From 0ab3dea8f171493e6daf6315720e244472b0c687 Mon Sep 17 00:00:00 2001 From: sunerpy Date: Sun, 2 Aug 2026 04:36:06 +0800 Subject: [PATCH] docs(upstream): record the batch 2 disposition (parity stays 1.4.1) --- docs/upstream-sync/UPSTREAM.md | 67 +++++++++++++++++++++++++++++++--- 1 file changed, 62 insertions(+), 5 deletions(-) diff --git a/docs/upstream-sync/UPSTREAM.md b/docs/upstream-sync/UPSTREAM.md index 506a9920..fd11faf4 100644 --- a/docs/upstream-sync/UPSTREAM.md +++ b/docs/upstream-sync/UPSTREAM.md @@ -11,7 +11,8 @@ applicable DEFER items landed across codegraph-rs `v0.28.3`–`v0.39.0`; see the 2026-07-17 CLOSEOUT entry below for the full release table) - **This project version:** see `Cargo.toml` (`codegraph-rs`, independent line) -- **Last sync:** `2026-07-17` +- **Last sync:** `2026-08-02` (batches 1–2 of the `1.5.0` round landed; parity + still `1.4.1` — batches 3–4 open) - **Upstream repo:** https://github.com/colbymchenry/codegraph > **1.2.0 → 1.4.1 sync: COMPLETE.** Every portable, in-scope behavior in that @@ -41,7 +42,7 @@ ## Sync log -### 2026-08-02 — AUDIT `1.4.1 → 1.5.0` + post-1.5.0 triage; batch 1 LANDED (tracked parity STAYS `1.4.1`) +### 2026-08-02 — AUDIT `1.4.1 → 1.5.0` + post-1.5.0 triage; batches 1–2 LANDED (tracked parity STAYS `1.4.1`) A full audit of the `1.4.1 → 1.5.0` range plus the 6 unreleased commits above `v1.5.0`, and a triage of colby's open issues. **Tracked parity deliberately does @@ -75,8 +76,8 @@ language extractors. | sha | disposition | rationale | | - | - | - | | `572d22b` TOML block finder preserves trailing `[[...]]` | **PORTED** — this batch, `88e7773` | Our `find_next_table_header` was the pre-fix logic verbatim, and reproduced with the shipped 0.42.0 binary: `uninstall --target codex` silently deleted a user's `[[mcp_servers.other.env]]` block | -| `f2a5df3` never serve a mis-sliced body from a drifted file | **PORT — batch 2** | Our exposure is WORSE than upstream's was: `read_project_source` slices current bytes at indexed lines with no freshness check, and the staleness banner promised at `instructions.rs:63` has **no implementation anywhere** | -| `f6ac7b3` blast radius follows caller chains | **PORT — batch 2** | `CALL_DEPTH = 1` plus an unconditional `"; ⚠️ no covering tests found"`; `codegraph affected` already BFSes correctly, the MCP renderer does not | +| `f2a5df3` never serve a mis-sliced body from a drifted file | **PORTED** — batch 2, `v0.42.2` | Our exposure was WORSE than upstream's: `read_project_source` sliced current bytes at indexed lines with no freshness check, and the staleness banner promised at `instructions.rs:63` had **no implementation anywhere** | +| `f6ac7b3` blast radius follows caller chains | **PORTED** — batch 2, `v0.42.2` | `CALL_DEPTH = 1` plus an unconditional `"; ⚠️ no covering tests found"`; `codegraph affected` already BFSed correctly, the MCP renderer did not | | `02c0e2c` bound the WAL after a killed session | **PORT (partial) — batch 3** | No `journal_size_limit` on any connection and no heal-at-open; our #1231 valve is bulk-index-only and documents itself as "sole connection" safe. Part (c) (watchdog `progressPaths`) is N/A — no SIGKILL watchdog exists here | | `38580e0` Python bare class refs → `references` edges | **PORT — batch 4, ISOLATED** | All three gates are pre-fix. The ONLY item in this round that moves `reference/golden/`; land it alone so a golden diff has exactly one possible cause | | `0682137` Claude prompt hook as `codegraph.cmd` | **N/A (packaging-rooted)** | We ship a native `codegraph.exe` (`install.ps1:34,144-150`), never a `.cmd` shim; Git Bash resolves the bare name to `.exe` natively, so writing `codegraph.cmd` would name a nonexistent file | @@ -87,7 +88,7 @@ language extractors. **reproduced on CLI AND MCP**. `exact_or_top_matches` falls back to `matches.first()` with no note, and `--strict` only fires on an EMPTY result, so a substituted non-empty answer passes it. Highest-value: fails toward confident - wrongness, and it is the default. → batch 2. + wrongness, and it is the default. → batch 2, **LANDED in `v0.42.2`**. - **#1482 / #1482b** TS rename-through-alias loses caller/impact edges (`export const a = fn`, `export { fn as a }`, `export default fn` all produce a false zero), and `.js` specifiers never resolve to `.ts` because @@ -122,6 +123,62 @@ by the first fix: scope confined to `crates/codegraph-cli/`. Four Final-Wave gates APPROVED; F3 ran a ~60-fixture matrix over three rounds and is what found both extra defects. +#### Batch 2 — LANDED (`v0.42.2`: `4e18f94`, `20e07e1`, `fea40a2`; PR #181) + +Ports `f2a5df3` and `f6ac7b3` from the `1.5.0` range plus issue #1473 from the +triage above. Each was an **honesty** defect — the graph asserting something it +had not established: + +- **#1473 silent symbol substitution.** A lookup matching no exact symbol fell + through to the top-ranked fuzzy result, so `callers ad` answered with rows + belonging to `add`. CLI lookup commands now exit non-zero pointing at + `codegraph query`; MCP returns `isError: true` pointing at `codegraph_search`. + Exact matching was widened to `qualified_name` and Godot resource paths so the + supported dotted-name and `.tscn` lookups survive. Decision A1 chose REFUSE over + annotate; A2 froze `--strict` (its 5 consumers are byte-unchanged). +- **`f2a5df3` drifted source served at stored line numbers**, returning a different + symbol's body. A request-memoized probe compares size + millisecond mtime first + and hashes only on a stat mismatch (decision B1). A drifted file is emitted + whole up to `FILE_MODE_MAX_LINES = 2000` or omitted with a notice — never + sliced (B2). `docs/mcp.md` had documented a staleness banner that nothing + produced; B3 made it real. Case 3 of the issue was deliberately NOT implemented. +- **`f6ac7b3` unmeasured coverage denial.** Blast radius claimed "no covering tests" + after inspecting direct callers only. It now walks callers through hop 3 under a + 64-lookup budget with an uncapped frontier and a 2-file display cap (C1), and + reports what it actually searched. + +**Five review-found defects in the fixes themselves**, all in `codegraph-mcp`: +freshness defaulted to fresh when the `FileRecord` was missing / the query failed +/ the read failed (reachable — `sync` deletes the file record before upserting +nodes and re-inserts it last, so a concurrent reader sees nodes whose file has no +record); the oversized branch compared `size` alone, so a same-size rewrite read +as fresh; a swallowed `get_callers` error still produced the strong three-hop +claim; a duplicated whole-file-fits predicate diverged from the rendering decision +at the trailing-newline boundary, banner-listing a 2000-line file whose source was +omitted; and the first liveness gate inferred section survival by matching +`#### {path} —` in the response text — source bytes as a control channel, +spoofable by a marker literal in a retained file (this repo's own test source +contains one). Freshness is now fail-closed via +`SourceFreshness::{ProvenFresh, PossiblyDrifted}`, and banner liveness comes from +`cut_at_section_boundary`'s surviving-prefix length plus per-section offsets. + +`make ci` 128 suites / 3110 passed / 0 failed. Each fix RED-proven by isolated +revert. `cut_at_section_boundary`'s new `(String, usize)` signature is +byte-identical to the old output (200k randomized inputs, 0 mismatches); the +section-offset formula and its `<=` predicate likewise (200k combinations, 0 +errors). **One audited golden movement**: +`reference/golden/mcp/codegraph_explore.json`, 4 blast-radius lines re-worded +(`⚠️ no covering tests found` → `no tests found within 3 caller hops`), the rest +byte-identical. `instructions.rs`, `initialize.json`, `codegraph-store/`, and +`codegraph-core/` untouched. Four Final-Wave gates APPROVED — F2 took three rounds +and is what found all five extra defects; F3 hands-on QA covered CLI and real MCP +stdio across six drift scenarios (and established that MCP drift cases need +`--no-watch`, since a background re-index legitimately clears the drift). + +**Parity still does NOT advance.** Batch 3 (`02c0e2c` WAL `journal_size_limit` + +heal-at-open) and batch 4 (`38580e0` Python bare class refs — the only +golden-moving item, to land isolated) remain open. + ### 2026-07-17 — CLOSEOUT: 1.2.0 → 1.4.1 sync COMPLETE (tracked parity advanced to 1.4.1) The `1.2.0 → 1.4.1` sync program evaluated on 2026-07-10 is now finished. Every