diff --git a/docs/validation/extensions-dependency-review-20260922.json b/docs/validation/extensions-dependency-review-20260922.json new file mode 100644 index 000000000..7647d77b1 --- /dev/null +++ b/docs/validation/extensions-dependency-review-20260922.json @@ -0,0 +1,747 @@ +{ + "generatedAt": "2026-09-22T16:45:19.411103+00:00", + "reviewTestedSource": "57f332dbb70dbbaf2a45fc2f6bf8fdd76c11f46a", + "applicationSource": "7575dcc71e4524c660aff06486ebc007cca290b9", + "acceptedHead": "b04cf479375b955d58dfed69d9211e43baecdf54", + "acceptedRegressionCheckout": "e0885ee750ffc99bfb304906bed25966cdac6fb7", + "pr": "https://github.com/colbymchenry/codegraph/pull/1911", + "sourceHashes": { + "docs/validation/dependency-review/model.cjs": "cdfe50e338edb589f6acd82e9bc0733f9c6e8bd8059c899afb0896ef17ff8348", + "docs/validation/dependency-review/run.cjs": "cf09b4c01594e21c80d62705458ff55b58246f9b7e110ee460f54a87b9409056", + "docs/design/semantic-dependency-contract.md": "064a27b0a81b1fecd742ee1632b93d674321d9a2176dd4070f0a8bdd459d9d75", + "src/plugins/api.ts": "779146a3bc84fd911d4c8fadd03c8fac03a5ac64766886c3498978223f2fd935", + "src/plugins/loader.ts": "5f026cb63d1697b82db346645b101792c77351d5ed630504196287fe79da7c83", + "src/plugins/registry.ts": "21f9d4807f343a9183ee738307c43f2b4fdb55e7988ed2e1150a580d3373d4d9", + "src/plugins/author-template.ts": "effca678ce3c0f25aa620cda4f5ad49b77a6d894f1b02a5ea3246236f14e18c4", + "src/plugins/package-validation.ts": "22edaf08c9531c6169ca0abf8f80c5b3536e29b049a2c387393ba2af4e003bf9", + "src/resolution/types.ts": "642fe8007246e70e2529bdad877d5c747de624aba2381dc9187eaeca9a428dfe", + "src/resolution/index.ts": "b016116b5348952f0933d74dfc20dfabe4bf76c2195aa47dc4bd5f7e50a607bf", + "src/resolution/callback-synthesizer.ts": "5d9feb00c36b72aa2cb173d5f30c4a800d3bcb2dc40875c93508d84970c01ea8", + "src/extraction/index.ts": "0108cacf9d8d0ab3e468ebd36b9ef75b0ce23b22480c55a1bbb75425a506eb17", + "src/extraction/tree-sitter.ts": "7a72225fde1868af0b19d25078f34aa3f445decc26de2aff6d4dcf43ecf0b324", + "src/index.ts": "31562b5bc5442620ea7e20fc6f11644f4bd6ebef6696488f884391ac02411be7", + "extensions/drupal/index.cjs": "e9a5f13baaf0ba53ab17f0e348edd73ba91c80a11034746372c808eda8e3714d", + "extensions/drupal/package.json": "876e4059a8f967a9d9ab595cafc359f8820c4d0f1bbc1b3ec8939f03ac0a11a1", + "__tests__/extension-sync.test.ts": "5f520cdda673d78afd0024115f9adc6ce37973a6bcee4356a7279e543ff743ac", + "package.json": "42c062210185a80c2d57bed2ac850a98d7660d3a0da2e04afa638f72305dd7e8", + "package-lock.json": "85274fb46487a320a60d2050f41f5637bf3ea116170b047fe24aa8e768cec366" + }, + "compiledHashes": { + "dist/index.js": "e66d30aaa728ca54cd419af1f50aa0ca22a6409efd58bb71b97ec5564de56ae5", + "dist/index.d.ts": "7a4d7d0e8829e1ebe74e387b1e2503ebd1d798f8174e1af81a72c1d62fc61d09", + "dist/db/index.js": "84832b6b622bbf40b2beed2824e6d020b18e55ddfa2d16458dcb8d638d102966", + "dist/plugins/recovery.js": "49ed19a5a386273a17d21b823b620be312dc58533e5a5dc8c451e97e39d39774", + "dist/extraction/index.js": "66dd378d44e82bbaf23df3b54a28aeaaa3e8bf6dea000eaa11d5d6aef6ea6b86", + "dist/extraction/core-reuse.js": "2c2883ef6a465edae6bf07fc02574eb975d6d2e2cd1d31ace49d9b87fed137c7", + "dist/extraction/parse-pool.js": "94cc18e2c14241f665641c174e9d882f5c893cfb825d6d13744d6a094fe929d6", + "dist/extraction/parse-worker.js": "85fa539597a610eb97c5738f9cfaaecf8b17cf7944519e2b95fb81a334daddc2", + "dist/extraction/tree-sitter.js": "87bfc4cd6cdc3cbc8406a531edc127ec84cacf770c9251a5bcfeaaf78b61883c", + "dist/extensions/drupal.cgext": "e5ed73bee51524585e4f4da1d5017fdee3037a3fa71d8f08edab6c318fedc59a", + "dist/extensions/drupal-0.1.0.cgext": "e5015747d02fe50d6af607b6c44f1db9cf7969a0070866ed03c7643377a459c8", + "dist/extensions/drupal-0.1.1.cgext": "e5ed73bee51524585e4f4da1d5017fdee3037a3fa71d8f08edab6c318fedc59a", + "marketplace/cloudflare/.build/worker.js": "981f24d6518908fa33259a3e3e8cb4d3d6d9a073446ccfa3132c1a98c52e7cb9", + "dist/plugins/manager.js": "143535f6590b35b55180f48d39b6ab6d2d94062938da418c8ac5bdf856ee4400", + "dist/plugins/loader.js": "2e3bd419159d6ca19bc8c2bd834429b9e622eb5b9e885d59670efb1318475247", + "dist/plugins/author-template.js": "053250ae725130e38c82222a2f97000884566940655aa603185763dfa338ac1f", + "dist/plugins/package.js": "039abfd75cfc0d68bf3254ac944d948378a3b0f68a723c17c110951110d4dd1f", + "dist/plugins/package-validation.js": "ce3d069c645bf04b7fc4fe1c55ce04520eedb2cc1d75b39c603f816358a39ea9", + "dist/resolution/index.js": "09fc4b8552c78dfb21a95d306c4edd9c96974a28fc76636a506ef708f1b7e923", + "dist/resolution/callback-synthesizer.js": "fe8080adce15d3c64cbc78015925b23ee24dc97e2bf68f35e8ea48c6c6cbeca9", + "dist/types.js": "172990e7194c219090f8c19e5c64da629cb4d89a7d14f1df667f76561ef24369" + }, + "acceptedSourceHashesMatched": 26, + "acceptedCompiledHashesMatched": 13, + "commands": [ + { + "receipt": ".qa/recovery/dependency-review-first.json", + "receiptSha256": "e9ac1bd068e11939b0116c3e86c37506ff7d44d279c39ebc0d845180a0d56289", + "log": ".qa/recovery/dependency-review-first.log", + "logSha256": "00c7e0f88937d3eb5831334de7d5be15f145e396fe9787ca71105aff368e0e86", + "body": { + "command": [ + "node", + "docs/validation/dependency-review/run.cjs", + ".qa/dependency-review/first" + ], + "cwd": "/data/workspace/Chats/109197f0a288be0afa6b7f8902925630f5a0bfde/codegraph", + "started_at": "2026-09-22T16:37:09.287172+00:00", + "revision": "b04cf479375b955d58dfed69d9211e43baecdf54", + "working_tree": "?? docs/validation/dependency-review/\n", + "exit_code": 1, + "seconds": 1.008, + "finished_at": "2026-09-22T16:37:10.295598+00:00", + "summary": [] + } + }, + { + "receipt": ".qa/recovery/dependency-review-second.json", + "receiptSha256": "8877661636f4027c4eb9ff4fc80a4ecaf18b985ede2da9d9322a9e5325946a75", + "log": ".qa/recovery/dependency-review-second.log", + "logSha256": "d0adf7df633a11adc7e94b6c91c237d855995a556e362f052c65deed214a0b44", + "body": { + "command": [ + "node", + "docs/validation/dependency-review/run.cjs", + ".qa/dependency-review/second" + ], + "cwd": "/data/workspace/Chats/109197f0a288be0afa6b7f8902925630f5a0bfde/codegraph", + "started_at": "2026-09-22T16:37:27.922149+00:00", + "revision": "b04cf479375b955d58dfed69d9211e43baecdf54", + "working_tree": "?? docs/validation/dependency-review/\n", + "exit_code": 1, + "seconds": 5.836, + "finished_at": "2026-09-22T16:37:33.758524+00:00", + "summary": [] + } + }, + { + "receipt": ".qa/recovery/dependency-review-third.json", + "receiptSha256": "1b0fe22ac6e9380a2284a1e4c8eddcf74fbdac454d35ff9f6a85f70ee1a86fd7", + "log": ".qa/recovery/dependency-review-third.log", + "logSha256": "34b13e052052763530846c48df77cf0cb0a5b89ade96a8815b788bcf6081f8a1", + "body": { + "command": [ + "node", + "docs/validation/dependency-review/run.cjs", + ".qa/dependency-review/third" + ], + "cwd": "/data/workspace/Chats/109197f0a288be0afa6b7f8902925630f5a0bfde/codegraph", + "started_at": "2026-09-22T16:38:38.897280+00:00", + "revision": "b04cf479375b955d58dfed69d9211e43baecdf54", + "working_tree": "?? docs/validation/dependency-review/\n", + "exit_code": 0, + "seconds": 6.585, + "finished_at": "2026-09-22T16:38:45.482175+00:00", + "summary": [] + } + }, + { + "receipt": ".qa/recovery/dependency-review-final.json", + "receiptSha256": "ea7de3011188bcc96a93397118fadb0b62196e1b34640e06efdc0a7455e6d8d2", + "log": ".qa/recovery/dependency-review-final.log", + "logSha256": "e0974b92ec7f8108ea6bbab32977b1bba8eec58a0c93ce0b58d8f62bfca2363e", + "body": { + "command": [ + "node", + "docs/validation/dependency-review/run.cjs", + ".qa/dependency-review/final" + ], + "cwd": "/data/workspace/Chats/109197f0a288be0afa6b7f8902925630f5a0bfde/codegraph", + "started_at": "2026-09-22T16:42:24.632990+00:00", + "revision": "57f332dbb70dbbaf2a45fc2f6bf8fdd76c11f46a", + "working_tree": "", + "exit_code": 0, + "seconds": 6.65, + "finished_at": "2026-09-22T16:42:31.282934+00:00", + "summary": [] + } + } + ], + "raw": { + ".qa/dependency-review/final/drupal-1.json": "342f75adc998d35f3ec5627af3c5e1a6ded077ebdecf77e4604185e430236e18", + ".qa/dependency-review/final/drupal-2.json": "cf7e5cb8d8600ffb2d56b32f5ad89a87963d6ffc952fb43084e089f18b2e263e", + ".qa/dependency-review/final/drupal-3.json": "f2e723a4eeb7c038001cac71bd88da0282786c2af5cb443ae0d0a09fec6b2461", + ".qa/dependency-review/final/drupal-4.json": "77498bdbd7aa4daea3b457366fd543b3ba43267c08c38536730d772be096814b", + ".qa/dependency-review/final/drupal-5.json": "779ba12c1c265166f180ee9718bcb1e1d9284d2c21877f7aed21a6d6200cc2f3", + ".qa/dependency-review/final/drupal-6.json": "ebc2867561c55c9dfe1c96499ccc4c5652f19c78914a030c33491344b7c27d7f", + ".qa/dependency-review/final/drupal-7.json": "bcfe8840ed859be5b22ee70eca3f7ea101c43219f0762ac82fcc3b401be3e8eb", + ".qa/dependency-review/final/drupal-8.json": "b072bdd01474d49b9c0f339edf322219a44a01d486a6443d7dc752391dbadcff", + ".qa/dependency-review/final/drupal-9.json": "691492e1d544552180372694fb7ac4156b295c3c0bed6a23e305a20b7e08243f", + ".qa/dependency-review/final/progress.json": "271c26e88935b783838cf728a17cd148f7c52c312ed5239b275f98e13fc9f560", + ".qa/dependency-review/final/result.json": "f48ad5d885a58b6b1fd42d3c5fa0424cfc8b98372e34b3fa95190b8b393a6d4a", + ".qa/dependency-review/final/source-model.cjs": "cdfe50e338edb589f6acd82e9bc0733f9c6e8bd8059c899afb0896ef17ff8348", + ".qa/dependency-review/final/source-run.cjs": "cf09b4c01594e21c80d62705458ff55b58246f9b7e110ee460f54a87b9409056", + ".qa/dependency-review/first/failure.json": "40d59f8d6b9f5ca717fe5f051a8e2fa7fb5cd27be647d4a18fb0da78772d266c", + ".qa/dependency-review/first/progress.json": "75dcccde18a9496c5f8b0f4bca918b0713a5fadc63259e4fdd733e71954b08f9", + ".qa/dependency-review/second/drupal-1.json": "80ff8556ce9b53af2558164010a40010fba4ff30f6207340337f0ab82083aeb7", + ".qa/dependency-review/second/drupal-2.json": "db0455138652c931f17e6ab312c8c2a6eb2768de3225a21923f2529c1e7b9d25", + ".qa/dependency-review/second/drupal-3.json": "7f993a780e0598b4b14d584e329b544b8fbfd8ed0feb45cf7028de9ea690c720", + ".qa/dependency-review/second/drupal-4.json": "78651faaf0947ea26c29fbb6d4367f4511cb0ea5d109c76a000682c7f3c03047", + ".qa/dependency-review/second/drupal-5.json": "12b2c929570a9ff8616340e942b2cfe578001a993d351158b4808405df67e695", + ".qa/dependency-review/second/drupal-6.json": "7b07af03c7ea13405bdf568744300fb2039be2f516e304130f45b044dfec9aed", + ".qa/dependency-review/second/drupal-7.json": "2029f4694d6ff71d71d4d303c0266bc2336ec04638567415ca02b4d42417ef2e", + ".qa/dependency-review/second/failure.json": "ace34ee8a15b3c14f1b1427bdf013513f854df158784fb7e6b324b91aba2ffa0", + ".qa/dependency-review/second/progress.json": "9cef3b4af72355cd02548daf16d8a4e6d87117f9ac184108cdc62d665b44b190", + ".qa/dependency-review/third/drupal-1.json": "a1d77a900e48b56ab945e89f627145d7841ab2b73c0ea8681dba1d752e40b090", + ".qa/dependency-review/third/drupal-2.json": "c0d8459a75d57d0d66dbeeaecc2b7b0fd7494156a640dd15da47436f10e5727e", + ".qa/dependency-review/third/drupal-3.json": "3aeac1725ba5296837d16736598b3d00ea6fa66191ded3ccea36a7dfe3df1291", + ".qa/dependency-review/third/drupal-4.json": "11569369e702757ac3df0c796ac91cb154b4424a5ef487620e5c50ca9377da42", + ".qa/dependency-review/third/drupal-5.json": "6694c4ea6f3d2487d5883b676c86cba71baea704a0adf67d3bcc4bca9338bbd2", + ".qa/dependency-review/third/drupal-6.json": "d92ec11a9ed0e6d6582c1e03a77d1f21d2d2ac06a8ff6c1f8829b14e275a08df", + ".qa/dependency-review/third/drupal-7.json": "5cc71a192217e2bd1c84e3806a1e10a032e9f81952c8376517eb83fa7edfa3a4", + ".qa/dependency-review/third/drupal-8.json": "6c05165e1e03e9fc4ee6046c1be3d42a7b5e56f57bedfd0bf4716e17e359db9f", + ".qa/dependency-review/third/drupal-9.json": "f790b26b16147ac32b471024c233040f66d386ed4293395b2c0ebb1a203e28a4", + ".qa/dependency-review/third/progress.json": "71653a10145c24d9617a689d4259dc09e3237066856c5bfa1cab5a3c0af33103", + ".qa/dependency-review/third/result.json": "18bbea905ecbe4c372a9040c0097544e0b91c71d28b2262798bf3aafb8697b89", + ".qa/recovery/dependency-review-first.json": "e9ac1bd068e11939b0116c3e86c37506ff7d44d279c39ebc0d845180a0d56289", + ".qa/recovery/dependency-review-first.log": "00c7e0f88937d3eb5831334de7d5be15f145e396fe9787ca71105aff368e0e86", + ".qa/recovery/dependency-review-second.json": "8877661636f4027c4eb9ff4fc80a4ecaf18b985ede2da9d9322a9e5325946a75", + ".qa/recovery/dependency-review-second.log": "d0adf7df633a11adc7e94b6c91c237d855995a556e362f052c65deed214a0b44", + ".qa/recovery/dependency-review-third.json": "1b0fe22ac6e9380a2284a1e4c8eddcf74fbdac454d35ff9f6a85f70ee1a86fd7", + ".qa/recovery/dependency-review-third.log": "34b13e052052763530846c48df77cf0cb0a5b89ade96a8815b788bcf6081f8a1", + ".qa/recovery/dependency-review-final.json": "ea7de3011188bcc96a93397118fadb0b62196e1b34640e06efdc0a7455e6d8d2", + ".qa/recovery/dependency-review-final.log": "e0974b92ec7f8108ea6bbab32977b1bba8eec58a0c93ce0b58d8f62bfca2363e", + ".qa/recovery/dependency-review-final.started.json": "3a648f8ddf4f8f8a4307c57fe159eb72262774255cf334df929eb505a19134b2", + ".qa/recovery/dependency-review-first.started.json": "b75c96c82be391818558f60ff23038a1b64aeaf6117016bdd09774228292dcc8", + ".qa/recovery/dependency-review-second.started.json": "bde924f3e2e1df7fc6868854201406fabf00cab33d4593e48877a59f4c517690", + ".qa/recovery/dependency-review-third.started.json": "d7235b940957e1d746be3e05f7db129096dc7feb8e2c0bfb433e33b1a0162a98" + }, + "result": { + "success": true, + "revision": "57f332dbb70dbbaf2a45fc2f6bf8fdd76c11f46a", + "node": "v22.23.2", + "platform": "linux", + "inputs": [ + { + "path": "__tests__/extension-sync.test.ts", + "sha256": "5f520cdda673d78afd0024115f9adc6ce37973a6bcee4356a7279e543ff743ac" + }, + { + "generated": "extensionTemplate(review-events)", + "sha256": "421bfbf182026c6180cc38e9aae845f3e416d2d6ff77fb4ff39d30b6b29e64d1" + }, + { + "corpus": "pathauto", + "revision": "b97aadf47a37cff25f7d6105c3dade6778fccb47", + "path": "composer.json", + "sha256": "4c44de1b45f67616472a1ef5ece891ad7a9b06c6d37ac4d35264b07348c0965d" + }, + { + "corpus": "pathauto", + "revision": "b97aadf47a37cff25f7d6105c3dade6778fccb47", + "path": "pathauto.routing.yml", + "sha256": "39d8d7d1300422cfe81b517cb28d34d40d9683906aac4aa450e7fc9bae7f62fe" + }, + { + "corpus": "pathauto", + "revision": "b97aadf47a37cff25f7d6105c3dade6778fccb47", + "path": "src/Form/PathautoSettingsForm.php", + "sha256": "f5bf0e826c8b8d79328899eb6f22c88ad049f02e1577416ab6d3289de87ac6b2" + }, + { + "corpus": "pathauto", + "revision": "b97aadf47a37cff25f7d6105c3dade6778fccb47", + "path": "src/Form/PathautoBulkUpdateForm.php", + "sha256": "f257129607c03e875e60a9f2990a1242ea90b060cb188cd4a955a3cb4060dd23" + }, + { + "path": "dist/extensions/drupal-0.1.1.cgext", + "sha256": "e5ed73bee51524585e4f4da1d5017fdee3037a3fa71d8f08edab6c318fedc59a" + } + ], + "checks": [ + { + "name": "negative symbol read: previously missing handler appears", + "scope": "expected stale-cache counterexample", + "staleHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", + "expectedHash": "45b492602391a02b89271750bd19b8adbfe90a5394a5b09ad332b96ba933759f", + "capturedQueries": [ + [ + "readFile", + [ + "binding.py" + ] + ], + [ + "getNodesByName", + [ + "dispatch" + ] + ], + [ + "getNodesByName", + [ + "missing" + ] + ] + ], + "corrected": true + }, + { + "name": "negative file read: missing binding file appears", + "scope": "expected stale-cache counterexample", + "staleHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", + "expectedHash": "b24fe7d1c11d7c6ccba58647cb309eaa7a1dc403ddef787a95ccee855595cfa5", + "capturedQueries": [ + [ + "readFile", + [ + "binding.py" + ] + ], + [ + "getNodesByName", + [ + "dispatch" + ] + ], + [ + "getNodesByName", + [ + "receipt" + ] + ] + ], + "corrected": true + }, + { + "name": "query membership: second same-named target makes prior unique result ambiguous", + "scope": "expected stale-cache counterexample", + "staleHash": "b24fe7d1c11d7c6ccba58647cb309eaa7a1dc403ddef787a95ccee855595cfa5", + "expectedHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", + "capturedQueries": [ + [ + "readFile", + [ + "binding.py" + ] + ], + [ + "getNodesByName", + [ + "dispatch" + ] + ], + [ + "getNodesByName", + [ + "receipt" + ] + ] + ], + "corrected": true + }, + { + "name": "enumeration membership: new indexed registration file appears", + "scope": "expected stale-cache counterexample", + "staleHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", + "expectedHash": "6f64ce95b2e116968754e87fc16bee6fd39801ebccc16eafaba6d251391d9ac4", + "capturedQueries": [ + [ + "getAllFiles", + [] + ] + ], + "corrected": true + }, + { + "name": "generic initial full evaluation", + "scope": "model with actual generic callback", + "ran": [ + "generic:bindings" + ], + "reused": [], + "fallback": null, + "outputHash": "b24fe7d1c11d7c6ccba58647cb309eaa7a1dc403ddef787a95ccee855595cfa5", + "edges": 1 + }, + { + "name": "unchanged snapshot reuses callback", + "scope": "model with actual generic callback", + "ran": [], + "reused": [ + "generic:bindings" + ], + "fallback": null, + "outputHash": "b24fe7d1c11d7c6ccba58647cb309eaa7a1dc403ddef787a95ccee855595cfa5", + "edges": 1 + }, + { + "name": "unread content change reuses callback", + "scope": "model with actual generic callback", + "ran": [], + "reused": [ + "generic:bindings" + ], + "fallback": null, + "outputHash": "b24fe7d1c11d7c6ccba58647cb309eaa7a1dc403ddef787a95ccee855595cfa5", + "edges": 1 + }, + { + "name": "metadata retarget replaces old owned edge between untouched endpoints", + "scope": "model with actual generic callback", + "ran": [ + "generic:bindings" + ], + "reused": [], + "fallback": null, + "outputHash": "79787a160058b1c8053a22bdc4249164b14dc4b05be7ee13e27429a83dc29002", + "edges": 1 + }, + { + "name": "target deletion removes owned output", + "scope": "model with actual generic callback", + "ran": [ + "generic:bindings" + ], + "reused": [], + "fallback": null, + "outputHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", + "edges": 0 + }, + { + "name": "target rename invalidates identity and selects new endpoint", + "scope": "model with actual generic callback", + "ran": [ + "generic:bindings" + ], + "reused": [], + "fallback": null, + "outputHash": "92833698f6094a311fd3728ee7172e61a6ff4f4ebc0da0ee45118ce08a213f8b", + "edges": 1 + }, + { + "name": "same-ID node field change invalidates complete query value", + "scope": "model with actual generic callback", + "ran": [ + "generic:bindings" + ], + "reused": [], + "fallback": null, + "outputHash": "92833698f6094a311fd3728ee7172e61a6ff4f4ebc0da0ee45118ce08a213f8b", + "edges": 1 + }, + { + "name": "option change is an invocation dependency", + "scope": "model with actual generic callback", + "ran": [ + "generic:bindings" + ], + "reused": [], + "fallback": null, + "outputHash": "b24fe7d1c11d7c6ccba58647cb309eaa7a1dc403ddef787a95ccee855595cfa5", + "edges": 1 + }, + { + "name": "config and scan policy epoch invalidate", + "scope": "model with actual generic callback", + "ran": [ + "generic:bindings" + ], + "reused": [], + "fallback": null, + "outputHash": "b24fe7d1c11d7c6ccba58647cb309eaa7a1dc403ddef787a95ccee855595cfa5", + "edges": 1 + }, + { + "name": "project identity prevents cross-project reuse", + "scope": "model with actual generic callback", + "ran": [ + "generic:bindings" + ], + "reused": [], + "fallback": null, + "outputHash": "b24fe7d1c11d7c6ccba58647cb309eaa7a1dc403ddef787a95ccee855595cfa5", + "edges": 1 + }, + { + "name": "package digest change invalidates", + "scope": "model with actual generic callback", + "ran": [ + "generic:bindings" + ], + "reused": [], + "fallback": null, + "outputHash": "b24fe7d1c11d7c6ccba58647cb309eaa7a1dc403ddef787a95ccee855595cfa5", + "edges": 1 + }, + { + "name": "throw preserves prior output and dependency generation", + "scope": "model commit only" + }, + { + "name": "failed invocation retries without reusing partial trace", + "scope": "model with actual generic callback", + "ran": [ + "generic:bindings" + ], + "reused": [], + "fallback": null, + "outputHash": "92833698f6094a311fd3728ee7172e61a6ff4f4ebc0da0ee45118ce08a213f8b", + "edges": 1 + }, + { + "name": "source observation race aborts model commit", + "scope": "model; no OS/SQLite transaction" + }, + { + "name": "restart discards cache and reevaluates", + "scope": "model with actual generic callback", + "ran": [ + "generic:bindings" + ], + "reused": [], + "fallback": null, + "outputHash": "92833698f6094a311fd3728ee7172e61a6ff4f4ebc0da0ee45118ce08a213f8b", + "edges": 1 + }, + { + "name": "empty directory observation invalidates when child appears", + "scope": "model rule fixture", + "ran": [ + "directories" + ], + "reused": [], + "fallback": null, + "outputHash": "dae3a66bf58f8fcca8dd9fc8d6d597f7cf97148ac7b8d4bf22ca7fb0e3429e57", + "edges": 1 + }, + { + "name": "query result order is observable and preserved", + "scope": "model rule fixture", + "ran": [ + "ordered-query" + ], + "reused": [], + "fallback": null, + "outputHash": "5e66fa0fffc6b61eccdbc8b3601622e6f7a27e1d2a072dea861ef78069ad1d23", + "edges": 1 + }, + { + "name": "upstream-stage edge membership invalidates supertype query", + "scope": "model rule fixture", + "ran": [ + "supertype" + ], + "reused": [], + "fallback": null, + "outputHash": "58298e57b75c8c739b67c1e2de80e37ab25a34883d6de9afddaf140e93724c12", + "edges": 1 + }, + { + "name": "registry reorder changes first-pair winner", + "scope": "model rule fixture", + "ran": [ + "b", + "a" + ], + "reused": [], + "fallback": null, + "outputHash": "5f393c9b9deef085739c39cdc042f34c06034c167c0ca9b1f16d33b76a49bfcb", + "edges": 1 + }, + { + "name": "removing first owner reveals shadowed contribution", + "scope": "model rule fixture", + "ran": [ + "a" + ], + "reused": [], + "fallback": null, + "outputHash": "5752859ea59944924ec65df0f6359887695f3ba6735f6e0281ce903d46384301", + "edges": 1 + }, + { + "name": "disabling all owners removes all owned outputs", + "scope": "model rule fixture", + "ran": [], + "reused": [], + "fallback": null, + "outputHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", + "edges": 0 + }, + { + "name": "unsupported context operation falls back to full schedule", + "scope": "model rule fixture", + "ran": [ + "generic:bindings", + "unsupported" + ], + "reused": [], + "fallback": "unsupported context operation: getProjectAliases", + "outputHash": "fe3f0e12e34b7e86f2b602536b608f0cc813e9eead3b6d6348aefad94ffda144", + "edges": 2 + }, + { + "name": "caught unsupported read still taints capture and forces fallback", + "scope": "model rule fixture", + "ran": [ + "unsupported" + ], + "reused": [], + "fallback": "unsupported context operation: getProjectAliases", + "outputHash": "6f64ce95b2e116968754e87fc16bee6fd39801ebccc16eafaba6d251391d9ac4", + "edges": 1 + }, + { + "name": "later-unit failure publishes neither earlier output nor its new cache", + "scope": "model transaction" + }, + { + "name": "actual generated starter: detection membership enables resolution", + "scope": "model with actual generated starter", + "ran": [ + "actual-starter-resolve" + ], + "reused": [], + "fallback": null, + "outputHash": "cf80bbbf01222d4ae42accd62e26ffd3dd15f1df3d5ac7f53303eb9d62a28ecc", + "edges": 1 + }, + { + "name": "actual generated starter: query ambiguity removes resolution", + "scope": "model with actual generated starter", + "ran": [ + "actual-starter-resolve" + ], + "reused": [], + "fallback": null, + "outputHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", + "edges": 0 + }, + { + "name": "declaration-only admission is UNSOUND for real cross-file fs hook", + "scope": "actual existing hook, expected stale result" + }, + { + "name": "legacy hook forces whole-schedule evaluation", + "scope": "model rule fixture", + "ran": [ + "actual-untracked-hook", + "generic:bindings" + ], + "reused": [], + "fallback": "legacy/untracked unit: whole schedule", + "outputHash": "cf8895836c591991df7bf5c209e122dbba105bad1aa6551a83280eba817eebc7", + "edges": 2 + }, + { + "name": "external environment is global fallback, never inferred from returned edges", + "scope": "model rule fixture", + "ran": [ + "untracked-env-model" + ], + "reused": [], + "fallback": "legacy/untracked unit: whole schedule", + "outputHash": "1c6910c8fc1a545dddff7b1531a74fbbe2d9723c5ab44a9df66e61259a77b007", + "edges": 1 + }, + { + "name": "Drupal actual full oracle: missing form target", + "scope": "model vs unmodified Drupal callback AND actual managed SQLite full rebuild on pinned subset", + "nodes": 30, + "edges": 1, + "graphHash": "569f187d6e3263a9070a28744355bcba97803d2b3512f51a28f85e6a96df7c6d", + "reads": 6, + "ran": [ + "drupal:wiring" + ], + "reused": [] + }, + { + "name": "Drupal actual full oracle: missing form appears", + "scope": "model vs unmodified Drupal callback AND actual managed SQLite full rebuild on pinned subset", + "nodes": 51, + "edges": 2, + "graphHash": "c2a05f51a2a26279830514bc4855718832d296957fd590019c60b7847b6f93fe", + "reads": 8, + "ran": [ + "drupal:wiring" + ], + "reused": [] + }, + { + "name": "Drupal actual full oracle: duplicate class removes ambiguous route", + "scope": "model vs unmodified Drupal callback AND actual managed SQLite full rebuild on pinned subset", + "nodes": 72, + "edges": 1, + "graphHash": "569f187d6e3263a9070a28744355bcba97803d2b3512f51a28f85e6a96df7c6d", + "reads": 10, + "ran": [ + "drupal:wiring" + ], + "reused": [] + }, + { + "name": "Drupal actual full oracle: duplicate deletion restores route", + "scope": "model vs unmodified Drupal callback AND actual managed SQLite full rebuild on pinned subset", + "nodes": 51, + "edges": 2, + "graphHash": "c2a05f51a2a26279830514bc4855718832d296957fd590019c60b7847b6f93fe", + "reads": 8, + "ran": [ + "drupal:wiring" + ], + "reused": [] + }, + { + "name": "Drupal actual full oracle: YAML retargets untouched PHP endpoints", + "scope": "model vs unmodified Drupal callback AND actual managed SQLite full rebuild on pinned subset", + "nodes": 51, + "edges": 2, + "graphHash": "c9db62ffc10207eaa1c679ead38bf12ca02abbbb3090b30ad9ae01675593a05f", + "reads": 8, + "ran": [ + "drupal:wiring" + ], + "reused": [] + }, + { + "name": "Drupal actual full oracle: target rename changes endpoint identity", + "scope": "model vs unmodified Drupal callback AND actual managed SQLite full rebuild on pinned subset", + "nodes": 51, + "edges": 2, + "graphHash": "9ca89614fbc032b77fb0e05b62c627b32904ba739aae44d898a8b8e028b11098", + "reads": 8, + "ran": [ + "drupal:wiring" + ], + "reused": [] + }, + { + "name": "Drupal actual full oracle: target deletion removes both routes", + "scope": "model vs unmodified Drupal callback AND actual managed SQLite full rebuild on pinned subset", + "nodes": 29, + "edges": 0, + "graphHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", + "reads": 6, + "ran": [ + "drupal:wiring" + ], + "reused": [] + }, + { + "name": "Drupal actual full oracle: target restoration restores both routes", + "scope": "model vs unmodified Drupal callback AND actual managed SQLite full rebuild on pinned subset", + "nodes": 51, + "edges": 2, + "graphHash": "c9db62ffc10207eaa1c679ead38bf12ca02abbbb3090b30ad9ae01675593a05f", + "reads": 8, + "ran": [ + "drupal:wiring" + ], + "reused": [] + }, + { + "name": "Drupal actual full oracle: non-indexed composer detection turns off wiring and nodes", + "scope": "model vs unmodified Drupal callback AND actual managed SQLite full rebuild on pinned subset", + "nodes": 43, + "edges": 0, + "graphHash": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", + "reads": 2, + "ran": [ + "drupal:wiring" + ], + "reused": [] + } + ], + "productionCachingEnabled": false, + "limits": [ + "In-memory model; no cache integrated into engine", + "Admission flag is not a sandbox", + "Drupal oracle uses four pinned files, not full corpus", + "No new latency, restart/process-kill or hosted proof" + ] + }, + "boundaries": { + "modelChecks": 33, + "actualManagedEngineReferenceStates": 9, + "productionCacheIntegrated": false, + "reranFullLinuxOrNative": false, + "precommitFailures": [ + "Artifact UTF-8 decode harness error", + "Expected route absent after detection disabled; harness corrected with explicit absence assertions" + ], + "earlyAttemptSourceLimit": "Initial dirty harness versions were not committed separately; receipts/logs retained. Final source copies match tested commit." + } +} diff --git a/docs/validation/extensions-dependency-review-20260922.md b/docs/validation/extensions-dependency-review-20260922.md new file mode 100644 index 000000000..f6b61f3a1 --- /dev/null +++ b/docs/validation/extensions-dependency-review-20260922.md @@ -0,0 +1,139 @@ +# Semantic dependency contract review — 2026-09-22 + +The recommendation is an **internal shadow recorder for one host-owned edge-only +adapter**, followed by a separate decision before skipping callbacks. Capture must +include negative reads and predicate membership; a declared “deterministic” API-v1 +plugin cannot safely opt itself into reuse. The production engine, public API, schemas +and immutable Drupal 0.1.0/0.1.1 packages are unchanged. + +Read the [decision and proposed contract](../design/semantic-dependency-contract.md), +[executable model](dependency-review/model.cjs), [driver](dependency-review/run.cjs) +and [source/receipt ledger](extensions-dependency-review-20260922.json). + +## New validation + +Tested review source: `57f332dbb70dbbaf2a45fc2f6bf8fdd76c11f46a` (clean checkout). +Accepted application remains `7575dcc71e4524c660aff06486ebc007cca290b9`; +accepted previous full validation checkout is `e0885ee750ffc99bfb304906bed25966cdac6fb7`. +All changes since accepted head `b04cf479375b955d58dfed69d9211e43baecdf54` are under +`docs/`. Executable review files are validation-only, not merely prose. + +Final command, from repository root: + +```sh +python3 ../run-check.py dependency-review-final \ + node docs/validation/dependency-review/run.cjs .qa/dependency-review/final +``` + +Exit **0**, **42 grouped checks**, Linux x64 / Node 22.23.2, 6.650 s total harness time. +This duration is not a performance benchmark or claimed update speedup. +Receipt: `.qa/recovery/dependency-review-final.json`; complete log: matching `.log`. +Self-copies of the two executable files match the tested commit. All results, input +hashes, full Drupal snapshots, read traces and outputs are retained under +`.qa/dependency-review/final/`; hashes and result bodies are in the ledger. + +| Evidence | Result and scope | +|---|---| +| Four deliberate positive-read-only counterexamples | Expected stale outputs reproduced for missing symbol appearance, missing file appearance, query ambiguity and new indexed registration membership. Full read sets corrected all four | +| Generic, author and rule-model cases (29 more; 33 model checks total) | Actual generic callback bytes extracted from the existing TypeScript fixture; actual generated author detect/resolve callback. Rule fixtures cover directories, derived edge membership, ordering, ownership, options/config/project/package identity, unsupported-read fallback, failure/retry and cold cache. These are in-memory model assertions | +| Real unrestricted-hook counterexample (included above) | Exact existing `require('fs')` cross-file hook changed output with no captured reads. Falsely declaring it safe produced stale output; explicit legacy mode reevaluated the whole schedule | +| Nine Drupal reference states | Unmodified immutable 0.1.1 artifact installed using the current managed installer into a disposable four-file Pathauto subset. Modeled outputs equal uncached actual Drupal callback outputs **and actual managed-engine SQLite contributions** after each full candidate evaluation | +| Existing application evidence | Reused at original revisions; no new Linux full suite, native suite, browser or hosted run triggered for this docs-only review | + +“42 checks” counts named scenarios, not 42 integrated engine tests. The model-only +reset/failure assertions do not certify process-death recovery, persistent cache +recovery, watcher behavior or arbitrary plugin determinism. + +### Actual Drupal reference states + +Source is Pathauto revision `b97aadf47a37cff25f7d6105c3dade6778fccb47`, obtained with +`git show :`, not from modified working-tree files. The four original files +are `composer.json`, `pathauto.routing.yml`, `src/Form/PathautoSettingsForm.php` and +`src/Form/PathautoBulkUpdateForm.php`; exact hashes are recorded. Mutations stay in a +test-owned temporary project, removed afterward. No original corpus graph is touched. + +| State | Actual Drupal edges | Settings route target | +|---|---:|---| +| Settings form missing | 1 | unresolved | +| Settings form appears | 2 | SettingsForm buildForm | +| Duplicate settings class appears | 1 | ambiguous, unresolved | +| Duplicate removed | 2 | SettingsForm buildForm | +| YAML `_form` retargeted | 2 | BulkUpdateForm buildForm | +| Bulk target renamed | 2 | buildForm in renamed file; new endpoint identity | +| Bulk target deleted | 0 | unresolved | +| Bulk target restored | 2 | BulkUpdateForm buildForm | +| Composer changed to non-Drupal | 0 | extension route nodes also absent | + +Each state checks the full returned Drupal edge set, endpoint identity, metadata, +line and provenance against SQLite, plus exact expected edge count and settings +target. The unsupported `_entity_form` route remains without a handler link. The +last state explicitly proves `composer.json` is **not** in indexed file membership; +its bytes still control detection. Captured read counts are 6, 8, 10, 8, 8, 8, 6, 8, +2. This is a route/detection subset, not new whole-Drupal accuracy certification. + +The engine still performs global evaluation. The model consumes the real engine's +nodes, source and indexed-file list afterward; no production cache is exercised. +The generic/author callback comparisons similarly establish representative behavior, +not a complete implementation of `ResolutionContext` or capability isolation. + +## Failures retained + +1. `dependency-review-first`: exit 1 after 28 model checks. The new harness mistakenly + decoded the artifact's UTF-8 entry as base64. Fixed to use the existing package + validator and UTF-8 format. No package bytes changed. +2. `dependency-review-second`: exit 1 after 35 checks. The harness required a route + node after deliberately disabling Drupal detection. Corrected to assert absence + of all contributed nodes in that explicit state; additionally restored the target + first so composer detection must remove **two real edges**, not just preserve zero. +3. `dependency-review-third`: exit 0, 41 checks on the precommit harness. Added a + project-identity check and immutable source copies before the final committed run. + Only the final run supplies the 42-check count. All initial receipt bodies and + logs remain available; early dirty harness states were not separately committed. + +## Reproduce without the workspace wrapper + +Use this preview checkout's built `dist` (build from this branch if unavailable) and +installed dependencies. The driver needs a local Pathauto Git clone containing the +pin above; it reads the pin directly and writes only a new temporary project and output. + +```sh +PATHAUTO_CORPUS=/absolute/path/to/pathauto \ + node docs/validation/dependency-review/run.cjs /absolute/path/to/new-evidence-directory +``` + +The driver guards the reviewed Drupal 0.1.1 artifact SHA256 +`e5ed73bee51524585e4f4da1d5017fdee3037a3fa71d8f08edab6c318fedc59a`. +The unchanged 0.1.0 hash is +`e5015747d02fe50d6af607b6c44f1db9cf7969a0070866ed03c7643377a459c8`. +Use a new output directory so older attempts remain intact. No network, registry, +credentials, remote import or hosting resource is needed to run this proof. + +## Decision limits and remaining gates + +The proposed view must close ambient I/O, capture empty/predicate results, preserve +stage snapshots and registry merge order, and publish graph plus trace generation +only after a successful candidate commit. Unknown/untrusted operations require the +global fallback; caught errors cannot erase taint. Extraction/postExtract caching, +cycle/fixed-point behavior, persistent read sets and graph storage deltas are deferred. +Whole-pass Drupal capture is broad and likely invalidates frequently. No new update +latency reduction is demonstrated by these model counts. + +The [accepted semantic-update report](extensions-semantic-update-20260922.md) remains +the application validation: **4,577 Linux passes / 192 skips / 284 files once** at +`e0885ee`; [native run 35744283425](https://github.com/colbymchenry/codegraph/actions/runs/35744283425) +at `7575dcc` passed Windows 162 focused/four skips and macOS 165/one, including the +accepted recovery coverage. Those results are reused, not a new current-head run. +The latest remote runs were inspected before this review; no rerun was needed. + +Accepted performance is still mixed: limited warm comment-edit/retarget medians +roughly 22% lower Pathauto and 26% lower Commerce; core cold 103.494 → 112.452 s +and higher RSS. Global candidate/database work remains. Historical 22–30% rebuild +overhead, unfavorable diagnostics, and the non-reproduced failed-reference polling +suspicion retain their original scope. + +Next bounded step: internal shadow capture with full-oracle comparison for one +host-owned edge-only adapter, before deciding whether to implement selective reuse. +Cloudflare account/zone/resources, stable Worker HTTPS, provider persistence/backup +and deployed Free-plan CPU suitability remain unverified; proposed +`marketplace.getcodegraph.com` is unconfigured. No desktop, hosting, public API, +production deployment, merge, release or package publication occurred.