woods 2.0.0.beta2 → 2.0.0.beta3

data/lib/woods/console/credential_index.rb

@@ -68,6 +68,7 @@ module Woods
       MISSING_KEY_ERRORS = %w[
         ActiveSupport::EncryptedConfiguration::MissingKeyError
         ActiveSupport::EncryptedFile::MissingKeyError
+        ActiveSupport::EncryptedFile::MissingContentError
         ActiveSupport::MessageEncryptor::InvalidMessage
       ].freeze
 
@@ -90,13 +91,19 @@ module Woods
         # @return [CredentialIndex] populated index, or an empty index when
         #   the credentials store can't be opened.
         def build(rails_app:)
-          new(secrets: collect_secrets(rails_app))
+          refresh(rails_app: rails_app)
         rescue StandardError => e
           raise unless missing_key_error?(e)
 
           new(secrets: [])
         end
 
+        # Strict refresh: construct the replacement completely before a caller
+        # installs it. Unlike boot-time .build, errors must preserve the old index.
+        def refresh(rails_app:)
+          new(secrets: collect_secrets(rails_app))
+        end
+
         # Emit a structured log warning when any of the given credentials
         # files has a modification time newer than `process_start`. This
         # catches the common "rotated credentials but forgot to restart"
@@ -136,12 +143,23 @@ module Woods
         private
 
         def collect_secrets(rails_app)
-          config = rails_app.credentials.config
+          config = fresh_credentials(rails_app.credentials).config
           collected = []
           walk(config, collected)
           collected
         end
 
+        def fresh_credentials(credentials)
+          return credentials unless defined?(ActiveSupport::EncryptedConfiguration) &&
+                                    credentials.is_a?(ActiveSupport::EncryptedConfiguration)
+
+          require_relative 'encrypted_credential_snapshot'
+          EncryptedCredentialSnapshot.new(
+            config_path: credentials.content_path, key_path: credentials.key_path,
+            env_key: credentials.env_key, raise_if_missing_key: true
+          )
+        end
+
         def walk(node, collected)
           case node
           when Hash  then node.each_value { |v| walk(v, collected) }

data/lib/woods/console/credential_scanner.rb

@@ -155,17 +155,17 @@ module Woods
       #   for patterns that fired — callers should treat a missing key as zero.
       def scan(value)
         counts = {}
-        scanned = walk(value, counts)
+        scanned = walk(value, counts, @secret_index)
         [scanned, counts]
       end
 
       private
 
-      def walk(value, counts)
+      def walk(value, counts, index)
         case value
-        when String then scan_string(value, counts)
-        when Hash   then walk_hash(value, counts)
-        when Array  then value.map { |item| walk(item, counts) }
+        when String then scan_string(value, counts, index)
+        when Hash   then walk_hash(value, counts, index)
+        when Array  then value.map { |item| walk(item, counts, index) }
         else value
         end
       end
@@ -177,19 +177,19 @@ module Woods
       # credential-shaped string is emitted as a Symbol after redaction
       # (e.g. `:"[REDACTED]"`). String keys stay Strings. Non-String,
       # non-Symbol keys (Integer, etc.) pass through unchanged.
-      def walk_hash(hash, counts)
+      def walk_hash(hash, counts, index)
         hash.each_with_object({}) do |(key, val), out|
           scanned_key = case key
-                        when String then scan_string(key, counts)
-                        when Symbol then scan_string(key.to_s, counts).to_sym
+                        when String then scan_string(key, counts, index)
+                        when Symbol then scan_string(key.to_s, counts, index).to_sym
                         else             key
                         end
-          out[scanned_key] = walk(val, counts)
+          out[scanned_key] = walk(val, counts, index)
         end
       end
 
-      def scan_string(str, counts)
-        result = redact_indexed_secrets(str, counts)
+      def scan_string(str, counts, index)
+        result = redact_indexed_secrets(str, counts, index)
         result = scan_encoded_forms(result, counts)
         @active_patterns.inject(result) do |acc, (name, pattern)|
           acc.gsub(pattern) do
@@ -290,10 +290,10 @@ module Woods
         printable.to_f / str.length >= PRINTABLE_RATIO_THRESHOLD
       end
 
-      def redact_indexed_secrets(str, counts)
-        return str unless @secret_index&.match?(str)
+      def redact_indexed_secrets(str, counts, index)
+        return str unless index&.match?(str)
 
-        redacted = @secret_index.redact(str)
+        redacted = index.redact(str)
         counts[INDEX_HIT] = (counts[INDEX_HIT] || 0) + redacted.scan(CredentialIndex::REDACTED).size
         redacted
       end

data/lib/woods/console/credential_scanner_registry.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Woods
+  module Console
+    # Coordinates scanner construction and rotation without retaining servers
+    # after their transports release them. Requests keep their own index snapshot.
+    class CredentialScannerRegistry
+      def initialize
+        @scanners = ObjectSpace::WeakMap.new
+        @mutex = Mutex.new
+      end
+
+      def register
+        @mutex.synchronize do
+          scanner = yield
+          # Older Ruby WeakMap implementations validate the value's liveness
+          # when enumerating. Keep the scanner in both weak positions so an
+          # immortal sentinel cannot make an abandoned scanner look live.
+          @scanners[scanner] = scanner
+          scanner
+        end
+      end
+
+      def rebuild
+        @mutex.synchronize do
+          scanners = @scanners.values
+          return nil if scanners.empty?
+
+          index = yield
+          scanners.each { |scanner| scanner.replace_index!(index) }
+          index
+        end
+      end
+    end
+  end
+end

data/lib/woods/console/embedded_executor.rb

@@ -1491,7 +1491,7 @@ module Woods
         # `SqlNoiseStripper` is the same module SqlValidator uses. The
         # combined single-pass strip_noise resolves comments and literals
         # together so a comment marker inside a literal can't hide a keyword.
-        stripped = SqlNoiseStripper.strip_noise(template)
+        stripped = SqlNoiseStripper.strip_noise(template, dialect: sql_dialect || :postgres, **mysql_quote_modes)
         if SCOPE_TEMPLATE_FORBIDDEN.match?(stripped)
           raise ValidationError,
                 'scope template contains forbidden SQL keywords ' \

data/lib/woods/console/encrypted_credential_snapshot.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'active_support/encrypted_configuration'
+
+module Woods
+  module Console
+    # A private, uncached Rails configuration for one credential-index build.
+    # Unlike Rails' permissive configuration reader, a missing encrypted file
+    # must raise during an explicit refresh rather than erase the last index.
+    class EncryptedCredentialSnapshot < ActiveSupport::EncryptedConfiguration
+      def read
+        ActiveSupport::EncryptedFile.instance_method(:read).bind(self).call
+      end
+    end
+  end
+end

data/lib/woods/console/rack_middleware.rb

@@ -81,17 +81,12 @@ module Woods
       #   for compatibility. Passing it fails closed because console_eval is unavailable.
       # @param unsafe_eval_audit_log_path [String, Pathname, nil] Legacy option retained
       #   for compatibility. Passing it fails closed because console_eval is unavailable.
-      def initialize(app, path: '/mcp/console', embedded_read_tools: false, # rubocop:disable Metrics/ParameterLists
-                     unsafe_eval_confirmation: nil, unsafe_eval_audit_log_path: nil,
-                     stateless: true)
-        @app = app
-        @path = path
-        @embedded_read_tools = embedded_read_tools
-        @unsafe_eval_confirmation = unsafe_eval_confirmation
-        @unsafe_eval_audit_log_path = unsafe_eval_audit_log_path
-        @stateless = stateless
-        @mutex = Mutex.new
-        @transport = nil
+      # Rails 6.0 forwards middleware options as a positional hash on Ruby 3.
+      # Delegate to explicit keywords to preserve required/unknown option checks.
+      def initialize(app, options = {}, **keywords)
+        raise TypeError, 'middleware options must be a Hash' unless options.is_a?(Hash)
+
+        initialize_options(app, **options, **keywords)
       end
 
       # Rack interface — intercepts requests at the configured path.
@@ -99,7 +94,8 @@ module Woods
       # The enabled flag is read from Woods.configuration on every request,
       # never captured at construction: the railtie inserts this middleware
       # before config/initializers have run (#183). While
-      # `console_mcp_enabled` is false (the default), requests — even at the
+      # `console_mcp_enabled` is false (the default), or HTTP is explicitly
+      # disabled with `console_mcp_http_enabled = false`, requests — even at the
       # mounted path — pass through to the wrapped app unchanged, so a host
       # that never opted in is completely unaffected. Requests at
       # non-matching paths always pass through.
@@ -118,11 +114,24 @@ module Woods
 
       private
 
+      def initialize_options(app, path: '/mcp/console', embedded_read_tools: false, # rubocop:disable Metrics/ParameterLists
+                             unsafe_eval_confirmation: nil, unsafe_eval_audit_log_path: nil,
+                             stateless: true)
+        @app = app
+        @path = path
+        @embedded_read_tools = embedded_read_tools
+        @unsafe_eval_confirmation = unsafe_eval_confirmation
+        @unsafe_eval_audit_log_path = unsafe_eval_audit_log_path
+        @stateless = stateless
+        @mutex = Mutex.new
+        @transport = nil
+      end
+
       # Whether the console is enabled, read from the live configuration on
       # every request. Nil-safe: the railtie mounts this middleware in every
       # app (#183), including hosts that never called Woods.configure.
       def enabled?
-        Woods.configuration&.console_mcp_enabled
+        Woods.configuration&.console_mcp_enabled && Woods.configuration.console_mcp_http_enabled
       end
 
       # Thread-safe lazy initialization of the MCP server and transport.

data/lib/woods/console/server.rb

@@ -14,6 +14,7 @@ require_relative 'audit_logger'
 require_relative 'confirmation'
 require_relative 'console_response_renderer'
 require_relative 'credential_scanner'
+require_relative 'credential_scanner_registry'
 require_relative 'eval_guard'
 require_relative 'table_gate'
 require_relative 'redactor'
@@ -44,10 +45,14 @@ module Woods
     #   transport.open
     #
     module Server # rubocop:disable Metrics/ModuleLength
+      SCANNERS = CredentialScannerRegistry.new
+      private_constant :SCANNERS
+
       class << self # rubocop:disable Metrics/ClassLength
         # Rebuild the boot-time credential index from fresh Rails credentials
-        # and hot-swap it into the active scanner without restarting the process.
+        # and hot-swap it into every live scanner without restarting the process.
         #
+        # Refresh failures propagate without replacing any live index.
         # Host rotation jobs should call this immediately after `rails credentials:edit`
         # changes are deployed. The swap is atomic on MRI (GVL) — in-flight scans see
         # either the old or the new index, never a partial one.
@@ -62,14 +67,11 @@ module Woods
         #   the rebuild was skipped.
         def rebuild_credential_index(rails_app: nil)
           return nil unless credential_defense_enabled?
-          return nil unless @active_scanner
 
           target_app = rails_app || default_rails_app
           return nil unless target_app
 
-          new_index = CredentialIndex.build(rails_app: target_app)
-          @active_scanner.replace_index!(new_index)
-          new_index
+          SCANNERS.rebuild { CredentialIndex.refresh(rails_app: target_app) }
         end
 
         # True when Woods is configured and credential defense is on.
@@ -288,21 +290,21 @@ module Woods
                                        model_reflections: model_reflections)
                        end
 
-          secret_index = build_credential_index(config)
-          disabled_patterns = Array(config&.console_disabled_scanner_patterns)
-          scanner = if disabled_patterns.include?(:all)
-                      nil
-                    else
-                      CredentialScanner.new(
-                        disabled_patterns: disabled_patterns,
-                        secret_index: secret_index
-                      )
-                    end
-          @active_scanner = scanner
+          scanner = build_scanner(config)
 
           ResponseContext.build(safe_ctx: safe_ctx, table_gate: table_gate, credential_scanner: scanner)
         end
 
+        def build_scanner(config)
+          disabled_patterns = Array(config&.console_disabled_scanner_patterns)
+          return nil if disabled_patterns.include?(:all)
+
+          SCANNERS.register do
+            CredentialScanner.new(disabled_patterns: disabled_patterns,
+                                  secret_index: build_credential_index(config))
+          end
+        end
+
         # Build the boot-time credential index from Rails.application's encrypted
         # credentials. Returns nil when credential defense is disabled or when no
         # Rails application is reachable (specs, non-Rails hosts) — the scanner

data/lib/woods/dependency_graph.rb

@@ -32,9 +32,14 @@ module Woods
     # enforce_dependencies: package units (Task 7)
     # commit_count, change_frequency: git enrichment (Task 5)
     NODE_ATTRIBUTE_KEYS = %i[
-      database table foreign_key_tables package enforce_dependencies commit_count change_frequency
+      database table foreign_key_tables package enforce_dependencies commit_count change_frequency kind
     ].freeze
 
+    # These extractors describe a whole source file rather than one constant.
+    # Other types remain unclassified: a path-like identifier is not evidence
+    # that a unit is a profile, and an unmarked unit need not name a constant.
+    FILE_PROFILE_TYPES = %i[caching configuration test_mapping rails_source gem_source].freeze
+
     # Optional edge keys beyond target and via. `through` is the through
     # association name; `through_db` is the through model's resolved
     # database, emitted only when present; `disable_joins` is emitted only
@@ -80,14 +85,14 @@ module Woods
       }.merge(node_attributes_from(unit))
 
       (@edges[unit.identifier] ||= {})[unit.type] =
-        unit.dependencies.map { |d| { target: d[:target], via: d[:via] }.merge(self.class.edge_attributes(d)) }
+        self.class.normalize_edges(unit.dependencies, strict: true)
       (@file_map[unit.file_path] ||= Set.new).add(unit.identifier) if unit.file_path
 
       # Type index for filtering (Set-based for O(1) insert)
       (@type_index[unit.type] ||= Set.new).add(unit.identifier)
 
       # Build reverse edges (Set-based for O(1) insert)
-      unit.dependencies.each do |dep|
+      @edges[unit.identifier][unit.type].each do |dep|
         (@reverse[dep[:target]] ||= Set.new).add(unit.identifier)
         (@reverse_via[[dep[:target], dep[:via]]] ||= Set.new).add(unit.identifier)
       end
@@ -645,7 +650,7 @@ module Woods
     # @return [Hash{Symbol => Object}] normalized, nil-free
     def node_attributes_from(unit)
       metadata = unit.respond_to?(:metadata) && unit.metadata.is_a?(Hash) ? unit.metadata : {}
-      attrs = {}
+      attrs = self.class.file_profile_attributes(unit.type)
       attrs[:database] = metadata[:database] unless metadata[:database].nil?
       attrs[:table] = metadata[:table_name] if unit.type == :model && !metadata[:table_name].nil?
       tables = Array(metadata[:foreign_keys]).filter_map { |fk| fk[:to_table] || fk['to_table'] if fk.is_a?(Hash) }
@@ -729,14 +734,15 @@ module Woods
     # `nodes` and `edges` stay keyed on the bare identifier, holding the
     # **primary** node — the type that sorts first. Identifiers registered
     # under more than one type put their remaining nodes in `variants`, a flat
-    # array that is **omitted entirely when empty**. So the serialized form of
-    # a graph with no collisions is byte-for-byte what it has always been, and
-    # a `dependency_graph.json` written before this change loads through
+    # array that is **omitted entirely when empty**. A
+    # `dependency_graph.json` written before this change loads through
     # {.from_h} unmodified: it simply carries no `variants`.
     #
     # `reverse`, `file_map` and `type_index` need no new shape. They are
     # already identifier-valued sets, so a Scenic view `reports` and a factory
     # `reports` each contribute to their own type bucket and their own path.
+    # The additive `reverse_via` index preserves typed source identities and
+    # complete relationship records without changing the legacy `reverse` map.
     #
     # @return [Hash] Complete graph data
     def to_h
@@ -747,6 +753,7 @@ module Woods
           nodes: key_sorted(self.class.relativize_nodes(primary_nodes, root)),
           edges: key_sorted(primary_edges),
           reverse: key_sorted(@reverse.transform_values { |ids| ids.to_a.sort }),
+          reverse_via: published_reverse_via,
           file_map: key_sorted(self.class.relativize_file_map(@file_map, root)),
           type_index: key_sorted(@type_index.transform_values { |ids| ids.to_a.sort }),
           stats: {
@@ -770,6 +777,23 @@ module Woods
     end
     private :key_sorted
 
+    # Reverse buckets are derived from every typed forward registration, rather
+    # than the bare-name in-memory filter index, which cannot preserve variants
+    # or distinguish association attributes. Legacy nil relationships stay nil.
+    def published_reverse_via
+      buckets = {}
+      @edges.each do |source, by_type|
+        by_type.each do |type, edges|
+          edges.each do |edge|
+            record = { source: source, source_type: type }.merge(edge.except(:target))
+            (buckets[edge[:target]] ||= []) << record
+          end
+        end
+      end
+      key_sorted(buckets.transform_values { |records| records.sort_by { |record| JSON.generate(record) } })
+    end
+    private :published_reverse_via
+
     # A copy whose edge containers are the caller's alone.
     #
     # `dup` copies only the top level, so `to_h[:edges][id]` used to be the
@@ -783,6 +807,9 @@ module Woods
     def detached_snapshot(memo)
       snapshot = memo.dup
       snapshot[:edges] = memo[:edges].transform_values { |list| list.map(&:dup) }
+      snapshot[:reverse_via] = memo[:reverse_via].transform_values do |records|
+        records.map { |record| record.transform_values { |value| value.is_a?(String) ? value.dup : value } }
+      end
       if memo.key?(:variants)
         snapshot[:variants] = memo[:variants].map do |record|
           record.merge(edges: record[:edges].map(&:dup))
@@ -794,7 +821,12 @@ module Woods
 
     # @return [Hash{String => Hash}] identifier => primary node
     def primary_nodes
-      @nodes.transform_values { |nodes| primary_of(nodes) }
+      # Late enrichment and JSON loading can insert optional fields in a
+      # different order. Canonicalize like variant_records so a graph's JSON
+      # fingerprint is stable across full and incremental publication.
+      @nodes.transform_values do |nodes|
+        primary_of(nodes).slice(:type, :file_path, :namespace, *NODE_ATTRIBUTE_KEYS)
+      end
     end
     private :primary_nodes
 
@@ -969,10 +1001,17 @@ module Woods
     # @param node [Hash]
     # @return [Hash{Symbol => Object}]
     def self.persisted_node_attributes(node)
-      NODE_ATTRIBUTE_KEYS.each_with_object({}) do |key, attrs|
+      attributes = NODE_ATTRIBUTE_KEYS.each_with_object({}) do |key, attrs|
         value = node.key?(key) ? node[key] : node[key.to_s]
         attrs[key] = normalize_node_attribute(key, value) unless value.nil?
       end
+      attributes.merge(file_profile_attributes(node[:type] || node['type']))
+    end
+
+    # Backfill the additive marker when an older graph is republished, so
+    # unchanged nodes in an incremental run agree with a fresh full graph.
+    def self.file_profile_attributes(type)
+      FILE_PROFILE_TYPES.include?(type&.to_sym) ? { kind: 'file_profile' } : {}
     end
 
     # Edge attributes present in a dependency or persisted edge hash.
@@ -1032,7 +1071,10 @@ module Woods
       graph.instance_variable_set(:@edges, edges)
 
       raw_reverse = data[:reverse] || data['reverse'] || {}
-      graph.instance_variable_set(:@reverse, raw_reverse.transform_values { |v| v.is_a?(Set) ? v : Set.new(v) })
+      reverse = raw_reverse.each_with_object({}) do |(target, sources), index|
+        (index[target.to_s] ||= Set.new).merge(sources)
+      end
+      graph.instance_variable_set(:@reverse, reverse)
 
       raw_file_map = data[:file_map] || data['file_map'] || {}
       graph.instance_variable_set(:@file_map, absolutize_file_map(normalize_file_map(raw_file_map), root))
@@ -1126,7 +1168,12 @@ module Woods
       }.merge(persisted_node_attributes(node))
     end
 
-    # Normalize edge data from either old format (bare strings) or new format (hashes).
+    # Normalize fresh dependencies and persisted edges to the same identity:
+    # string targets and symbol relationship labels. Extractors may emit
+    # symbolic external targets (such as :http_api); retaining those symbols
+    # after a JSON-loaded baseline splits reverse indexes on re-registration.
+    # Unit dependency metadata stays unchanged; only graph records normalize.
+    # Also accepts the old bare-string edge format.
     #
     # ROUND-TRIP INVARIANT (do not break when refactoring):
     #   DependencyGraph#to_h -> JSON.generate -> JSON.parse -> DependencyGraph.from_h
@@ -1147,15 +1194,20 @@ module Woods
     # explicit data conversion.
     #
     # @param edges [Array] Edge entries — either strings or hashes
+    # @param strict [Boolean] require hashes for fresh units; legacy loads stay tolerant
     # @return [Array<Hash>] Normalized edges with :target and :via keys
-    def self.normalize_edges(edges)
+    def self.normalize_edges(edges, strict: false)
+      raise ArgumentError, 'Fresh graph dependencies must be an array' if strict && !edges.is_a?(Array)
+
       return [] unless edges.is_a?(Array)
 
       edges.map do |edge|
+        raise ArgumentError, 'Fresh graph dependencies must be hashes' if strict && !edge.is_a?(Hash)
+
         if edge.is_a?(String)
           { target: edge, via: nil }
         elsif edge.is_a?(Hash)
-          { target: edge[:target] || edge['target'], via: (edge[:via] || edge['via'])&.to_sym }
+          { target: (edge[:target] || edge['target'])&.to_s, via: (edge[:via] || edge['via'])&.to_sym }
             .merge(edge_attributes(edge))
         else
           { target: edge.to_s, via: nil }

data/lib/woods/embedding/corpus.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+require 'json'
+require_relative '../atomic_file'
+require_relative '../generation'
+
+module Woods
+  class Error < StandardError; end unless defined?(Woods::Error)
+
+  module Embedding
+    # Collect the complete extraction input before an embedding run can mutate
+    # stores. Native publications use their authoritative listings, never a glob
+    # that could mistake a missing/corrupt payload for intentional deletion.
+    class Corpus
+      class Incomplete < Woods::Error; end
+
+      def initialize(output_dir)
+        @output_dir = output_dir.to_s
+      end
+
+      def load
+        native? ? published_units : legacy_units
+      rescue IOError, SystemCallError, JSON::ParserError, EncodingError, ArgumentError => e
+        raise Incomplete, "Embedding input incomplete: #{e.message}. Repair or rebuild extraction before embedding."
+      end
+
+      private
+
+      def native?
+        path = File.join(@output_dir, Generation::FILENAME)
+        if File.exist?(path)
+          marker = JSON.parse(AtomicFile.read(path))
+          raise IOError, 'invalid generation marker' unless marker.is_a?(Hash)
+        end
+
+        if !marker || marker['payload'].nil?
+          if File.directory?(File.join(@output_dir, 'payloads'))
+            raise IOError, 'missing publication pointer beside payloads'
+          end
+
+          return false
+        end
+
+        validate_marker(marker)
+        true
+      end
+
+      def validate_marker(marker)
+        strings_valid = %w[payload token].all? { |key| marker[key].is_a?(String) && !marker[key].empty? }
+        return if strings_valid && marker['number'].is_a?(Integer) && marker['number'].positive?
+
+        raise IOError, 'invalid published generation marker'
+      end
+
+      def published_units
+        require_relative '../mcp/index_reader'
+
+        reader = MCP::IndexReader.new(@output_dir)
+        reader.with_pinned_generation do
+          # Generation's compatibility fallback to the root is useful for
+          # readers, but cannot prove completeness for destructive reconciliation.
+          if reader.payload_dir.expand_path == Pathname.new(@output_dir).expand_path
+            raise IOError,
+                  'published payload missing or invalid'
+          end
+
+          validate_counts(reader.manifest)
+          reader.each_unit.to_a
+        end
+      end
+
+      def validate_counts(manifest)
+        counts = manifest.is_a?(Hash) && manifest['counts']
+        valid = counts.is_a?(Hash) && counts.all? do |dir, count|
+          MCP::IndexReader::TYPE_DIRS.include?(dir) && count.is_a?(Integer) && count >= 0
+        end
+        raise IOError, 'invalid published manifest counts' unless valid
+      end
+
+      # Pre-pointer indexes may use arbitrary filenames and have no manifest
+      # or authoritative listing. Keep that input contract, but never silently
+      # omit unreadable JSON before reconciling persisted identities.
+      def legacy_units
+        Dir.glob(File.join(@output_dir, '**', '*.json')).filter_map do |path|
+          relative = path.delete_prefix("#{@output_dir}/")
+          next if relative.start_with?('dumps/', 'payloads/') || File.basename(path) == 'checkpoint.json'
+
+          data = JSON.parse(AtomicFile.read(path))
+          data if data.is_a?(Hash) && data.key?('type') && data.key?('identifier')
+        end
+      end
+    end
+  end
+end