feat: establish ConceptWeave foundation

.github/workflows/product.yml

@@ -0,0 +1,99 @@
+name: Product
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  rust-quality:
+    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
+    runs-on: ubuntu-24.04
+    env:
+      COVERAGE_TOOLCHAIN: nightly-2026-08-20
+    steps:
+      - name: Checkout exact source revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Verify exact source revision
+        env:
+          EXPECTED_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
+
+      - name: Validate Product CI contract
+        run: python3 scripts/check_ci_contract.py
+
+      - name: Show pinned Rust toolchain
+        run: rustc --version && cargo --version
+
+      - name: Format
+        run: cargo fmt --all --check
+
+      - name: Clippy
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - name: Test
+        run: cargo test --workspace
+
+      - name: Public documentation
+        env:
+          RUSTDOCFLAGS: -D warnings
+        run: cargo doc --workspace --no-deps
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
+        with:
+          tool: cargo-llvm-cov
+
+      - name: Install pinned branch-coverage toolchain
+        run: rustup toolchain install "$COVERAGE_TOOLCHAIN" --profile minimal --component llvm-tools-preview
+
+      - name: Exact owned coverage
+        run: ./scripts/check_coverage.sh
+
+      - name: Validate public JSON contract
+        run: |
+          npx --yes ajv-cli@5.0.0 compile \
+            --spec=draft2020 \
+            -s contracts/semantic-candidate.schema.json
+          npx --yes ajv-cli@5.0.0 test \
+            --spec=draft2020 \
+            -s contracts/semantic-candidate.schema.json \
+            -d contracts/fixtures/semantic-candidate.valid.json \
+            --valid
+          npx --yes ajv-cli@5.0.0 test \
+            --spec=draft2020 \
+            -s contracts/semantic-candidate.schema.json \
+            -d contracts/fixtures/semantic-candidate.invalid-whitespace.json \
+            --invalid
+          npx --yes ajv-cli@5.0.0 test \
+            --spec=draft2020 \
+            -s contracts/semantic-candidate.schema.json \
+            -d contracts/fixtures/semantic-candidate.invalid-published-truth.json \
+            --invalid
+          npx --yes ajv-cli@5.0.0 test \
+            --spec=draft2020 \
+            -s contracts/semantic-candidate.schema.json \
+            -d contracts/fixtures/semantic-candidate.invalid-state-truth-mismatch.json \
+            --invalid
+
+      - name: Lockfile freshness
+        run: |
+          cargo generate-lockfile --locked
+          git ls-files --error-unmatch Cargo.lock >/dev/null
+          test -z "$(git status --porcelain=v1 --untracked-files=all -- Cargo.lock)"
+
+      - name: Clean working tree
+        run: test -z "$(git status --porcelain=v1 --untracked-files=all)"

.gitignore

@@ -0,0 +1,4 @@
+/target
+*.profraw
+coverage.json
+.DS_Store

AGENTS.md

@@ -0,0 +1,23 @@
+# AGENTS.md — ConceptWeave
+
+Read the organization `ContextualWisdomLab/.github` master context and product goal directive before material work. Live GitHub state and this repository's accepted ADRs override remembered chat state.
+
+## Product boundary
+
+ConceptWeave owns automatic, evidence-bound **Semantic Model Engineering**. Do not turn it into a semantic catalog, lineage engine, generic LLM gateway, browser crawler, or another product's system of record.
+
+## Development rules
+
+- Apply DDD continuously; maintain the Context Map and Ubiquitous Language.
+- Rust 1.98.0 is the production baseline for core logic. Production mathematical/vector/model-scoring computation, if introduced, remains Rust-first.
+- `conceptweave-domain` has no provider/network/database dependencies.
+- External products and providers enter through versioned ports and Anti-Corruption Layers.
+- LLM work uses `contextual-orchestrator`; model output is proposal evidence, never semantic authority.
+- No direct cross-service application-table SQL.
+- New database objects, when introduced, use descriptive two-or-more-word `snake_case` names and 3NF by default.
+- Preserve source evidence, truth status, and publication state separately.
+- Published semantic truth is immutable; correction uses supersession/new release.
+- Public Rust APIs require beginner-readable documentation.
+- Owned production coverage target is 100% line/function/region/branch where tooling exposes it.
+- Never suppress deprecation warnings; fix causes.
+- Never force-push shared branches, self-approve, fabricate checks, or weaken branch protection.

ARCHITECTURE.md

@@ -0,0 +1,77 @@
+# ConceptWeave Architecture
+
+## Product responsibility
+
+ConceptWeave owns the process that turns observed enterprise evidence into governed semantic-model releases. It does not own source-system truth or downstream catalog/query experiences.
+
+```mermaid
+flowchart LR
+    S[Source systems and artifacts] --> O[Source Observation]
+    O --> D[Semantic Discovery]
+    D --> V[Model Validation]
+    V --> G[Governance & Publication]
+    G --> P[Versioned semantic release]
+
+    CO[contextual-orchestrator] -. proposal assistance .-> D
+    LW[LineageWeave] -. inferred/proposed lineage .-> O
+    CG[context-graph-contracts] -. shared graph/provenance contracts .-> P
+    P --> SDP[semantic-data-portal]
+    P --> GRC[governance-risk-compliance]
+    P --> EA[enterprise-architecture-core]
+```
+
+## DDD context map
+
+| Context | Type | Owns | Does not own |
+| --- | --- | --- | --- |
+| Source Observation | Supporting | immutable observations, parser receipts, evidence locations | source-system business truth |
+| Semantic Discovery | Core | candidate generation and evidence binding | publication authority |
+| Model Validation | Supporting | deterministic validation reports | human review decisions |
+| Governance & Publication | Core | proposal lifecycle, review receipts, releases, supersession | catalog/search runtime |
+| Interoperability | Supporting | versioned import/export and ACL adapters | foreign product internals |
+
+## Aggregate boundaries
+
+### SemanticCandidate
+
+Smallest consistency boundary for a single proposed semantic artifact and its evidence-bound publication state. It cannot jump directly from Draft to Published.
+
+### SemanticModelRelease (planned)
+
+Immutable publication aggregate containing approved candidate identities, release version, artifact digests, validation receipts, reviewer receipts, and supersession metadata. It will reference candidates rather than copy foreign source records.
+
+## Truth model
+
+- `observed`: exact source fact;
+- `inferred`: derived candidate;
+- `proposed`: submitted for governance;
+- `authoritative`: explicitly reviewed and published;
+- `superseded`: formerly authoritative and replaced;
+- `rejected`: explicitly rejected.
+
+Truth status and publication workflow are distinct. A source observation can be authoritative in its source domain without making an inferred semantic interpretation authoritative.
+
+## Integration boundaries
+
+- `contextual-orchestrator`: LLM/model routing only.
+- `LineageWeave`: inferred/proposed lineage evidence only.
+- `semantic-data-portal`: published semantic artifact consumer/governance/catalog plane; it is not ConceptWeave's internal database.
+- `context-graph-contracts`: shared cross-product identifiers, truth/provenance/event contracts where adopted.
+- Keyverse: future identity/tenant authentication boundary.
+
+No direct cross-service application-table SQL is permitted.
+
+## Foundation directory structure
+
+```text
+crates/
+  conceptweave-domain/       # Core domain contract only
+contracts/                   # Versioned public schemas
+docs/
+  adr/                       # Binding architecture decisions
+  doctoring/                 # Standards/research evidence
+scripts/                     # Deterministic repository-quality helpers
+.github/workflows/           # CI evidence
+```
+
+Adapters and application services are added only when their bounded responsibility exists; generic `utils`, `helpers`, or `services` dumping grounds are prohibited.

CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+All notable changes to ConceptWeave are documented here.
+
+## Unreleased
+
+### Added
+
+- Initial ConceptWeave product, DDD, security, test, and operability baselines.
+- Rust 1.98.0 `conceptweave-domain` foundation with evidence-bound semantic candidate contracts.
+- Fail-closed Draft -> Proposed -> Validated -> Reviewed -> Published lifecycle with explicit rejection and supersession.
+- Draft 2020-12 JSON Schema for the semantic-candidate public contract.
+- Standards and research doctoring covering stable W3C ontology standards, 2026 RDF/SHACL work in progress, Apache Ossie, and recent LLM ontology-engineering research.
+
+### Security
+
+- Model-generated semantics remain non-authoritative until deterministic validation and authorized review.
+- Unsafe Rust is forbidden in the core domain crate.

CLAUDE.md

@@ -0,0 +1,7 @@
+# CLAUDE.md — ConceptWeave
+
+Follow `AGENTS.md`, `ARCHITECTURE.md`, accepted ADRs, and the organization master context before making changes.
+
+ConceptWeave's core invariant is: **inference is not authority**. Every generated concept, relation, constraint, dimension, measure, or physical mapping must retain evidence and pass the explicit governance lifecycle before publication.
+
+Keep domain logic in bounded domain modules, LLM/provider logic behind ports/adapters, and source/consumer systems independent. Prefer deterministic validation and explicit abstention over plausible unsupported output.

Cargo.toml

@@ -0,0 +1,10 @@
+[workspace]
+members = ["crates/conceptweave-domain"]
+resolver = "2"
+
+[workspace.package]
+version = "0.1.0"
+edition = "2024"
+rust-version = "1.98"
+repository = "https://github.com/ContextualWisdomLab/ConceptWeave"
+license = "Apache-2.0"