@event4u/agent-config 17.2.1 → 17.4.0

package/src/scripts/advisories.ts

@@ -63,6 +63,7 @@ import {
     emptyLedger,
     validateAcceptance,
 } from './_lib/advisory_verdicts.js';
+import { readRegistry, recordProject } from './_lib/project_registry.js';
 import { event4u_root } from './_lib/user_global_paths.js';
 import {
     advance,
@@ -363,25 +364,40 @@ export function markOwnActionsPrivate<T extends { entries: Array<{ ecosystem: st
     return inv;
 }
 
-/** The user-global index of project roots — roots and fingerprints only (5.4). */
+/**
+ * The project list is the shared user-global registry (`_lib/project_registry`,
+ * ADR-299): a sibling of the advisories machine dir, so an injected dir keeps
+ * its registry beside it. Roots and fingerprints only (5.4).
+ */
+function registryDirFor(mdir: string): string {
+    return path.join(path.dirname(mdir), 'projects');
+}
+
 function recordProjects(mdir: string, rows: Array<{ root: string; fingerprint: string }>, now: Date): void {
+    for (const r of rows) recordProject(r.root, { fingerprint: r.fingerprint }, { dir: registryDirFor(mdir), now });
+}
+
+/** The pre-registry `projects.json`, imported once and then moved aside. */
+function migrateLegacyProjects(mdir: string): void {
     const file = path.join(mdir, 'projects.json');
-    let doc: Record<string, { fingerprint: string; at: string }> = {};
+    let doc: Record<string, { fingerprint?: string; at?: string }>;
     try {
         doc = JSON.parse(fs.readFileSync(file, 'utf-8'));
     } catch {
-        doc = {};
+        return;
+    }
+    for (const [root, e] of Object.entries(doc ?? {})) {
+        const at = typeof e?.at === 'string' && !Number.isNaN(Date.parse(e.at)) ? new Date(e.at) : new Date();
+        recordProject(root, { fingerprint: typeof e?.fingerprint === 'string' ? e.fingerprint : null }, { dir: registryDirFor(mdir), now: at });
     }
-    for (const r of rows) doc[r.root] = { fingerprint: r.fingerprint, at: now.toISOString() };
-    writeJson(file, doc);
+    fs.renameSync(file, `${file}.migrated`);
 }
 
 export function knownProjects(mdir: string = machineDir()): string[] {
-    try {
-        return Object.keys(JSON.parse(fs.readFileSync(path.join(mdir, 'projects.json'), 'utf-8'))).filter((r) => fs.existsSync(r));
-    } catch {
-        return [];
-    }
+    migrateLegacyProjects(mdir);
+    return Object.values(readRegistry({ dir: registryDirFor(mdir) }).projects)
+        .map((e) => e.root)
+        .filter((r) => fs.existsSync(r));
 }
 
 // ---------------------------------------------------------------------------

package/src/scripts/ai_council/council_egress.ts

@@ -17,8 +17,8 @@
  * decision D8, which this module does not take.
  */
 
+import { detectNormalized, detectWithExtent } from '../_lib/egress_normalize.js';
 import {
-    detect,
     EGRESS_RULES,
     type EgressRule,
     type EgressSpan,
@@ -26,8 +26,6 @@ import {
     prefixesOf,
     rawKeyPrefixPattern,
     replaceSpans,
-    resolveOverlaps,
-    findSpans,
     REVIEW_CREDENTIAL_ROWS,
 } from '../_lib/egress_rules.js';
 import { parseTokens, TokenScope } from '../_lib/egress_token.js';
@@ -88,9 +86,10 @@ export class CouncilEgress {
      * proven is replaced through the nearest END marker, as the line masks did.
      */
     replace(text: string): string {
-        const spans = resolveOverlaps(findSpans(text, BUNDLE_RULES))
+        const at = detectWithExtent(text, BUNDLE_RULES);
+        const spans = at.spans
             .filter((s) => s.class === 'credential' || this.opts.identifiers)
-            .map((s) => ({ ...s, end: maskingEnd(text, s) }));
+            .map((s) => ({ ...s, end: at.end(s, maskingEnd) ?? s.end }));
         spans.sort((a, b) => a.start - b.start);
         const merged: EgressSpan[] = [];
         for (const s of spans) {
@@ -124,7 +123,7 @@ export class CouncilEgress {
         for (const value of this.replaced) {
             if (body.includes(value)) return { reason: 'replaced-value-present', what: 'value replaced in this run' };
         }
-        for (const s of detect(body)) {
+        for (const s of detectNormalized(body)) {
             const high = s.class === 'credential' ? s.rule !== 'generic-assignment' : s.validated && this.opts.identifiers;
             if (high) return { reason: 'high-confidence-finding', what: s.rule };
         }

package/src/scripts/bench_graph_feeder_latency.ts

@@ -66,7 +66,8 @@ import { gitEnv } from './_lib/git_env.js';
 import { graphUntestedVerdict } from './_lib/graph_feeder_record.js';
 import { LexicalIndex } from './_lib/lexical_index.js';
 import { buildFromRepo } from './code_graph/build.js';
-import { graphState, NATIVE_CACHE_REL } from './code_graph/detect.js';
+import { graphState } from './code_graph/detect.js';
+import { graphHome } from './code_graph/graph_home.js';
 import { loadGraph } from './code_graph/query.js';
 import { emitSqliteTwin, sqliteTwinPath } from './code_graph/sqlite_store.js';
 import type { CodeEdge, CodeGraph } from './code_graph/types.js';
@@ -159,7 +160,13 @@ export async function makeFixture(root: string, files: number, withGraph: boolea
     git(dir, ['init', '-q']);
     git(dir, ['add', '-A']);
     git(dir, ['commit', '-q', '-m', 'fixture']);
-    if (withGraph) await buildFromRepo(dir, path.join(dir, NATIVE_CACHE_REL));
+    if (withGraph) {
+        // A project home, as in every repository the feeder serves: the hooks the
+        // bench spawns run under their own user-global root, where a global
+        // graph home would not be found.
+        fs.mkdirSync(path.join(dir, 'agents'));
+        await buildFromRepo(dir, graphHome(dir).cachePath);
+    }
     fs.writeFileSync(path.join(dir, 'src', 'service.ts'), 'export function handle(x: string): string {\n    return x.trim();\n}\n');
     return dir;
 }
@@ -404,7 +411,7 @@ export function benchLoadSplit(opts: { graph: string; runs?: number | undefined
             if (!v.ok) throw new Error(`invalid graph at ${opts.graph}: ${v.errors.slice(0, 3).join('; ')}`);
             const graph = parsed as CodeGraph;
             const t3 = performance.now();
-            const wrote = emitSqliteTwin(graph, raw, copy);
+            const wrote = emitSqliteTwin(graph, copy);
             const t4 = performance.now();
             const byId = new Map(graph.nodes.map((n) => [n.id, n]));
             const outM = new Map<string, CodeEdge[]>();

package/src/scripts/build_mcp_registry_manifest.ts

@@ -208,31 +208,40 @@ function _render_cf_json(m: JsonObject): string {
     return pyJsonDumps(payload, { indent: 2, sortKeys: true }) + '\n';
 }
 
+/** The registry schema the payload is validated against; its `description` caps at 100 characters. */
+export const SERVER_SCHEMA_URL = 'https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json';
+export const REGISTRY_DESCRIPTION_MAX = 100;
+
 /**
  * Official MCP Registry server.json (registry.modelcontextprotocol.io).
- * Minimal valid shape per the registry's server.schema.json: reverse-DNS
- * name (matches package.json `mcpName` + the README `mcp-name:` marker),
- * the npm package pointer, and the stdio transport. The version is asserted
- * equal to package.json.version by lint_mcp_registry_manifest (CI).
+ * The name matches package.json `mcpName` + the README `mcp-name:` marker; the
+ * description is `agentConfig.registryDescription`, because the npm description
+ * is longer than the registry accepts. The positional `mcp-server` argument is
+ * what makes a registry client start the server instead of the bare CLI.
+ * Version- and length-equality are asserted by lint_mcp_registry_manifest (CI).
  */
-function _render_server_json(m: JsonObject): string {
-    const pkg = m['package'] as JsonObject;
+export function renderServerJson(pkg: JsonObject): string {
     const version = pkg['version'] as string;
+    const agentConfig = (pkg['agentConfig'] as JsonObject | undefined) ?? {};
     const payload: JsonObject = {
-        $schema: 'https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json',
-        name: 'io.github.event4u-app/agent-config',
-        description: pkg['description'],
+        $schema: SERVER_SCHEMA_URL,
+        name: pkg['mcpName'] as string,
+        title: 'agent-config',
+        description: (agentConfig['registryDescription'] as string | undefined) ?? '',
+        websiteUrl: pkg['homepage'] as string,
         repository: {
-            url: pkg['repository'],
+            url: _repo_url(pkg),
             source: 'github',
         },
         version,
         packages: [
             {
                 registryType: 'npm',
-                identifier: '@event4u/agent-config',
+                identifier: pkg['name'] as string,
                 version,
+                runtimeHint: 'npx',
                 transport: { type: 'stdio' },
+                packageArguments: [{ type: 'positional', value: 'mcp-server' }],
             },
         ],
     };
@@ -280,7 +289,9 @@ export function main(argv: readonly string[]): number {
     const manifest_text = pyJsonDumps(manifest, { indent: 2, sortKeys: true }) + '\n';
     const row_md = _render_row_md(manifest);
     const cf_json = _render_cf_json(manifest);
-    const server_json = _render_server_json(manifest);
+    const server_json = renderServerJson(
+        JSON.parse(fs.readFileSync(_config.PKG_FILE, 'utf-8')) as JsonObject,
+    );
 
     const outputs: Array<[string, string]> = [
         [_config.OUT_MANIFEST, manifest_text],

package/src/scripts/check_dependency_floors.ts

@@ -60,6 +60,13 @@ export const EXACT_PIN_EXCEPTIONS: Readonly<Record<string, string>> = {
         'which would make every grammar load throw rather than degrade — so the runtime ' +
         'and its grammars move together, in one reviewed change, or not at all. ' +
         'Refresh procedure: src/vendor/grammars/README.md.',
+    // The three sigstore modules are the trusted computing base of the
+    // unattended upgrade's provenance check (sigstore_provenance.ts): a
+    // patch release of any of them changes what "verified" means, so each
+    // version is reviewed rather than resolved. They move together.
+    '@sigstore/verify': 'Trusted computing base of the release provenance check; moves only in a reviewed change, with its two siblings.',
+    '@sigstore/bundle': 'Parses the bundle the provenance check verifies; pinned with @sigstore/verify for the same reason.',
+    '@sigstore/protobuf-specs': 'Decodes the pinned trust root and npm keys; pinned with @sigstore/verify for the same reason.',
 };
 
 /**
@@ -75,6 +82,13 @@ export const SECURITY_FLOOR_EXCEPTIONS: Readonly<Record<string, { required: stri
             'high-severity route-guard bypass via path traversal (CVSS 7.5) affects <=10.1.1; ' +
             '10.1.2 is the fix. Verified with npm audit on a clean 10.1.0 install, 2026-07-31.',
     },
+    zod: {
+        required: '^4.6.6',
+        reason:
+            'high-severity memory exhaustion while validating oversized constrained collections ' +
+            '(GHSA-mrhx-c7xc-m3w5) affects <4.6.6; 4.6.6 is the fix. Verified with npm audit on ' +
+            'clean 4.6.5 (1 high) and 4.6.6 (0) installs, 2026-10-24.',
+    },
 };
 
 /** A settled caret floor: `^X.Y.0`. */

package/src/scripts/check_egress_mutations.ts

@@ -33,6 +33,7 @@ export const ENGINE_MODULES: readonly string[] = [
     'src/scripts/_lib/egress_rules.ts',
     'src/scripts/_lib/egress_token.ts',
     'src/scripts/_lib/egress_text.ts',
+    'src/scripts/_lib/egress_normalize.ts',
 ];
 
 export interface Recipe {

package/src/scripts/check_release_manifest_content.ts

@@ -4,7 +4,7 @@
  * `check_release_pr_shape`.
  *
  * The shape check lets a release PR carry `package.json`, `package-lock.json`
- * and the three plugin manifests, and it reads only their NAMES. Smoke is
+ * and the plugin and extension manifests, and it reads only their NAMES. Smoke is
  * skipped on release heads (`docs/contracts/release-pr-gating.md`), so an added
  * script, a new dependency or a changed `bin` path could ride a release PR with
  * no gate reading it. This compares each manifest against the base and fails on
@@ -27,6 +27,7 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { CONSUMER_IMPACT_VALUES } from './_lib/consumer_impact.js';
+import { PINNED_PACKAGE_ARG_RE } from './_lib/listing_manifests.js';
 import { DeadScopeError, reportScanned } from './_lib/scan_scope.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -43,8 +44,17 @@ export const VERSION_FIELDS: Readonly<Record<string, readonly Pattern[]>> = {
     '.claude-plugin/marketplace.json': [['version'], ['metadata', 'version'], ['plugins', '*', 'version']],
     '.augment-plugin/plugin.json': [['version']],
     '.augment-plugin/marketplace.json': [['version'], ['metadata', 'version'], ['plugins', '*', 'version']],
+    '.github/plugin/plugin.json': [['version'], ['mcpServers', 'agent-config', 'args', '*']],
+    'gemini-extension.json': [['version'], ['mcpServers', 'agent-config', 'args', '*']],
 };
 
+/**
+ * Patterns admitted only as a re-pin: an `npx` argument may move from one
+ * `@event4u/agent-config@X.Y.Z` to another, never to any other string — the
+ * arguments around it are the command a crawler runs.
+ */
+const PINNED_ARG_PATTERN: Pattern = ['mcpServers', 'agent-config', 'args', '*'];
+
 function _matches(p: readonly Segment[], pat: Pattern): boolean {
     if (p.length !== pat.length) return false;
     return pat.every((seg, i) => seg === p[i] || (seg === '*' && /^\d+$/u.test(p[i] ?? '')));
@@ -137,7 +147,12 @@ export function manifestDifferences(file: string, base: string | null, head: str
             before = (before as Record<string, unknown> | undefined)?.[s];
             after = (after as Record<string, unknown> | undefined)?.[s];
         }
-        if (atVersion && typeof before === 'string' && typeof after === 'string') continue;
+        const pinOnly = _matches(p, PINNED_ARG_PATTERN);
+        const inShape =
+            typeof before === 'string' &&
+            typeof after === 'string' &&
+            (!pinOnly || (PINNED_PACKAGE_ARG_RE.test(before) && PINNED_PACKAGE_ARG_RE.test(after)));
+        if (atVersion && inShape) continue;
         out.push(`${file}: ${_render(p)} differs outside the version fields`);
     }
     return out;

package/src/scripts/check_release_pr_shape.ts

@@ -36,6 +36,11 @@ const ALLOWLIST_GLOBS = [
     // the tarball (publish-surface.json roots), so a release PR must carry them.
     '.augment-plugin/plugin.json',
     '.augment-plugin/marketplace.json',
+    // Listing manifests — version and the `npx` pin rewritten by release.ts
+    // set_plugin_manifest_versions; neither ships in the tarball, but a crawler
+    // reads them from the default branch.
+    '.github/plugin/plugin.json',
+    'gemini-extension.json',
     'src/packs/*/pack.yaml',
     'src/packs/*/README.md',
     'src/domains/*/pack.yaml',

package/src/scripts/code_graph/build.ts

@@ -17,8 +17,9 @@ import { fileURLToPath } from 'node:url';
 
 import { write_atomic } from '../_lib/fs_atomic.js';
 import { extractFile, type FileExtract, type RawEdge } from './extract.js';
-import { buildLaravelOverlay } from './laravel_overlay.js';
 import { grammarWasmPath } from './loader.js';
+import { type PassReport, runPasses } from './passes.js';
+import { EMPTY_PROBE, PROBE_MARKERS, type ProjectProbe } from './providers/index.js';
 import {
     ALIAS_VIA,
     aliasRulesFrom,
@@ -30,8 +31,9 @@ import {
     resolveAlias,
     resolvePsr4,
 } from './resolution_tiers.js';
-import { DOC_EXTS, docsLayer } from './docs_layer.js';
-import { readScipIndex, type ScipDocument, scipEdges, supersededByScip } from './scip_reader.js';
+import { templateBase } from './conventions_default.js';
+import { DOC_EXTS } from './docs_layer.js';
+import { readScipIndex, type ScipDocument } from './scip_reader.js';
 import { emitSqliteTwin } from './sqlite_store.js';
 import {
     type CodeEdge,
@@ -77,7 +79,21 @@ const CODE_EXTS: ReadonlySet<string> = new Set(Object.keys(EXT_LANG));
 /** Generated output under the project root: the engine never reads its own artefacts back. */
 const GENERATED_DIRS: ReadonlySet<string> = new Set(['agents/map', 'agents/runtime']);
 
+/** Whether the discovery walk would enter every directory of repo-relative `rel` (posix). */
+export function walkedPath(rel: string): boolean {
+    const dirs = rel.split('/').slice(0, -1);
+    for (let i = 0; i < dirs.length; i++) {
+        const d = dirs[i] as string;
+        if (IGNORE_DIRS.has(d) || d.startsWith('.') || GENERATED_DIRS.has(dirs.slice(0, i + 1).join('/'))) return false;
+    }
+    return true;
+}
+
 export function discoverFiles(root: string, exts: ReadonlySet<string> = CODE_EXTS): string[] {
+    return walkFiles(root, (name) => exts.has(path.extname(name).toLowerCase()));
+}
+
+function walkFiles(root: string, accept: (name: string) => boolean): string[] {
     const abs = path.resolve(root);
     // Resolve the root itself first: a repo checked out under a symlinked
     // path (e.g. macOS /tmp → /private/tmp) must still confine correctly —
@@ -106,8 +122,7 @@ export function discoverFiles(root: string, exts: ReadonlySet<string> = CODE_EXT
                 continue;
             }
             if (!e.isFile()) continue;
-            const ext = path.extname(e.name).toLowerCase();
-            if (!exts.has(ext)) continue;
+            if (!accept(e.name)) continue;
             let real: string;
             try {
                 real = fs.realpathSync(full);
@@ -122,6 +137,33 @@ export function discoverFiles(root: string, exts: ReadonlySet<string> = CODE_EXT
     return out.sort();
 }
 
+/** Manifests a provider may read to detect a stack, by basename. */
+export const MANIFEST_NAME = /^(?:composer\.json|package\.json|pyproject\.toml|requirements[\w.-]*\.txt|pom\.xml|build\.gradle(?:\.kts)?|go\.mod|[\w.-]+\.csproj|Gemfile)$/;
+
+/** The project's manifests and marker files, for provider detection (ADR-298). */
+export function readProjectProbe(root: string): ProjectProbe {
+    const abs = path.resolve(root);
+    const manifests = new Map<string, string>();
+    const markers = new Set<string>();
+    const paths: string[] = [];
+    for (const full of walkFiles(abs, () => true)) {
+        const rel = toPosixRel(abs, full);
+        paths.push(rel);
+        const name = path.basename(full);
+        if (!MANIFEST_NAME.test(name) && !PROBE_MARKERS.has(name)) continue;
+        if (PROBE_MARKERS.has(name)) {
+            markers.add(rel);
+            continue;
+        }
+        try {
+            manifests.set(rel, fs.readFileSync(full, 'utf-8'));
+        } catch {
+            continue;
+        }
+    }
+    return { manifests, markers, paths };
+}
+
 function toPosixRel(root: string, full: string): string {
     return path.relative(root, full).split(path.sep).join('/');
 }
@@ -234,10 +276,21 @@ function resolveSpecifier(fromFile: string, spec: string, fileIds: ReadonlySet<s
  *   go      `example.com/x/mod` → every non-test `.go` file of the most specific
  *           directory whose path ends the import path — a Go import names a
  *           package, and a package is all of its files.
+ *   ruby    `require_relative 'x'` → `x.rb` beside the importer; `require 'a/b'`
+ *           → the one `a/b.rb` under any directory (a load-path root).
+ *   csharp  `using A.B` → the one file declaring namespace `A.B` (`namespaces`).
+ *           A namespace declared by several files is left to name lookup: it
+ *           binds no file, since a `using` names no single one.
  *
  * A suffix that matches two files is refused rather than guessed.
  */
-export function resolveLangModule(lang: Lang, fromFile: string, spec: string, fileIds: readonly string[]): string[] {
+export function resolveLangModule(
+    lang: Lang,
+    fromFile: string,
+    spec: string,
+    fileIds: readonly string[],
+    namespaces: ReadonlyMap<string, readonly string[]> = new Map(),
+): string[] {
     const unique = (suffixes: string[]): string[] => {
         const hits = fileIds.filter((f) => suffixes.some((s) => f === s || f.endsWith(`/${s}`)));
         return hits.length === 1 ? hits : [];
@@ -264,6 +317,16 @@ export function resolveLangModule(lang: Lang, fromFile: string, spec: string, fi
         }
         return best ? goFiles.filter((f) => idDirname(f) === best).sort() : [];
     }
+    if (lang === 'ruby') {
+        if (spec.startsWith('.')) {
+            const dir = idDirname(fromFile);
+            const joined = path.posix.normalize(dir && dir !== '.' ? `${dir}/${spec}` : spec);
+            const c = joined.endsWith('.rb') ? joined : `${joined}.rb`;
+            return fileIds.includes(c) ? [c] : [];
+        }
+        return unique([spec.endsWith('.rb') ? spec : `${spec}.rb`]);
+    }
+    if (lang === 'csharp') return [...(namespaces.get(spec) ?? [])];
     return [];
 }
 
@@ -309,6 +372,8 @@ export function buildGraph(
     resolution: ResolutionConfig = EMPTY_RESOLUTION_CONFIG,
     scip: readonly ScipDocument[] = [],
     docs: readonly SourceFile[] = [],
+    probe: ProjectProbe = EMPTY_PROBE,
+    report?: { passes?: PassReport },
 ): CodeGraph {
     const nodes = extracts.flatMap((e) => e.nodes);
     const nodeIds = new Set(nodes.map((n) => n.id));
@@ -383,6 +448,21 @@ export function buildGraph(
     const fileIdList = [...fileIds].sort();
     /** Go imports name a package of several files; the binding takes the first, these carry the rest. */
     const extraImports: Array<{ source: string; target: string }> = [];
+    const namespaceFiles = new Map<string, string[]>();
+    for (const ex of extracts) for (const ns of ex.namespaces ?? []) push(namespaceFiles, ns, ex.file);
+    // C# name lookup is scoped by namespace, not by file: a type is visible
+    // from its own namespace, every enclosing one, and each `using`. Within
+    // that set a unique name IS the binding the compiler makes.
+    const csTypes = new Map<string, string[]>();
+    const csVisible = new Map<string, string[]>();
+    for (const ex of extracts) {
+        if (ex.lang !== 'csharp') continue;
+        for (const [id, ns] of Object.entries(ex.typeNamespaces ?? {})) push(csTypes, `${ns}\0${id.slice(id.indexOf('#') + 1)}`, id);
+        const seen = new Set<string>();
+        for (const ns of ex.namespaces ?? []) for (let p = ns; p; p = p.includes('.') ? p.slice(0, p.lastIndexOf('.')) : '') seen.add(p);
+        for (const r of ex.rawEdges) if (r.relation === 'imports' && r.importKind === 'namespace' && !r.localName && r.moduleSpecifier) seen.add(r.moduleSpecifier);
+        csVisible.set(ex.file, [...seen]);
+    }
     for (const ex of extracts) {
         const locals = new Map<string, string[]>();
         for (const n of ex.nodes) if (n.kind !== 'file') push(locals, n.label, n.id);
@@ -419,8 +499,9 @@ export function buildGraph(
                 if (hit) imports.set(local, { target: hit, exact: false, via: 'name-lookup' });
                 continue;
             }
-            if (ex.lang === 'python' || ex.lang === 'java' || ex.lang === 'go') {
-                const hits = resolveLangModule(ex.lang, ex.file, spec, fileIdList);
+            if (ex.lang === 'csharp' && (namespaceFiles.get(spec)?.length ?? 0) > 1) continue;
+            if (ex.lang === 'python' || ex.lang === 'java' || ex.lang === 'go' || ex.lang === 'csharp' || ex.lang === 'ruby') {
+                const hits = resolveLangModule(ex.lang, ex.file, spec, fileIdList, namespaceFiles);
                 const first = hits[0];
                 if (first === undefined) {
                     imports.set(local, {
@@ -502,6 +583,11 @@ export function buildGraph(
                 // reported as ones.
                 via: bound.via,
             };
+        if (lang === 'csharp') {
+            const ids = new Set((csVisible.get(file) ?? []).flatMap((ns) => csTypes.get(`${ns}\0${name}`) ?? []));
+            const fit = [...ids].filter((id) => satisfies(nodeKind.get(id), want));
+            if (fit.length === 1) return { target: fit[0] as string, confidence: 'EXTRACTED', via: 'namespace-scope' };
+        }
         if (scopeOnly) return null;
         const wide =
             want === 'constructible'
@@ -607,6 +693,9 @@ export function buildGraph(
             // against a same-named declaration elsewhere in the repository is
             // the defect this roadmap removes, applied to a second relation.
             const hit = resolveInScope(ex.file, r.targetName, 'any', ex.lang, true);
+            // A C# type reference to a framework type (`List`, `Task`) names no
+            // project file, and a `symbol:` edge per mention would only be noise.
+            if (!hit && ex.lang === 'csharp') return;
             emit({
                 source: r.sourceId,
                 target: hit?.target ?? `symbol:${r.targetName}`,
@@ -670,6 +759,28 @@ export function buildGraph(
             }
             return;
         }
+        // scoped `C::m()` whose class the file binds by a stated mechanism
+        // (an import, PSR-4, a local declaration, a C# namespace): the class
+        // is known, so a method it declares or inherits is the target, and the
+        // edge is exactly as trustworthy as the class binding.
+        if ((r.callStyle === 'scoped' || r.callStyle === 'dynamic') && r.scopeName) {
+            const cls = resolveInScope(ex.file, r.scopeName, 'any', ex.lang, true);
+            const kind = cls ? nodeKind.get(cls.target) : undefined;
+            if (cls && isStatedResolution(cls.via) && (kind === 'class' || kind === 'interface' || kind === 'enum')) {
+                const m = resolveHierMethod(cls.target, r.targetName);
+                if (m) {
+                    emit({
+                        source: r.sourceId,
+                        target: m,
+                        relation: 'calls',
+                        confidence: m.startsWith(`${cls.target}::`) ? cls.confidence : 'INFERRED',
+                        resolved_via: cls.via,
+                        provider: 'native',
+                    });
+                    return;
+                }
+            }
+        }
         // scoped (Class::m unresolved / facade) or dynamic ($obj->m) → AMBIGUOUS
         const cands = methodCandidates(r.targetName, ex.lang);
         if (r.callStyle === 'dynamic' && cands.length === 0) {
@@ -754,39 +865,9 @@ export function buildGraph(
         });
     }
 
-    // Framework links no import states (routes, views, tables); rule-read,
-    // emitted only when the target exists. Also drops the base edges it
-    // proves false: a fluent `->middleware()` bound by name to some
-    // unrelated in-repo `middleware()`.
-    const overlay = buildLaravelOverlay(files, nodes, resolution);
-    let routeBuilderCalls = 0;
-    if (overlay.nodes.length > 0 || overlay.edges.length > 0) {
-        const kept = edges.filter((e) => !overlay.dropEdge(e));
-        routeBuilderCalls = edges.length - kept.length;
-        // Element-wise: a spread of ~200k edges overflows the call stack.
-        edges.length = 0;
-        for (const e of kept) edges.push(e);
-        for (const e of overlay.edges) edges.push(e);
-        for (const n of overlay.nodes) nodes.push(n);
-    }
-
-    if (docs.length > 0) {
-        const allFiles = new Set([...files.map((f) => f.path), ...docs.map((d) => d.path)]);
-        const layer = docsLayer(docs, allFiles);
-        for (const n of layer.nodes) nodes.push(n);
-        for (const e of layer.edges) edges.push(e);
-    }
-
-    // A project's own SCIP index states references the compiler resolved;
-    // each one supersedes the native name guess it duplicates.
-    if (scip.length > 0) {
-        const stated = scipEdges(scip, nodes);
-        const dropped = supersededByScip(stated, nodes);
-        const kept = edges.filter((e) => !dropped(e));
-        edges.length = 0;
-        for (const e of kept) edges.push(e);
-        for (const e of stated) edges.push(e);
-    }
+    // Everything after resolution: convention providers, docs, SCIP (passes.ts).
+    const passes = runPasses({ files, docs, scip, resolution, probe }, nodes, edges);
+    if (report) report.passes = passes;
 
     // deterministic ordering
     nodes.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
@@ -800,7 +881,9 @@ export function buildGraph(
     for (const e of edges) counts[e.confidence] += 1;
     const suppressed: CodeGraph['suppressed_edge_counts'] = {
         dynamic_no_candidate: suppressedKeys.size,
-        ...(routeBuilderCalls > 0 ? { route_builder_call: routeBuilderCalls } : {}),
+        ...(Object.keys(passes.suppressed).length > 0
+            ? { contested_by_provider: Object.fromEntries(Object.entries(passes.suppressed).sort()) }
+            : {}),
     };
 
     const languages = [...new Set(extracts.map((e) => e.lang))].sort() as Lang[];
@@ -819,6 +902,18 @@ export function buildGraph(
         h.update(createHash('sha256').update(d.source, 'utf-8').digest('hex'));
         h.update('\n');
     }
+    // Manifests and markers decide which providers run: a changed manifest is
+    // a changed input even when no source file moved.
+    for (const [p, text] of [...probe.manifests].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
+        h.update(`manifest\0${p}\0`);
+        h.update(createHash('sha256').update(text, 'utf-8').digest('hex'));
+        h.update('\n');
+    }
+    for (const p of [...probe.markers].sort()) h.update(`marker\0${p}\n`);
+    // Template files are no source, yet their presence decides `renders` and
+    // default-pass edges: they are inputs too. Other non-code paths (caches,
+    // logs, assets) are not read and stay out of the identity.
+    for (const p of probe.paths) if (templateBase(p) !== null) h.update(`template\0${p}\n`);
     // The SCIP index is an input like any source file: a new index must not
     // read as the same graph.
     for (const d of [...scip].sort((a, b) => (a.path < b.path ? -1 : 1))) {
@@ -833,6 +928,7 @@ export function buildGraph(
         grammar_abi: EXPECTED_GRAMMAR_ABI,
         edge_confidence_counts: counts,
         suppressed_edge_counts: suppressed,
+        ...(passes.providers.length > 0 ? { providers: passes.providers } : {}),
         nodes,
         edges,
     };
@@ -908,6 +1004,7 @@ export function serializeGraph(g: CodeGraph): string {
         'grammar_abi',
         'edge_confidence_counts',
         'suppressed_edge_counts',
+        'providers',
         'nodes',
         'edges',
     ];
@@ -936,13 +1033,14 @@ export function serializeGraph(g: CodeGraph): string {
         // byte what it was before this field existed.
         if (e.ambiguity_reason) base['ambiguity_reason'] = e.ambiguity_reason;
         if (e.candidates) base['candidates'] = e.candidates;
+        if (e.provider_id) base['provider_id'] = e.provider_id;
         return base;
     };
     const ordered: Record<string, unknown> = {};
     for (const k of key_order) {
         if (k === 'nodes') ordered[k] = g.nodes.map(node);
         else if (k === 'edges') ordered[k] = g.edges.map(edge);
-        else ordered[k] = g[k];
+        else if (g[k] !== undefined) ordered[k] = g[k];
     }
     return JSON.stringify(ordered, null, 2) + '\n';
 }
@@ -1086,14 +1184,16 @@ export async function buildFromRepo(
             continue;
         }
     }
-    const graph = buildGraph(files, extracts, readResolutionConfig(root), scip, docs);
+    const report: { passes?: PassReport } = {};
+    const graph = buildGraph(files, extracts, readResolutionConfig(root), scip, docs, readProjectProbe(abs), report);
+    for (const f of report.passes?.failures ?? []) process.stderr.write(`code-graph: pass ${f.pass} failed — ${f.reason}\n`);
     const json = serializeGraph(graph);
     if (cachePath) {
         write_atomic(cachePath, json);
         write_atomic(sidecarPath(cachePath), JSON.stringify(nextSidecar));
         // Derived SQLite twin (ADR-129): best-effort accelerator beside the
         // canonical JSON — never fails the build, no-op on old Node.
-        emitSqliteTwin(graph, json, cachePath);
+        emitSqliteTwin(graph, cachePath);
     }
     return { graph, json, fileCount: files.length, reExtracted, reused };
 }