v0.41.49: PHP namespace paths, settled answers, validated configuration, rules files removed #567

Merged

buildagent merged 200 commits from integration-1110 into master 2026-11-11 16:41:02 +01:00

Conversation 0 Commits 200 Files changed 189 +13171 -4194

buildagent commented 2026-11-11 07:24:31 +01:00

Member

Copy link

Release train on top of v0.41.48. The version bump and the PHP package host floor ride in this branch, so the qualified head is the tag candidate.

Breaking changes

• Rules files removed. code-index init writes .code-index.toml and nothing else. The rules command, init --no-rules and the hook installer are gone. Blocks that earlier versions wrote into a repository stay there. The skill remains served over MCP, and code-index skill install writes an on-disk copy on request. Follow-up: #571.
• Invalid .code-index.toml is refused at daemon start, indexing, the walker and watch. Before, the daemon warned and used defaults.

Changes

• PHP resolution (#531, #566): qualified calls and constructors resolve by the written namespace path; parent:: binds to the superclass; a leading-backslash name binds only to the global symbol it names. PHP package 0.1.6 carries the extractor side and requires this host.
• Readiness (#562, #546 item 3): no negative answer before the index and language eligibility have settled; one-shot calls wait for startup and dispatch once; a degraded session answers non-retryable with its repair instruction.
• Script importers (#543): importers resolved by path and the importing row's language; named imports bind exported constants and statics.
• Conformance (#563): grant coverage is checked before the verdict outcome; bridge authority is reported as not_graded.
• State directory (#514): state reads and writes go through the state-directory guard.
• code-index query (#561): one JSON document on stdout, with every content_in pointer re-inlined.
• Configuration: a config that becomes invalid during a session refuses tools with index_unavailable / invalid_configuration instead of answering empty results, and the session recovers after repair without a restart. Four keys that nothing reads are reported as ineffective. watch --debounce-ms wins over the config. Ignore patterns are validated.
• languages.enabled: entries are checked for form only. A malformed entry is refused with the accepted form and a suggestion; a well-formed name that no builtin and no installed package declares is accepted and reported (at load, in doctor, and as a project_overview.language_ownership row), so a config can name a language before its package is installed. languages enable <name> still refuses an unknown name.
• Configuration diagnostics print the user-facing path form (no \\?\ prefix on Windows).
• MCP arguments: schemas state the ranges the handlers enforce; resolution_gaps(limit: 0) is count-only; an unknown CODE_INDEX_ENVELOPE value is diagnosed and disclosed.
• stats releases its database reader before surveying installed packages (a polling client could exhaust the readers; already present in v0.41.48).
• Dependency: rustix 1.1.6 for RUSTSEC-2026-0486.
• Documentation: the audit of every user-visible item this train changed (7 blockers, 10 gaps) is closed; docs/package-profiles.md is the complete profile-key reference, checked against the registry by a test.

Bind account

Against v0.41.48 on all nine pinned repositories only php-guzzle moved: 55 binds removed (all audited wrong), 57 added and 5 retargeted (all audited correct), no correct bind lost, 1,632 retagged. The corpus, stage and cost baselines are blessed with that account.

Qualification

• CI on the head 2296b2f2: all 44 jobs green on Linux and Windows (runs 2549–2552), including cargo test, the daemon transport leg, OSS corpus tier 1, cargo deny, all eleven package suites with their corpus legs, and pilot compatibility.
• Earlier CI rounds were red and are fixed: a test helper that exhausted the database readers by polling stats; a Windows file-replace collision in a fixture; three tests that depended on which packages the machine has installed (local runs on a machine with packages installed did not show them); a Windows path-form mismatch in configuration diagnostics; a one-shot test that depended on machine speed.
• Local full gate run (42 steps) on 37c76ee2: 39 green. Workspace and daemon-leg steps failed in the same two tests (a doc size reserve and a pinned test population, where lanes met at the merge); the packages-only acceptance showed that a config naming a not-installed language was refused. All fixed; the last is the languages.enabled change above.
• Partial local re-run on f73682d5 with an empty user package store: formatting, lints for both targets, docs, timing, doctests, fast gates, packages-only and shipped-build acceptance green; workspace 5,570 of 5,571 and daemon leg 1,049 of 1,050. The one failure (a harness rule about how a new test starts the CLI) is fixed in 2296b2f2; that rule and the affected suite were re-run on both legs.
• Not repeated locally after 37c76ee2: the corpus, precision and package suites; CI ran them on the head. The Windows behaviour of the last fixes was verified by CI only.

Not in this train

The file-isolation rules for #566 (branch codex-r2) are deferred. The shared argument and settings registry is #570.

🤖 Generated with Claude Code

https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Release train on top of v0.41.48. The version bump and the PHP package host floor ride in this branch, so the qualified head is the tag candidate. ## Breaking changes - **Rules files removed.** `code-index init` writes `.code-index.toml` and nothing else. The `rules` command, `init --no-rules` and the hook installer are gone. Blocks that earlier versions wrote into a repository stay there. The skill remains served over MCP, and `code-index skill install` writes an on-disk copy on request. Follow-up: #571. - **Invalid `.code-index.toml` is refused** at daemon start, indexing, the walker and `watch`. Before, the daemon warned and used defaults. ## Changes - **PHP resolution (#531, #566):** qualified calls and constructors resolve by the written namespace path; `parent::` binds to the superclass; a leading-backslash name binds only to the global symbol it names. PHP package 0.1.6 carries the extractor side and requires this host. - **Readiness (#562, #546 item 3):** no negative answer before the index and language eligibility have settled; one-shot calls wait for startup and dispatch once; a degraded session answers non-retryable with its repair instruction. - **Script importers (#543):** importers resolved by path and the importing row's language; named imports bind exported constants and statics. - **Conformance (#563):** grant coverage is checked before the verdict outcome; bridge authority is reported as `not_graded`. - **State directory (#514):** state reads and writes go through the state-directory guard. - **`code-index query` (#561):** one JSON document on stdout, with every `content_in` pointer re-inlined. - **Configuration:** a config that becomes invalid during a session refuses tools with `index_unavailable` / `invalid_configuration` instead of answering empty results, and the session recovers after repair without a restart. Four keys that nothing reads are reported as ineffective. `watch --debounce-ms` wins over the config. Ignore patterns are validated. - **`languages.enabled`:** entries are checked for form only. A malformed entry is refused with the accepted form and a suggestion; a well-formed name that no builtin and no installed package declares is accepted and reported (at load, in `doctor`, and as a `project_overview.language_ownership` row), so a config can name a language before its package is installed. `languages enable <name>` still refuses an unknown name. - **Configuration diagnostics** print the user-facing path form (no `\\?\` prefix on Windows). - **MCP arguments:** schemas state the ranges the handlers enforce; `resolution_gaps(limit: 0)` is count-only; an unknown `CODE_INDEX_ENVELOPE` value is diagnosed and disclosed. - **`stats`** releases its database reader before surveying installed packages (a polling client could exhaust the readers; already present in v0.41.48). - **Dependency:** `rustix` 1.1.6 for RUSTSEC-2026-0486. - **Documentation:** the audit of every user-visible item this train changed (7 blockers, 10 gaps) is closed; `docs/package-profiles.md` is the complete profile-key reference, checked against the registry by a test. ## Bind account Against v0.41.48 on all nine pinned repositories only php-guzzle moved: 55 binds removed (all audited wrong), 57 added and 5 retargeted (all audited correct), no correct bind lost, 1,632 retagged. The corpus, stage and cost baselines are blessed with that account. ## Qualification - **CI on the head `2296b2f2`:** all 44 jobs green on Linux and Windows (runs 2549–2552), including `cargo test`, the daemon transport leg, OSS corpus tier 1, `cargo deny`, all eleven package suites with their corpus legs, and pilot compatibility. - **Earlier CI rounds were red and are fixed:** a test helper that exhausted the database readers by polling `stats`; a Windows file-replace collision in a fixture; three tests that depended on which packages the machine has installed (local runs on a machine with packages installed did not show them); a Windows path-form mismatch in configuration diagnostics; a one-shot test that depended on machine speed. - **Local full gate run (42 steps) on `37c76ee2`:** 39 green. Workspace and daemon-leg steps failed in the same two tests (a doc size reserve and a pinned test population, where lanes met at the merge); the packages-only acceptance showed that a config naming a not-installed language was refused. All fixed; the last is the `languages.enabled` change above. - **Partial local re-run on `f73682d5` with an empty user package store:** formatting, lints for both targets, docs, timing, doctests, fast gates, packages-only and shipped-build acceptance green; workspace 5,570 of 5,571 and daemon leg 1,049 of 1,050. The one failure (a harness rule about how a new test starts the CLI) is fixed in `2296b2f2`; that rule and the affected suite were re-run on both legs. - **Not repeated locally after `37c76ee2`:** the corpus, precision and package suites; CI ran them on the head. The Windows behaviour of the last fixes was verified by CI only. ## Not in this train The file-isolation rules for #566 (branch `codex-r2`) are deferred. The shared argument and settings registry is #570. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

buildagent added 101 commits 2026-11-11 07:24:31 +01:00

fix: resolve script import constants and importer targets ... 0e2db3c724

Bind named calls to exact exported constant values while retaining module, visibility, contribution, capability and uniqueness checks. Resolve JS/TS reverse imports through relative or configured paths with script extension and index rules instead of file stems.

Add fixture and daemon regressions with private exports, alias imports, pagination and same-package stem decoys. Both fixture/e2e pairs fail their corresponding mutations. Corpus binds are unchanged; the importer account audits 22 correct additions and 2463 wrong removals across ts-zod and js-express.

Refs #543 (arrow constants and importer identity only).

Gate negative evidence on settled index eligibility ... b8cd51cad3

Use one lifecycle predicate for eligibility claims, absence notes and
reply-wide qualification. Keep the gate above tool and JSON resource
dispatch, including context_pack's budget reservation, so new builders
inherit the same settlement rule.

Serve cold source paths as pending while language routing is unsettled.
Derive retryability from the existing durable-queue/daemon convergence
measurement, and disclose the observed lifecycle instead of guessing
that a daemon is older. Preserve genuine settled zeros and exclusions.

Add portable cold-start, reconciliation, convergence and settled-control
e2e coverage plus a dispatch-placement registry. Extend the existing
package-only activation test to inspect the first text answer. Eight
mutations were caught and restored with verified snapshots.

Validation: targeted unit/e2e/registry checks pass on both legs; normal
build cold Rust read passes. Full daemon suite, workspace Clippy, fmt and
strict private-item rustdoc pass. The full default run found two test
expectations requiring updates (suite census 64 -> 65, startup extension
refusal); both affected suites pass their targeted reruns.

fix: choose script importer dialect from import language 70f075c6ce

fix: resolve script importer rows for every target language 9cf41bbca2

Preserve measured refusals and bound one-shot startup ... c7dfdedb9a

Classify path refusals centrally and retain fixed walk and byte reasons
while language eligibility settles. Give byte refusals precedence over
an unclaimed old generation. Restrict settlement traversal to response
containers, preserve existing notes and basis values, and pin the rewrite
sites for every tool and JSON resource. Operational process counters keep
their measured populations.

One-shot queries use the project's approved packages without scanning
other projects for automatic grants before publishing their reader.
Disclose the exhausted startup wait and a bounded override instead of
prescribing another index pass for an already complete database.
Document measurement floors, retry convergence and refusal stability;
align CLI assertions with the measured convergence value.

Validation: targeted tests on both legs; mutation checks fail as intended;
full code-index-mcp suite on snapshot and daemon legs; query_cli; workspace
clippy with warnings denied; fmt; workspace private-item rustdoc with
warnings denied. All restored-code checks pass.

fix: share script path candidates and disclose unresolved imports 38cf21b19c

Publish durable readers before automatic package surveys 85ef550301

Preserve automatic enablement and bounded one-shot convergence 7c9de10424

fix: admit exported mutable variables in named imports 965c023286

Choose one-shot remedies from measured parse and startup work 887bc9db8e

Keep one-shot retry attempts in separate evidence snapshots f67af62396

Require explicit eligibility decisions for coverage reason codes 3aa99ce288

Document pending snapshot startup and durable retry semantics d311ef6aeb

Limit one-shot handoff to the projects reported as pending 7e5c9d6ed5

Exercise incomplete lookups in CLI startup handoff tests fc5f3d877b

Preserve batch replies and session disclosures across startup retries 707eb05156

Persist first-start language decisions before publishing readers a163fe6bb8

Require steady completion in one-shot resume and handoff fixtures ece2632884

perf: filter script rows in SQL and cache unchanged importer replies 90f7d1a677

Guard first-start decisions while package discovery is delayed 14a7e79644

Preserve all query response content items 5943d0a3dc

Restore one-document query output and re-inline batch source 04e0cbae1a

fix(php): preserve namespace roots and relative class targets ... 9c9ea7e8d4

Carry global roots, namespace-relative names and static-call shape through the PHP guest. Resolve qualified calls from lexical owners, declared bases and expanded imports, and clear unsupported dynamic scopes.

Rebuild PHP package 0.1.5 with reproducible records. Add shipped-package fixture and daemon coverage, and source-checked parity deltas. The corpus bind audit removes 55 wrong targets, adds 57 correct targets and retargets five parent calls; corpus baselines are left for lead review. Precision gate remains 7/7 with zero phantoms.

test: account for script importers across zod express and Vue 4de65155dd

Index namespace path members and enclosing spans once a7d9027176

fix: disclose unresolved script imports only for compatible targets cdaaf8759a

Load namespace path declarations through scoped path closure 1e93117829

Bind activation verdict reuse to the measured capability set a3f3af3e5a

Make PHP call path authority explicit and verify receiver boundaries db23dc9ecb

Seek scoped namespace type refs through the file-leading index ce6a8eb8cf

Reserve one-shot pending disclosures and preserve qualified refusal hints 4e354095e0

Remeasure legacy verdicts on automatic activation and disclose unknown inputs 566ac92f8c

perf: share script import routes and skip unrelated importer work 2a400ec693

perf: look up import-binding candidates without scanning all files 2ebafb5bc2

Retain legacy verdict fixtures alongside measured registry cases ... 94a577fa1c

The seven original suites were measured against the new activation contract. Their synthetic activation packages fail real C1, so those paths retain explicit input metadata. Restore metadata-free verdicts for registry rendering, and exercise measured variants through the same assertions. The legacy upgrade fixture is captured from the installed release after bundled Rust adoption.

Merge codex-r4: one-document query output for split content, verdicts bound to their measured grant ... f6c6a71111

#561: `code-index query` re-inlines every content_in pointer, including batch entries, and keeps unreferenced items.
#563: a conformance verdict records the capability set it was measured under; enable and automatic activation
re-measure on a mismatch or a legacy verdict instead of refusing or skipping.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Preserve first settled tree disclosures and load snapshot ownership d325b407b6

Settle project reconciliation independently of automatic grant surveys b94226b388

Await startup state before a single one-shot tool dispatch d4c4fb2845

Stop interrupting when the reconcile writer lease ends 840bc8a719

Refresh startup negatives without surveying activation offers 7c23f9e56b

Close unfinished RPC exchanges when startup waits are cancelled bc3df08cbb

fix: restrict unresolved package disclosure to declared entries 7bb60e722c

perf: omit script predicates from non-script importer queries 8c37647b27

Keep read-only activation surveys out of operator mutation locks 9fe41a41e8

Enforce profile-declared global identities and restrict qualified bypass ... 2ee672deeb

Validate global paths in a generic final pass for PHP, Ruby and C#.
Preserve an inherited member only with exact receiver identity and a
positive local lineage proof. Preserve global markers in type refs and
Ruby root-only declaration scopes; rebuild the three affected packages.

A qualified flag no longer overrides origin by itself: rule 11 needs
exact written target identity. The full release account records both
precision gains and 132 correct Python/TypeScript removals; retaining
those correct targets remains incomplete, rather than claiming an
ambient import proves a receiver type.

Targeted fixtures and six executed mutations, precision, fmt, clippy,
and private-item docs verified. Ratchet and cost report real movement;
Ruby cost conditions and corpus parity remain red. No baselines blessed.

Restore rule eleven for references without a global root ... 8524d180cd

Keep the final root identity and lineage check separate from the qualified fallback. Preserve unknown non-rooted receivers, including the two audited Python false targets outside this change. The focused preservation test passes and disabling rule eleven makes its target assertion fail (exit 101); snapshot restored with matching MD5.

Remove the C sharp global root package experiment ... 9d4528aacf

Restore the extractor, shipped WASM, manifest, digest, provenance, registry entry and parity deltas from before P4. Remove its added fixture and parity allowances; no shipped profile uses global_alias. The audited C sharp targets were already correct.

Withdraw the Ruby global root package change ... f026065179

Restore the complete released Ruby package and walker rather than ship a package with red suite, parity and cost evidence. Remove its profile activation, fixtures and parity allowances. The three audited Ruby rule-eleven wrong targets remain known and out of scope for this reduced train.

Record released host compatibility checks for the reduced package set ... c773cd61f1

In isolated CODE_INDEX_HOME q4-state, /usr/local/bin/code-index inspected and installed PHP package digest 5558aa47ef3a77d7cdaac3c78c64f4758c123cc145b722a02a050ea3d899b6ce and indexed one PHP file with zero parse errors. Its manifest declares extends=php only, so no new profile key ships and the existing host floor remains applicable. Ruby was withdrawn.

Explicit global_root and php_path_semantics declarations each fail on the released binary with manifest.unknown_field (exit 1), rather than being ignored. Packages declaring either key must set requires_host to the first core release supporting it and follow that core. Existing policy: crates/package/src/manifest.rs module docs (deny_unknown_fields); profile_spec::an_unreadable_declaration_is_refused_by_name. Logs: /tmp/claude-1000/codex-r3/q4-release-*.log.

Hand off pending one-shot startup even before reader publication 828a8db8a5

Reconcile the manifest profile vocabulary census ... b6e7022cdd

The two accepted new profile fields bring the complete declaration to 35 traits. The existing full-vocabulary gate failed with 35 versus 33; updating its explicit census and the canonical-declaration documentation makes all five profile schema tests pass. No package manifest declares the new fields.

Skip profile loads when the global-root pass has no references ... 486bcbf43d

Return after the bounded root selection if it has no rows. This avoids
loading and decoding profiles and preparing unused candidate statements.
Per-statement attribution over all nine pinned repositories measured the
profile-load aggregate on cs-dapper at 392 -> 357 VM steps (12 -> 11 calls),
with the same 35-step saving on js-express. PHP's root scan remains 515896
steps and its qualified-decision update accounts for 870 of 919 sorts.

Final release comparison: all nine producer/language populations match.
The 132 previously lost correct targets are restored. Eight repositories
have zero target changes. PHP has 55 removals, 57 additions and 5 retargets,
identical site-for-site to the accepted PHP account. Fifty removals have a
written global root and a wrong namespaced target (42 from rule 11, eight
from rule 10); five are accepted parent corrections. No correct target lost.
Rule changes: 11 -42, 10 -8, 41 -1642, 50 +1694, including 1632 retags.
The 75 retained-target audit samples and all 117 PHP movements are recorded
under /tmp/claude-1000/codex-r3/q5-*.json.

Targeted preservation mutation exits 101 at its target assertion. The root
and inherited-member mutants each fail their own fixture, and all restored
targeted tests pass. Every snapshot/restore has matching MD5 and a touch.
Final PHP package suite, profile schema suite, precision (7/7 with population
and zero declared phantoms), clippy, fmt and private-item docs pass.

corpus_ratchet remains RED (exit 101): php-guzzle resolved/calls +2, edges
-29; all other dimensions/repos unchanged. Calls reconcile as 57-55=2;
distinct edges as 7 added minus 36 removed. The narrowed P4 adds no corpus
target movement beyond the accepted PHP work.
corpus_cost remains RED (exit 101): PHP sorts 2561 -> 919, below its lower
band. Both assertions were last touched by 31820ebf. Neither baseline was
changed or blessed. Final statement attribution exits 0 across all nine repos.
Final logs: q5-final-{gates,attribution,php}.log; q5-exits.txt records clippy
and RUSTDOCFLAGS=-D warnings cargo doc --workspace --no-deps
--document-private-items. Released-host checks accept the actual key-free
PHP manifest and refuse a candidate-built explicit-key CIP by field name.

Route remaining .code-index state accesses through state_fs (#514) ... 12ccfb0425

Under --no-daemon --db <elsewhere>, db::open skips <root>/.code-index/, so languages::first_start_enablement and languages::load_state were the first touches of that directory. first_start_enablement probed marker.exists() and fell back to raw create_dir_all + fs::write when enabled came from .code-index.toml or was unchanged, following a repository-planted dangling symlink at .code-index/languages-enabled; load_state also read .code-index/languages.toml without check_state_dir. Route languages marker/state reads and writes, cli::doctor probe writes (.doctor-write-test, .doctor-disk-probe), and core::workspace::read_workspace_id through code_index_core::state_fs so links are refused in state_fs's vocabulary and never followed.

docs: state qualified reachability and field invariants ad1724591a

docs(php): require a host floor for qualified path facts ... 20d0ddbcec

Released host comparison on php-guzzle: 38,733 reference sites on both sides; 37,039 identical, 1,694 lost binds, no retargets or additions. Full comparison: /tmp/claude-1000/codex-r3/z3-comparison.json. The lead must set [package].requires_host to >=CORE_RELEASE_WITH_NEW_PASSES at release time before repacking; no release version is guessed here.

test(php): prove scoped namespace loads match cold binds ... 1c1ef4f878

Extend scoped_pass_equivalence::binds over the PHP fixture and staged php-guzzle. After a base declaration edit, an alias caller edit, and a duplicate path declaration, compare every reference target and deciding rule by source site and occurrence. Require Scoped resolution and cold-answer changes, with explicit path-binding and ambiguity controls.

Mutation: truncate scoped declaration traversal before the source-to-path hop. Both new tests fail with missing rule-50 cross-file binds; restore via cp and touch with matching MD5s. Both restored tests pass.

Verification: both new tests; PHP package suite across first-party-tests, plugin-host, CLI and indexer; cargo clippy --workspace --all-targets -- -D warnings; cargo fmt --all -- --check; RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --document-private-items. All green. Logs: /tmp/claude-1000/codex-r3/z-gate-exits.txt.

Merge codex-r3: PHP namespace paths, parent:: and global-root calls (#531, #566 class 1) ... 23ba9b3227

Extraction keeps the written global root and the path-call shape; one resolver pass decides qualified PHP calls by
the written path (self/static/parent, aliases, namespace-relative), and a generic global-root pass binds an
absolute reference only to the symbol whose qualified name it writes. PHP package rebuilt.
php-guzzle against the last release: 55 wrong binds removed, 57 correct added, 5 retargets; no movement in the
other eight corpus repos. C# and Ruby package changes were tried and withdrawn.
The rebuilt PHP package loses 1,694 binds on the previous host, so it needs a requires_host floor at this release.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Record measured empty grant in agent_task_plugin_bench (#563) ... 6d27a01d91

narrow_the_grant_through_the_shipped_cli writes a synthetic passing C1 verdict for its fixtureless XAML package before running shipped plugin enable --grant none. Record that verdict via save_measured with MeasuredGrant::new(false, &[], &[]), matching the other activation suites updated in a3f3af3e.

Bound local snapshot grant reconciliation to one rerun 3755ecd111

Document eligibility pending lifecycle and pin client version skew 0ceb322c75

Register and exercise startup wait dispatch and its timing budget 904b0d3926

Gate startup snapshot publication on retained activation safety bcd657457b

Keep lifecycle documentation within the envelope topic reserve 15355c5eb2

Record measured empty grant in builtin_displacement_e2e (#563) 4ede1dba9f

Revert "Record measured empty grant in builtin_displacement_e2e (#563)" ... 0779b231f8

This reverts commit 4ede1dba9f.

Revert "Record measured empty grant in agent_task_plugin_bench (#563)" ... 6a0455df02

This reverts commit 6d27a01d91.

Revert "Retain legacy verdict fixtures alongside measured registry cases" ... 2a5c7cb54b

This reverts commit 94a577fa1c.

Revert "Remeasure legacy verdicts on automatic activation and disclose unknown inputs" ... ebf00b1d7a

This reverts commit 566ac92f8c.

Revert "Bind activation verdict reuse to the measured capability set" ... 17cb19ce19

This reverts commit a3f3af3e5a.

Check verdict authority coverage before outcome in require_loaded_verdict (#563) 72d364962b

Merge agy-c1: state writes through the state-dir guard (#514), verdict gate order (#563) ... ab347dfe21

#514: language state, the enablement marker, the doctor probes and the workspace-id read go through state_fs, so a
repository-planted link never decides where this process reads or writes state.
#563: the exact-grant verdict design merged with codex-r4 is reverted (it broke the covering rule of #103 and the
explicit-check step before widening a grant). The fix is the order inside require_loaded_verdict: authority coverage
is decided before the outcome, so a failed verdict measured without the requested authority answers
conformance_not_run with the flags to run, and only a covering verdict can answer conformance_failed.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Merge codex-r1: no negative answer before the index and eligibility are settled (#562, #546 item 3) ... e25cc55d55

One predicate above the tool dispatch gates refusals, empty results and count floors while a project's index or
language eligibility is unsettled; refusals that do not depend on eligibility stay measured and carry
coverage_reason. Durable readers are published before the cross-project grant survey, and a project is settled by
its own reconcile, language decision and package set, so true negatives answer in about the time positives do in
one-shot, snapshot and daemon modes. One-shot calls await startup (bounded) and dispatch once; the remedy is chosen
from what is pending. A cancelled startup wait closes its RPC channel.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Merge codex-r2 (importer part): script imports resolved by path, exported constants as import targets (#543) ... 6b543d5421

Named imports bind exported constants and exported mutable variables. get_dependencies importers are decided by the
resolved import target for JavaScript/TypeScript rows, whatever the target's language, through the one candidate rule
the resolver uses; an unresolved import that could name the requested file is disclosed as a lower bound.
ts-zod: 2,408 wrong importers removed, 4 correct added; js-express: 55 removed, 18 added; none lost.
The file-isolation rules of #566 class 3 are not part of this merge.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Keep import decisions out of global-root use resolution ... 47431a4fd3

Register global-root and PHP namespace-path ref-kind stances. Restrict global-root identity to use kinds so an ambiguous rooted import cannot acquire a new target and TYPE_FQN rule.

Compare PHP class and ambiguous function imports with the installed release. The regression fails when the kind restriction is removed; restore verified with snapshot checksums.

Validation: ref-kind registry, global_roots, php_namespace_paths, scoped_pass_equivalence (28 passed, missing corpus fixture retried successfully with COSI_CORPUS_DIR), workspace clippy, and fmt check.

Merge codex-r6: global-root pass leaves import refs alone; ref-kind stance for the two new passes ... 21f754a156

PHP import refs are qualified and can carry a leading backslash, so the global-root pass could rewrite their target.
It now names the reference kinds it decides. Both new resolver passes are registered in ref_kind_stance_registry.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

chore: v0.41.49 bcfaccbecd

fix(php): require the host that resolves namespace paths 6d981c28c5

Merge codex-r7: v0.41.49 and the PHP package host floor ... 0c54ec841a

The version bump rides in the source branch because the rebuilt PHP package requires this core: on the previous host
it loses 1,694 binds on php-guzzle. Only the PHP manifest, its digest and its registry row changed; the extractor
binary and the ten other packages are byte-identical.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

ci: run scoped pass equivalence under the corpus require floor e5149b320f

ci: register the settlement source gate in fast gates 4cf20cc7c7

fix: document importer read snapshot writer-lock exemption 5d2483fd16

test: use existing frozen script packages for importer coverage 44dd80d58b

test: enforce corpus availability through the coverage house pattern ff6a1c6708

fix: ask the core module dialect for script importer policy 3cda76df72

style: format importer policy and corpus coverage edits 094a6d4b04

test: give PHP its written namespace and verify stem-independent binds ea8dc9d5f6

test: freeze script packages with named-import and module-map facts baca272be6

fix: admit unknown const visibility through the cross-file import pool aadcce4dda

test: account for scoped equivalence in the corpus build population 57b533c73f

docs: describe the shared anchor and namespace fixture controls 9f6b1733f6

fix: centralize typed script import preference with module policy f0c21a56d9

test: pin initial host derivation records for new immutable script fixtures b6b2e5a91c

test: register the read-only importer snapshot exemption with its reason 226b359c9c

Merge codex-r8: green indexer registries, const import pool split, corpus floor for scoped pass equivalence ... aa65ab661c

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

test(corpus): bless PHP namespace-path and global-root movement with its bind account ... 3ffb5c4ebb

Only php-guzzle moved against v0.41.48 on all nine pinned repos: 55 binds
removed (all audited wrong), 57 added and 5 retargeted (all audited
correct), no correct bind lost, 1632 retagged from the same-file relative
rule to the fully qualified type rule. The cost rise is attributed per
statement: the two new linear passes carry 91 percent of it.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

test(daemon): build reverse dependency fixture from real schema 715697e59e

test(ci): isolate durable startup and activation settlement timing a1caa09669

test: pin frozen PHP projection for namespace path fixtures 8d2415404c

test: exclude importer-only project from ABI extraction fixture walk ... c7389f944b

4de65155 added script_import_review for Vue importer resolution. Its two util.ts files each add one source-backed binding value on line 1; they are not extraction fixtures. Preserve the TypeScript pin at 114. The full abi_projection binary passes all eight tests; restoring the broad walk reproduced 116 versus 114.

Merge codex-r9: real-schema daemon fixtures, timing registration, PHP projection pins ... 8f262802ed

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

buildagent added 83 commits 2026-11-11 11:22:28 +01:00

docs: explain package root and PHP profile traits (B1) 6918f36bfe

fix: explain target-specific importer lower bounds (B2) f58f20a8e5

docs: align startup retry guidance with measured convergence (B3) 36248c6fed

docs: disclose bounded snapshot settlement and degraded remedy (B4) 182bf99e19

fix: degraded negatives require repair rather than retry (B5) 4152ba4d79

docs: bound precision claims to the measured task set (B6) ab3db72c5b

fix: disclose ungraded bridge authority in verdicts and status (B7) 778235b148

docs: define human-facing settlement vocabulary (S1) 8fabf8524b

docs: explain recursive CLI JSON content reinlining (S2) 2ae1ce95f0

docs: explain conformance refusal ordering for grants (S3) acf2135a87

docs: explain PHP written-path semantics and limits (S4) df84622d18

docs: expose resolver rule meanings and false-positive limits (S5) 098afa297c

docs: scope importer path identity to script import rows (S6) 2c61ece906

docs: explain recovery from an invalid impact seed (S7) 23ed07f800

docs: explain aggregate hunk omission limits and workaround (S8) 47751b881e

docs: explain state-directory guard recovery (S9) 72467e581f

docs: explain named constant and static import bindings (S10) a85ae867ec

fix: carry degraded state detail into eligibility notes (B5) a474a4c788

docs: use exact retryable field spelling in the skill (S1) 9650ca55a7

fix: retain ungraded authority disclosure for failed status (B7) 43cda1a210

docs: remove obsolete three-state lifecycle count (B4) d49ca4ec4c

docs: keep the qualified skill within the resource cap (B6) 4d36c86b81

docs: link confidence to the exact envelope resource URI (S5) 0e6c1f01b5

test: retain both structural disclosures in verdict round trips (B7) d4689919da

docs: trim instruction and read help while retaining contracts (B6) 44d85666ce

docs: keep snapshot guidance within catalogue headroom (B4) c778b6a770

fix(cli): preserve explicit watch debounce precedence 67fc80b78d

fix(mcp): preserve count-only resolution gaps requests 0ce6d88482

docs(config): describe current scope and automatic enablement 161322d092

docs(package): check the complete profile reference against live registries 668f6531cc

docs: give resolution rules one resource home and retain headroom (S5) 1151e2cb5f

fix(config): disclose compatibility keys with no effect b0baf72a56

Retain readiness probe failures and daemon log tail on startup timeout 10ba2d47b9

fix(mcp): publish runtime argument bounds from shared constants 3131166e11

docs: preserve startup reserve by tightening shared instructions (B6) a358b8da3c

docs: link concise confidence guidance to its full rule guide (S5) 063059c6fa

docs: retain the topology marker while trimming repeated read prose (B6) c3c373022f

test(mcp): register shared schema and handler bounds 93a9618714

fix(mcp): diagnose invalid envelope defaults with a shared vocabulary 098d6c3675

fix(config): refuse invalid manifests across indexing entry points 6a136abc7a

Include last completed readiness stats, resolve queues and startup phases in diagnostics e5f2693c1e

test: register the extracted resolver evidence explainer (S5) 7214cb684d

fix(config): validate ignore patterns and enabled language names 00f3251efb

docs(config): remove obsolete package file hint and register key guard ca93dd4e75

test(mcp): sweep every page cap and preserve schema headroom 370ca5e444

docs(mcp): keep envelope reference within its growth reserve 8a9b0d4272

Merge codex-r12: profile reference checked against the registry, schema bounds equal handler bounds, count-only resolution gaps, envelope vocabulary ... 8b421e846b

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Probe daemon lifecycle without repeated activation surveys ... 2305af27b5

Under CPU contention the named script daemon settled at 102 seconds, but stats probes occupied the read pool and readiness failed at 120 seconds. Use the lifecycle-only path_claims probe; retain full stats only for timeout diagnostics. The wire regression rejects stats and was verified red with that mutation.

Request full provenance on the worktree discovery assertion 1446ca6588

Retry transient Windows atomic-save collisions in the watcher fixture 80d7b48c66

fix(config): report ineffective keys once per unchanged key set 6d7124053f

fix(config): refuse invalid inputs before activation reconciliation c1577b9079

docs(config): clarify optional settings and project routing exceptions 1c3c48bbdf

fix(config): block live event admission when walk config is invalid bc663dae86

docs: preserve the wire routing phrase within the startup budget (B6) da9e7c0e35

test(config): isolate diagnostic capture from parallel tracing callsites 1c55b9d7e2

test(config): pass the existing resolve control reference directly e395560c5c

Release stats readers before filesystem surveys and coalesce offer misses ... d01bb33920

Build the database portion of stats under its original read epoch, then
return the reader before the cached extension walk, language census and
activation-offer survey. Concurrent offer misses now share the existing
fingerprint memo rather than independently parsing every installed package.

The startup regression holds the actual offer memo and proves another
query can acquire the sole reader while stats waits. Moving drop(conn)
back below offers made that exact test fail with "an offer survey must
not exhaust the reader pool". Restored the cp snapshot and verified MD5.

Validated extension-census unit tests, activation_offer_memo,
diagnostic_census and reader_epoch_e2e. Measurements are recorded outside
the repository under /tmp/claude-1000/codex-r13/measurement.

Remove a needless borrow in the stats reader regression 8dc313aed7

test(config): expose silent mid-session invalid manifest replies 6340107091

Record two-core cold-start and stats measurements against installed release ... 5ef633cba8

Same four-file script fixture, signed package bytes, approvals, cold state
and taskset -c 0,1 for both optimized daemons and their sibling hosts.
Ready seconds, installed: 6.324 / 6.169 / 4.041; candidate: 3.936 / 3.850 / 3.648.
No observed startup regression; do not attribute host-load noise to speedup.
Stats median of 50 calls, startup/settled ms: installed 1.955/2.504;
candidate 2.313/2.371. No errors in the 200 final sampled stats calls.
Cold misses still take 354ms on the candidate, but no longer own readers.

The original 84.6s debug-plus-CPU-hogs reproduction spent 80.0s in
package loading/compilation; ordinary resolution was 0.182s. Existing
logs bound walk and pre-resolve indexing together, not separately.
All logs, scripts, source audit, limitations and dogfood findings remain
outside the repository at /tmp/claude-1000/codex-r13/.

Targeted tests, explicit reader-lifetime mutation, fmt, and daemon
all-targets Clippy with -D warnings passed. No package fixtures changed.

fix(config): refuse invalid session measurements and reconcile after repair d6f315b597

docs(config): describe startup refusal and live session recovery ddc900533a

Merge codex-r13: readiness probe prints its state and polls lifecycle only, stats releases its reader before surveys, Windows fixture retries ... 9a8c421386

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

fix(config): detect fast typo repairs between config polls ec4f692dee

test(config): repair to identical existing manifest bytes 5e06c1bad4

test(config): assert error envelope and unchanged daemon PID after repair 00849d999a

Merge codex-r11: invalid configuration is refused and disclosed, ineffective keys reported, explicit debounce flag wins, validated ignores and language names ... f63d57b6f4

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Restore handwritten instructions and qualify benchmark precision 74fe251a79

Merge branch 'integration-1110' into codex-r10 ... 1593c88818

# Conflicts:
#	crates/mcp-server/src/docs/envelope.md
#	docs/operations.md

Remove instruction and hook writers; expose opt-in skill install e4eb613328

Remove generated instruction copies and document explicit skill delivery d8044f0ab9

Publish the complete package-profile reference under docs fd8ed65851

Repoint skill checks and guard config-only init with a mutation-tested assertion e032ca078d

Keep served skill documentation independent of removed writers b29b1eb8d0

Describe the remaining one-shot query scheduling population ded09190eb

Assert the remaining README verb pin directly 0323849d58

Retain timing isolation for the renamed shell-budget test 628c77ea12

Reconcile owner-default documentation and validated-language diagnostic after merge a2eebae006

Format the shared-language diagnostic assertion 19ffd4b18b

Merge codex-r10: audit findings closed, rules and hook writers removed, explicit skill install, profile reference under docs ... 37c76ee20b

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

docs: restore envelope topic headroom without dropping facts b382966471

test: account for config session suite in settle barrier population 7c7eff5e30

buildagent changed title from PHP namespace paths, settled first-contact answers, script importers, query output (v0.41.49) to v0.41.49: PHP namespace paths, settled answers, validated configuration, rules files removed 2026-11-11 11:22:47 +01:00

buildagent added 1 commit 2026-11-11 11:55:56 +01:00

chore(deps): rustix 1.1.6 for RUSTSEC-2026-0486 ... 4f869010c4

The advisory (xattr functions mark unwritten bytes as initialized for a
zero-length buffer) was published on 2026-11-11 and fails cargo deny.
Only the rustix entry moves; every other lockfile entry is unchanged.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

buildagent added 15 commits 2026-11-11 15:03:00 +01:00

Accept unavailable language ids at config load and report warnings 8d2dd1506e

Expose unavailable enabled languages and cover permissive config loading c08d8bc448

Align existing warning deduplication checks with shared diagnostics 2723ccdc08

Verify unavailable language warnings through load logging and doctor 520a00ef06

Test both unsettled one-shot reply shapes without timing assumptions f7c38242b4

Scope enabled-language availability warnings to the default user store 007634bdc3

Render shared config diagnostics with the user-facing display path 5bdc6f7a45

Stage discovery in one-shot settlement retryability test 6762ccc44e

Merge codex-r16: one-shot tests independent of machine speed ... 0ee14ba58e

The Linux CI runner parsed the queried file inside the 300 ms one-shot wait,
so the reply was a disclosed partial answer (rows, floor basis,
reconcile_pending) where the test demanded the miss error. The unsettled
window is now staged with the discovery-delay hook, and one helper asserts the
shared contract for both unsettled shapes.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Limit unavailable enabled-language rows to undeclared names 5cc986618c

Render unavailable enabled names as one actionable warning eb3c6936f2

Explain enabled-language syntax refusals and suggest canonical names d2e5af3f78

Require ownership regression CLI surfaces to report their results b430267dee

Merge codex-r15: a language name without an installed package is reported, not refused ... f73682d546

Config load refused every languages.enabled name that no builtin and no
package installed on this machine declares. That made validity depend on
install state: enable-then-install, a committed config shared by a team and
an uninstalled package each refused the whole index (packages-only acceptance,
three older tests on both CI platforms). Load now checks the name's form only;
an undeclared name is reported at load, in doctor and as an ownership row.
Config diagnostics print the user-facing path form.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

test(mcp): spawn the CLI through the store-isolated constructor ... 2296b2f2b2

The ownership regression test built a Command over the CLI binary directly,
which harness_store_isolation forbids: such a process inherits the developer's
package store unless every call site remembers to override it. The test keeps
its own populated store; its override is applied after the default.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

buildagent merged commit a7ce9603e6 into master 2026-11-11 16:41:02 +01:00

buildagent referenced this pull request from a commit 2026-11-11 16:41:02 +01:00

Merge PR #567: v0.41.49: PHP namespace paths, settled answers, validated configuration, rules files removed

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

code-review

  

correctness

  

dos

  

performance

  

security

  

severity/high

  

severity/low

  

severity/medium

  

tech-debt

  

Kind/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority

Critical

The priority is critical

  

Priority

High

The priority is high

  

Priority

Low

The priority is low

  

Priority

Medium

The priority is medium

  

Reviewed

Confirmed

Issue has been confirmed

  

Reviewed

Duplicate

This issue or pull request already exists

  

Reviewed

Invalid

Invalid issue

  

Reviewed

Won't Fix

This issue won't be fixed

  

Status

Abandoned

Somebody has started to work on this but abandoned work

  

Status

Blocked

Something is blocking this issue or pull request

  

Status

Need More Info

Feedback is required to reproduce issue or to continue work

No labels

code-review

correctness

dos

performance

security

severity/high

severity/low

severity/medium

tech-debt

Kind/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/Security

Kind/Testing

Priority

Critical

Priority

High

Priority

Low

Priority

Medium

Reviewed

Confirmed

Reviewed

Duplicate

Reviewed

Invalid

Reviewed

Won't Fix

Status

Abandoned

Status

Blocked

Status

Need More Info

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

h-dv/code-index!567

No description provided.