverage_map` — it never runs tests. A missing report is
+   unmeasured, not 0%. See
+   [references/tools/coverage_map.md](references/tools/coverage_map.md).
 
 Do not call `open_repo` "just in case". Cross-repository tools take explicit
 roots in their arguments. Multi-root retarget requires launching with
@@ -58,6 +63,7 @@ audit and coverage results.
 - Keep source spans, graph revision, relation type, extractor, and confidence
   attached to findings.
 - Treat static reachability and audit output as candidates, not runtime proof.
+  `coverage_map` is an ingest. Quality builds the LCOV file.
 - Preserve exact transport identity; do not merge Kafka, AMQP/RabbitMQ, NATS,
   SNS/SQS, JMS, GraphQL, and gRPC evidence because operation names match.
 - The core is local, offline, and read-only. Use `weavatrix-refactor` only for

package/skill/references/tool-routing.md

@@ -44,7 +44,7 @@ cannot silently switch to another repository. Pass an explicit
 - [`find_duplicates`](tools/find_duplicates.md) — Deterministic Type-1/2/3 clone families.
 - [`find_dead_code`](tools/find_dead_code.md) — Conservative unreferenced-symbol review queue.
 - [`run_audit`](tools/run_audit.md) — Repository structure and evidence completeness audit.
-- [`coverage_map`](tools/coverage_map.md) — Measured coverage discovery or explicit static reachability.
+- [`coverage_map`](tools/coverage_map.md) — Ingest a report Quality already built. Does not run tests. Missing report is unmeasured, not 0%.
 - [`hot_path_review`](tools/hot_path_review.md) — Rank functions by static complexity times resolved call fan-in.
 - [`perf_attribution`](tools/perf_attribution.md) — Correlate a measurement series with the declarations that changed between the revisions that produced it.
 - [`get_architecture_contract`](tools/get_architecture_contract.md) — Read or preview the local target-architecture contract.
@@ -97,7 +97,7 @@ runtime, gateway, or policy authority. Requires engine `weavatrix-rust`
 - [`agent_inventory`](tools/agent_inventory.md) — List plugins, skills, MCP bindings, catalog tools, and supplied observations.
 - [`agent_trace`](tools/agent_trace.md) — Declared origin, profile, transport, and package bindings for one identity.
 - [`agent_context`](tools/agent_context.md) — Bounded context; `allowed-tools` is not a grant.
-- [`agent_change_impact`](tools/agent_change_impact.md) — Compare two catalog snapshots; a known inject transform can keep one exposure compatible.
+- [`agent_change_impact`](tools/agent_change_impact.md) — Compare two catalog snapshots on a supported schema subset. Unsupported keywords stay undetermined. Duplicate labels are `ambiguous-identity`. Skill hits are declared `allowed-tools`.
 
 ## Mermaid diagrams
 
@@ -112,9 +112,9 @@ engine `weavatrix-rust` 2.14.3.
 
 Local ABI JSON, supplied solc/Foundry artifacts, and static viem/wagmi
 sources only. Not a compiler, RPC client, or wallet. Requires engine
-`weavatrix-rust` 2.16.2.
+`weavatrix-rust` 2.16.4.
 
-- [`web3_inventory`](tools/web3_inventory.md) — List ABIs, artifacts, and static consumers.
-- [`web3_trace`](tools/web3_trace.md) — Walk proven ABI, artifact, and consumer bindings.
-- [`web3_impact`](tools/web3_impact.md) — Interface deltas and consumer-specific effects, including silent event misdecode.
+- [`web3_inventory`](tools/web3_inventory.md) — List ABIs, artifacts, and static consumers. Truncation is reported.
+- [`web3_trace`](tools/web3_trace.md) — Walk the requested depth from the seed. A cut reports truncation.
+- [`web3_impact`](tools/web3_impact.md) — Interface deltas on the paired files. A missing candidate is `missing_input`. Comment properties are not the callee.
 - [`web3_context`](tools/web3_context.md) — Bounded fragments plus explicit deployment gaps.

package/skill/references/tools/agent_change_impact.md

@@ -7,7 +7,11 @@ adapter compensation, and declared consumers.
 
 After adding `before` and `after` catalog JSON files to the repository. A
 known inject transform can keep one exposure compatible while the upstream
-required list grew. Incomplete pagination is not a deletion.
+required list grew. Incomplete pagination is not a deletion. Verdicts are
+a supported-subset proof: unsupported keywords stay `undetermined`. A
+boolean `enum: [true, false]` is not a restriction. `integer` to
+`number` is a widening. Duplicate tool labels are `ambiguous-identity`.
+Skill hits are declared `allowed-tools`, not proven calls.
 
 ## Inputs
 

package/skill/references/tools/coverage_map.md

@@ -1,29 +1,69 @@
 # `coverage_map`
 
-Measured coverage discovery or explicit static reachability.
+Ingest a measured coverage report and hang it on graph nodes. This is not a
+test runner.
 
-## When to use
+## Do not get lost
 
-Attach measured coverage reports to graph nodes and keep static reachability separately labeled.
+| Product | Job |
+| --- | --- |
+| Weavatrix Quality (`quality_run` / `wvq run`) | **Build** the report with the project's own frozen runner and write `.weavatrix/coverage/lcov.info`. |
+| Weavatrix `coverage_map` | **Ingest** a report that already exists. Never spawn `cargo test`, Vitest, Jest, Bun, Go, or Playwright. |
 
-A missing measured report must not be described as clean coverage.
+Call Quality first when you need measured numbers. Then call `coverage_map`.
+Calling `coverage_map` alone on a repository that has no report is a successful
+empty ingest: `measured_coverage.present = false`, plus separately labeled
+static reachability. That is not 0% and not 100%.
 
-## Inputs
+Cortex Loom "coverage certificates" are packet facts. They are not line
+coverage and they do not feed this tool.
 
-- `output_format` ("text" | "json" | "structured", default "json") — text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is safe only where the client reads structuredContent.
-- `path` (string).
-- `top_n` (integer, min 0).
+## Search paths (first file wins)
 
-## Minimal call
+1. `lcov.info`
+2. `coverage/lcov.info`
+3. `.weavatrix/coverage/lcov.info` — the path Quality publishes
+4. `tarpaulin-report.json`
+5. `target/tarpaulin/tarpaulin-report.json`
+6. `target/llvm-cov/coverage.json`
+7. `coverage/coverage-final.json`
 
-```json
-{
-  "name": "coverage_map",
-  "arguments": {
-    "output_format": "text"
-  }
-}
-```
+## Arguments
 
-Use `output_format:"text"` for compact agent interaction. The live MCP
-`tools/list` schema remains authoritative for this installed version.
+- `path` — substring filter on report file paths
+- `top_n` — cap the returned file list
+
+## How to read the reply
+
+- `measured_coverage.present = true` — a report was parsed. `report` is the
+  repository-relative path. `source` states that Weavatrix did not execute
+  tests.
+- `measured_coverage.present = false` — none of the search paths existed.
+  `files` is empty. `static_reachability` may still list likely tests. The
+  `warning` field repeats that this is not measured coverage.
+- `status: COMPLETE` with `present = false` is not a green coverage gate.
+
+## Quality builds the report
+
+Weavatrix Quality does not invent a second test stack. Discovery uses what
+the repository already has:
+
+- Rust: `cargo llvm-cov` when that Cargo subcommand exists (skipped on
+  `windows-gnu`, which lacks `profiler_builtins`), else `cargo tarpaulin`,
+  else plain `cargo test` (no measured report).
+- JavaScript/TypeScript: Vitest with an already-declared coverage provider,
+  else Jest `--coverage`, else Bun `--coverage`. Playwright is used only
+  when no other JS runner owns the package.
+- Go: the registered `go-test` coverprofile is normalized and then published
+  as LCOV on the Weavatrix search path.
+
+Policy bindings may still say `cargo-test`. Discovery may upgrade the spawn
+to `cargo-llvm-cov` or `cargo-tarpaulin`. Mutation stays on `cargo-test` so
+each mutant is not measured as if it were a coverage run.
+
+## Agent sequence
+
+1. `quality_run` (or `wvq run`) on the same repository, **or** place one of
+   the files above yourself.
+2. `coverage_map` (optionally `path` / `top_n`).
+3. Treat `present = false` as "unmeasured", not as "uncovered" or "safe".

package/skill/references/tools/web3_impact.md

@@ -7,7 +7,10 @@ deltas, including silent event misdecode risk.
 
 A contract ABI changed and a client still binds an older copy. An indexed
 mask change can decode without throwing. Deployment state stays
-`not_provided` unless a runtime observation was supplied.
+`not_provided` unless a runtime observation was supplied. Consumers stay
+on the paired baseline/candidate files. A missing candidate is
+`missing_input`, not `MEMBER_REMOVED`. Comment properties inside a call
+object are not the callee.
 
 ## Inputs
 

package/skill/references/tools/web3_trace.md

@@ -6,7 +6,9 @@ call site.
 ## When to use
 
 After `web3_inventory`, when a function or event name is not enough: follow
-the exact occurrence to its ABI member and static client binding.
+the exact occurrence to its ABI member and static client binding. `depth`
+is walked from the seed; a cut reports truncation instead of pretending
+the walk finished.
 
 ## Inputs