v0.16.0 — Node-free MCP host, overlay self-disclosure, "bring an adapter" diagnostics

v0.16.0 — Node-free MCP host, overlay self-disclosure, "bring an adapter" diagnostics

Highlights

zzop-mcp: a Node-free host binary (in-tree). One self-contained executable that runs the full engine with zero Node runtime — an MCP stdio server plus direct CLI subcommands.

• Tools: analyze_repo (auto-discovers <path>/zzop.config.jsonc; zero-config runs still include the bundled rule packs and default git signal collection), cross_repo (config-first via configPath — the config's trees, including "auto", define the join — or config-free paths mode, which explicitly discloses any per-tree config it did NOT load), and validate_envelope (the custom-parser authoring feedback loop).
• Resources: 7 authoring contracts embedded in the binary under zzop://contract/* — envelope JSON Schema and guide, the byte-pinned key-normalization fixture, DSL reference and authoring guide, a minimal example envelope. You can author a custom parser or rule pack against the binary alone, with no source checkout.
• Output contract: summary-first (full counts by severity/rule always ride along), capped lists always disclose truncation ({shown, totalMatching, hint}), and the honesty channels — warnings, configWarnings, the disclosure registry — are never capped.
• Protocol robustness: malformed JSON-RPC lines answer -32700 (previously a silent swallow that could hang a client on Windows-path escapes); non-object frames answer -32600.
• Distribution status: build from source this release (cargo build -p zzop-mcp); prebuilt binaries are the next distribution step. See docs/modules/mcp.md.

Overlay self-disclosure (engine). Mode-B adapter overlays now explain themselves instead of failing silently:

• source-mismatch: an overlay declaring source: "X" attached to a tree whose sourceId is "Y" warns that its facts merge into Y — joins that look cross-source read as intra-source. (Emitted only when the overlay carries join-relevant io; attribute-/entry-marker-only overlays are source-agnostic and stay quiet.)
• synthetic entries: declared files[].path entries that match no file in the tree are counted and named — path typos no longer silently inflate fileCount.
• zero-fact envelopes: an overlay whose entries carry no consumed facts is called out — and, with teeth: an overlay entry now counts as parser coverage only if it actually contributes a fact, so an empty adapter can no longer mask the diagnostic below. (Note for adapter authors: Mode B does not consume overlay symbols; see the updated contract notes in docs/NORMALIZED_AST.md.)

Per-extension "bring an adapter" diagnostic (engine). Files whose extension has no native parser (a .sql migration, a .py service) no longer vanish silently: one aggregated warning per extension names sample files and the exact remedy (overlays: [...] in zzop.config.jsonc). Non-source files (docs, images, lockfiles, styles, ...) are excluded via a pinned list.

Also in this release

• packDefs (embedders): AnalyzeRequest accepts inline rule-pack definitions, loaded before packsDir directories (a directory pack with the same id wins) — this is how the self-contained binary ships its bundled packs as data. The JS surface is unchanged.
• New shared crates: zzop-facade (the pure JSON facade, extracted so the Node addon and the binary drive one engine code path) and zzop-config (a Rust port of the config front-end with JS parity; one documented deviation — path-like config values resolve against the config file's directory, since a server host's cwd is meaningless).
• Workspace layout (contributors): internal crates moved under crates/; packages/ now holds only published artifacts; the npm binding directory was renamed packages/napi → packages/native to match its public name @zzop/native. Crate names are unchanged.
• Docs: adapter self-disclosure contract notes (docs/NORMALIZED_AST.md, docs/adapters/README.md), new docs/modules/mcp.md and packages/mcp/README.md, packDefs/validateEnvelopeOnly documented in docs/modules/napi.md, the DSL reference gained the previously-missing trigger_in_loop field, plus a number of accuracy fixes (including the site's health output example, which showed a field that does not exist).

Behavior changes to expect

• New warnings may appear on existing repos — the unparsed-extension diagnostic and the overlay self-disclosure set. These are warnings only: findings, caches, and parser fingerprints are unchanged, so upgrading does not trigger a re-analysis.
• No breaking changes. The envelope contract (v1) and every config key are unchanged; packDefs is additive.