1.0.0rc4: federation WEFT_FEDERATION_TOKEN + dogfood 2026-06-06 (gate clarity, legis dev-loop, payload controls, 401 distinction)

.agents/skills/filigree-workflow/SKILL.md

@@ -196,7 +196,7 @@ When parsing `--json` output or MCP responses, expect these unified envelopes:
   one of: `VALIDATION`, `NOT_FOUND`, `CONFLICT`, `INVALID_TRANSITION`,
   `PERMISSION`, `NOT_INITIALIZED`, `IO`, `INVALID_API_URL`,
   `FILE_REGISTRY_DISPLACED`, `REGISTRY_UNAVAILABLE`,
-  `CLARION_REGISTRY_VERSION_MISMATCH`, `CLARION_OUT_OF_SYNC`,
+  `LOOMWEAVE_REGISTRY_VERSION_MISMATCH`, `LOOMWEAVE_OUT_OF_SYNC`,
   `BRIEFING_BLOCKED`, `STOP_FAILED`, `SCHEMA_MISMATCH`, `INTERNAL`.
   Branch on `code` for retry policy
   (`CONFLICT` → exit 4, retryable; everything at exit 1 needs operator

.agents/skills/loomweave-workflow/.fingerprint

@@ -1 +1 @@
-fe04e6fd9d528b07738f527b41d817dff89344f051465af012fc42ed44377ea3
+8af48023ff74748434eec046b718fe586bce8784e51d474c9c58daf8f292326b

.agents/skills/loomweave-workflow/SKILL.md

@@ -65,18 +65,27 @@ tell which case you're in.
 | `execution_paths_from` | bounded call paths out of an entity | `{"id": "<id>", "max_depth": 5}` |
 | `subsystem_members` | modules in a subsystem | `{"id": "core:subsystem:<hash>"}` |
 | `subsystem_of` | the subsystem an entity belongs to (reverse of `subsystem_members`) | `{"id": "<id>"}` |
-| `summary` | on-demand prose summary of one entity | `{"id": "<id>"}` |
+| `summary` † | on-demand prose summary of one entity | `{"id": "<id>"}` |
 | `summary_preview_cost` | preview a `summary` call's cache status / cost before spending | `{"id": "<id>"}` |
 | `issues_for` | Filigree issues attached to an entity | `{"id": "<id>"}` |
 | `source_for_entity` | an entity's exact indexed source span + bounded context | `{"id": "<id>", "context_lines": 10}` |
 | `call_sites` | the source line(s) behind a calls/references edge | `{"id": "<id>", "role": "caller"}` |
 | `orientation_pack` | one deterministic orientation packet for an entity or file:line (entity + context + neighbors + paths + issues + freshness) | `{"file": "rel/path.py", "line": 42}` |
 | `index_diff` | index freshness / drift vs. the current working tree | `{}` |
-| `analyze_start` | launch a background re-index, return its `run_id` | `{}` |
+| `analyze_start` † | launch a background re-index, return its `run_id` | `{}` |
 | `analyze_status` | poll a started analyze (queued/running/terminal + progress) | `{"run_id": "<id>"}` |
-| `analyze_cancel` | stop a running analyze (group-kills plugin + Pyright) | `{"run_id": "<id>"}` |
+| `analyze_cancel` † | stop a running analyze (group-kills plugin + Pyright) | `{"run_id": "<id>"}` |
 | `project_status` | index freshness, counts, LLM + Filigree status | `{}` |
 
+† **Write-gated.** `summary` (`entity_summary_get`), `analyze_start`,
+`analyze_cancel`, `propose_guidance`, and `promote_guidance` are registered only
+when `serve.mcp.enable_write_tools: true` is set in `loomweave.yaml` (default
+`false`). When the gate is off they do not appear in `tools/list` and a call
+returns a tool-disabled error — run `loomweave config check` to see the active
+policy. `summary` additionally requires the live LLM provider to be enabled
+(`llm_policy.enabled: true` + `allow_live_provider: true`), or it serves cache
+only.
+
 `callers_of` / `neighborhood` / `execution_paths_from` take a `confidence`
 tier — one of `"resolved"` (default; only high-confidence edges),
 `"ambiguous"`, or `"inferred"`. There is no `"all"` value. When you suspect an
@@ -163,6 +172,7 @@ for team sharing). Agents may call `propose_guidance` to create a Filigree
 observation, but that proposal is inert until an operator promotes it through
 `promote_guidance` or the CLI. Promoted sheets reach you through `guidance_for`
 and are composed into `summary` prompts with a real guidance fingerprint.
+(`propose_guidance` and `promote_guidance` are write-gated — see the † note above.)
 
 ## Workflow: orient, then navigate
 

.claude/skills/filigree-workflow/SKILL.md

@@ -196,7 +196,7 @@ When parsing `--json` output or MCP responses, expect these unified envelopes:
   one of: `VALIDATION`, `NOT_FOUND`, `CONFLICT`, `INVALID_TRANSITION`,
   `PERMISSION`, `NOT_INITIALIZED`, `IO`, `INVALID_API_URL`,
   `FILE_REGISTRY_DISPLACED`, `REGISTRY_UNAVAILABLE`,
-  `CLARION_REGISTRY_VERSION_MISMATCH`, `CLARION_OUT_OF_SYNC`,
+  `LOOMWEAVE_REGISTRY_VERSION_MISMATCH`, `LOOMWEAVE_OUT_OF_SYNC`,
   `BRIEFING_BLOCKED`, `STOP_FAILED`, `SCHEMA_MISMATCH`, `INTERNAL`.
   Branch on `code` for retry policy
   (`CONFLICT` → exit 4, retryable; everything at exit 1 needs operator

.claude/skills/loomweave-workflow/.fingerprint

@@ -1 +1 @@
-fe04e6fd9d528b07738f527b41d817dff89344f051465af012fc42ed44377ea3
+8af48023ff74748434eec046b718fe586bce8784e51d474c9c58daf8f292326b

.claude/skills/loomweave-workflow/SKILL.md

@@ -65,18 +65,27 @@ tell which case you're in.
 | `execution_paths_from` | bounded call paths out of an entity | `{"id": "<id>", "max_depth": 5}` |
 | `subsystem_members` | modules in a subsystem | `{"id": "core:subsystem:<hash>"}` |
 | `subsystem_of` | the subsystem an entity belongs to (reverse of `subsystem_members`) | `{"id": "<id>"}` |
-| `summary` | on-demand prose summary of one entity | `{"id": "<id>"}` |
+| `summary` † | on-demand prose summary of one entity | `{"id": "<id>"}` |
 | `summary_preview_cost` | preview a `summary` call's cache status / cost before spending | `{"id": "<id>"}` |
 | `issues_for` | Filigree issues attached to an entity | `{"id": "<id>"}` |
 | `source_for_entity` | an entity's exact indexed source span + bounded context | `{"id": "<id>", "context_lines": 10}` |
 | `call_sites` | the source line(s) behind a calls/references edge | `{"id": "<id>", "role": "caller"}` |
 | `orientation_pack` | one deterministic orientation packet for an entity or file:line (entity + context + neighbors + paths + issues + freshness) | `{"file": "rel/path.py", "line": 42}` |
 | `index_diff` | index freshness / drift vs. the current working tree | `{}` |
-| `analyze_start` | launch a background re-index, return its `run_id` | `{}` |
+| `analyze_start` † | launch a background re-index, return its `run_id` | `{}` |
 | `analyze_status` | poll a started analyze (queued/running/terminal + progress) | `{"run_id": "<id>"}` |
-| `analyze_cancel` | stop a running analyze (group-kills plugin + Pyright) | `{"run_id": "<id>"}` |
+| `analyze_cancel` † | stop a running analyze (group-kills plugin + Pyright) | `{"run_id": "<id>"}` |
 | `project_status` | index freshness, counts, LLM + Filigree status | `{}` |
 
+† **Write-gated.** `summary` (`entity_summary_get`), `analyze_start`,
+`analyze_cancel`, `propose_guidance`, and `promote_guidance` are registered only
+when `serve.mcp.enable_write_tools: true` is set in `loomweave.yaml` (default
+`false`). When the gate is off they do not appear in `tools/list` and a call
+returns a tool-disabled error — run `loomweave config check` to see the active
+policy. `summary` additionally requires the live LLM provider to be enabled
+(`llm_policy.enabled: true` + `allow_live_provider: true`), or it serves cache
+only.
+
 `callers_of` / `neighborhood` / `execution_paths_from` take a `confidence`
 tier — one of `"resolved"` (default; only high-confidence edges),
 `"ambiguous"`, or `"inferred"`. There is no `"all"` value. When you suspect an
@@ -163,6 +172,7 @@ for team sharing). Agents may call `propose_guidance` to create a Filigree
 observation, but that proposal is inert until an operator promotes it through
 `promote_guidance` or the CLI. Promoted sheets reach you through `guidance_for`
 and are composed into `summary` prompts with a real guidance fingerprint.
+(`propose_guidance` and `promote_guidance` are write-gated — see the † note above.)
 
 ## Workflow: orient, then navigate
 

.gitignore

@@ -15,9 +15,18 @@ site/
 
 # Wardline runtime output
 findings.jsonl
-.wardline-cache/
+
+# Sibling legacy locations (transition window — .weft/<sibling>/ is preferred but
+# the old dot-dirs may still be present until siblings finish migrating).
 .loomweave
 
+# NOTE: do NOT ignore .weft/ — wardline's own .weft/wardline/{baseline,judged,waivers}.yaml
+# are deliberately committed; weft.toml is operator-authored and tracked.
+# DO ignore transient sibling port files: a committed .weft/<sibling>/ephemeral.port
+# would let a shared repo redirect wardline's token-bearing emit to a chosen loopback
+# port (a live, never-committed runtime artifact, not tracked state).
+.weft/*/ephemeral.port
+
 # Filigree issue tracker
 .filigree/
 .env
@@ -33,4 +42,3 @@ CLAUDE.md
 .coverage
 coverage.json
 loomweave.yaml
-wardline.yaml