Validate continuation evidence, sum per-turn tokens and turns, retain final cumulative cost, and include background wait in elapsed time. Add an offline pinned-CLI canary before paid evaluation and allow 60-minute sessions within the existing deadline and cleanup reserve.
* fix(routes): reject middleware and route metadata false positives
* fix(routes): invalidate cached phantom routes on upgrade
* test(routes): cover cache upgrades across merged schema versions
Verify that schemas 137 through 140 invalidate both parse stores after merging main into PR #3561 and advancing the schema to 141.
---------
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
* fix(ingestion): re-point Go struct member edges when struct is declared in a sibling file (#3558)
findEnclosingClassInfo mints a Go method's owner id from the file
containing the method (Struct:<methodFile>:<Type>), while the Struct
node is keyed by the file declaring the struct (parse-worker uses
declFile). Same package, different file => the HAS_METHOD edge's
sourceId points at a node that does not exist and the edge is silently
dropped at COPY into LadybugDB.
Add reconcileGoStructOwnerEdges, run at the end of the parse phase
after ALL worker chunks are merged so every package's structs are
visible. It rewrites only edges that would otherwise dangle, and only
when exactly one Struct node shares the dangling id's package directory
and simple name; 0 or >=2 candidates keep the old drop behavior (a
wrong owner is worse than a dropped edge).
Index build is lazy: dangling Struct sources are rare (struct fields
never dangle — they live in the struct's own file), so the common
non-Go or fully-same-file case pays two per-type edge scans and no
whole-node pass.
Regression test: test/integration/go-cross-file-struct-owner.test.ts
(fails-before: 1 HAS_METHOD edge; passes-after: 3).
* fix(ingestion): scope Go struct-owner reconcile by language and package
Address PR #3559 review findings:
- Scope the pass to Go: dangling HAS_METHOD/HAS_PROPERTY owner ids whose
Struct:<file>:<name> file is not Go source (Rust, Swift, ...) are never
re-pointed, and only Struct nodes stamped language 'go' (the marker the
worker sets on every declared symbol) are candidates. Negative test pins
a Rust-shaped dangling edge staying untouched beside a same-name Go
struct.
- Key candidate structs by (dir, declared package clause, name) instead of
(dir, name): one directory can carry 'package pkg' and external-test
'package pkg_test' files declaring the same type name, which the old key
saw as ambiguous and dropped fail-closed. Clauses are read via the shared
inferGoPackageName derivation with a call-scoped cache. Integration test
covers the 3-file layout (pkg decl, pkg_test decl, pkg_test methods file)
and asserts the edge lands on the pkg_test.Widget node.
- Keep the direct call in parse-impl with a TODO: the pass needs a
graph-level post-merge hook, which no LanguageProvider/ScopeResolver hook
provides today.
* refactor(ingestion): remove Go graph repair from shared parse phase
* fix(ingestion): resolve Go ownership during ingestion (language-provider.ts)
* Add resolveDetachedOwnerName function to Go config
* Refactor method owner population logic in Go
* Refactor receiver binding to handle unnamed receivers
* Enhance route handler method resolution logic
Refactor route handler to improve ownership resolution and method indexing.
* Add emitPostResolutionEdges to scope resolver
* fix(ingestion): resolve Go ownership during ingestion (ownership.ts)
* fix(ingestion): resolve Go ownership during ingestion (ast-helpers.ts)
* Add resolveDetachedOwnerName to provider methods
* Update SCHEMA_BUMP to 141
Increment schema version to 141 for new features and fixes.
* fix(ingestion): resolve Go ownership during ingestion (decl.go)
* fix(ingestion): resolve Go ownership during ingestion (external_decl_test.go)
* fix(ingestion): resolve Go ownership during ingestion (external_methods_test.go)
* fix(ingestion): resolve Go ownership during ingestion (foreign.rs)
* fix(ingestion): resolve Go ownership during ingestion (go.mod)
* fix(ingestion): resolve Go ownership during ingestion (local.go)
* fix(ingestion): resolve Go ownership during ingestion (methods.go)
* fix(ingestion): resolve Go ownership during ingestion (go-cross-file-struct-owner.test.ts)
* Refactor comments and method registration in tests
Updated comments for clarity and modified method registration to include qualified names and ownership.
* fix(ingestion): resolve Go ownership during ingestion (has-method.test.ts)
* Update SCHEMA_BUMP to 141 in tests
* refactor(ingestion): remove obsolete Go struct owner reconciliation
* fix(go): model build constraints for method ownership
* test(go): cover build constraint grammar and platform variants
* fix(go): resolve method owners across compatible build variants
* test(go): verify variant ownership through ingestion pipeline
This test verifies that build-variant owners are consistent across different workers, the semantic registry, and the graph. It sets up various scenarios to ensure that ownership is correctly resolved and that there are no dangling edges in the ownership graph.
* fix(go): reject impossible known constraints when peer is unknown
Address PR #3559 review feedback. Regression coverage follows in this update.
* feat(ingestion): allow providers to group incremental resolution files
Add the optional language-neutral hook used by the Go ownership writeback fix for PR #3559.
* fix(go): group sibling files for incremental ownership resolution
Use the existing Go package-directory key for the provider hook.
* fix(incremental): collect sibling resolution groups for changed paths
Keep group keys local to each provider and include current siblings of deleted files.
* fix(analyze): persist ownership changes in unchanged Go siblings
Expand changed and deleted resolution groups before importer traversal. Use the same effective file set for deletion and writeback so package-wide ownership changes reach the database.
* test(incremental): cover provider-local resolution groups
Cover changed, added, deleted and unrelated paths for the new sibling expansion helper.
* test(go): compare incremental ownership writes with cold rebuilds
Reproduce ownership changes after deleting and restoring a Windows declaration while the shared method file stays unchanged. Verify incremental writes and persisted ownership parity with forced rebuilds.
* test(go): exclude impossible owners with unknown method constraints
Use real parsing to cover impossible owner edges and valid owners hidden by impossible competitors.
* test(go): pin filename rules and unknown constraint overlap
Document Go first-dot filename behavior and verify impossible known constraints in both operand orders.
* test(go): register incremental ownership coverage across platforms
Include the new database-backed Go ownership suite in the cross-platform test list.
* test(go): schedule incremental ownership suite with native database tests
Complete PR #3559 review fixes. Local validation: 47 focused tests across five suites passed; build and source/test type checks passed. The full suite was interrupted without a result.
* refactor(ingestion): centralize worker owner hook forwarding
Pass the language provider into the private cached owner lookup instead of repeating four owner hooks at five call sites. Keep qualified-name selection explicit and preserve the exported helper signature.
Validation: CLI/shared build and test typecheck pass; repository lint has no errors; 591 tests pass with one skipped across 13 ownership and worker suites. Web typecheck is blocked by uninstalled web dependencies. Graph checks are unavailable because this checkout has no registered index.
* test(rename): add Go cross-file fixture module
Part of the cross-file method ownership regression for PR #3559. The completed fixture uses real indexing, public rename preview/apply, warm cache replay and post-rename reindexing. All 14 Go rename integration cases pass locally.
* test(rename): add cross-file fixture before/types.go
* test(rename): add cross-file fixture before/methods.go
* test(rename): add cross-file fixture before/callers.go
* test(rename): add cross-file fixture after/go.mod
* test(rename): add cross-file fixture after/types.go
* test(rename): add cross-file fixture after/methods.go
* test(rename): add cross-file fixture after/callers.go
* Add test case for renaming pointer receiver method
Complete the real persisted-index regression fixture for PR #3559. The type, pointer receiver method and callers are in separate Go files. Public rename preview/apply must make exactly four edits across the structural interface family while preserving an unrelated same-name method, comments and strings.
The fixture checks six exact ownership, interface and call edges before rename, after warm parse-cache replay and after reindexing the edited sources. All 14 Go rename integration cases pass. Formatting and the CLI typecheck pass. Graph impact/detect-changes could not run because this checkout has no registered index.
---------
Co-authored-by: System administrator <root@nixos-infra.home>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
* fix(lbug): round GITNEXUS_LBUG_MAX_DB_SIZE up to a power of two
The native buffer manager rejects any max DB size that is not a power of
two, but the env parser accepted any positive integer, so a value such as
300000000000 failed at open and was then reported with a misleading
"set a larger limit" hint.
Round a positive safe integer up to the next power of two and warn once
naming the raw and effective values. Values that are not safe integers
now fall back to the 16 GiB default.
Refs #3529
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* feat(lbug): add remedies for the address-space ceiling and past-EOF read
Add two pure classifiers beside bufferPoolExhaustionRemedy. They parse only
what the engine message states, label the byte count as the limit the engine
reported (not the configured value), and name GITNEXUS_ATOMIC_INCREMENTAL=0
only for runs that knob changes. Neither asserts why the failure occurred.
Refs #3529, #3530
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* feat(lbug): add size-evidence formatting for failure diagnostics
formatFileEvidence is a pure formatter over stat-shaped input (apparent
size, allocated blocks, raw statfs f_type), so sparse and regular cases are
testable without a real sparse file. describeFileEvidence wraps it, never
throws, and reports a missing file as unavailable.
Refs #3530
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* fix(analyze): honor GITNEXUS_ATOMIC_INCREMENTAL=0 and classify staged failures
GITNEXUS_ATOMIC_INCREMENTAL was only read as === '1', so the documented =0
mitigation did nothing for watch and auto-sync, which pass atomicIncremental
as an option. An explicit =0 now beats the caller's request. Full rebuilds
and the escalation to staging still stage and are unaffected.
In the analyze catch block, snapshot the live and staging files before the
checkpoint driver stops and the database closes (closing can checkpoint the
staging file), classify the error once, then log the remedy and the held
evidence for a size-ceiling or past-EOF failure. The off-switch is named
only when the failed run was an atomic-incremental staged write. A max-size
message the classifiers do not recognise keeps the generic hint, and the
original error is rethrown unchanged. The atomic-incremental staging log
line now records the staged file size.
Refs #3529, #3530
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* docs: document max DB size rounding and GITNEXUS_ATOMIC_INCREMENTAL
Note that GITNEXUS_LBUG_MAX_DB_SIZE must be a power of two and is rounded
up, add GITNEXUS_ATOMIC_INCREMENTAL (1 and 0, and which builds 0 does not
affect) to both README env tables, and add a Troubleshooting entry for the
two intermittent embedding write-back failures and the evidence lines GitNexus
now logs for them.
Refs #3529, #3530
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* fix(review): apply review findings
Review fixes:
- Label the GITNEXUS_LBUG_BUFFER_POOL_SIZE=0 sentinel in the failure
evidence line instead of printing "buffer pool 0 B".
- Replace FailureRemedyContext {staged, offSwitchApplies} with a single
StagedBuildMode ('in-place' | 'staged-rebuild' | 'staged-incremental'),
removing the { staged: false, offSwitchApplies: true } illegal state.
- Re-attach the LBUG_MAX_DB_SIZE doc comment to the exported constant.
- Cover the in-place classified failure through runFullAnalysis, and the
buffer-pool sentinel label, with new tests.
Also carries the simplification pass: failure evidence is collected only for
a classified failure, the staged-build flag is reused, the env var is read
once, and the evidence tests share one temp-dir helper.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* fix(lbug): bound failure-evidence stats and record checkpoint activity
Review findings #1 and #3 on #3570.
describeFileEvidence raced nothing: a stat on a stalled 9p/NFS/virtiofs
mount hung the analyze failure handler before the driver stopped, the
database closed and the original error was rethrown. Each stat/statfs now
has a 2000 ms deadline and fails open; a missing file reads "absent"
instead of "unavailable", a stalled one reads "unavailable (timed out ...)".
collectFailureEvidence (new) is the single evidence collector: it reads
the checkpoint activity snapshot and dispatches every stat in one
Promise.all before its first await, covering the live index, the staging
copy and its .wal/.shadow/.wal.checkpoint sidecars. That is what lets a
#3530 report tell a short main file from pages pending in the sidecars or
from a CHECKPOINT GitNexus itself ran just before the failing DELETE.
runCheckpointWithRetry now records completed count, last completion time
and in-flight count. Both the periodic driver tick and checkpointOnce (the
staged window-start CHECKPOINT) go through it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* fix(lbug): state the off-switch cost, pin the rounded max size, isolate ambient env
Review findings #5 (note), #6 (wiring) and #11 on #3570.
offSwitchNote now says that GITNEXUS_ATOMIC_INCREMENTAL=0 can leave the
live index partly written after a failed in-place write, and that the next
run then rebuilds it in full.
A new test stubs GITNEXUS_LBUG_MAX_DB_SIZE=300000000000, reloads
lbug-config and asserts the native Database constructor receives 2 ** 39
and that exactly one rounding warning is logged. The existing tests all
called the parsers directly and matched the constructor argument with
expect.any(Number), so reverting the wiring left the suite green.
vitest.config.ts sets GITNEXUS_ATOMIC_INCREMENTAL to the empty string
(neither '0' nor '1', i.e. unset) like GITNEXUS_MEMORY, so an exported =0
no longer switches off every staging test.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* fix(analyze): carry the failure diagnosis in the error message and label escalated runs
Review findings #2, #4, #5, #7, #8 and the run-analyze half of #6 on #3570.
#4: the remedy and `Failure evidence` lines were only sent to onLog, which
`analyze --watch` wires only with GITNEXUS_VERBOSE=1 and the auto-sync
launcher drops - the only two callers that request atomic-incremental
staging. They are now appended to the rethrown error's message in place
(identity and prototype preserved, native text first so classifiers
anchored on it still match), which every caller prints. A thrown value
that is not an Error falls back to a log. Auto-sync truncated that message
to 240 characters before logging it; the log now allows 2000 while the
persisted summary stays short.
#8: remedy delivery is best effort, so a throwing onLog sink or an
unwritable message can no longer replace the native error.
#2: escalatedFullWrite is declared above the try, and an escalated
atomic-incremental run is classified as a rebuild. Its remedy no longer
points at GITNEXUS_ATOMIC_INCREMENTAL=0, which does not stop the
escalation from staging.
#5: when GITNEXUS_ATOMIC_INCREMENTAL=0 overrides a caller that requested
staging, the run logs one line saying so and what a failed write costs.
#7: the stage-time size line uses the same "staging copy" label as the
failure evidence.
#6: tests pin the evidence-before-driver-stop-before-close order, the exact
configured max DB size in the evidence, and the appended text against the
substring classifiers in the CLI and auto-sync.
The READMEs describe the new evidence lines, ask reporters to include the
stage-time line, and name GITNEXUS_WAL_MANUAL_CHECKPOINT=0 as the bisect
knob for the checkpoint hypothesis.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Address PR review feedback (#3570)
- wal-checkpoint-driver: count a checkpoint as completed only when
tryFlushWAL actually ran one. It returns false when no connection is
open, and the failure evidence renders the count as "N completed".
- auto-sync runner: an oversized native error now logs its head and tail
(1000 characters each) so the appended failure diagnosis, which is always
the tail, survives. The persisted 240-character summary is unchanged.
- lbug-config: the max-size remedy said GITNEXUS_LBUG_MAX_DB_SIZE "must be
a power of 2", but non-powers are rounded up. It now says so, as do the
matching lines in gitnexus/README.md.
- failure-evidence and file-evidence tests use the default registered
temp-dir prefix, so the stale-sidecar sweep recognises their fixtures.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Address PR review feedback (#3570)
- run-analyze: stringify the thrown value through a helper that cannot
throw, so an exotic throw (null-prototype object, throwing toString)
cannot abort the failure handler before it stops the driver, closes the
database and reclaims the staging copy.
- run-analyze: a classified non-Error throw is wrapped in an Error (original
kept as `cause`) so the diagnosis travels in the message like every other
case, instead of in a log that the auto-sync launcher drops. This removes
the separate log fallback.
- auto-sync runner: the oversized-error log keeps head and tail within the
2000-character cap; the separator no longer pushes it to 2003.
- lbug-config: the max-size rounding warning prints the operator's value as
supplied (300000000000.9), not the integer it floored to.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Address PR review feedback (#3570)
- lbug-config: the max-size remedy's rounding example was itself a power of
two. It now shows a value being rounded: 300000000000 becomes 549755813888.
- auto-sync-runner test: the comment said the whole log line is capped at
2000 characters; the assertion covers the error payload after the prefix.
- extension-loader test: pin that the installer child is handed the rounded
max DB size for a non-power-of-two override. The installer prefers that
argument over the env var and has its own non-rounding parser, so this is
what keeps a valid override working there.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Address PR review feedback (#3570)
- Keep the whole failure diagnosis in auto-sync's capped log line: the
tail now reserves the remedy and evidence lines (with a 240-char floor
for the native head) instead of an even head/tail split.
- Count only this run's checkpoints in the failure evidence: snapshot the
process-global activity when the run begins and report the difference,
so an earlier `analyze --watch` refresh no longer leaks in.
- Diagnose classified failures thrown while opening the staging copy, via
helpers shared with the write-path catch.
- Halt checkpoint ticks before measuring failure evidence: start
`walCheckpointDriver.stop()` (which clears its timer synchronously)
before the stats, then await the drain before close.
Note: pre-existing timeouts in run-analyze-fts-repair ("fails repair mode
when no base meta exists", "abandons a pending set that fails
EMBEDDING_RESUME_MAX_ATTEMPTS times in a row") reproduce on the unchanged
PR head on this host and are not addressed by this commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
* chore(deps): consolidate Dependabot GitHub Actions updates
* chore(deps): consolidate web updates and secure transitive dependencies
* fix(web): preserve diagram appearance with Mermaid 12
* test(ci): align workflow security tests with updated action pins
* fix(ci): split coverage across eight shards to avoid job timeout
CI run 38693066214 cancelled Ubuntu coverage shard 1 after 25 minutes while tests were still passing. The missing coverage blob then caused the execution audit and CI gate to fail.
Increase only the coverage shard count from four to eight. Keep the timeout, full suite, coverage thresholds, and execution audit intact.
Validation: all 1,247 test files form a complete, disjoint eight-shard partition using the configured Vitest sequencer; 117 targeted tests passed (2 existing skips); workflow generator, Prettier, concurrency validation, and diff checks passed.
* fix(ci): leave headroom for Windows test shards
Run 38697469283 exhausted the 20-minute Windows watchdog. Use ten platform shards while retaining eight coverage shards and all existing timeouts, coverage gates, and execution audits. The accompanying timing refresh and recorded-profile regression keep all 145 platform-sensitive test files covered exactly once.
* fix(ci): refresh underestimated Windows suite timings
Refresh eight materially underestimated timing weights using Windows runs 38697469283 and 38693066214. The old partition placed native suites ahead of cli-e2e with insufficient time left under the watchdog. Keep every suite and the partitioning algorithm unchanged.
* test(ci): replay the Windows timeout workload
Add a deterministic regression from recorded Windows CI timings, independent of the scheduling table. It failed before the fix with a 1,426-second shard and now protects three minutes of watchdog headroom.
Validation: 118 targeted tests passed (2 existing skips); typecheck, formatting, workflow generation, concurrency and diff checks passed. Independent review found no actionable issues. All 145 platform test files are selected exactly once; replaying the complete observed profile gives a 973-second maximum across ten shards. Hosted CI remains the final elapsed-time check.
* fix(mcp): reject corrupt query identities and refresh index metadata
* fix(mcp): preserve reader and search integrity
Keep replaced readers unknown until matching metadata is published.
Defer shared-handle refresh until other consumers release the old graph
to avoid rebuilding connections against the same stale generation.
Propagate identity corruption after both hybrid search lanes settle,
so the sibling cannot query after its database session is released.
Select the regressions for the OS matrix and retain Python coverage
without optional Swift grammars.
Validation: 393 focused tests, nine native generation tests and ten
race executions across five fresh processes pass. Build and source/test
typechecks pass. The early full run passed 26,096 tests and failed eight:
seven reproduce on baseline; the mixed-source publication case passes
in clean reruns. Windows/macOS native execution remains for CI.
Graph analysis maps all edited production symbols; coverage remains
partial for the anonymous FTS test callback, manually reviewed.
Refs #3571
* fix(lbug): bump @ladybugdb/core to 0.21.2 to stop doubled rows after delete and re-copy
LadybugDB 0.21.0 and 0.21.1 return every row of a table that spans more
than one native vector twice once the incremental writeback has DETACH
DELETEd it and a COPY into an earlier table has run. NodeGroup::scan let a
morsel that ended before the group's first live row wrap an unsigned
subtraction and rescan to the end of the group (LadybugDB #1085, fixed in
0.21.2). No primary key error fires. The identity guard from #3442 stops
the run with "unexpected or duplicate ID", so a Swift edit that pulls every
importer into the write set failed on repos with more than 2048 structs.
Only unreleased main was affected: 1.6.12 ships 0.18.3.
Pin 0.21.2 in package.json, update the six @ladybugdb/core entries in the
lockfile, and move coreVersion in the vendored FTS manifest. The FTS
extension stays at 0.21.0 because no v0.21.1 or v0.21.2 artifact is
published; the pairing assertion and its unit tests pass.
Add a regression to the delete-nodes-for-files suite: 2049 structs with
CONTAINS edges are loaded, every file is deleted, the graph is loaded
again, and each id and edge must appear exactly once.
Verification (Linux, Node 22.18):
- lbug-delete-nodes-for-files: 11/11 on 0.21.2. With the 0.21.1 native
packages swapped in, the new test fails with 4098 rows instead of 2049.
- Reporter recipe end to end on the built CLI: incremental analyze exits 0
with no duplicate ids on a Swift-heavy fixture and on a 70-file Python
fixture, with and without FTS. On 0.21.1 the Swift fixture exits 1.
- A 0.21.1-written database opens and reads under 0.21.2.
- prettier, eslint and typecheck:tests are clean on the changed files.
- The full lbug-db project had not finished when this was committed.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* test(fts): say what the Windows warm-session branch covers
On Windows the repair step calls poolClose, which removes the pool entry
before the in-place writer opens. The step therefore checks the backend's
cached capability state, not a live pool connection. The comment now says so
instead of implying the pool stays warm. No behavior change.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* revert: take the @ladybugdb/core 0.21.2 bump out of this PR
Reverts 0cdc3dfe3. The bump fixes LadybugDB 0.21.0 and 0.21.1 returning every
row of a large table twice after a delete and re-copy, but on Windows it
crashes the vendored FTS extension, which is still the v0.21.0 build: four of
eight Windows shards failed with exit code 3221225477 (0xC0000005) in tests
that load libfts and build an FTS index. All eight passed on 9d79092ab with
core 0.21.1. A Windows extension is only published for v0.21.0, not for
v0.21.1 or v0.21.2.
The bump moves to its own draft PR (#3578) until a matching Windows
extension exists. This PR returns to its original query-integrity and
index-freshness scope.
Restores gitnexus/package.json, the six @ladybugdb/core entries in
package-lock.json, the coreVersion in vendor/lbug-fts/manifest.json, and
removes the regression test that belongs with the bump. All four files are
identical to origin/main (1b4e3f0a8) after this commit.
Verification:
- git diff origin/main for the four files is empty.
- fts-artifact-coverage and vendored-extension-path unit tests pass (31),
and assert-publish-fts-coverage reports core 0.21.1 paired with extension
0.21.0.
- The graph check on the staged revert was partial, because it only deletes
test code. The forward change was gated clean: 4 files, 6 symbols, all in
that test, no affected processes.
- Windows CI has not run on this commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
* test(accuracy): retire repaired Python accessor gaps
* fix(python): connect module accessor resolution
* fix(python): resolve calls through module-returning accessors
Bind `_pc().target()` and `m = _pc(); m.target()` to the module's
function when a local accessor returns an imported module, and count
capped-out dropped names in the impact lower bound.
Closes#3497
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor(python): share module-accessor position key (#3542)
- Reuse the capture-side positionKey in the receiver namespace resolver
instead of a second line:col helper plus an inline template.
- Note why the synthetic { moduleScope, scopes: [] } input is sufficient
for createNamespaceTargetCache (sealed disk-backed ParsedFile shape).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor(python): reuse subtype-dispatch positionKey (#3542)
- Export the existing line:col positionKey from subtype-dispatch instead of
defining an identical copy in module-accessors, so both Python capture
side channels key positions through one helper.
- Apply prettier to the Function-scope indexing line.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(ci): unique test titles and rebaseline Python benches (#3542)
- impact-epistemic-lower-bound: `%j` rendered null, NaN and Infinity all as
`null`, so the test-completeness audit rejected the duplicate identities.
Use `%s` so every parameterized case has a distinct title.
- python-scope: capture fingerprint changes with the new module-accessor
capture facts (golden captures were already updated).
- receiver-resolution: +4 Python call drops (125 -> 129). The two-step
`x = f(); x.m()` form is now counted as an unresolved call instead of
vanishing: fastapi-depends `router.get/post` (unknown, x3) and
python-method-chain-binding `user.get_city()` (in-program; `User` has no
`get_city`, so the site is genuinely unresolvable).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs(indexing): document native pool exhaustion recovery (U3)
Publish the reviewed recovery runbook and collapsed-write guardrails for #3526.
* docs(indexing): explain native buffer pool sizing (U3)
* fix(indexing): reject collapsed staged graph writes (U2)
* fix(indexing): abort native buffer exhaustion (U1)
* test(indexing): cover exhausted and collapsed graph writes
* ci(tests): split ubuntu coverage into 4 shards
Coverage shard 1/3 runs 20-25 minutes across branches and now hits the
25-minute job timeout (cancelled on this PR and on unrelated branches),
which skips coverage-merge and fails "every test executed" plus every
platform compatibility gate downstream. A fourth shard brings each slice
well under the cap. Shard job names are not required checks; the merge
job globs coverage-blob-*, so no other wiring changes.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(lbug): remove branching from buffer-exhaustion tests
Split the collapsed-staged-graph case into first-time and existing-index
tests sharing one helper, so every assertion runs unconditionally instead
of behind `if (hasExistingIndex)`. Parameterize the first-COPY exhaustion
case with its statement matcher (reusing isRelationshipCopy) rather than a
ternary on the phase name. Assertions are unchanged.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Use the existing snapshot capture ceiling for buffered materialization so
valid graphs remain usable on filesystems without reflinks. Preflight both
release runtimes before paid sessions and exercise the real copy boundary
with a 513 MiB regression and the native release smoke.
* fix(deps): make tree-sitter peer installs clean
Keep the eight audited lockfile peer ranges consistent with the bundled tree-sitter 0.25.1 runtime and apply the existing manifest preparation during postinstall. Ordinary and strict npm installs resolve without peer warnings.
* docs: explain audited tree-sitter peer maintenance
* fix(deps): pin audited tree-sitter peers to 0.25.1
* fix(deps): normalize audited peers to the exact runtime
* docs: clarify exact tree-sitter runtime peer pins
* test(deps): cover exact peer pins and existing-install migration
Verify exact 0.25.1 peers, repeatable preparation, and migration from the previously widened peer metadata.
* fix(deps): support pnpm symlinks in bundle preparation (#3555)
Follow package symlinks and pnpm sibling dependency containers. Deduplicate real paths to avoid revisiting aliases or cycles while preserving the audited manifest and duplicate-instance checks.
Validated with strict npm ci, both typechecks, npm pack, a real pnpm layout, and a pnpm-installed tarball parsing all 19 grammars on main and worker threads.
* test(deps): cover pnpm layout and symlink cycles (#3555)
Exercise real package symlinks, transitive sibling dependencies, a self-cycle, metadata drift before writes, and rejection of distinct duplicate grammar instances.
The original script fails the pnpm regressions; the updated script passes all 10 bundle tests.
* chore(autofix): apply prettier + eslint fixes via /autofix command
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
lint-staged 15 pulls braces via micromatch (GHSA-vfj7-8cjw-p6xm, high).
lint-staged 16 uses picomatch instead, clearing the remaining npm audit
findings at the repo root. Node floor (>=20.17) is met by CI (22/24).
Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(deps): upgrade native tree-sitter to 0.25.1
* fix(tree-sitter): preserve sync loading and update verified capture baselines
Route C# scope queries through the synchronous native grammar loader so the compiled analyze module remains require-compatible on Node 22.18. Refresh only the audited empty-Python-module and renamed-PHP-fixture captures, and pin the runtime assertion to 0.25.1.
Validated 479 targeted tests, all 16 scope-capture benchmark cases, Python capture/import guards, compiled C# worker parsing, build, typecheck and formatting. Performance budgets are unchanged.
* fix(tree-sitter): refresh upstream vendors and preserve parser semantics
* fix(ci): refresh prebuilds and support Windows ARM
Refresh macOS, Linux ARM, and Windows x64 grammar binaries from the successful native CI builds. Pin node-gyp 12.4.0 so the Windows ARM jobs recognize Visual Studio 2026.
Use local Git filtering for E2E to avoid PR-files API timeouts on generated parser diffs.
Validation: 143 focused tests, Actionlint, and all 16 scope-capture benchmark checks passed. Full npm test run started; native database suites still running.
* fix(ci): refresh Windows ARM grammar prebuilds
Import all seven Windows ARM grammar artifacts from successful native build run 37965761760. Artifact filenames and SHA-256 hashes verified; all 42 native build jobs passed.
Validation: 31 prebuild coverage tests passed.
* fix(bench): stabilize scope capture timing guard
Warm each input size seven times and use 21 median samples while retaining isolated timing blocks. Yield between languages so native finalizers release allocations outside the measured sections. Keep all fixture sizes, fingerprints, scaling formulas, and budgets unchanged.
Validation: all 16 language guards passed with a 2 GB heap limit (1.38 deep-chain ratio; 1518 MB peak RSS). Linear and quadratic controls passed their expected guard outcomes. Formatting and graph change analysis passed. Full npm test is running without failures so far.
* fix(parser): reduce TypeScript capture traversal cost
* fix(test): await parser worker readiness before teardown
* fix(parser): load C# synchronously in workers
* fix(grpc): resolve native proto detections against their own file
With the native proto grammar active, sibling .proto files that declare
the same short service name under different packages tied in the
directory-based resolveProtoConflict heuristic and both providers were
dropped. A proto-origin detection already knows its defining file, so
use that file's entry before falling back to the heuristic.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* ci(packaging): assert native grammars load from the installed tarball
The packaged-install smoke only ran `gitnexus --version`, so a grammar
that failed to load from the published package (bundled runtime, patched
peer manifests, vendored prebuilds, C# sync loader, Protobuf wrapper)
would ship silently; the dev-tree ABI smoke also accepts vendored
grammars that report unavailable. Parse a sample for every registered
grammar plus the native Protobuf plugin from the installed package, on
the main thread and in a worker thread.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* ci(tree-sitter): track compatibility workarounds instead of 0.25 readiness
The daily readiness report still targeted tree-sitter@0.25.0, so after the
upgrade it would keep reporting "Blocked" and never close its tracking issue.
Repurpose it to track what we carry for the bundled runtime: derive the target
from the package.json pin, list each pack-time peer patch from
prepare-tree-sitter-bundle.cjs with its drop condition (bump, wait for an
upstream release, transitive, or intentionally pinned), and reword the
buckets. The workflow adopts the issue opened under the old title.
Also update the grammar-update-monitor header and auto-PR text, which still
described the 0.21.1 runtime and a tree-sitter-c hold.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(dart): assert both nested labels target the loop; fix Zig call-shape doc
The nested-label CFG test only jumped to `outer` and checked reachability,
which still passes when a jump is retargeted to the inner loop (its exit
reaches the outer header). Jump to both labels and assert the exact
`continue` edges; dropping the inner label now fails the test.
Update the Zig callable-flow comment: call_expression now wraps actuals in a
required `arguments:` field.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Set the supported ONNX installer skip policy inside the cleared build
sandbox so optional CUDA downloads do not abort offline lifecycle scripts.
Keep CPU binaries, network containment, and all grading checks intact.
Strengthen command construction and real Bubblewrap lifecycle coverage.
Targeted tests: 114 passed, 15 skipped. Full core and real containment
validation deferred to hosted CI with maintainer approval.
* test(release): add fixed-answer native tool accuracy
* fix(release): gate stable artifacts on pinned paired evaluations
Apply review findings #1-4: gate Docker publication, grade in-flight retries, preserve repository context, and execute negative controls in CI.
* fix(eval): verify native context and resolve harness security findings
Inspect Claude's first startup reminder for ordinary repository guidance.
Bound launcher-option matching and escape Markdown backslashes and pipes.
Exclude only the parsed synthetic accuracy corpus from CodeQL; keep the
benchmark harness and evaluator under security analysis.
Validated focused Python and TypeScript regressions plus core typecheck.
* fix(eval): wake the EC2 runner and prove paired evaluator execution
Bootstrap the existing dedicated instance from a protected hosted job, bound
native runner pickup, and stop only instances started by this run. Keep paid
sessions inside the fixed stop window and add a runner-only dispatch.
Require a contained six-cell prepare/session/oracle/report canary in CI,
including a failed repair that remains in the measured denominator.
* fix(ci): reuse existing configuration and disambiguate accuracy cases
Remove the new AWS credential/settings path and release opt-in variable. Bound native runner pickup with the existing GitHub token and retain private EventBridge startup until its existing mechanism can be reused. Reuse current workflow environment names and evolution schedule controls.
Name malformed-observation cases explicitly so the execution audit distinguishes null from missing and actually tests invalid arrays.
* fix(review): isolate release builds and preserve benchmark evidence
* fix(release): gate RC publication on paired quality and manage EC2 lifecycle
* fix(ci): clarify release shell redirects and build script
* fix(eval): remove temporary patch sinks after capture
* fix(bench): retire tool-accuracy allowances repaired on main
Main at 50aa4be3b repaired three #3487 route checks (#3505) and all four
#3499 Python scope checks (#3502, #3504). The ratchet correctly failed the
merged head with stale allowances, so remove them and keep the fixed answers
as release protection: 18/31 pass, 13 recorded gaps remain.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(release): gate RCs on accuracy only and keep paid runs for stable
Follow the cost split proposed in discussion #3493: fixed-answer tool
accuracy on every RC, paired agent runs before stable releases and on a
weekly schedule against the latest RC.
RC publication no longer prepares a bundle, calls release-evaluation.yml
and waits for a paid run of up to 21 hours on the shared EC2 lock. Every
release attaches this run's accuracy report; stable npm publication still
requires exact-commit paired evidence. release-evaluation.yml drops its
workflow_call path and the now-unused candidate bundle module.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(release): address PR #3503 review feedback
- Page through recent release-evaluation runs instead of reading only
the newest 50, so valid stable evidence cannot be pushed off page one.
- Bound each runner-pickup jobs request by the remaining deadline.
- Replace non-finite floats at any depth in failure receipts so the
incomplete report still serializes with allow_nan=False.
- Clarify that the summary.cap case has 501 names over 1001 sites.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(review): harden candidate build and close review gaps
- Mount the candidate checkout's .git read-only inside the build sandbox,
so lifecycle scripts cannot plant git config (e.g. core.fsmonitor) that
host git later runs in that checkout during actions/checkout cleanup.
The real-Bubblewrap canary now also attempts that write.
- Type tool-accuracy observations instead of using explicit any.
- Cover the fail-closed branches reviewers found untested: unsafe or
missing evidence artifacts, mismatched task pins, malformed repo/SHA,
an instance that stops again during bootstrap, and unbalanced GitNexus
guidance markers.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs(release): describe RC accuracy gate and stable evidence step
- CONTRIBUTING now states that RCs are gated by CI (including the
fixed-answer tool-accuracy check) without a paid run, and that stable
publication needs a passing Release evaluation for the exact commit
within seven days.
- The oracle-control fixture passes tarfile's data filter only where it
exists (3.11.4+), matching the declared Python 3.11 floor.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor(bench): pin tool-accuracy fixture line anchors in one place
run.ts bucketed rename edits and explain findings by line literals that
expectations.ts duplicated. Export FIXTURE_ANCHORS (file, line, pinned text)
from expectations.ts, build the fixed answers and run.ts classifiers from it,
and fail loudly (runner and unit test) when a fixture line no longer holds
the pinned text. Expected answers and observations are unchanged.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(bench): fail closed when ripgrep is missing from the tool-accuracy run
rename's text-search pass shells out to rg and only logs a degraded warning
when it is absent, so a runner without ripgrep scored a degraded rename
(homonym.ts:1 missing) and still passed. Check rg --version before indexing,
record it in accuracy.json source.externalTools, and install ripgrep in the
ci-tests tool-accuracy job and the docker release-gate (same if: condition).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor(eval): split baseline guidance, share bwrap preamble, drop dead bare option, harden patch cleanup
- Move the baseline (no-GitNexus) guidance scrubbing out of proposer_sandbox.py
into baseline_guidance.py, with its unit tests.
- Expose real_directory, runtime_mount_args and bwrap_base_args publicly so
release_build no longer imports private helpers or re-assembles the shared
bubblewrap preamble; the candidate build command is byte-identical.
- Remove the unused run_claude `bare` parameter and its --bare/--tools branches.
- capture_patch: a failed temporary-directory removal no longer discards the
read patch or replaces an earlier error; it is attached as a note, or warned
on stderr when there was no earlier error.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(ec2-runner): keep stop observing through transient describe failures
- stop() treats a failed or timed-out describe-instances call as unknown
state and keeps observing until the stop deadline; a persistent failure
is still raised at the deadline with the last command error. Unusable
states and identity mismatches still fail at once (new CommandError
subclass separates command failures from semantic ones).
- Readiness CLI has one paid mode: --job-name NAME. --evolve is removed;
skill evolution passes its job name, and tests tie the watchdog command
to the paid job's actual name in both EC2 workflows.
- Jobs-API requests never get a timeout larger than the remaining pickup
budget (previously rounded up to 1s past the deadline).
- Document that the shared concurrency group keeps only one pending run,
so a queued release evaluation can be replaced and must be confirmed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs(eval): record verified EC2 lifecycle configuration
The README still described the AWS settings as assumed and unverified.
The OIDC role, environment settings and runner_only lifecycle were
configured and verified live on 2026-10-09.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(release-eval): grade both runtimes against one pinned task toolchain
Candidate and stable each staged task dependencies (node_modules,
gitnexus-shared/dist) from their own runtime checkout, so the same v1.6.12
task source was graded with different TypeScript, Vitest and LadybugDB
versions and a per-task solve delta also measured dependency drift.
- Check out and build the pinned task commit once (tasks-base) and point
every task's repo at it for both runtimes; the runtime under test reaches
sessions only through --gitnexus-root. prepare requires --task-repo at the
single pinned task commit (new task-sha subcommand resolves it).
- Retain sandbox_dependency_content_digest per measured row and make
release_gate fail when any task's cells, across candidate and stable, do not
share one recorded dependency digest.
- Move the task-pin comparison into validate_report(task_pins=...) and use
it from release_report check and release_gate.
- Cover the gate CLI with a missing and a corrupt candidate report.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs(ci): warn that a pending release evaluation can be replaced
GitHub keeps one pending run per concurrency group, so a newer queued
EC2 run cancels a pending release evaluation. Operators must confirm the
startup job ran before relying on the evidence.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(eval): prove hidden oracles against the grading toolchain
Release evaluation now grades every task with dependencies built at the
pinned task commit (TypeScript 5.9.3, Vitest 4.1.11), but the oracle
controls still ran against the current checkout's toolchain. The Ubuntu
containment job now builds the pinned task toolchain and points the
controls at it. All seven controls pass locally against that build.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(ci): pin the duplicated EC2 lifecycle jobs together
Both EC2 workflows carry their own copy of the live-verified start,
check, readiness and stop jobs. A reusable workflow would change that
verified job structure, so instead a test requires the copies to stay
identical apart from the job display name and the paid-job dependency.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(release-eval): accept stable evidence only from main's current evaluator
Stable publish validated downloaded agent evidence against the release
commit's eval/ tree and never tied a report to the run that produced it.
Evidence from an older evaluator stayed acceptable for seven days after
graders changed, while task changes on main made every fresh evaluation
mismatch the tag. The first invalid artifact also hid older valid runs.
The composite action now extracts eval/ from main's head and runs the
validator there with locked base dependencies only (no dev extras or
project build). A report counts only when its harness_sha is the head_sha
of its trusted main run and the compare API shows no change under eval/,
the release-evaluation workflow or the pinned agent CLI between that
harness and the evaluator; a missing, diverged or 300-file comparison
fails closed. Runs are tried newest first, rejected runs are skipped
with a bounded reason list, every gh call has a timeout, and task pins
use validate_report's task_pins check.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(eval): break the sandbox import cycle and resolve code-scanning alerts
- baseline_guidance is now pure text handling with its own GuidanceError;
the baseline mount builder lives in proposer_sandbox again and converts
that error to SandboxError, so imports run one way only.
- task_assets uses the public real_directory name; the unused private
alias is gone.
- The oracle-control fixture always extracts with tarfile's data filter
and skips on Pythons that lack it, instead of extracting unfiltered.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(release-eval): run candidate lifecycle scripts offline; reject smuggled report fields
- build_candidate now downloads locked dependencies with --ignore-scripts,
then runs every lifecycle script (dependency installs, prepare, build)
in a fresh network namespace, so candidate code cannot reach host-local
services. Verified locally that the current head and the pinned task
commit build this way; the real-Bubblewrap canary now asserts only
loopback is visible to a lifecycle script.
- validate_report requires the evidence document to equal its
field-whitelisted rebuild, so per-run or top-level fields outside the
published schema are rejected before the publisher copies the file.
- The sandbox test suite also covers a no-GitNexus sandbox refusing
unbalanced guidance markers.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs(eval): describe the offline candidate lifecycle
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(release-eval): pin downloads to the npm registry; require dependency binding
Address review feedback on PR #3503:
- The candidate's online install phase now refuses lockfile entries that
resolve outside https://registry.npmjs.org/ (other than in-checkout
workspace links) and refuses shipped .npmrc files, so a candidate
cannot steer npm at loopback, private or metadata endpoints.
- Every measured row must carry a 64-hex task-dependency digest, so a
single report cannot be accepted with its grading toolchain unbound.
- Oversized JSON integers mark a measurement untrustworthy instead of
crashing report generation.
- Baseline guidance stripping recognises headings with up to three
leading spaces (CommonMark).
- Remove a stale comment about the old private helper name.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(eval): parse CommonMark ATX headings; compare evidence by exact JSON
- Baseline guidance stripping now parses headings as CommonMark ATX
headings (0-3 leading spaces, optional closing # run, tabs), so a
GitNexus section heading like '## GitNexus rules ##' is removed too.
- Evidence validation compares the serialized rebuild with the report,
so a retyped value (true for 1, 2.0 for 2) no longer passes.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(eval): drop continuations of every CommonMark list item in baseline guidance
A removed GitNexus instruction left its indented continuation behind when
the item used '+' or an ordered marker (1. / 1)). The scrubber now
recognises every CommonMark list-item marker.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(eval): isolate candidate MCP from agent task writes (#3503)
Run MCP in a nested Bubblewrap boundary with read-only task, graph,
registry and runtime mounts, private state and isolated processes/network.
Keep task writes on the agent's built-in tools and remove mutating MCP grants.
Add startup/tool mutation canaries and preserve explicit unsafe diagnostics.
Validation: focused pytest 138 passed, 16 skipped. Full locked evaluator
996 passed, 29 skipped; real containment canaries require Ubuntu CI.
Note: eight pre-existing comparator-reuse failures reproduce on the
unchanged head due to missing os.supports_dir_fd support. One process-control
timeout failed in the full run and passed alone and on the unchanged head.
* fix(eval): close baseline mount overlap and test symlink evidence (#3503)
Reject supplied no-MCP mounts that cover forbidden GitNexus paths, including ancestor mounts and lexical aliases. Keep ordinary dependency mounts available.
Exercise evidence symlink rejection with a real valid-report target and retain dangling-link coverage.
Validation: 1026 evaluator tests passed, 29 skipped; targeted mount tests 36 passed and evidence tests 34 passed. Removing the symlink guard in memory makes the repaired regression fail. Ruff and diff checks passed.
Note: eight pre-existing comparator-reuse failures remain in this environment because os.supports_dir_fd lacks the required os.lstat support.
---------
Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
