weavatrix 1.16.3 → 1.17.1

package/README.md

@@ -12,7 +12,7 @@
 Weavatrix answers the questions agents otherwise invent: what breaks if this
 file changes, who consumes this n8n field, whether an MCP schema still
 accepts yesterday’s request, which viem call sites follow an ABI layout
-change, and whether `.weavatrix/architecture.json` still holds. **64
+change, and whether `.weavatrix/architecture.json` still holds. **67
 read-only operations**, one revision-bound graph, no LSP and no prompt pack.
 
 Codex, Claude Code, Cursor, and Grok get impact, architecture, APIs, Git
@@ -58,7 +58,7 @@ weavatrix mcp .
 ```toml
 [mcp_servers.weavatrix]
 command = "npx"
-args = ["-y", "weavatrix@1.16.3", "mcp", "."]
+args = ["-y", "weavatrix@1.17.1", "mcp", "."]
 ```
 
 Pass an absolute repository path when the Codex process cwd is not the project
@@ -67,7 +67,7 @@ you intend to analyze.
 ### Claude Code
 
 ```sh
-claude mcp add weavatrix -- npx -y weavatrix@1.16.3 mcp .
+claude mcp add weavatrix -- npx -y weavatrix@1.17.1 mcp .
 ```
 
 ### Cursor
@@ -80,7 +80,7 @@ the plugin for the same server name:
   "mcpServers": {
     "weavatrix": {
       "command": "npx",
-      "args": ["-y", "weavatrix@1.16.3", "mcp", "${workspaceFolder}"]
+      "args": ["-y", "weavatrix@1.17.1", "mcp", "${workspaceFolder}"]
     }
   }
 }
@@ -89,14 +89,14 @@ the plugin for the same server name:
 Profiles expose bounded views of the same engine:
 
 ```sh
-npx -y weavatrix@1.16.3 mcp . --profile=all
-npx -y weavatrix@1.16.3 mcp . --profile=code
-npx -y weavatrix@1.16.3 mcp . --profile=seo
-npx -y weavatrix@1.16.3 mcp . --profile=n8n
-npx -y weavatrix@1.16.3 mcp . --profile=dify
-npx -y weavatrix@1.16.3 mcp . --profile=agent
-npx -y weavatrix@1.16.3 mcp . --profile=diagram
-npx -y weavatrix@1.16.3 mcp . --profile=web3
+npx -y weavatrix@1.17.1 mcp . --profile=all
+npx -y weavatrix@1.17.1 mcp . --profile=code
+npx -y weavatrix@1.17.1 mcp . --profile=seo
+npx -y weavatrix@1.17.1 mcp . --profile=n8n
+npx -y weavatrix@1.17.1 mcp . --profile=dify
+npx -y weavatrix@1.17.1 mcp . --profile=agent
+npx -y weavatrix@1.17.1 mcp . --profile=diagram
+npx -y weavatrix@1.17.1 mcp . --profile=web3
 ```
 
 The package contains native binaries for Windows x64/arm64, macOS x64/arm64,
@@ -227,7 +227,7 @@ Three commits before `ec8bf30` this package was 1.9.2; the agent reads that
 follow-up to a diff without touching the worktree. Binary blobs fail closed
 instead of being decoded into garbage.
 
-## The 64 read-only operations
+## The 67 read-only operations
 
 | Workflow | Operations |
 | --- | --- |
@@ -235,12 +235,9 @@ instead of being decoded into garbage.
 | Change impact | `get_dependents`, `change_impact`, `select_tests`, `verified_change`, `prepare_change`, `graph_diff` |
 | Exact source context | `search_code`, `read_source`, `inspect_symbol`, `go_to_definition`, `find_references`, `context_bundle`, `map_stacktrace` |
 | Health and quality | `find_duplicates`, `find_dead_code`, `run_audit`, `coverage_map`, `hot_path_review`, `perf_attribution` |
-
-Need measured coverage from this MCP host? Run Weavatrix Quality first, then
-`coverage_map`. The host will not invent percentages from an empty search
-path. Quality publishes `.weavatrix/coverage/lcov.info`.
 | APIs and transports | `list_endpoints`, `trace_endpoint`, `trace_api_contract` |
-| Architecture | `get_architecture_contract`, `verify_architecture`, `verify_capabilities`, `explain_architecture_violation`, `propose_architecture_exception` |
+| Architecture | `architecture_inventory`, `get_architecture_contract`, `verify_architecture`, `verify_capabilities`, `explain_architecture_violation`, `propose_architecture_exception` |
+| Local CI | `ci_restrictions`, `explain_restriction` |
 | Git and repositories | `git_history`, `git_read_blob`, `cross_repo_git`, `open_repo`, `list_known_repos`, `rebuild_graph` |
 | Native extensions | `vector_search`, `semantic_link`, `seo_link_suggestions`, `memory_context` |
 | n8n workflows | `n8n_inventory`, `n8n_trace`, `n8n_context` |
@@ -253,6 +250,20 @@ Every operation is read-only with respect to the analyzed repository.
 Pagination and explicit limits bound large neighborhoods, histories, searches,
 and contract inventories.
 
+`architecture_inventory` describes observed components without assigning an
+architecture style. `ci_restrictions` reads local GitHub Actions workflows and
+recognizes literal checks, with optional event, base branch, and changed-path
+scenario. `explain_restriction` retrieves one finding. Dynamic conditions,
+actual runs, and remote required checks remain unknown until separate evidence
+is supplied; a workflow file alone never establishes a passing gate.
+
+Need measured coverage? Run Weavatrix Quality first, then `coverage_map`.
+The host will not invent percentages from an empty search path. Quality
+publishes `.weavatrix/coverage/lcov.info`. Agent schema verdicts are a
+supported-subset proof: unsupported keywords stay `undetermined`, and
+skill hits are declared `allowed-tools`. Web3 consumers stay on the
+paired files; a missing candidate is `missing_input`.
+
 ## 24 repository surfaces
 
 | Group | Surfaces |
@@ -279,7 +290,7 @@ export in git → existing JSON/YAML parse → typed domain → inventory / trac
 | [Dify](https://weavatrix.com/dify) | `dify_inventory`, `dify_trace`, `dify_context` | Product 1.13.0 |
 | Agent packages | `agent_inventory`, `agent_trace`, `agent_context`, `agent_change_impact` | Product 1.14.0 |
 | Mermaid diagrams | `diagram_inventory`, `diagram_trace`, `diagram_context` | Product 1.14.0 |
-| Web3 integration | `web3_inventory`, `web3_trace`, `web3_impact`, `web3_context` | Product 1.16.3 |
+| Web3 integration | `web3_inventory`, `web3_trace`, `web3_impact`, `web3_context` | Product 1.16.4 |
 
 | Need | Use |
 | --- | --- |
@@ -299,17 +310,20 @@ coding agent
     |
     | MCP over stdio
     v
-weavatrix 1.16.3
+weavatrix 1.17.1
     profile catalog · refresh · watcher · MCP framing
     |
     v
-weavatrix-rust 2.16.3
-    typed graph · analysis · 64 product operations including n8n, Dify, agent packages, Mermaid, and Web3
+weavatrix-rust 2.17.0
+    typed graph · analysis · 67 product operations including local CI, n8n, Dify, agent packages, Mermaid, and Web3
 ```
 
 This npm product owns MCP transport and native distribution. The
 [`weavatrix-rust`](https://github.com/Weavatrix/weavatrix-rust) crate is
 the reusable protocol-independent engine; it is not an MCP server.
+[`weavatrix-stream`](https://github.com/Weavatrix/weavatrix-stream)
+provides adapters for Weavatrix observations; this host does not take a
+runtime dependency on it.
 Its standalone diagnostic therefore reports `weavatrix-rust <engine-version>`,
 while this MCP product reports both its product and embedded-engine identities.
 

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "weavatrix",
-  "version": "1.16.3",
-  "weavatrixEngineVersion": "2.16.3",
-  "description": "Native repository intelligence for coding agents: 64 read-only MCP operations backed by typed evidence graphs, impact, architecture, APIs, Git, search, semantics, memory, n8n workflows, Dify apps, agent packages, Mermaid diagrams, and Web3 ABIs.",
+  "version": "1.17.1",
+  "weavatrixEngineVersion": "2.17.0",
+  "description": "Native repository intelligence for coding agents: 67 read-only MCP operations backed by typed evidence graphs, impact, architecture, local CI restrictions, APIs, Git, search, semantics, memory, n8n workflows, Dify apps, agent packages, Mermaid diagrams, and Web3 ABIs.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
   "license": "MIT",
   "homepage": "https://weavatrix.com",

package/server.json

@@ -2,19 +2,19 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.Weavatrix/weavatrix",
   "title": "Weavatrix",
-  "description": "Native Weavatrix MCP: 64 read-only tools for code, n8n, Dify, agents, Mermaid, and Web3.",
+  "description": "Native Weavatrix MCP: 67 read-only tools for code, local CI, n8n, Dify, agents, Mermaid, Web3.",
   "repository": {
     "url": "https://github.com/Weavatrix/weavatrix",
     "source": "github"
   },
-  "version": "1.16.3",
+  "version": "1.17.1",
   "websiteUrl": "https://weavatrix.com",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "weavatrix",
-      "version": "1.16.3",
+      "version": "1.17.1",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/skill/SKILL.md

@@ -23,12 +23,15 @@ contracts. Do not call it merely because the server is available.
 1. Call `graph_stats` and confirm `repository_context.root` matches the workspace
    you intend. The MCP process is pinned to its launch root; it will not silently
    answer for another repository.
-2. Use `module_map` for orientation or `search_code` for a known literal.
+2. Use `module_map` or `architecture_inventory` for orientation, or
+   `search_code` for a known literal.
 3. Pin decisive evidence with `inspect_symbol`, `go_to_definition`,
    `find_references`, `context_bundle`, or `read_source`.
 4. Expand only when needed: `get_dependents` or `change_impact` for risk,
    `trace_endpoint` or `trace_api_contract` for runtime contracts,
-   `verify_architecture` for policy, `run_audit` for a broad health pass,
+   `verify_architecture` for policy, `ci_restrictions` for local GitHub Actions
+   checks and `explain_restriction` for one finding, `run_audit` for a broad
+   health pass,
    `n8n_inventory` / `n8n_trace` / `n8n_context` for exported n8n
    workflows, and `dify_inventory` / `dify_trace` / `dify_context` for
    exported Dify YAML, and `agent_inventory` / `agent_trace` /

package/skill/references/tool-routing.md

@@ -41,6 +41,9 @@ cannot silently switch to another repository. Pass an explicit
 
 ## Quality and architecture
 
+- [`architecture_inventory`](tools/architecture_inventory.md) — Observed components and typed edges without a style label.
+- [`ci_restrictions`](tools/ci_restrictions.md) — Local GitHub Actions checks and conditional applicability.
+- [`explain_restriction`](tools/explain_restriction.md) — One restriction and its evidence limits.
 - [`find_duplicates`](tools/find_duplicates.md) — Deterministic Type-1/2/3 clone families.
 - [`find_dead_code`](tools/find_dead_code.md) — Conservative unreferenced-symbol review queue.
 - [`run_audit`](tools/run_audit.md) — Repository structure and evidence completeness audit.
@@ -97,7 +100,7 @@ runtime, gateway, or policy authority. Requires engine `weavatrix-rust`
 - [`agent_inventory`](tools/agent_inventory.md) — List plugins, skills, MCP bindings, catalog tools, and supplied observations.
 - [`agent_trace`](tools/agent_trace.md) — Declared origin, profile, transport, and package bindings for one identity.
 - [`agent_context`](tools/agent_context.md) — Bounded context; `allowed-tools` is not a grant.
-- [`agent_change_impact`](tools/agent_change_impact.md) — Compare two catalog snapshots; a known inject transform can keep one exposure compatible.
+- [`agent_change_impact`](tools/agent_change_impact.md) — Compare two catalog snapshots on a supported schema subset. Unsupported keywords stay undetermined. Duplicate labels are `ambiguous-identity`. Skill hits are declared `allowed-tools`.
 
 ## Mermaid diagrams
 
@@ -112,9 +115,9 @@ engine `weavatrix-rust` 2.14.3.
 
 Local ABI JSON, supplied solc/Foundry artifacts, and static viem/wagmi
 sources only. Not a compiler, RPC client, or wallet. Requires engine
-`weavatrix-rust` 2.16.3.
+`weavatrix-rust` 2.16.4.
 
-- [`web3_inventory`](tools/web3_inventory.md) — List ABIs, artifacts, and static consumers.
-- [`web3_trace`](tools/web3_trace.md) — Walk proven ABI, artifact, and consumer bindings.
-- [`web3_impact`](tools/web3_impact.md) — Interface deltas and consumer-specific effects, including silent event misdecode.
+- [`web3_inventory`](tools/web3_inventory.md) — List ABIs, artifacts, and static consumers. Truncation is reported.
+- [`web3_trace`](tools/web3_trace.md) — Walk the requested depth from the seed. A cut reports truncation.
+- [`web3_impact`](tools/web3_impact.md) — Interface deltas on the paired files. A missing candidate is `missing_input`. Comment properties are not the callee.
 - [`web3_context`](tools/web3_context.md) — Bounded fragments plus explicit deployment gaps.

package/skill/references/tools/agent_change_impact.md

@@ -7,7 +7,11 @@ adapter compensation, and declared consumers.
 
 After adding `before` and `after` catalog JSON files to the repository. A
 known inject transform can keep one exposure compatible while the upstream
-required list grew. Incomplete pagination is not a deletion.
+required list grew. Incomplete pagination is not a deletion. Verdicts are
+a supported-subset proof: unsupported keywords stay `undetermined`. A
+boolean `enum: [true, false]` is not a restriction. `integer` to
+`number` is a widening. Duplicate tool labels are `ambiguous-identity`.
+Skill hits are declared `allowed-tools`, not proven calls.
 
 ## Inputs
 

package/skill/references/tools/architecture_inventory.md

@@ -0,0 +1,22 @@
+# `architecture_inventory`
+
+Observed package, component, and typed edge evidence. No style label or
+target architecture is inferred.
+
+## When to use
+
+Orient in an unfamiliar repository or compare observed structure with a
+separately declared architecture contract.
+
+## Inputs
+
+- `output_format` (`text`, `json`, or `structured`).
+- `expected_repository` (optional active-root guard).
+
+## Minimal call
+
+```json
+{"name":"architecture_inventory","arguments":{"output_format":"text"}}
+```
+
+The live MCP `tools/list` schema is authoritative.

package/skill/references/tools/ci_restrictions.md

@@ -0,0 +1,28 @@
+# `ci_restrictions`
+
+Local GitHub Actions jobs, steps, literal checks, and their evidence limits.
+It never runs a workflow or reads remote merge protection.
+
+## When to use
+
+Identify configured CI checks and ask whether a known event, base branch, and
+changed path would enter a workflow. `UNDETERMINED` is returned for dynamic
+conditions, scripts, or unavailable action bodies.
+
+## Inputs
+
+- `scope`: optional workflow-path substring.
+- `scenario`: optional object with `event`, `branch` (PR base branch), and
+  `changed_files` (array of repository paths). Do not pass secrets.
+- `max_results` and `token_budget`: response bounds.
+- `output_format` and `expected_repository`: common MCP arguments.
+
+## Minimal call
+
+```json
+{"name":"ci_restrictions","arguments":{"scenario":{"event":"pull_request","branch":"main","changed_files":["src/lib.rs"]},"output_format":"text"}}
+```
+
+The response separates declaration, applicability, observed execution,
+failure effect, and remote enforcement. A configured coverage threshold is
+not measured coverage. The live MCP `tools/list` schema is authoritative.

package/skill/references/tools/explain_restriction.md

@@ -0,0 +1,22 @@
+# `explain_restriction`
+
+Retrieve one local restriction by the ID returned from `ci_restrictions`.
+
+## When to use
+
+Inspect its source digest and byte span, invocation, applicability, failure
+effect, and unknowns before making a change.
+
+## Inputs
+
+- `id` (required): exact restriction ID.
+- `scenario`: optional `event`, `branch`, and `changed_files` object.
+- `output_format` and `expected_repository`: presentation and active-root guard.
+
+## Minimal call
+
+```json
+{"name":"explain_restriction","arguments":{"id":".github/workflows/ci.yml/quality/3/rustfmt_check/1","output_format":"text"}}
+```
+
+The live MCP `tools/list` schema is authoritative.

package/skill/references/tools/web3_impact.md

@@ -7,7 +7,10 @@ deltas, including silent event misdecode risk.
 
 A contract ABI changed and a client still binds an older copy. An indexed
 mask change can decode without throwing. Deployment state stays
-`not_provided` unless a runtime observation was supplied.
+`not_provided` unless a runtime observation was supplied. Consumers stay
+on the paired baseline/candidate files. A missing candidate is
+`missing_input`, not `MEMBER_REMOVED`. Comment properties inside a call
+object are not the callee.
 
 ## Inputs
 

package/skill/references/tools/web3_trace.md

@@ -6,7 +6,9 @@ call site.
 ## When to use
 
 After `web3_inventory`, when a function or event name is not enough: follow
-the exact occurrence to its ABI member and static client binding.
+the exact occurrence to its ABI member and static client binding. `depth`
+is walked from the seed; a cut reports truncation instead of pretending
+the walk finished.
 
 ## Inputs