Raise the live FAST exact-delta changed-file cap to two after the batch publish path gained same-generation node-before-edge ordering. Convert the former two-file fallback fixture into a production-route exact parity test, and add a three-file fixture that proves larger batches still fall back before publish and match a fresh FAST rebuild.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner (277 passed); CBM_ONLY_SUITE=incremental ./build/c/test-runner (160 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Make batch file-delta publish order-independent for same-generation deltas by splitting the existing single-file publish body into reusable delete, node, edge, and metadata phases. Batch publish now deletes old rows for every file, inserts all new nodes, then inserts edges and metadata, so forward references to nodes from later deltas resolve inside the same transaction.\n\nAdd a two-file FAST exact-delta regression that publishes main.go before helper.go and compares the resulting database with a fresh FAST rebuild. The test helper now runs the postpasses needed for canonical node-property parity.\n\nValidation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner (276 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Make the test-only exact scratch helper choose the existing Branch node when present, matching the production exact incremental root-selection rule. This prevents the two-file scratch probe from creating project-root CONTAINS_FILE edges that the real indexed graph would not produce.\n\nNo production behavior changes. Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner (275 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add a focused two-file Go probe for the multi-file exact-delta investigation. The helper builds an exact scratch graph by reusing the existing store seed, sequential pass, LSP cross, calls, usages, and delta-builder paths, without exposing new production API surface or enabling multi-file exact publish.
The probe verifies the module-level helper -> main.main USAGE edge exists in both scratch and the helper.go file delta. This narrows the remaining blocker: multi-file exact publishing stays disabled until broader end-to-end full-vs-delta parity is proven across affected frontier and derived surfaces.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner (275 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Multi-file exact upsert was parity-unsafe: a two-file Go batch could miss a cross-file package-name USAGE edge compared with a fresh FAST rebuild. Limit live exact upsert to one changed file through a named constant and let larger batches fall through to the existing containment path before publish.
Keep the single-file exact path aligned with the full sequential pass order by carrying a per-file result cache and running lsp_cross before calls/usages only when that cache exists. Add parity coverage for the single-file exact path and for multi-file fallback to a fresh FAST rebuild.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner (274 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Strengthen the live exact-upsert regression by snapshotting the FAST exact-update database, forcing a clean FAST rebuild of the same repo state, and comparing canonical nodes, edges, and file hashes with the existing graph diff helper. This keeps the test focused on semantic parity rather than transient row IDs.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; captured CBM_ONLY_SUITE=pipeline ./build/c/test-runner (273 passed, exact route logged incremental.exact.done files=1).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Wire a conservative exact-upsert route for opt-in incremental FAST/DEP runs after classification and before the existing full graph load/redump path. The route reuses the existing scratch seed, extraction, descriptor metadata, batch planner, generation reservation, stamp, and publish APIs, and it falls back before publish for deletes, global-derived modes, oversized frontiers, planner rejection, or scratch/pass failures.
Add focused pipeline coverage for a safe isolated-file exact upsert with a positive generation and for FULL mode remaining on the containment path. Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner (273 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Seed Project, Branch, and Folder nodes into exact-delta scratch graphs so changed-file structure can regenerate the same containment endpoints that full indexing created. This avoids false fallback for ordinary Branch-to-File and Folder-to-File structure without publishing any production route by itself.
Add a focused pipeline regression for Branch-to-File containment: changed file nodes stay excluded from scratch, structure roots are available, descriptor generation emits the exact CONTAINS_FILE tuple, and planner accepts it as an exact candidate.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner (271 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add an internal helper that stamps a reserved positive generation onto an exact file-delta descriptor after preflight planning and before publish. The helper preserves the store API const contract by copying any attached file-state into descriptor-owned storage before handing it to publish.
Add focused pipeline tests for invalid zero generation, metadata stamping, and the plan-reserve-stamp-apply route so the live exact-delta path can keep provisional generation 0 during planning without publishing generationless deltas.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner (270 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Keep plan-only exact-delta candidates usable with provisional generation zero, but make apply_file_delta_batch fail closed with missing_generation before calling the store publish path.
Add a focused regression for generation-zero apply attempts while preserving the existing publish_error coverage for positive but unreserved generations.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add a focused exact-delta regression proving multi-file delete batches fail closed with delete_batch_requires_full and leave existing graph nodes untouched.
This preserves the current safety boundary: single-file exact delete is supported internally, while mixed or multi-delete cleanup remains a separate design task before live routing.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Route both delete-file-delta public APIs through one internal transaction helper so rollback, stale-derived-view marking, and optional generation completion cannot drift.
Keep the existing caller-visible validation behavior: cbm_store_delete_file_delta_complete still requires a positive reserved generation, while cbm_store_delete_file_delta keeps its existing argument contract.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=store_nodes ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add edge owner paths to inbound-edge metadata so the file-delta planner can distinguish source-node ownership from edge cleanup ownership.
Add cbm_store_delete_file_delta_complete(), reusing the existing delete body while completing the reserved generation in the same SQLite transaction.
Allow only single-file exact delete candidates with a positive generation, existing ownership, inbound-edge safety, and complete affected frontier. apply_file_delta_batch now fails closed with frontier_requires_batch when affected paths are not all included in the supplied batch.
Rename and new-folder exact routing remain fallback/design tasks; production live exact routing remains unwired/default-off.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=store_nodes ./build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner; CBM_ONLY_SUITE=incremental ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add a focused regression for the structural exact-delta boundary: descriptor generation may include a CONTAINS_FILE edge for the changed file, but planning must still fall back when the source folder endpoint is new and unresolved in the existing store.
This keeps new folder creation out of exact-delta routing until folder-node creation, cleanup, and full-vs-delta parity semantics are designed. Validated with git diff --check, scripts/check-source-safety.sh, build/c/test-runner build, and CBM_ONLY_SUITE=pipeline ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Emit regenerated CONTAINS_FILE edges from the file-delta descriptor when the edge targets the changed File node. This keeps the rule graph-semantic and language-independent while leaving new folder creation fallback-only through normal endpoint resolution.
Update the structural exact-delta fixture to model edge ownership, prove descriptor/planner acceptance, publish the delta, and verify duplicate structural edges are not left behind.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add an internal store query that returns exact inbound edge tuples and owner paths for file-delta preflight.
Use it in the exact-delta planner so unowned structural CONTAINS_FILE edges are accepted only when the candidate regenerates the same source, target, and type tuple. Existing realistic full-pipeline structure still falls back when the descriptor omits that edge; live exact-delta routing remains unwired.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=store_nodes ./build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Make owner rebuild treat a rel_path as file-owned only when a File node exists for that path. Full-pipeline Folder nodes can carry directory paths in file_path, and those paths must not become exact-delta node or edge owners.
Expand the owner rebuild regression to cover Function, File, and Folder nodes, including a Folder -> File structural edge. Validated with diff check, source-safety, test-runner rebuild, store_nodes, pipeline, and incremental suites.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add a focused pipeline exact-delta regression that drives the real file-structure helper for a nested file and proves structural containment stays fallback-only under the current descriptor ownership model.
This prevents a future live exact-delta route from publishing a partial graph when Project/Folder containment is present but not represented as owned regenerable delta data. Validated with diff check, source-safety, test-runner rebuild, and CBM_ONLY_SUITE=pipeline.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Replace raw strdup calls in the incremental inbound-edge snapshot with cbm_strdup so the touched path follows the repository portability wrapper convention. Add a source-safety diff guard and self-test that reject newly introduced raw strdup calls in production code without failing historical existing uses.
Validation: git diff --check; make -j8 -f Makefile.cbm build/c/test-runner; make -f Makefile.cbm lint-source-safety; CBM_ONLY_SUITE=pipeline ./build/c/test-runner; CBM_ONLY_SUITE=incremental ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Normal full indexing persisted file_state for future incremental runs but did not populate node_owners or edge_owners, so the exact-delta planner always failed its existing-ownership precondition on real stores. Add a set-based SQLite rebuild helper and call it only when incremental_reindex is enabled, preserving default full-index overhead.
Add store and pipeline regressions covering graph-derived owner rows and the enabled full-index path. Validation: git diff --check; scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=store_nodes ./build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner; CBM_ONLY_SUITE=incremental ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add an explicit-fingerprint variant of the file-delta metadata helper so future exact-delta publishes can persist the same effective mode/threshold fingerprint used by full and containment incremental paths. Keep the existing helper as a compatibility wrapper around the static default fingerprint.
Add a focused regression that formats an effective fingerprint through the shared formatter and verifies it is attached to file_state metadata.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner; CBM_ONLY_SUITE=incremental ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Include effective index mode and pipeline thresholds in the file_state pass fingerprint used by full and containment incremental indexing. Metadata-equal files now remain unchanged only when content hash and effective pass/config fingerprint both match, so mode or threshold changes fail closed instead of returning a stale no-op.
The fingerprint encodes threshold doubles by raw bits rather than locale-sensitive decimal formatting. Missing file_state rows remain legacy-compatible. No live exact-delta route or incremental default behavior is enabled by this change.
Validated with: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner; CBM_ONLY_SUITE=incremental ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Append response-level warnings for stale semantic and architecture-derived data without writing to stdout or stderr. Reuse one warning helper so multiple warnings share the same JSON array, and suppress PageRank-backed key_functions when PageRank is explicitly stale.
Replace the vector search prepare-time stderr diagnostic with the store error buffer pattern. Validated with: make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=mcp ./build/c/test-runner; bash scripts/check-source-safety.sh; git diff --check.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Mark project-wide graph-derived views stale inside the same store transaction as exact file-delta publish/delete operations. Keep nodes_fts as the per-file derived view slot while PageRank, LinkRank, node_degree, semantic_edges, routes, and architecture are invalidated together after canonical graph changes.
Add focused store coverage for single publish, batch-complete publish, multifile publish, and delete stale marking. Validated with: make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=store_nodes ./build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner; CBM_ONLY_SUITE=store_search ./build/c/test-runner; CBM_ONLY_SUITE=mcp ./build/c/test-runner; bash scripts/check-source-safety.sh; git diff --check.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add derived-view freshness flags to store search and traversal results, and use the existing derived_view_state store APIs to suppress explicitly stale PageRank, LinkRank, and node-degree acceleration. Missing freshness rows remain legacy-compatible so old DBs keep their existing rank output.
Mark PageRank, LinkRank, and node-degree views complete after successful rank-table writes using the named unknown-generation constant when no index generation is available. MCP search_graph and trace_path now return structured warnings when stale derived rankings are ignored, without writing protocol-breaking stdout/stderr.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=store_search ./build/c/test-runner; CBM_ONLY_SUITE=pagerank ./build/c/test-runner; CBM_ONLY_SUITE=mcp ./build/c/test-runner; CBM_ONLY_SUITE=store_nodes ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add a reusable cbm_derived_view_state_t reader and free helper for the derived_view_state ledger. This gives search, traversal, MCP, and future exact-delta routing one store-level read path instead of duplicating SQL.
Extend the store freshness regression to verify stale state reads, complete-state replacement reads, and missing-state behavior after an invalid status write is rejected.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=store_nodes ./build/c/test-runner (76 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add named derived-view constants plus reusable store APIs for setting one derived-view state and marking multiple views stale in one transaction. This supports the exact-delta freshness plan without enabling live exact-delta routing or changing query semantics.
Update tests to cover stale batch marking, complete-state replacement, invalid status rejection, and zero-view no-op behavior. Replace the unsupported PageRank planner test literal with the shared derived-view constant.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -B -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=store_nodes ./build/c/test-runner (76 passed); CBM_ONLY_SUITE=pipeline ./build/c/test-runner (256 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add an exact-delta planning fixture for two changed files whose old graph and new deltas reference each other. The test proves the batch planner unions both affected paths, resolves same-batch endpoints, and can still produce an exact candidate without enabling any live incremental route.
This is a P4.4.3 proof slice only. Route/generated-edge cleanup, pass/config invalidation, and derived-view split work remain pending before default incremental behavior can change.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner (256 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Use compatible file_state content hashes to verify files whose legacy mtime+size metadata is unchanged, so same-size rewrites with preserved timestamps are detected instead of treated as no-ops.
Keep old databases compatible: when no file_state row exists, the classifier retains the existing file_hashes metadata path. Store/query or hash failures fail closed by classifying the file as changed.
This does not enable incremental indexing by default and it does not claim a performance win. Metadata-different files still use the fast stat path; metadata-equal files with file_state now pay a content-hash confirmation cost until later ctime/git/status candidate narrowing is designed and measured.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner (255 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Persist compatible file_state rows from full indexes and non-noop containment incremental publishes using the shared content-hash helper. Keep no-op incremental runs on the existing fast path and use generation 0 as named compatibility metadata until exact-delta generations are active.
Also make full-path file_hash persistence fail closed on delete/upsert/commit errors before file_state is written, matching the incremental metadata policy more closely.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -j8 -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner (253 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Expose the existing exact-delta XXH3 file hash helper through the internal pipeline API and have file-delta metadata use the shared helper. This prepares changed-file discovery work without changing incremental routing or default indexing behavior.
Add a focused pipeline regression proving direct helper output matches file_state.content_hash exactly, so future classifier work cannot drift into a second hash format.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add a transactional store primitive for deleting all canonical graph and freshness metadata owned by one file. The helper removes owned nodes and edges, owner rows, symbol exports, import refs, file hashes, and file state, then optionally marks a derived view stale for the delete generation.
This is store-layer groundwork only: pipeline delete and rename routing still fail closed until changed-file discovery and affected-frontier coverage are complete.
Validation: git diff --check; bash scripts/check-source-safety.sh; make -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=store_nodes ./build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Replace the plain cbm_init() static guard with a C11 atomic one-shot state machine so parallel extraction callers wait for allocator/library initialization instead of racing the guard.
Make the macOS mach timebase cache use the same release/acquire publication pattern while leaving the Linux, BSD, and Windows timing paths unchanged.
Add a parallel cbm_init() idempotence regression registered first in the parallel suite.
Validation: make -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=parallel ./build/c/test-runner; CBM_ONLY_SUITE=platform ./build/c/test-runner; bash scripts/check-source-safety.sh; git diff --check.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Make cbm_system_info() publish its first-call cache with a C11 atomic one-shot state machine while preserving the existing Windows, macOS, BSD, and Linux detector branches and fallbacks.
Build the semantic pretrained-token map locally, use the portability strdup wrapper for new allocations, and keep the deterministic sparse-vector fallback when allocation fails without leaking partial key/value pairs.
Add a parallel first-call system-info regression covering consistent published snapshots.
Validation: make -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=system_info ./build/c/test-runner; CBM_ONLY_SUITE=worker_pool ./build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner; bash scripts/check-source-safety.sh; git diff --check.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Treat max_workers as the total number of active callbacks, including the caller thread, instead of spawning max_workers helpers and then also running work on the caller. This removes one extra thread per dispatch and matches callers that allocate per-worker state for exactly worker_count slots.
Reuse the portable thread wrapper default stack policy by passing stack_size=0, and document the total-concurrency contract in worker_pool.h. Add a focused regression that holds three iterations open and verifies max_workers=2 never exceeds two active callbacks.
Validation: make -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=worker_pool ./build/c/test-runner; CBM_ONLY_SUITE=parallel ./build/c/test-runner; bash scripts/check-source-safety.sh; git diff --check.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Build deleted-node sets before mutating graph indexes so allocation or invariant failures return before partial deletes.
Reuse existing node_by_id keys as the temporary deleted-set ownership transfer instead of allocating duplicate ID strings, and size path lookup tables to the number of paths instead of over-reserving.
Add batch delete cascade coverage for cbm_gbuf_delete_by_paths and assert delete_by_label return values.
Validation: make -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=graph_buffer ./build/c/test-runner; CBM_ONLY_SUITE=incremental ./build/c/test-runner; bash scripts/check-source-safety.sh; git diff --check.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Return only exactly represented directory names from cbm_readdir so callers never stat, open, list, or delete a fabricated prefix path. This centralizes the Windows UTF-8 expansion edge case in compat_fs instead of duplicating checks at each caller.
Also make MCP bad-project available_projects hints append only complete escaped JSON strings and expose available_projects_truncated when the compact hint omits entries.
Validation: make -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=platform ./build/c/test-runner; CBM_ONLY_SUITE=mcp ./build/c/test-runner; bash scripts/check-source-safety.sh; git diff --check.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add cbm_getenv_fits so path-like environment values can fail closed when set but too long, instead of being silently truncated by bounded copies or falling back to HOME.
Use checked formatting for Claude hook command/script paths, install/uninstall Claude config paths, install/update binary targets, and PATH directory writes. Overlong paths now return or report an error before mutating a truncated location.
Add focused CLI regressions for overlong hook homes and CLAUDE_CONFIG_DIR, plus platform coverage for the new environment helper.
Validation: make -f Makefile.cbm cbm; make -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=cli ./build/c/test-runner; CBM_ONLY_SUITE=platform ./build/c/test-runner; bash scripts/check-source-safety.sh; git diff --check.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Validate CLI config and instruction parent paths before creating directories so truncated fixed buffers cannot create a different target. Route JSON and markdown writes through the existing cbm_write_file_atomic helper for consistent replace semantics.
Add regression coverage for overlong JSON config and instruction paths to prove failed writes do not create truncated parent directories.
Validation: make -f Makefile.cbm cbm; make -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=cli ./build/c/test-runner; bash scripts/check-source-safety.sh; git diff --check.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Make SessionStart hook comments explicit that stdout is harness-injected session context, not MCP protocol output. This removes vague same-methodology wording without changing install or hook behavior.
Validation: CBM_ONLY_SUITE=cli ./build/c/test-runner; bash scripts/check-source-safety.sh; git diff --check.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add a root-overridable self-test harness for scripts/check-source-safety.sh so the guard can be tested against synthetic trees without scanning the real repository.
Cover clean input, MCP/server stdout writes, unsafe string APIs, and new raw filesystem APIs in production diffs. Add a dedicated lint-source-safety target because the broader lint-no-suppress path is currently blocked by existing NOLINT audit failures before this guard can run.
Validation: bash scripts/test-source-safety.sh; bash scripts/check-source-safety.sh; git diff --check; make -f Makefile.cbm lint-source-safety.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add CBM_PROFILE-gated spans around the httplink pass phases so generated/dependency hot spots can be measured without changing route semantics or protocol output.
The spans separate node collection, route discovery, prefix resolution, registration edges, route insertion, call-site scanning, and match/link work.
Validation:
- bash scripts/check-source-safety.sh
- git diff --check
- make -f Makefile.cbm build/c/test-runner
- CBM_ONLY_SUITE=httplink ./build/c/test-runner
- CBM_ONLY_SUITE=pipeline ./build/c/test-runner
- make -f Makefile.cbm cbm
- CLI CBM_PROFILE smoke on a temporary Express repo
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Replace the pass_httplinks private full-file reader with a shared bounded httplink helper that uses the existing platform file-size and mmap wrappers. Keep route extraction behavior unchanged while naming the full-source byte cap and adding a focused cap/length regression test.
Validation:
- bash scripts/check-source-safety.sh
- git diff --check
- make -f Makefile.cbm build/c/test-runner
- CBM_ONLY_SUITE=httplink ./build/c/test-runner
- CBM_ONLY_SUITE=pipeline ./build/c/test-runner
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Strengthen the file-delta publish and pipeline route parity fixtures by dumping delta-updated and fresh stores to temporary DBs and comparing canonical graph facts through the shared test_graph_diff helper.
This replaces count-plus-sampled-field evidence with stable node, edge, and file-hash equality while keeping production code unchanged. Validated with store_nodes, pipeline, source-safety, and diff-check.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add a batch-aware exact-delta planner preflight that checks inbound edges into the file being replaced before any future exact-delta publish route can run. Sources owned by files in the same delta batch are allowed; unchanged external sources and unowned structural sources fall back to full rebuild behavior.
This keeps live exact-delta routing/defaults unchanged while preventing a future owner-table delete/publish path from dropping cross-file or structural inbound edges. Covered by pipeline fallback regressions, store_nodes, source-safety, diff-check, and the incremental suite.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Require exact-delta planning to see existing file_state and node ownership for each upserted file before endpoint and frontier planning. Delta publish deletes stale graph rows through node_owners and edge_owners, so treating full-dump-style stores without ownership metadata as exact candidates could leave stale rows behind.
Add a reusable store owner-count helper and focused pipeline coverage for missing ownership fallback while keeping the live incremental route unwired/default-off.
Validation: make -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner; CBM_ONLY_SUITE=store_nodes ./build/c/test-runner; bash scripts/check-source-safety.sh; git diff --check; escalated CBM_ONLY_SUITE=incremental ./build/c/test-runner.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Add an internal store-to-scratch-graph seeding helper for future exact-delta indexing. The helper copies unchanged persisted resolver targets into a graph buffer, skips changed paths, and seeds the registry with the same symbol labels used by the definition passes.
Consolidate registry-symbol and import-target label predicates so definition, import resolution, incremental registry seeding, and scratch seeding cannot drift. Add focused pipeline tests for stale changed-path exclusion and external endpoint descriptor planning.
This does not wire the production incremental route, change defaults, publish exact deltas, or alter MCP/CLI API behavior.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Move incremental changed/deleted/mode-skipped ownership into a single internal classification struct so the existing containment path and future exact-delta route decision share one pre-load state.
This preserves current routing and publish behavior, keeps incremental_reindex default-off, and switches touched string copies to cbm_strdup for repo wrapper consistency.
Validated with: make -f Makefile.cbm build/c/test-runner; CBM_ONLY_SUITE=pipeline ./build/c/test-runner; escalated CBM_ONLY_SUITE=incremental ./build/c/test-runner; bash scripts/check-source-safety.sh; git diff --check.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Andrew Hundt