weft-rag 2.4.0__tar.gz

weft_rag-2.4.0/.gitignore

@@ -0,0 +1,85 @@
+# A sibling checkout, reachable for reading only.
+# Never a build input: see CLAUDE.md and docs/README.md.
+/_external-src
+
+# Python
+__pycache__/
+*.py[cod]
+.venv/
+dist/
+build/
+*.egg-info/
+
+# Tooling
+.pytest_cache/
+.ruff_cache/
+.pyright/
+
+# `uv.lock` was here, filed between two caches. It is not a cache: `ci.yml` runs
+# `uv sync --frozen` in three of its four jobs, and every one of them died at that step
+# the first time CI ever ran. It is tracked now — the resolution CI installs and the
+# resolution a developer installs must be one artefact, which is the same argument
+# `docs/README.md` makes about single-sourcing anything two readers can disagree about.
+#
+# It constrains nobody downstream. A lockfile is not a dependency bound; what a consumer
+# resolves is decided by each distribution's `pyproject.toml`.
+
+# Session-local attempt counter for the guard_quality_gates.py PreToolUse hook — per-session
+# scratch, not a record anyone should read later. See the hook's module docstring.
+.claude/.gate-attempts.json
+
+# Secrets. `.env` holds live provider keys; only the documented, valueless
+# example is tracked. Listed before any tooling rule so a stray `git add -A`
+# cannot reach it.
+.env
+.env.*
+!.env.example
+
+# Corpus payload. Every subdirectory of /corpus is a materialised document set and
+# is deliberately untracked; `corpus/manifest.toml` and `scripts/fetch_corpus.py`
+# are the tracked artefact. `09` §4 V1 permits exactly this:
+# a corpus is "either redistributable or fetched by a pinned, checksummed script",
+# and the mRMR papers are published under publisher copyright, so committing them
+# would be redistribution this repository has no right to perform. The manifest
+# carries a sha256 per document, which is what makes the set reproducible without
+# the bytes being here. The pattern is a directory glob rather than a list of names
+# so that scaling the corpus up cannot silently start tracking a paper.
+/corpus/*/
+
+# Where a baseline run stages the corpus it indexes and writes the `weft.toml` it measures
+# through (`eval/run_baseline.py`). The staged copies are the same untracked papers one
+# directory over, and the configuration is reproduced by the harness rather than kept — what
+# is tracked is the run it produced, under `eval/baselines/`.
+/.baseline-run/
+
+# Working artefacts of a build session — a generated map of the codebase and a design
+# record produced while planning. Untracked on purpose: `docs/README.md` routes every
+# document this project owns, and a design that matters belongs in the `docs/` file
+# that owns its content, not in a root-level file nothing points at.
+/.phase2-*.md
+/.phase3-*.md
+/.phase4-*.md
+
+# Gate-session preparation: the Bring lists of `docs/05-grilling-sessions.md`, measured on the day
+# a session is about to run. Untracked for the same reason — the session's outcome belongs in
+# `docs/README.md`'s decision log and in the reference document the decision changes, never here.
+/.gate-brief-*.md
+
+# Claude Code local state
+.claude/settings.local.json
+
+.DS_Store
+
+# The build harness driving Phase 2, alongside its brief, findings and design record.
+/.phase2-build.js
+
+# Transient: harvested subagent findings, promoted into docs/lessons.md by implement-ll.
+# Never committed — its content belongs in the queue or nowhere.
+.claude/lessons-spool.md
+
+# Reading material and design records about codebases this project does not own.
+# Kept on disk, deliberately outside version control: nothing tracked here refers to
+# them, and a write to any of them would leave no trace in a diff.
+/docs/_external-reading/
+
+/tmp/

weft_rag-2.4.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Adam Krysztopa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

weft_rag-2.4.0/NOTICE

@@ -0,0 +1,77 @@
+Weft
+Copyright (c) 2026 Adam Krysztopa
+
+This product is licensed under the MIT License. See the LICENSE file at the root
+of this repository.
+
+--------------------------------------------------------------------------------
+Original work
+--------------------------------------------------------------------------------
+
+**Weft carries no third party's source text.** Every line of this project's own
+code is written for it, against its own contracts. Nothing here depends on a
+licence granted by anyone else.
+
+That is a rule, not a description: no file may be copied or adapted from another
+project's source, and no third-party source text may be pasted into this
+repository. Where a prior system informed a design, what was carried across is
+understanding — an approach, an ordering, a measurement, a reason a guard exists
+— restated in this project's own words and implemented fresh. Copyright does not
+reach any of that.
+
+What was learned from prior work, and what was deliberately not taken, is a
+design record kept outside version control. Nothing in it authorises a copy of a
+third party's text, because that is not permitted here at all.
+
+--------------------------------------------------------------------------------
+Three cases, because the sentence above used to be absolute and was not accurate
+--------------------------------------------------------------------------------
+
+This section was added on 2026-09-05. It previously read "Weft contains no source
+text from any other codebase", and two separate things made that literally false
+while nothing about the project's substance had changed. Both are stated here
+rather than left for a reader to discover, because a founding claim that is
+almost true is worse than a narrower one that is exactly true.
+
+1. **A third party's code — never.** Somebody else's work is somebody else's:
+   not a file, a function body, a docstring, a comment, a prompt string, a word
+   list or a test fixture. Read to understand, then closed. This is the rule
+   above and it has not moved.
+
+2. **The copyright holder's own prior work — permitted, and marked.** Material
+   written by this project's own author before this project began carries no
+   third party's rights. Copying it violates nobody's licence, and forbidding it
+   would be a rule about tidiness dressed as a rule about ownership. Where such
+   material is carried across, the file carrying it says so, naming the source
+   work — so a reader can always tell the two origins apart without asking.
+
+   **How it says so, because "says so" was a sentence and not a convention until
+   2026-09-09.** The carried lines are delimited in place, by a comment in
+   whatever syntax the file is written in: `weft-prior-work begin: <source work>`
+   opens the span and names the source work it came from, and
+   `weft-prior-work end` closes it and takes no argument. Spans do not nest — a
+   span inside a span makes *which lines are that work* answerable two ways,
+   which is the one question this convention exists to answer. Every source work
+   carried this way is enumerated on the repository's own README.md, where a
+   reader looks first, and tests/architecture/test_release_licensing.py fails
+   the build when the marked spans and that enumeration disagree. The obligation
+   falls in the same commit as the copied line and never after it, which is why
+   the check exists before the first copy rather than behind it.
+
+3. **Short attributed quotation of a stated rationale — permitted, and bounded.**
+   A handful of docstrings in this repository quote a sentence of a third party's
+   *reasoning* — why one cleaning stage must run before another — attributed with
+   a path and a line number, immediately beside this project's own restatement of
+   the same reasoning. Nothing executable was ever carried this way: no
+   expression, no algorithm, no data. This is ordinary attributed quotation of a
+   published rationale, of the kind a comment citing a paper makes, and the
+   previous absolute wording forbade it in words while the repository practised
+   it. It is bounded rather than open: a quotation must be a sentence or two, it
+   must be attributed at the point of use, and it must sit next to the project's
+   own words on the same point — never stand in for them.
+
+The distinction that matters, and it is the same test the rest of this project
+uses: **if you could not have written it without the other file open, it is a
+copy.** Case 1 forbids that outright. Case 2 permits it because the other file is
+the author's own. Case 3 is not that at all — it is quoting someone, with their
+name on it, beside your own argument.

weft_rag-2.4.0/PKG-INFO

@@ -0,0 +1,108 @@
+Metadata-Version: 2.5
+Name: weft-rag
+Version: 2.4.0
+Summary: Weft — a RAG engine built as a microkernel. The default install: the kernel's packs, and the weft command.
+License-Expression: MIT
+License-File: LICENSE
+License-File: NOTICE
+Requires-Python: >=3.12
+Requires-Dist: ftfy>=6.2
+Requires-Dist: opentelemetry-api
+Requires-Dist: packaging>=24
+Requires-Dist: pgvector>=0.3
+Requires-Dist: psycopg[binary]>=3.2
+Requires-Dist: pyyaml
+Requires-Dist: rouge-score>=0.1
+Requires-Dist: weft-kernel<1.0.0,>=0.1.0
+Provides-Extra: all
+Requires-Dist: docling-slim[convert-core,feat-ocr-rapidocr-onnx,format-pdf,models-local]>=2.55; extra == 'all'
+Requires-Dist: openai>=3.1; extra == 'all'
+Requires-Dist: opentelemetry-sdk>=1.28; extra == 'all'
+Requires-Dist: pdfplumber>=0.11.10; extra == 'all'
+Requires-Dist: pillow>=10.0; extra == 'all'
+Requires-Dist: pypdf>=6.16; extra == 'all'
+Requires-Dist: qdrant-client>=1.12; extra == 'all'
+Provides-Extra: bertscore
+Requires-Dist: bert-score>=0.3; extra == 'bertscore'
+Provides-Extra: docling
+Requires-Dist: docling-slim[convert-core,feat-ocr-rapidocr-onnx,format-pdf,models-local]>=2.55; extra == 'docling'
+Provides-Extra: openai
+Requires-Dist: openai>=3.1; extra == 'openai'
+Requires-Dist: pillow>=10.0; extra == 'openai'
+Provides-Extra: otel
+Requires-Dist: opentelemetry-sdk>=1.28; extra == 'otel'
+Provides-Extra: pdf
+Requires-Dist: pdfplumber>=0.11.10; extra == 'pdf'
+Requires-Dist: pypdf>=6.16; extra == 'pdf'
+Provides-Extra: qdrant
+Requires-Dist: qdrant-client>=1.12; extra == 'qdrant'
+Provides-Extra: reference
+Requires-Dist: ruff>=0.16.0; extra == 'reference'
+Description-Content-Type: text/markdown
+
+# weft-rag
+
+Weft — a RAG engine built as a microkernel. This is the default install: the packs that index a
+directory and answer a question about it, and the `weft` command.
+
+**The distribution is `weft-rag`; the command is `weft`** — the name `weft` belongs to an unrelated
+project on PyPI, so what you install and what you run are spelled differently:
+
+```bash
+uvx --from weft-rag weft --help
+```
+
+## What is in it, and what is not
+
+Twenty-one packs ship here and each keeps its own identity: `weft plugins list` prints one row per
+pack, and `weft.toml` configures one at a time — `[packs.store]`, not `[packs.weft-rag]`.
+
+One distribution publishes **beside** this one, and it is separate for a single reason:
+
+| | |
+|---|---|
+| `weft-kernel` | the registry, discovery, the pipeline model and the payload types. Depends on `pydantic` and `opentelemetry-api` and nothing else, and installs and imports alone — which is what proves the kernel names no capability |
+
+Six packs that used to be their own distributions now ship inside this wheel instead, each behind
+an extra that keeps its outside library declinable — G19, 2026-09-09:
+
+| extra | pack | needs |
+|---|---|---|
+| `[openai]` | an `Embedder` and an `LLMProvider` against the OpenAI API | `openai`, `pillow`, and a credential |
+| `[pdf]` | two PDF extraction backends | `pypdf`, `pdfplumber` |
+| `[qdrant]` | a Qdrant store backend, beside the pgvector one shipped here | `qdrant-client` |
+| `[otel]` | sets the OpenTelemetry TracerProvider the registration seam already emits spans into | `opentelemetry-sdk` |
+| `[docling]` | a learned-layout PDF extraction backend | `docling-slim` |
+| — | `agent`, the first-party agentic front end. Imports nothing outside this wheel, so it needs no extra | none |
+
+`weft-rag[all]` installs every one of those libraries at once. `graph` — the Postgres-backed
+graph-traversal pack added at ledger task 11.5 — was never a separate distribution either and
+needs no extra.
+
+None of these seven packs is needed to index a directory and query it. A pack neither we nor you
+wrote installs beside this wheel on exactly the same terms and is discovered the same way, with no
+edit to anything here — that is the extension model, not a courtesy.
+
+See `docs/09-release.md` §1 for why this is one wheel rather than many — fourteen packs at G10
+(2026-08-22), six more folded in by G19 (2026-09-09).
+
+## What installing this trusts
+
+**A pack runs with your full privileges, and installing one is trusting it.** Weft discovers packs
+through Python entry points and calls their `register()` in this process, so a pack can do anything
+the interpreter can do. That is stated rather than mitigated, because the mitigations are not
+available: **signature verification, sandboxing, per-pack privilege separation, and any defence
+against a pack that is hostile once running are all out of reach without a process boundary**,
+which Weft does not have.
+
+What Weft does give you is visibility and refusal, not containment:
+
+- `weft plugins doctor` names every distribution that is installed, at what version, and what each
+  one *discloses* about the network, filesystem and subprocess access it uses. A disclosure is what
+  the pack says about itself; nothing checks it.
+- `[packs] allow` in `weft.toml` is an exhaustive pin. Anything not listed is **never imported** —
+  refusal before any of its code runs, which is the one control that does work without a process
+  boundary.
+
+A control that looked like enforcement but was not would be worse than an acknowledged gap, because
+people build policy on it. `docs/02-extension-model.md` §2 is the argument in full.

weft_rag-2.4.0/README.md

@@ -0,0 +1,66 @@
+# weft-rag
+
+Weft — a RAG engine built as a microkernel. This is the default install: the packs that index a
+directory and answer a question about it, and the `weft` command.
+
+**The distribution is `weft-rag`; the command is `weft`** — the name `weft` belongs to an unrelated
+project on PyPI, so what you install and what you run are spelled differently:
+
+```bash
+uvx --from weft-rag weft --help
+```
+
+## What is in it, and what is not
+
+Twenty-one packs ship here and each keeps its own identity: `weft plugins list` prints one row per
+pack, and `weft.toml` configures one at a time — `[packs.store]`, not `[packs.weft-rag]`.
+
+One distribution publishes **beside** this one, and it is separate for a single reason:
+
+| | |
+|---|---|
+| `weft-kernel` | the registry, discovery, the pipeline model and the payload types. Depends on `pydantic` and `opentelemetry-api` and nothing else, and installs and imports alone — which is what proves the kernel names no capability |
+
+Six packs that used to be their own distributions now ship inside this wheel instead, each behind
+an extra that keeps its outside library declinable — G19, 2026-09-09:
+
+| extra | pack | needs |
+|---|---|---|
+| `[openai]` | an `Embedder` and an `LLMProvider` against the OpenAI API | `openai`, `pillow`, and a credential |
+| `[pdf]` | two PDF extraction backends | `pypdf`, `pdfplumber` |
+| `[qdrant]` | a Qdrant store backend, beside the pgvector one shipped here | `qdrant-client` |
+| `[otel]` | sets the OpenTelemetry TracerProvider the registration seam already emits spans into | `opentelemetry-sdk` |
+| `[docling]` | a learned-layout PDF extraction backend | `docling-slim` |
+| — | `agent`, the first-party agentic front end. Imports nothing outside this wheel, so it needs no extra | none |
+
+`weft-rag[all]` installs every one of those libraries at once. `graph` — the Postgres-backed
+graph-traversal pack added at ledger task 11.5 — was never a separate distribution either and
+needs no extra.
+
+None of these seven packs is needed to index a directory and query it. A pack neither we nor you
+wrote installs beside this wheel on exactly the same terms and is discovered the same way, with no
+edit to anything here — that is the extension model, not a courtesy.
+
+See `docs/09-release.md` §1 for why this is one wheel rather than many — fourteen packs at G10
+(2026-08-22), six more folded in by G19 (2026-09-09).
+
+## What installing this trusts
+
+**A pack runs with your full privileges, and installing one is trusting it.** Weft discovers packs
+through Python entry points and calls their `register()` in this process, so a pack can do anything
+the interpreter can do. That is stated rather than mitigated, because the mitigations are not
+available: **signature verification, sandboxing, per-pack privilege separation, and any defence
+against a pack that is hostile once running are all out of reach without a process boundary**,
+which Weft does not have.
+
+What Weft does give you is visibility and refusal, not containment:
+
+- `weft plugins doctor` names every distribution that is installed, at what version, and what each
+  one *discloses* about the network, filesystem and subprocess access it uses. A disclosure is what
+  the pack says about itself; nothing checks it.
+- `[packs] allow` in `weft.toml` is an exhaustive pin. Anything not listed is **never imported** —
+  refusal before any of its code runs, which is the one control that does work without a process
+  boundary.
+
+A control that looked like enforcement but was not would be worse than an acknowledged gap, because
+people build policy on it. `docs/02-extension-model.md` §2 is the argument in full.

weft_rag-2.4.0/pyproject.toml

@@ -0,0 +1,256 @@
+# `weft-rag` — the default install, and the bundle. Ledger task 6.1; `docs/09-release.md` §1,
+# settled by G10 (2026-08-22) and **re-settled 2026-09-05** after v0.1.0's first contact with a
+# real index. **Named `weft-rag` and not `weft` since ledger task 6.13**: `weft` is taken on PyPI
+# — "The durable task substrate for agent systems", 99 releases — so the name G10 chose is
+# unpublishable. `docs/lessons.md` L6.33.
+#
+# **The command a user types is still `weft`.** It is this distribution's console script, so the
+# rename touches what you install and not what you run: `uvx --from weft-rag weft --help`.
+#
+# ---------------------------------------------------------------------------------------------
+# What this is, and what it stopped being
+# ---------------------------------------------------------------------------------------------
+#
+# It was a meta-distribution: no code, fifteen exact pins, and one job — naming a tested
+# combination. It now **ships twenty-three packs' code and their twenty-one entry points in one
+# wheel** — the fourteen from G10, six more folded in by G19, and `graph` from ledger task
+# 11.5 — and none of them are separate distributions any longer.
+#
+# The measurement that decided it, taken from the twenty `pyproject.toml` files with a parser
+# rather than a regex: **ten of the twenty declared no external dependency whatsoever**.
+# Installing without one of them avoided nothing. They were separate distributions for
+# architectural symmetry, and symmetry is not a user-visible benefit — while twenty names cost
+# twenty trusted-publisher forms, twenty version numbers to keep coherent, and, on the day
+# `v0.1.0` asked PyPI to create nineteen projects, fifteen refusals with
+# `429 Too many new projects created` (`docs/lessons.md` L7.3).
+#
+# **Two distributions ship, and that is G19's count (2026-09-09) — down from the six G10 first
+# left.** `weft-kernel` (`pydantic`, `opentelemetry-api` — and separate for fitness function 1,
+# which installs it alone and imports it; bundling it would demote the check that proves the
+# kernel names no capability) is the one distribution beside this wheel now. `weft-openai`,
+# `weft-pdf`, `weft-qdrant`, `weft-otel`, `weft-agent` and `weft-docling` each carried a
+# dependency somebody may decline as their own distribution; each is now an extra on this wheel
+# instead — `[openai]`, `[pdf]`, `[qdrant]`, `[otel]`, `[docling]` — except `agent`, which needs
+# none at all.
+#
+# **What was given up, stated because the argument is only honest with the cost on the table:**
+#
+#   * **Independent semver for the fourteen.** They versioned separately (`weft-command` at
+#     2.1.0, `weft-store` at 2.0.0, eleven at 1.0.0) and now share this file's version. G9's
+#     deprecation machinery largely existed to manage skew *between* these packs; most of that
+#     skew stops existing. Contract versions (`STORE_CONTRACT_VERSION` and its siblings) are a
+#     separate axis and are **not** affected — a pack outside this wheel still checks them.
+#   * **Per-pack isolated-install proof.** Task 6.6 generalised fitness function 1 to every
+#     published distribution. Twenty of them are no longer separately installable — the fourteen
+#     G10 folded in, and the six more G19 folded in on top — so that check narrows to the two.
+#     What covers the twenty instead is an import assertion against
+#     the built wheel, which is **weaker**, and is labelled weaker in
+#     `scripts/check_isolated_installs.py` rather than counted as the same coverage.
+#   * **Four already-published names become vestigial.** `weft-command`, `weft-embed`,
+#     `weft-generate` and `weft-llm` reached PyPI before the rate limit stopped the rest. PyPI
+#     cannot delete a project. They stay claimed, receive no further versions, and are recorded
+#     here so a future reader does not think they were lost.
+#
+# **What did not change, and it is the point.** The Python packages did not move relative to
+# each other, no import changed, every pack still registers through the same public `weft.packs`
+# entry point a third party uses, and a third-party pack installs beside this wheel exactly as
+# `weft-canary` does. What changed is how the code is *wheeled*, not how it is written.
+#
+# **A pack's identity is its entry-point name, not this distribution's name.** `weft plugins
+# list|doctor` prints twenty-one distinguishable rows, and `[packs.store]` configures the store
+# and nothing else — see `weft_kernel.discovery`'s own module docstring for where the two
+# identities part. That separation is what made this file possible; without it, bundling would
+# have collapsed twenty-one settings namespaces into one.
+
+[project]
+name = "weft-rag"
+# **`2.1.0`, and it is a mechanical fact rather than a promise.** `docs/09-release.md` §2.3's
+# binding rule — G9, 2026-08-21 — forces a distribution's version to track the maximum contract
+# version it publishes, and fitness function 6 enforces it. This wheel publishes sixteen contract
+# constants, and `COMMAND_CONTRACT_VERSION` is `2.1.0`; `weft-command` and `weft-store` already
+# carried `2.x` for exactly this reason before they were bundled, so the number is inherited, not
+# invented. §2.2 answers the objection in advance: "fitness function 6 enforces the binding, not
+# the leading digit... a distribution can carry a major digit above `0` before the project has
+# decided it is *1.0-ready*". The 1.0 milestone is G10's substantive judgment and its precondition
+# table is untouched by this digit.
+# **2.1.0 → 2.2.0 at Phase 7's close, and the bump is a correction rather than a routine
+# increment.** Tasks 7.0 and 7.2a added two *public* modules — `weft_command.invocation` (the
+# invocation seam, where a library caller now enters) and `weft_command.catalogue` (the command
+# walk, moved out of `weft_cli`) — and the version did not move. `v2.1.0` is a git tag, and
+# `git ls-tree v2.1.0` shows neither module, so `2.1.0` named two different APIs and
+# `weft-agent`'s own `weft-rag>=2.0.0` would have resolved, from an index, to a published
+# distribution that cannot satisfy `from weft_command.invocation import invoke`. **Minor, per
+# G9's two-audience rule**: a new module is additive for a caller and changes no Protocol, so an
+# implementer owes nothing. Found by Phase 7's close review; `docs/lessons.md` `L8.40`.
+# **2.3.0 → 2.4.0 at ledger task 11.5** — `weft_kg` gained a `register()`, a new `weft.packs`
+# entry point (`graph`) and two new plugin names. Minor, per the identical G9 rule immediately
+# above: additive for a caller, no Protocol changed.
+version = "2.4.0"
+description = "Weft — a RAG engine built as a microkernel. The default install: the kernel's packs, and the weft command."
+requires-python = ">=3.12"
+license = "MIT"
+license-files = ["LICENSE", "NOTICE"]
+readme = "README.md"
+
+# The kernel, and every external dependency the fourteen bundled packs declared between them.
+# Ten of the fourteen declared none at all; these are the rest, each kept with the floor its
+# own distribution set and the reason its own manifest gave:
+#
+#   * `ftfy` — `weft_clean`'s mojibake repair.
+#   * `rouge-score` — `weft_eval`'s lexical-overlap metrics.
+#   * `psycopg[binary]` + `pgvector` — `weft_store`'s pgvector backend. The heaviest thing here,
+#     and the one genuine argument against a single wheel: an operator who only wants Qdrant
+#     still gets a Postgres driver. Kept in rather than made an extra, because `pgvector` is the
+#     default store every quickstart, every fixture and the one `compose.yaml` container assume,
+#     and an extra that everything defaults to needing is a footgun with a flag on it.
+#   * `pyyaml` — `weft_cli.pipeline_catalogue`, the one module that opens a pipeline document.
+#     G1 fixes `weft-kernel`'s dependencies at `pydantic` and `opentelemetry-api`, so a YAML
+#     parser can never live there.
+#   * `opentelemetry-api` — `weft_cli.tracing_status` reads `get_tracer_provider()` directly, to
+#     answer `weft plugins doctor`'s "are my spans going anywhere?" as a fact about the process.
+#     Declared explicitly rather than left to arrive through `weft-kernel`.
+#   * `packaging` — `weft_cli.skew` parses PEP 508 requirements and version specifiers.
+dependencies = [
+    "weft-kernel>=0.1.0,<1.0.0",
+    "ftfy>=6.2",
+    "rouge-score>=0.1",
+    "psycopg[binary]>=3.2",
+    "pgvector>=0.3",
+    "pyyaml",
+    "opentelemetry-api",
+    "packaging>=24",
+]
+
+# Both extras are inherited unchanged from the distributions that declared them, and both exist
+# for the same reason: a dependency that only one surface needs, which nothing on the
+# index-and-ask path ever reaches.
+#
+#   * `bertscore` — `weft_eval.embedding_metrics`' optional judge. A model download.
+#   * `reference` — `weft_cli.contract_reference` pipes generated Markdown through the real
+#     `ruff format`, so the checked-in file is byte-identical to what `poe ci-checks`' own `fmt`
+#     step produces. The floor is >=0.16.0, the first release that formats Python code blocks in
+#     Markdown by default, which is the behaviour it relies on. **Declared at task 6.7 and
+#     declared nowhere before**: it worked only because the workspace root's dev group carries
+#     `ruff` (`docs/lessons.md` L6.24).
+[project.optional-dependencies]
+bertscore = ["bert-score>=0.3"]
+reference = ["ruff>=0.16.0"]
+
+# **The six capability extras — G19, 2026-09-09.** Each was its own published distribution until
+# that session, on G10's criterion that a pack "carrying a dependency somebody may decline" ships
+# separately. An extra makes the dependency declinable at a fraction of the cost, so the code now
+# ships in this wheel and only the outside library is optional. What a user declines is what they
+# were ever declining: `docling-slim` is 897 MB and `weft_docling` is a few kilobytes.
+#
+# **A pack whose extra is not installed reports `failed`, and that is by design rather than by
+# luck.** `weft_kernel.discovery` folds any import error into a `FAILED` report — its own comment:
+# "a pack's import can raise anything; that is FAILED, not a crash" — so `weft plugins doctor`
+# names the pack and what is missing, and the run continues without it.
+#
+# `agent` has no extra and needs none: `weft_agent` imports nothing outside this wheel, so it is
+# always available. It is listed here in the comment rather than in the table because an empty
+# extra would be a knob that does nothing.
+pdf = ["pypdf>=6.16", "pdfplumber>=0.11.10"]
+openai = ["openai>=3.1", "pillow>=10.0"]
+qdrant = ["qdrant-client>=1.12"]
+otel = ["opentelemetry-sdk>=1.28"]
+docling = ["docling-slim[convert-core,format-pdf,models-local,feat-ocr-rapidocr-onnx]>=2.55"]
+# `all` lists the libraries rather than referring to this distribution's own extras. A
+# self-reference (`weft-rag[pdf,openai,...]`) is a requirement on a sibling with no version
+# bound, which fitness function 10(b) refuses for the reason it refuses every other one: an
+# unbounded requirement permits any pack against any kernel. Listing them is also the honest
+# form — a reader sees what `all` costs without resolving anything.
+all = [
+    "pypdf>=6.16",
+    "pdfplumber>=0.11.10",
+    "openai>=3.1",
+    "pillow>=10.0",
+    "qdrant-client>=1.12",
+    "opentelemetry-sdk>=1.28",
+    "docling-slim[convert-core,format-pdf,models-local,feat-ocr-rapidocr-onnx]>=2.55",
+]
+
+[project.scripts]
+weft = "weft_cli.cli:main"
+
+# The twenty-one packs this wheel registers. **The name on the left is the pack's identity** — the
+# row `weft plugins list|doctor` prints, and the key a `[packs.<pack>]` settings block uses — so
+# these twenty-one are what an operator writes in `weft.toml`, never `weft-rag`.
+#
+# Twenty-three packages ship; twenty-one register. `weft_command` and `weft_prompts` deliberately declare
+# no entry point and register nothing: fitness function 2 requires a distribution declaring one
+# to be active *and contributing*, and every first-party prompt belongs to the plugin that asks
+# it a question. They are libraries other packs publish contracts from, which is a real thing to
+# be, and a pack that registers nothing is one fitness function 2 would have to waive.
+[project.entry-points."weft.packs"]
+blob = "weft_blob:register"
+chunk = "weft_chunk:register"
+clean = "weft_clean:register"
+cli = "weft_cli.commands:register"
+embed = "weft_embed:register"
+enhance = "weft_enhance:register"
+eval = "weft_eval:register"
+extract = "weft_extract:register"
+generate = "weft_generate:register"
+index = "weft_index:register"
+llm = "weft_llm:register"
+retrieve = "weft_retrieve:register"
+store = "weft_store:register"
+vision = "weft_vision:register"
+
+# The six that arrived with G19 (2026-09-09), each formerly its own distribution. A pack's
+# identity is its name on the left, and those names are unchanged — `pdf`, `openai`, `qdrant`,
+# `otel`, `agent`, `docling` are what an operator already writes in `weft.toml`, so no
+# `[packs.*]` block, no `[services]` selection and no `plugins doctor` row moves. Only the wheel
+# they arrive in changed.
+agent = "weft_agent:register"
+docling = "weft_docling:register"
+openai = "weft_openai:register"
+otel = "weft_otel:register"
+pdf = "weft_pdf:register"
+qdrant = "weft_qdrant:register"
+# Ledger task 11.5 — `weft_kg` was already carried in this wheel's own package list (11.4
+# published its contract with no entry point at all); this is the line that makes it reachable.
+graph = "weft_kg:register"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+# Twenty-three top-level packages in one wheel, listed rather than globbed: a glob would silently
+# ship whatever happened to be under `src/`, and what this distribution ships is a decision.
+#
+# **They live under this project's own `src/`, and that placement is load-bearing.** The first
+# attempt pointed `[tool.hatch.build.targets.wheel.force-include]` at `../weft-chunk/src/...` and
+# left the fourteen where they were. The wheel built and worked; `uv build` — which builds the
+# sdist and then builds a wheel *from* it, in an isolated directory where `../` does not exist —
+# failed outright, so task 6.7's "every sdist carries what the checkout has" could never hold.
+# A path outside the project root is not a packaging detail one backend flag away; it is outside
+# what a source distribution can contain. Moving the trees here costs nothing at all — the
+# top-level module names are unchanged, so no import in the tree, and no test, changed.
+[tool.hatch.build.targets.wheel]
+packages = [
+    "src/weft_agent",
+    "src/weft_blob",
+    "src/weft_chunk",
+    "src/weft_clean",
+    "src/weft_cli",
+    "src/weft_command",
+    "src/weft_docling",
+    "src/weft_embed",
+    "src/weft_enhance",
+    "src/weft_eval",
+    "src/weft_extract",
+    "src/weft_generate",
+    "src/weft_index",
+    "src/weft_kg",
+    "src/weft_llm",
+    "src/weft_openai",
+    "src/weft_otel",
+    "src/weft_pdf",
+    "src/weft_prompts",
+    "src/weft_qdrant",
+    "src/weft_retrieve",
+    "src/weft_store",
+    "src/weft_vision",
+]