weavatrix 1.16.4 → 1.17.2

package/README.md

@@ -12,7 +12,7 @@
 Weavatrix answers the questions agents otherwise invent: what breaks if this
 file changes, who consumes this n8n field, whether an MCP schema still
 accepts yesterday’s request, which viem call sites follow an ABI layout
-change, and whether `.weavatrix/architecture.json` still holds. **64
+change, and whether `.weavatrix/architecture.json` still holds. **67
 read-only operations**, one revision-bound graph, no LSP and no prompt pack.
 
 Codex, Claude Code, Cursor, and Grok get impact, architecture, APIs, Git
@@ -58,7 +58,7 @@ weavatrix mcp .
 ```toml
 [mcp_servers.weavatrix]
 command = "npx"
-args = ["-y", "weavatrix@1.16.4", "mcp", "."]
+args = ["-y", "weavatrix@1.17.2", "mcp", "."]
 ```
 
 Pass an absolute repository path when the Codex process cwd is not the project
@@ -67,7 +67,7 @@ you intend to analyze.
 ### Claude Code
 
 ```sh
-claude mcp add weavatrix -- npx -y weavatrix@1.16.4 mcp .
+claude mcp add weavatrix -- npx -y weavatrix@1.17.2 mcp .
 ```
 
 ### Cursor
@@ -80,7 +80,7 @@ the plugin for the same server name:
   "mcpServers": {
     "weavatrix": {
       "command": "npx",
-      "args": ["-y", "weavatrix@1.16.4", "mcp", "${workspaceFolder}"]
+      "args": ["-y", "weavatrix@1.17.2", "mcp", "${workspaceFolder}"]
     }
   }
 }
@@ -89,14 +89,14 @@ the plugin for the same server name:
 Profiles expose bounded views of the same engine:
 
 ```sh
-npx -y weavatrix@1.16.4 mcp . --profile=all
-npx -y weavatrix@1.16.4 mcp . --profile=code
-npx -y weavatrix@1.16.4 mcp . --profile=seo
-npx -y weavatrix@1.16.4 mcp . --profile=n8n
-npx -y weavatrix@1.16.4 mcp . --profile=dify
-npx -y weavatrix@1.16.4 mcp . --profile=agent
-npx -y weavatrix@1.16.4 mcp . --profile=diagram
-npx -y weavatrix@1.16.4 mcp . --profile=web3
+npx -y weavatrix@1.17.2 mcp . --profile=all
+npx -y weavatrix@1.17.2 mcp . --profile=code
+npx -y weavatrix@1.17.2 mcp . --profile=seo
+npx -y weavatrix@1.17.2 mcp . --profile=n8n
+npx -y weavatrix@1.17.2 mcp . --profile=dify
+npx -y weavatrix@1.17.2 mcp . --profile=agent
+npx -y weavatrix@1.17.2 mcp . --profile=diagram
+npx -y weavatrix@1.17.2 mcp . --profile=web3
 ```
 
 The package contains native binaries for Windows x64/arm64, macOS x64/arm64,
@@ -227,7 +227,7 @@ Three commits before `ec8bf30` this package was 1.9.2; the agent reads that
 follow-up to a diff without touching the worktree. Binary blobs fail closed
 instead of being decoded into garbage.
 
-## The 64 read-only operations
+## The 67 read-only operations
 
 | Workflow | Operations |
 | --- | --- |
@@ -236,7 +236,8 @@ instead of being decoded into garbage.
 | Exact source context | `search_code`, `read_source`, `inspect_symbol`, `go_to_definition`, `find_references`, `context_bundle`, `map_stacktrace` |
 | Health and quality | `find_duplicates`, `find_dead_code`, `run_audit`, `coverage_map`, `hot_path_review`, `perf_attribution` |
 | APIs and transports | `list_endpoints`, `trace_endpoint`, `trace_api_contract` |
-| Architecture | `get_architecture_contract`, `verify_architecture`, `verify_capabilities`, `explain_architecture_violation`, `propose_architecture_exception` |
+| Architecture | `architecture_inventory`, `get_architecture_contract`, `verify_architecture`, `verify_capabilities`, `explain_architecture_violation`, `propose_architecture_exception` |
+| Local CI | `ci_restrictions`, `explain_restriction` |
 | Git and repositories | `git_history`, `git_read_blob`, `cross_repo_git`, `open_repo`, `list_known_repos`, `rebuild_graph` |
 | Native extensions | `vector_search`, `semantic_link`, `seo_link_suggestions`, `memory_context` |
 | n8n workflows | `n8n_inventory`, `n8n_trace`, `n8n_context` |
@@ -249,6 +250,19 @@ Every operation is read-only with respect to the analyzed repository.
 Pagination and explicit limits bound large neighborhoods, histories, searches,
 and contract inventories.
 
+`build_graph` and `architecture_inventory` share one typed build model. They
+preserve nested Cargo, npm/TypeScript, Go, and Python components, many-to-many
+declared memberships, collision-free identities, configuration predicates,
+and immutable source evidence. Totals and SCC/cycle witnesses are computed
+before pagination, so a response cap cannot change the graph verdict.
+
+`ci_restrictions` reuses that target-aware topology while reading local GitHub
+Actions workflows and literal checks. Root files, repeated commands, UTF-8 BOM
+offsets, optional events, base branches, and changed-path scenarios keep exact
+evidence. Dynamic conditions, mutually exclusive configuration unions, actual
+runs, and remote required checks remain explicit unknowns; a workflow file
+alone never establishes a passing gate.
+
 Need measured coverage? Run Weavatrix Quality first, then `coverage_map`.
 The host will not invent percentages from an empty search path. Quality
 publishes `.weavatrix/coverage/lcov.info`. Agent schema verdicts are a
@@ -302,12 +316,12 @@ coding agent
     |
     | MCP over stdio
     v
-weavatrix 1.16.4
+weavatrix 1.17.2
     profile catalog · refresh · watcher · MCP framing
     |
     v
-weavatrix-rust 2.16.4
-    typed graph · analysis · 64 product operations including n8n, Dify, agent packages, Mermaid, and Web3
+weavatrix-rust 2.17.1
+    typed graph · analysis · 67 product operations including local CI, n8n, Dify, agent packages, Mermaid, and Web3
 ```
 
 This npm product owns MCP transport and native distribution. The

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "weavatrix",
-  "version": "1.16.4",
-  "weavatrixEngineVersion": "2.16.4",
-  "description": "Native repository intelligence for coding agents: 64 read-only MCP operations backed by typed evidence graphs, impact, architecture, APIs, Git, search, semantics, memory, n8n workflows, Dify apps, agent packages, Mermaid diagrams, and Web3 ABIs.",
+  "version": "1.17.2",
+  "weavatrixEngineVersion": "2.17.1",
+  "description": "Native repository intelligence for coding agents: 67 read-only MCP operations backed by typed evidence graphs, impact, architecture, local CI restrictions, APIs, Git, search, semantics, memory, n8n workflows, Dify apps, agent packages, Mermaid diagrams, and Web3 ABIs.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
   "license": "MIT",
   "homepage": "https://weavatrix.com",

package/server.json

@@ -2,19 +2,19 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.Weavatrix/weavatrix",
   "title": "Weavatrix",
-  "description": "Native Weavatrix MCP: 64 read-only tools for code, n8n, Dify, agents, Mermaid, and Web3.",
+  "description": "Native Weavatrix MCP: 67 read-only tools for code, local CI, n8n, Dify, agents, Mermaid, Web3.",
   "repository": {
     "url": "https://github.com/Weavatrix/weavatrix",
     "source": "github"
   },
-  "version": "1.16.4",
+  "version": "1.17.2",
   "websiteUrl": "https://weavatrix.com",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "weavatrix",
-      "version": "1.16.4",
+      "version": "1.17.2",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/skill/SKILL.md

@@ -23,12 +23,15 @@ contracts. Do not call it merely because the server is available.
 1. Call `graph_stats` and confirm `repository_context.root` matches the workspace
    you intend. The MCP process is pinned to its launch root; it will not silently
    answer for another repository.
-2. Use `module_map` for orientation or `search_code` for a known literal.
+2. Use `module_map` or `architecture_inventory` for orientation, or
+   `search_code` for a known literal.
 3. Pin decisive evidence with `inspect_symbol`, `go_to_definition`,
    `find_references`, `context_bundle`, or `read_source`.
 4. Expand only when needed: `get_dependents` or `change_impact` for risk,
    `trace_endpoint` or `trace_api_contract` for runtime contracts,
-   `verify_architecture` for policy, `run_audit` for a broad health pass,
+   `verify_architecture` for policy, `ci_restrictions` for local GitHub Actions
+   checks and `explain_restriction` for one finding, `run_audit` for a broad
+   health pass,
    `n8n_inventory` / `n8n_trace` / `n8n_context` for exported n8n
    workflows, and `dify_inventory` / `dify_trace` / `dify_context` for
    exported Dify YAML, and `agent_inventory` / `agent_trace` /

package/skill/references/tool-routing.md

@@ -19,7 +19,7 @@ cannot silently switch to another repository. Pass an explicit
 - [`get_community`](tools/get_community.md) — Return one coupling community (containment and package edges excluded).
 - [`list_communities`](tools/list_communities.md) — List deterministic coupling communities (containment and package edges excluded).
 - [`module_map`](tools/module_map.md) — Production folder map at a requested directory depth.
-- [`build_graph`](tools/build_graph.md) — Workspace, target and runner topology from manifest evidence.
+- [`build_graph`](tools/build_graph.md) — Typed workspace, target, configuration, task, and runner topology from captured manifest evidence.
 - [`search_code`](tools/search_code.md) — Literal or Rust-regex repository search without ripgrep.
 - [`read_source`](tools/read_source.md) — Bounded source context by node or repository path.
 - [`inspect_symbol`](tools/inspect_symbol.md) — Definition, direct relationships and source evidence.
@@ -41,6 +41,9 @@ cannot silently switch to another repository. Pass an explicit
 
 ## Quality and architecture
 
+- [`architecture_inventory`](tools/architecture_inventory.md) — Nested observed components, declared memberships, complete edge totals, and typed cycle witnesses without a style label.
+- [`ci_restrictions`](tools/ci_restrictions.md) — Local GitHub Actions checks and conditional applicability.
+- [`explain_restriction`](tools/explain_restriction.md) — One restriction and its evidence limits.
 - [`find_duplicates`](tools/find_duplicates.md) — Deterministic Type-1/2/3 clone families.
 - [`find_dead_code`](tools/find_dead_code.md) — Conservative unreferenced-symbol review queue.
 - [`run_audit`](tools/run_audit.md) — Repository structure and evidence completeness audit.

package/skill/references/tools/architecture_inventory.md

@@ -0,0 +1,28 @@
+# `architecture_inventory`
+
+Observed package, nested component, declared-membership, and typed edge
+evidence. No style label or target architecture is inferred.
+
+## When to use
+
+Orient in an unfamiliar repository or compare observed structure with a
+separately declared architecture contract.
+
+Component identities distinguish paths that sanitize alike, including the
+repository root. Files can retain every matching declared membership. Edge
+totals and component SCC/cycle witnesses are computed before presentation
+limits, and each recovered fact keeps its immutable source evidence. A cycle in
+the component quotient is reported as architecture, not as symbol recursion.
+
+## Inputs
+
+- `output_format` (`text`, `json`, or `structured`).
+- `expected_repository` (optional active-root guard).
+
+## Minimal call
+
+```json
+{"name":"architecture_inventory","arguments":{"output_format":"text"}}
+```
+
+The live MCP `tools/list` schema is authoritative.

package/skill/references/tools/build_graph.md

@@ -1,10 +1,14 @@
 # `build_graph`
 
-Workspace, target and runner topology from manifest evidence.
+Typed workspace, package, target, task, and runner topology from captured
+manifest evidence.
 
 ## When to use
 
-Inspect workspace members, targets, aggregators, and runner topology extracted from manifests.
+Inspect Cargo, npm/TypeScript, Go, and Python workspace members, targets,
+aggregators, entry points, configuration variants, and runner topology. The
+same model feeds architecture and local CI linkage; source evidence is captured
+with the analyzed snapshot rather than reread from a changing worktree.
 
 ## Inputs
 
@@ -24,3 +28,7 @@ Inspect workspace members, targets, aggregators, and runner topology extracted f
 
 Use `output_format:"text"` for compact agent interaction. The live MCP
 `tools/list` schema remains authoritative for this installed version.
+
+`max_members` limits presentation only. Returned totals still describe the
+complete recovered model, and the result reports an incomplete page instead of
+pretending omitted members do not exist.

package/skill/references/tools/ci_restrictions.md

@@ -0,0 +1,28 @@
+# `ci_restrictions`
+
+Local GitHub Actions jobs, steps, literal checks, and their evidence limits.
+It never runs a workflow or reads remote merge protection.
+
+## When to use
+
+Identify configured CI checks and ask whether a known event, base branch, and
+changed path would enter a workflow. `UNDETERMINED` is returned for dynamic
+conditions, scripts, or unavailable action bodies.
+
+## Inputs
+
+- `scope`: optional workflow-path substring.
+- `scenario`: optional object with `event`, `branch` (PR base branch), and
+  `changed_files` (array of repository paths). Do not pass secrets.
+- `max_results` and `token_budget`: response bounds.
+- `output_format` and `expected_repository`: common MCP arguments.
+
+## Minimal call
+
+```json
+{"name":"ci_restrictions","arguments":{"scenario":{"event":"pull_request","branch":"main","changed_files":["src/lib.rs"]},"output_format":"text"}}
+```
+
+The response separates declaration, applicability, observed execution,
+failure effect, and remote enforcement. A configured coverage threshold is
+not measured coverage. The live MCP `tools/list` schema is authoritative.

package/skill/references/tools/explain_restriction.md

@@ -0,0 +1,22 @@
+# `explain_restriction`
+
+Retrieve one local restriction by the ID returned from `ci_restrictions`.
+
+## When to use
+
+Inspect its source digest and byte span, invocation, applicability, failure
+effect, and unknowns before making a change.
+
+## Inputs
+
+- `id` (required): exact restriction ID.
+- `scenario`: optional `event`, `branch`, and `changed_files` object.
+- `output_format` and `expected_repository`: presentation and active-root guard.
+
+## Minimal call
+
+```json
+{"name":"explain_restriction","arguments":{"id":".github/workflows/ci.yml/quality/3/rustfmt_check/1","output_format":"text"}}
+```
+
+The live MCP `tools/list` schema is authoritative.