BatchWeaver v1.0.1

BatchWeaver v1.0.1

A patch release that fixes the VS Code extension source build. The Go module,
CLI, and public API are unchanged from v1.0.0.

Fixed

• BW-KI-014 — the extension failed a clean source build. In v1.0.0,
  editors/vscode/package.json declared version 1.0.0 while its
  package-lock.json still recorded 0.1.0-beta.3. npm ci validates that the
  two agree, so a clean install failed and the extension could not be built or
  packaged from the v1.0.0 source tree. The lockfile is now synchronized.

• The extension version check no longer drifts. The extension test read a
  hard-coded version string, so every release bump broke it after the fact. It
  now derives the expected version from release/VERSION, the single canonical
  version for the repository, and asserts that package.json, the lockfile, and
  the lockfile root package all agree with it.

The Go module, CLI, and prebuilt VSIX were unaffected by BW-KI-014; only
building the extension from source was.

Compatibility

No API change. v1.0.1 is a drop-in replacement for v1.0.0.

• Tier 1 (stable, SemVer): module root, config, diagnostics,
  operation, runtime — unchanged.
• Tier 2 (experimental): bridge and the four adapters/* packages —
  unchanged.
• Go: go1.26.x; minimum go1.26.0, current go1.26.5.

Install

go install github.com/Voskan/BatchWeaver/cmd/batchweaver@v1.0.1
go get github.com/Voskan/BatchWeaver@v1.0.1

Remaining accepted risks

Unchanged from v1.0.0 except where noted; see the
stable-release decision.

1. Artifacts are unsigned and carry no hosted build attestation
   (BW-KI-012).
2. No extended production-campaign evidence at the tagged commit
   (BW-KI-013). The hosted compatibility matrix, build modes, cross-targets,
   CodeQL, dependency review, and release assurance did succeed at the v1.0.0
   commit.
3. The public prerelease period was short.
4. No live-backend acceptance. Client integrations use hermetic fakes.

Installation is no longer an accepted risk: go install ...@v1.0.0 was verified
from the public module proxy.

BatchWeaver v1.0.0

BatchWeaver v1.0.0

The first stable release. v1.0.0 freezes the public Go API under Semantic
Versioning and ships a tested upgrade path from every published prerelease.

What BatchWeaver is

A proof-gated batching compiler and typed request-coalescing runtime for Go. It
finds supported scalar access patterns — including common N+1 query shapes —
proves their safety conditions, previews deterministic changes, and executes
compatible calls in bounded batches without silently crossing request, tenant,
authorization, transaction, or session boundaries.

Highlights since v0.1.0-beta.3

• Concrete client bindings. Public adapters/pgxv5, adapters/redisv9,
  adapters/gqlgen, and adapters/grpcgo packages with hermetic coverage
  (pgxmock, miniredis, the public gqlgen extension API, and grpc-go bufconn).
• Composite and bounded-join SQL synthesis. Composite-key PostgreSQL reads
  and one explicitly at-most-one INNER/LEFT join, with integrity validation.
• Shared workspace analysis cache. The daemon owns a bounded,
  content-addressed cache that CLI and editor requests reuse.
• Hosted compatibility matrix enforcement and a scheduled production-like
  campaign covering eleven fuzz categories, soak, leak budgets, and faults.
• Executable prerelease migration suite from beta.1, beta.2, and beta.3.

Compatibility

• Tier 1 (stable, SemVer): module root, config, diagnostics,
  operation, runtime.
• Tier 2 (experimental): bridge and the four adapters/* packages. They
  ship in the v1 module but may change incompatibly in a minor release.
• Artifact schemas remain v1alpha1 and are regenerated, not migrated.
• Go: go1.26.x; minimum go1.26.0, current go1.26.5.

Full detail: API freeze.

Install

go install github.com/Voskan/BatchWeaver/cmd/batchweaver@v1.0.0
go get github.com/Voskan/BatchWeaver@v1.0.0

Upgrading from a beta

Configuration schema 1 is unchanged, so beta configuration loads as-is. Discard
analysis, proof, transform, profile, daemon, and editor caches and regenerate
bridges and transformation plans rather than reusing beta artifacts. The full
sequence is in migration, which is executable and runs on
every test run.

Accepted risks

This release ships with four documented gaps. They are recorded, not hidden.

1. Artifacts are unsigned and carry no hosted build attestation. Integrity
   is verifiable through SHA-256 checksums, SPDX/CycloneDX SBOMs, a local
   provenance statement, and reproducible builds.
2. Hosted compatibility evidence was not observed at the tagged commit. The
   matrix passes locally and the workflow exists.
3. The public prerelease period was short, so field evidence is limited to
   the project's automated suites. No long-term production-stability claim is
   made.
4. No live-backend acceptance. Client integrations use hermetic fakes.

Each has a remediation plan in the
stable-release decision and the
machine-readable gate report.

Verification

sha256sum --check SHA256SUMS
batchweaver version
batchweaver doctor

Known limitations

See KNOWN-ISSUES.md and
docs/limitations.

BatchWeaver v0.1.0-beta.3

BatchWeaver 0.1.0-beta.3 Release Notes

Status: public beta prerelease. This version supersedes beta.1 and beta.2 for
new installations; it is not a stable-v1 or production-readiness claim.

Why beta.3

Public verification of a complete beta.2 GitHub Release download found that
GitHub flattened five reports/... asset paths while SHA256SUMS retained the
directory prefixes. The files and their individual GitHub digests were intact,
but whole-set verification failed. Published versions are immutable, so beta.2
was not retagged and its assets were not replaced.

Beta.3 emits every manifest-declared artifact at the release root and rejects
nested, empty, or duplicate public asset names before publication. This makes
GitHub asset names, manifest paths, and checksum paths identical.

Installation

go install github.com/Voskan/BatchWeaver/cmd/batchweaver@v0.1.0-beta.3
go get github.com/Voskan/BatchWeaver@v0.1.0-beta.3
batchweaver version
batchweaver doctor

The version command must report BatchWeaver 0.1.0-beta.3 and channel beta.
Install the VSIX with:

code --install-extension batchweaver-vscode-0.1.0-beta.3.vsix

Verify a complete release download

Download every GitHub Release asset into one directory, then run:

shasum -a 256 -c SHA256SUMS
batchweaver release verify release-manifest.json

GNU systems may use sha256sum -c SHA256SUMS. Both commands must verify the
entire declared set, including reports, SBOMs, provenance, archives, and VSIX.

Compatibility and safety

The supported API, schemas, ABI, feature surface, and compatibility matrix are
unchanged from beta.2. Go 1.26.5 is the supported toolchain. Preview
transformations and run the full application test suite before any explicit
materialization.

Verification limitations

The tag and artifacts are unsigned. SHA256SUMS provides integrity
verification, SBOMs are supplied in SPDX and CycloneDX formats, and the local
unsigned provenance statement does not claim a hosted SLSA level.

Security and feedback

Report vulnerabilities through the private process in SECURITY.md. Use the
structured issue forms or Discussions for reproducible beta feedback. No source
or runtime data is uploaded and no telemetry is added.

BatchWeaver v0.1.0-beta.2

BatchWeaver 0.1.0-beta.2 Release Notes

Status: public beta prerelease. This version supersedes beta.1 for new
installations; neither release is a stable-v1 or production-readiness claim.

Why beta.2

Public verification of go install ...@v0.1.0-beta.1 found that the installed
CLI reported dev. The beta.1 module, packages, and release archives were
otherwise intact. Semantic-versioned releases are immutable, so beta.1 was not
retagged or replaced.

Beta.2 derives its version and available revision from Go module build
information whenever release linker metadata is absent. It also includes the
corrected GitHub Pages workflow pin discovered during the beta.1 deployment.

Installation

go install github.com/Voskan/BatchWeaver/cmd/batchweaver@v0.1.0-beta.2
go get github.com/Voskan/BatchWeaver@v0.1.0-beta.2
batchweaver version
batchweaver doctor

The version command must report BatchWeaver 0.1.0-beta.2 and channel beta.

Archives must be checked against SHA256SUMS. Install the VSIX with:

code --install-extension batchweaver-vscode-0.1.0-beta.2.vsix

Compatibility and safety

The supported feature surface and compatibility matrix are unchanged from
beta.1. Go 1.26.5 is the supported toolchain. Concrete pgx, go-redis, gqlgen,
and grpc-go bindings are not included. Preview transformations and run the full
application test suite before any explicit materialization.

Verification limitations

The tag and artifacts are unsigned. SHA256SUMS provides integrity
verification, SBOMs are supplied in SPDX and CycloneDX formats, and the local
unsigned provenance statement does not claim a hosted SLSA level.

Security and feedback

Report vulnerabilities through the private process in SECURITY.md. Use the
structured issue forms or Discussions for reproducible beta feedback. No source
or runtime data is uploaded and no telemetry is added.

Superseded: New installations should use v0.1.0-beta.3. Earlier tags and assets remain unchanged for auditability.

BatchWeaver v0.1.0-beta.1

BatchWeaver 0.1.0-beta.1 Release Notes

Status: public beta prerelease. This is not a stable-v1 or production-readiness
claim.

Summary

BatchWeaver is a proof-gated Go compiler/runtime toolkit that turns supported
scalar access patterns into reviewed batch execution. This beta packages the
compiler, proof engine, overlay-first transformer, typed runtime, adapter
contracts, daemon/LSP, VS Code extension, and release assurance tooling.

Why BatchWeaver

Manual batching can improve throughput but can also change ordering, errors,
cancellation, authorization boundaries, and transaction identity. BatchWeaver
requires a semantic proof for each supported transformation and rejects cases it
cannot justify conservatively.

Included and supported

• static loop prefetch and certified runtime-call lowering for documented shapes;
• explicit typed batch providers and database/sql/net/http integrations;
• deterministic plans, diffs, overlays, transformed tests, materialize/revert;
• macOS arm64 native validation and five cross-platform archives;
• standalone LSP, optional gopls proxy, and a release-asset VSIX.

Installation

go install github.com/Voskan/BatchWeaver/cmd/batchweaver@v0.1.0-beta.1
batchweaver version
batchweaver doctor

Archives must be checked against SHA256SUMS before execution. The VSIX can be
installed locally with
code --install-extension batchweaver-vscode-0.1.0-beta.1.vsix.

Five-minute quickstart

git clone https://github.com/Voskan/BatchWeaver.git
cd BatchWeaver
git checkout v0.1.0-beta.1
go run ./cmd/batchweaver scan ./examples/static-prefetch/...
go run ./cmd/batchweaver prove ./examples/static-prefetch/...
go test -race ./examples/static-prefetch/...

Preview and test before any explicit materialization. Source remains unchanged
by default.

Compatibility and known limitations

Go 1.26.5 is the supported toolchain. Native evidence is strongest on
macOS/arm64; other artifact targets have limited cross-build evidence as recorded
in release/compatibility.json. Concrete pgx, go-redis, gqlgen, and grpc-go
bindings are not included. The VSIX installs and activates in a real Visual
Studio Code 1.131.0 Extension Host on macOS arm64. See KNOWN-ISSUES.md.

Breaking-change policy

This is a beta. Public Go APIs, schemas, runtime ABI, and generated artifacts may
change between prereleases with changelog and migration guidance. Tags and
released assets are immutable.

Upgrade, rollback, and verification

Keep tool/runtime/extension versions aligned, regenerate plans after upgrades,
and invalidate versioned caches. Roll back by disabling transformations, using
the scalar path, reverting materialized changes, clearing versioned caches, and
installing the prior version. Verify artifacts with sha256sum -c SHA256SUMS or
shasum -a 256 -c SHA256SUMS, then run batchweaver release verify when the
manifest and complete asset set are together.

The tag and artifacts are unsigned. SHA256SUMS provides integrity verification,
the supplied provenance statement is local and unsigned, and no hosted SLSA
level is claimed.

Security and feedback

Do not report vulnerabilities or transformation isolation failures in a public
issue; follow SECURITY.md. Reproducible bugs and beta feedback use the GitHub
issue forms. BatchWeaver uploads no source or runtime data and adds no telemetry.

Contributors

This prerelease was produced from the repository history. No external
adoption, contributor, or production-validation claim is made.

Superseded: New installations should use v0.1.0-beta.3. Earlier tags and assets remain unchanged for auditability.