@guanlin4924/devflow-pi 0.1.80 → 0.1.82

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guanlin4924/devflow-pi",
-  "version": "0.1.80",
+  "version": "0.1.82",
   "type": "module",
   "description": "Devflow 专项研发 Pi，基于固定版本 OMP Runtime 组装研发状态机、代码智能、设计、实现与质量门禁。",
   "license": "UNLICENSED",

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/requirement_graph.rb

@@ -957,7 +957,10 @@ module RequirementGraph
     blocking = []
     checkers.each do |id, issues|
       next if DEFERRED_CHECKERS.include?(id)
-      blocking.concat(issues)
+      # The derived ID list is an observation, not a failed obligation. A
+      # confirmed high-risk node may remain high-risk forever; only its
+      # unconfirmed state (checked below) or model-authored risk keys block.
+      blocking.concat(id == "risk-derivation-check" ? issues.reject { |entry| entry.start_with?("derived high-risk nodes: ") } : issues)
     end
     Array(graph["nodes"]).each do |node|
       next unless node.is_a?(Hash) && high_risk_by_structure?(node)

package/plugins/devflow-intel/extensions/devflow-intel.ts

@@ -1,4 +1,5 @@
-import { existsSync } from "node:fs";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -53,12 +54,22 @@ export default function devflowIntel(pi: ExtensionAPI) {
     label: "Devflow Code Index",
     description: "Scan, validate, audit, or query the deterministic project code index.",
     parameters: z.object({
-      action: z.enum(["scan", "validate", "audit", "query", "relations", "impact"]),
+      action: z.enum(["scan", "validate", "audit", "query", "relations", "impact", "search-content", "resolve-domain", "query-plan", "domain-import"]),
       term: z.string().optional(),
       object: z.string().optional(),
       entity: z.string().optional(),
+      projectId: z.string().default("default"),
+      plan: z.record(z.string(), z.unknown()).optional(),
+      bundle: z.record(z.string(), z.unknown()).optional(),
+      repository: z.string().optional(),
+      pathPrefix: z.string().optional(),
+      language: z.string().optional(),
+      matchKind: z.enum(["literal", "identifier", "phrase", "substring"]).default("literal"),
+      direction: z.enum(["incoming", "outgoing", "both"]).default("outgoing"),
+      expectedRevision: z.string().optional(),
       changeType: z.enum(["remove_field", "rename_field", "change_type", "optional_to_required", "required_to_optional", "change_nullability", "change_enum"]).optional(),
       snapshot: z.string().optional(),
+      mappingRevision: z.string().optional(),
       depth: z.number().int().min(0).max(20).default(3),
       includeHeuristic: z.boolean().default(false),
       limit: z.number().int().min(1).max(100).default(20),
@@ -68,7 +79,7 @@ export default function devflowIntel(pi: ExtensionAPI) {
     approval: (args) => {
       const action = (args as { action?: string }).action;
       // scan 写 .planning/code-index，按 exec 询问；validate/audit/query 只读，免确认。
-      return action === "scan" ? "exec" : "read";
+      return ["scan", "domain-import"].includes(action ?? "") ? "exec" : "read";
     },
     async execute(_id, params, _signal, _onUpdate, ctx) {
       const skillRoot = resolveSkillRoot(ctx.cwd);
@@ -92,6 +103,40 @@ export default function devflowIntel(pi: ExtensionAPI) {
         args.push("--index", ".planning/code-index", "--term", params.term, "--limit", String(params.limit));
         if (params.snapshot) args.push("--snapshot", params.snapshot);
       } else {
+        if (params.action === "search-content") {
+          if (!params.term) return render({ ok: false, exitCode: 2, stdout: "", stderr: "term is required" }, {});
+          args.push("--index", ".planning/code-index", "--term", params.term, "--limit", String(params.limit));
+          args.push("--project-id", params.projectId);
+          args.push("--match-kind", params.matchKind === "phrase" ? "exact_phrase" : params.matchKind);
+          if (params.repository) args.push("--repository", params.repository);
+          if (params.pathPrefix) args.push("--path-prefix", params.pathPrefix);
+          if (params.language) args.push("--language", params.language);
+          return render(await run(args, ctx.cwd), { action: params.action });
+        } else if (params.action === "resolve-domain") {
+          if (!params.term) return render({ ok: false, exitCode: 2, stdout: "", stderr: "term is required" }, {});
+          args.push("--index", ".planning/code-index", "--term", params.term, "--project-id", params.projectId, "--limit", String(params.limit));
+          if (params.mappingRevision) args.push("--mapping-revision", params.mappingRevision);
+          return render(await run(args, ctx.cwd), { action: params.action });
+        } else if (params.action === "query-plan") {
+          if (!params.plan) return render({ ok: false, exitCode: 2, stdout: "", stderr: "plan is required" }, {});
+          const plan = { ...params.plan };
+          if (plan.limit === undefined) plan.limit = params.limit;
+          args.push("--index", ".planning/code-index", "--project-id", params.projectId, "--plan", JSON.stringify(plan));
+          if (params.snapshot) args.push("--snapshot", params.snapshot);
+          return render(await run(args, ctx.cwd), { action: params.action });
+        } else if (params.action === "domain-import") {
+          if (!params.bundle) return render({ ok: false, exitCode: 2, stdout: "", stderr: "bundle is required" }, {});
+          const bundleDir = mkdtempSync(path.join(tmpdir(), "devflow-domain-"));
+          const bundlePath = path.join(bundleDir, "bundle.json");
+          try {
+            writeFileSync(bundlePath, JSON.stringify(params.bundle), { encoding: "utf8", mode: 0o600 });
+            args.push("--index", ".planning/code-index", "--project-id", params.projectId, "--bundle", bundlePath);
+            if (params.expectedRevision) args.push("--expected-revision", params.expectedRevision);
+            return render(await run(args, ctx.cwd), { action: params.action });
+          } finally {
+            rmSync(bundleDir, { recursive: true, force: true });
+          }
+        }
         if (params.action === "impact") {
           if (!params.entity) return render({ ok: false, exitCode: 2, stdout: "", stderr: "entity is required" }, {});
           args.push("--index", ".planning/code-index", "--entity", params.entity, "--depth", String(params.depth), "--limit", String(params.limit));
@@ -101,6 +146,7 @@ export default function devflowIntel(pi: ExtensionAPI) {
         }
         if (!params.object) return render({ ok: false, exitCode: 2, stdout: "", stderr: "object is required" }, {});
         args.push("--index", ".planning/code-index", "--object", params.object, "--depth", String(params.depth), "--limit", String(params.limit));
+        args.push("--direction", params.direction);
         if (params.snapshot) args.push("--snapshot", params.snapshot);
         if (params.includeHeuristic) args.push("--include-heuristic");
       }

package/plugins/devflow-intel/skills/workflow-code-index/scripts/code_index.py

@@ -27,7 +27,10 @@ from adapters.registry import AdapterRegistry
 from semantic import SEMANTIC_EXTRACTOR_VERSION, build_semantic_facts
 from core.discovery import discover_codebases
 from core.hashing import file_sha256
-from core.scanner import scan_files
+from core.scanner import scan_files, DEFAULT_EXCLUDES
+from hybrid_query import execute as execute_plan, read_connection, validate_plan
+from domain_registry import import_bundle
+from source_content import content_integrity
 from validators.project_binding_check import audit_project_binding
 from validators.relation_check import audit_relations
 from validators.schema_validate import validate_index
@@ -68,13 +71,16 @@ def _publish_snapshot(staging: Path, output: Path, counts: Dict[str, int], works
         # Keep the public snapshot schema stable while exposing the richer
         # SQLite schema separately.  Older consumers only know schemaVersion=1.
         "schemaVersion": 1,
-        "indexSchemaVersion": 3,
+        "indexSchemaVersion": 4 if workspace_state.get("contentSearch") else 3,
         "capabilities": {
             "structural": True,
             "semantic": True,
             "fts": True,
             "relations": True,
             "provenance": True,
+            "contentSearch": workspace_state.get("contentSearch", False),
+            "domainMapping": {"version": 1, "storage": "external_registry"},
+            "queryPlan": {"version": 1},
         },
         "generation": generation,
         "generatedAt": datetime.now(timezone.utc).isoformat(),
@@ -195,6 +201,8 @@ def main(argv=None) -> int:
     scan.add_argument("--output", default=".planning/code-index", help="Index output directory.")
     scan.add_argument("--codebase", action="append", default=[], help="Explicit codebase: name:path[:type]. Can repeat.")
     scan.add_argument("--changed-files", nargs="*", default=[], help="Optional changed files for incremental refresh.")
+    scan.add_argument("--include", action="append", default=[], help="Repository-relative include glob. Can repeat.")
+    scan.add_argument("--max-file-size", type=int, default=1500000)
     scan.add_argument("--exclude", action="append", default=[], help="Additional directory names to exclude.")
 
     validate = sub.add_parser("validate", help="Validate an index in staged levels.")
@@ -227,6 +235,7 @@ def main(argv=None) -> int:
     relations.add_argument("--limit", type=int, default=100)
     relations.add_argument("--snapshot")
     relations.add_argument("--include-heuristic", action="store_true")
+    relations.add_argument("--direction", choices=["incoming", "outgoing", "both"], default="outgoing")
 
     impact = sub.add_parser("impact", help="Traverse cross-layer semantic facts in a fixed snapshot.")
     impact.add_argument("--index", default=".planning/code-index")
@@ -236,7 +245,28 @@ def main(argv=None) -> int:
     impact.add_argument("--snapshot")
     impact.add_argument("--change-type", choices=["remove_field", "rename_field", "change_type", "optional_to_required", "required_to_optional", "change_nullability", "change_enum"], help="Optional proposed change classification.")
 
+    for action in ("search-content", "resolve-domain", "query-plan", "domain-import"):
+        operation = sub.add_parser(action)
+        operation.add_argument("--index", default=".planning/code-index")
+        operation.add_argument("--snapshot")
+        operation.add_argument("--project-id", default="")
+        operation.add_argument("--limit", type=int, default=20)
+        operation.add_argument("--repository", action="append", default=[])
+        operation.add_argument("--path-prefix", default="")
+        operation.add_argument("--mapping-revision", default="approved-current")
+        if action == "search-content":
+            operation.add_argument("--language")
+            operation.add_argument("--match-kind", choices=["literal", "substring", "identifier", "exact_phrase"], default="literal")
+        if action == "query-plan":
+            operation.add_argument("--plan", required=True, help="Structured QueryPlan JSON, never SQL")
+        elif action == "domain-import":
+            operation.add_argument("--bundle", required=True, help="JSON mapping bundle file")
+            operation.add_argument("--expected-revision", help="Expected approved current revision for CAS")
+        elif action in {"search-content", "resolve-domain"}:
+            operation.add_argument("--term", required=True)
     args = parser.parse_args(argv)
+    if args.command in {"search-content", "resolve-domain", "query-plan", "domain-import"}:
+        return command_structured(args)
     if args.command == "scan":
         return command_scan(args)
     if args.command == "validate":
@@ -255,6 +285,10 @@ def main(argv=None) -> int:
 def command_scan(args) -> int:
     root = Path(args.root).resolve()
     output = (root / args.output).resolve() if not Path(args.output).is_absolute() else Path(args.output).resolve()
+    includes = getattr(args, "include", [])
+    max_file_size = getattr(args, "max_file_size", 1500000)
+    if not 1 <= max_file_size <= 50000000:
+        raise ValueError("max-file-size must be 1..50000000")
     progress = _Progress(output)
     progress.emit("start", "scan started", root=str(root), output=str(output), codebases=args.codebase)
     with _index_lock(output, exclusive=True):
@@ -263,6 +297,10 @@ def command_scan(args) -> int:
         registry = AdapterRegistry()
         changed = _normalize_changed_files(root, args.changed_files)
         existing = _load_existing(output)
+        previous_scope = _load_snapshot(output).get("workspace", {}).get("scanScope", {})
+        previous_roots = {(item.get("name"), item.get("path")) for item in previous_scope.get("codebases", [])}
+        if changed and (set(previous_scope.get("exclude", [])) != DEFAULT_EXCLUDES | set(args.exclude) or previous_roots != {(item.name, str(item.root)) for item in codebases} or previous_scope.get("includes", []) != sorted(set(includes)) or previous_scope.get("maxFileSize", 1500000) != max_file_size):
+            changed = set()  # Scope changes require a complete rebuild, never reuse out-of-scope rows.
         secondary_changed = _incoming_evidence_files(existing, changed)
         changed |= secondary_changed
 
@@ -277,7 +315,7 @@ def command_scan(args) -> int:
                 diagnostics.append(_diagnostic(codebase.name, "", 1, "warning", "skipped_file", f"codebase root does not exist: {codebase.root}", "discovery@1"))
                 continue
             progress.emit("discover", f"discovering {codebase.name}", codebase=codebase.name, path=str(codebase.root))
-            all_files = scan_files(codebase.root, excludes=args.exclude)
+            all_files = scan_files(codebase.root, excludes=args.exclude, includes=includes, max_bytes=max_file_size)
             progress.emit("discover", f"discovered {len(all_files)} files in {codebase.name}", codebase=codebase.name, files=len(all_files))
             discovered_paths.update(_workspace_rel(root, path) for path in all_files)
             if changed:
@@ -355,11 +393,17 @@ def command_scan(args) -> int:
             )
             workspace_state["generatedAt"] = datetime.now(timezone.utc).isoformat()
             workspace_state["scanScope"] = {
-                "exclude": sorted(set(args.exclude)),
+                "exclude": sorted(DEFAULT_EXCLUDES | set(args.exclude)),
+                "includes": sorted(set(includes)),
+                "generatedPolicy": "exclude_known_build_directories",
+                "dependencyPolicy": "exclude_known_dependency_directories",
+                "maxFileSize": max_file_size,
                 "codebases": [
-                    {"name": item.name, "path": str(item.root)} for item in codebases
+                    {"name": item.name, "path": str(item.root), "workspacePath": _workspace_rel(root, item.root)} for item in codebases
                 ],
             }
+            workspace_state["scopeHash"] = _hash_lines([json.dumps(workspace_state["scanScope"], sort_keys=True)])
+            workspace_state["root"] = str(root)
             workspace_state["semanticExtractor"] = SEMANTIC_EXTRACTOR_VERSION
             workspace_state["extractorSetHash"] = _hash_lines([*workspace_state.get("extractors", []), SEMANTIC_EXTRACTOR_VERSION])
             progress.emit("semantic", "building semantic facts")
@@ -381,6 +425,7 @@ def command_scan(args) -> int:
                 semantic_entities=semantic_entities,
                 semantic_flows=semantic_flows,
                 feature_bindings=feature_bindings,
+                source_root=root,
             )
             progress.emit("documents", "writing index projections")
             write_markdown(staging, files, symbols, relations, diagnostics)
@@ -430,6 +475,26 @@ def _validate_publish_gate(selected: Path, snapshot: Dict[str, object]) -> List[
             quick = conn.execute("PRAGMA quick_check").fetchone()
             if not quick or quick[0] != "ok":
                 errors.append(f"sqlite quick_check failed: {quick[0] if quick else 'no result'}")
+            if snapshot.get("capabilities", {}).get("contentSearch"):
+                content_tables = _table_names(conn)
+                for table in ("source_artifacts", "source_content_chunks", "snapshot_metadata"):
+                    if table not in content_tables:
+                        errors.append(f"content capability missing table {table}")
+                content_capability = snapshot["capabilities"]["contentSearch"]
+                if isinstance(content_capability, dict) and content_capability.get("tokenizer") == "trigram" and "source_content_fts" not in content_tables:
+                    errors.append("trigram content capability missing FTS table")
+                if {"source_content_chunks", "snapshot_metadata"}.issubset(content_tables):
+                    declared = conn.execute("SELECT value FROM snapshot_metadata WHERE key='contentSearch'").fetchone()
+                    integrity = conn.execute("SELECT value FROM snapshot_metadata WHERE key='contentIntegrity'").fetchone()
+                    if declared is None or json.loads(declared[0]) != content_capability:
+                        errors.append("content capability metadata mismatch")
+                    actual = content_integrity(conn)
+                    if integrity is None or json.loads(integrity[0]) != actual or actual.get("missing_fts_rowids", 0):
+                        errors.append("content/FTS rowid, count or integrity mismatch")
+                if {"source_content_chunks", "code_files", "source_artifacts"}.issubset(content_tables):
+                    invalid = conn.execute("SELECT count(*) FROM source_content_chunks c LEFT JOIN code_files f ON f.id=c.code_file_id LEFT JOIN source_artifacts a ON a.content_hash=c.content_hash WHERE f.id IS NULL OR a.content_hash IS NULL OR c.content_hash<>f.content_hash OR c.code_generation<>?", (snapshot.get("generation"),)).fetchone()[0]
+                    if invalid:
+                        errors.append(f"content index has {invalid} invalid chunk references")
             snapshot_id = snapshot.get("generation")
             tables = _table_names(conn)
             required = {"analysis_snapshots", "code_files", "symbols", "relations", "diagnostics"}
@@ -521,8 +586,69 @@ def command_validate(args) -> int:
     if not errors:
         print(f"Index validation passed ({level}).")
     return 1 if errors else 0
+def command_structured(args) -> int:
+    output = Path(args.index).resolve()
+    try:
+        if args.command == "query-plan":
+            if len(args.plan) > 32000:
+                raise ValueError("QueryPlan exceeds 32KB")
+            raw_plan = json.loads(args.plan)
+            if "limit" not in raw_plan:
+                raw_plan["limit"] = getattr(args, "limit", 20)
+            plan = validate_plan(raw_plan)
+        else:
+            plan = {"featureTerms": [args.term] if hasattr(args, "term") else [],
+                    "phases": ["search_content", "verify_evidence"] if args.command == "search-content" else ["resolve_domain"],
+                    "limit": args.limit, "repositoryFilter": getattr(args, "repository", []),
+                    "pathPrefix": getattr(args, "path_prefix", ""), "mappingRevision": getattr(args, "mapping_revision", "approved-current"),
+                    "language": getattr(args, "language", None), "matchKind": getattr(args, "match_kind", "literal")}
+            plan = validate_plan(plan)
+        requested = getattr(args, "snapshot", None)
+        planned = plan.get("codeGeneration")
+        if planned and planned != "current":
+            if requested and requested != planned:
+                raise ValueError("conflicting snapshot and codeGeneration")
+            requested = planned
+        with _index_lock(output, exclusive=False):
+            selected = _selected_generation(output, requested)
+            snapshot = _load_snapshot(selected)
+            errors = _validate_snapshot_bundle(selected, snapshot)
+            if errors:
+                raise ValueError(errors[0])
+            if not requested and not _query_is_fresh(Path(snapshot.get("workspace", {}).get("root", output.parent.parent)), snapshot, read_jsonl(selected / INDEX_FILES["files"])):
+                print(json.dumps({"_meta": {"status": "stale_index", "snapshot": snapshot.get("generation")}}))
+                return 1
+            conn = read_connection(selected / "index.sqlite")
+            try:
+                if snapshot.get("workspace", {}).get("scopeHash"):
+                    scope_json = json.dumps(snapshot["workspace"]["scanScope"], sort_keys=True)
+                    if _hash_lines([scope_json]) != snapshot["workspace"]["scopeHash"]:
+                        raise ValueError("scan scope hash mismatch")
+                    stored = conn.execute("SELECT value FROM snapshot_metadata WHERE key='scanScope'").fetchone()
+                    if stored is None or json.loads(stored[0]) != snapshot["workspace"]["scanScope"]:
+                        raise ValueError("scan scope metadata mismatch")
+                registry = output.parent / "domain-registry.sqlite"
+                if args.command == "domain-import":
+                    bundle_path = Path(args.bundle)
+                    if bundle_path.stat().st_size > 2_000_000:
+                        raise ValueError("mapping bundle exceeds 2MB")
+                    result = import_bundle(registry, args.project_id, json.loads(bundle_path.read_text()), getattr(args, "expected_revision", None), conn, snapshot["generation"])
+                else:
+                    result = execute_plan(conn, snapshot, plan, registry, getattr(args, "project_id", ""))
+                print(json.dumps(result, ensure_ascii=False, sort_keys=True))
+            finally:
+                conn.close()
+        return 0
+    except (ValueError, TypeError, KeyError, OSError, sqlite3.Error) as exc:
+        status = "partial" if isinstance(exc, sqlite3.OperationalError) and "interrupt" in str(exc) else "invalid_query"
+        print(json.dumps({"_meta": {"status": status, "reason": str(exc)}}))
+        return 1
+
+
 def command_query(args) -> int:
     output = Path(args.index).resolve()
+    if hasattr(args, "term") and (not args.term or len(args.term) > 256 or "\x00" in args.term):
+        raise ValueError("term must contain 1..256 characters")
     with _index_lock(output, exclusive=False):
         selected = _selected_generation(output, getattr(args, "snapshot", None))
         index = selected / "index.sqlite"
@@ -539,8 +665,7 @@ def command_query(args) -> int:
         if not getattr(args, "snapshot", None) and not _query_is_fresh(output.parent.parent, snapshot, files):
             print("Stale code index: refresh required before query.", file=sys.stderr)
             return 1
-        conn = sqlite3.connect(str(index))
-        conn.row_factory = sqlite3.Row
+        conn = read_connection(index)
         try:
             symbol_columns = {row[1] for row in conn.execute("PRAGMA table_info(symbols)")}
             provenance = ", parser, content_hash, metadata_json" if {"parser", "content_hash", "metadata_json"}.issubset(symbol_columns) else ", NULL AS parser, NULL AS content_hash, NULL AS metadata_json"
@@ -554,16 +679,16 @@ def command_query(args) -> int:
                     WHERE symbols_fts MATCH ?
                     LIMIT ?
                     """,
-                    (args.term, limit),
+                    ('"' + args.term.replace('"', '""') + '"', limit),
                 ).fetchall()
             except sqlite3.OperationalError:
-                like = f"%{args.term}%"
+                like = args.term
                 rows = conn.execute(
                     f"""
                     SELECT id, codebase, kind, name, qualified_name, path, line_start, line_end,
                            {provenance[2:]}
                     FROM symbols
-                    WHERE name LIKE ? OR qualified_name LIKE ? OR path LIKE ?
+                    WHERE instr(lower(name),lower(?))>0 OR instr(lower(qualified_name),lower(?))>0 OR instr(lower(path),lower(?))>0
                     LIMIT ?
                     """,
                     (like, like, like, limit),
@@ -580,6 +705,10 @@ def command_query(args) -> int:
 
 
 def command_relations(args) -> int:
+    if getattr(args, "direction", "outgoing") != "outgoing":
+        args.plan = json.dumps({"seedEntityIds": [args.object], "phases": ["traverse_relations", "verify_evidence"], "direction": args.direction, "depth": min(args.depth, 5), "limit": min(args.limit, 100), "includeHeuristic": args.include_heuristic})
+        args.command = "query-plan"
+        return command_structured(args)
     output = Path(args.index).resolve()
     depth = max(0, min(args.depth, 20)); limit = _bounded_limit(args.limit, 1000)
     with _index_lock(output, exclusive=False):
@@ -590,7 +719,7 @@ def command_relations(args) -> int:
             print(bundle_errors[0], file=sys.stderr); return 1
         if not getattr(args, "snapshot", None) and not _query_is_fresh(output.parent.parent, snapshot, files):
             print("Stale code index: refresh required before query.", file=sys.stderr); return 1
-        conn = sqlite3.connect(str(selected / "index.sqlite")); conn.row_factory = sqlite3.Row
+        conn = read_connection(selected / "index.sqlite")
         try:
             symbol_columns = {row[1] for row in conn.execute("PRAGMA table_info(symbols)")}
             parser_expr = "s.parser" if "parser" in symbol_columns else "NULL"
@@ -621,6 +750,10 @@ def command_relations(args) -> int:
             for row in rows[:limit]:
                 item = dict(row)
                 item["snapshot"] = snapshot.get("generation")
+                relation_parser = conn.execute("SELECT parser FROM relations WHERE from_id=? AND relation_type=? AND evidence_path=? AND evidence_line=? LIMIT 1", (item["from_id"], item["relation_type"], item["evidence_path"], item["evidence_line"])).fetchone()
+                item["relation_parser"] = relation_parser[0] if relation_parser else "unknown"
+                item["source_file_parser"] = item.get("from_parser")
+                item["provenance"] = {"relation_parser": item["relation_parser"], "source_file_parser": item["source_file_parser"], "snapshot": snapshot.get("generation")}
                 if getattr(args, "change_type", None):
                     item["impact_kind"] = args.change_type
                     item["severity"] = _impact_severity(args.change_type, item.get("flow_type", "relation"))
@@ -655,7 +788,7 @@ def command_impact(args) -> int:
             if not _query_is_fresh(output.parent.parent, snapshot, files):
                 print("Stale code index: refresh required before impact query.", file=sys.stderr)
                 return 1
-        conn = sqlite3.connect(str(selected / "index.sqlite")); conn.row_factory = sqlite3.Row
+        conn = read_connection(selected / "index.sqlite")
         try:
             tables = _table_names(conn)
             semantic_tables = {"semantic_flows", "entity_versions", "feature_bindings", "coverage_metrics"}
@@ -792,7 +925,9 @@ def _query_is_fresh(root: Path, snapshot: Dict[str, object], files: List[dict])
     if not any(path.startswith("../") for path in indexed_paths):
         scope = workspace.get("scanScope") if isinstance(workspace.get("scanScope"), dict) else {}
         excludes = scope.get("exclude", []) if isinstance(scope, dict) else []
-        current_paths = sorted(_workspace_rel(root, item) for item in scan_files(root, excludes=excludes))
+        repositories = scope.get("codebases", [])
+        roots = [Path(item["path"]) for item in repositories] if repositories else [root]
+        current_paths = sorted({_workspace_rel(root, item) for repository in roots for item in scan_files(repository, excludes=excludes, max_bytes=scope.get("maxFileSize", 1500000), includes=scope.get("includes", []))})
         expected_paths_hash = workspace.get("discoveredPathsHash") or workspace.get("indexedPathsHash")
         if _hash_lines(current_paths) != expected_paths_hash:
             return False

package/plugins/devflow-intel/skills/workflow-code-index/scripts/core/scanner.py

@@ -1,4 +1,5 @@
 import os
+import fnmatch
 import subprocess
 from pathlib import Path
 from typing import Iterable, List, Sequence
@@ -22,6 +23,7 @@ DEFAULT_EXCLUDES = {
     ".dart_tool",
     "__pycache__",
     "Pods",
+    "server/public",
 }
 
 TEXT_EXTENSIONS = {
@@ -57,7 +59,7 @@ TEXT_EXTENSIONS = {
 }
 
 
-def scan_files(root: Path, excludes: Iterable[str] = (), max_bytes: int = 1_500_000) -> List[Path]:
+def scan_files(root: Path, excludes: Iterable[str] = (), max_bytes: int = 1_500_000, includes: Iterable[str] = ()) -> List[Path]:
     root = root.resolve()
     excluded = DEFAULT_EXCLUDES | set(excludes)
     paths = _scan_with_git(root, excluded) or _scan_with_rg(root, excluded) or _scan_with_walk(root, excluded)
@@ -65,6 +67,9 @@ def scan_files(root: Path, excludes: Iterable[str] = (), max_bytes: int = 1_500_
     for path in sorted(paths):
         if not path.is_file():
             continue
+        relative = path.relative_to(root).as_posix()
+        if includes and not any(fnmatch.fnmatch(relative, pattern) or (pattern.startswith("**/") and fnmatch.fnmatch(relative, pattern[3:])) for pattern in includes):
+            continue
         if _is_excluded(path, root, excluded):
             continue
         if path.suffix and path.suffix.lower() not in TEXT_EXTENSIONS:
@@ -130,5 +135,8 @@ def _is_excluded(path: Path, root: Path, excluded: Sequence[str]) -> bool:
         parts = path.resolve().relative_to(root).parts
     except ValueError:
         return True
-    return any(part in excluded for part in parts)
+    relative = "/".join(parts)
+    if any(fnmatch.fnmatch(relative, pattern) or fnmatch.fnmatch(relative + "/", pattern.rstrip("/") + "/") for pattern in excluded):
+        return True
+    return any(part in excluded for part in parts) or any("/" in pattern and ("/" + "/".join(parts) + "/").find("/" + pattern.strip("/") + "/") >= 0 for pattern in excluded)
 

package/plugins/devflow-intel/skills/workflow-code-index/scripts/domain_registry.py

@@ -0,0 +1,168 @@
+"""Append-only project scoped mapping bundles, separate from code snapshots.
+
+Approval import is an explicit local reviewer attestation, not an authorization service.
+"""
+import json
+import sqlite3
+from datetime import datetime, timezone
+
+SCHEMA = '''
+CREATE TABLE IF NOT EXISTS domain_mapping_revisions(
+ project_id TEXT NOT NULL,mapping_revision TEXT NOT NULL,code_generation TEXT NOT NULL,
+ requirement_revision TEXT,status TEXT NOT NULL,previous_revision TEXT,bundle_json TEXT NOT NULL,
+ created_at TEXT NOT NULL,PRIMARY KEY(project_id,mapping_revision));
+CREATE TABLE IF NOT EXISTS domain_mapping_current(project_id TEXT PRIMARY KEY,current_revision TEXT NOT NULL);
+CREATE TABLE IF NOT EXISTS domain_term_versions(
+ project_id TEXT NOT NULL,mapping_revision TEXT NOT NULL,term_id TEXT NOT NULL,canonical_name TEXT NOT NULL,
+ PRIMARY KEY(project_id,mapping_revision,term_id));
+CREATE TABLE IF NOT EXISTS domain_term_alias_versions(
+ project_id TEXT NOT NULL,mapping_revision TEXT NOT NULL,term_id TEXT NOT NULL,alias TEXT NOT NULL,
+ PRIMARY KEY(project_id,mapping_revision,term_id,alias));
+CREATE TABLE IF NOT EXISTS domain_feature_versions(
+ project_id TEXT NOT NULL,mapping_revision TEXT NOT NULL,feature_id TEXT NOT NULL,canonical_name TEXT NOT NULL,
+ PRIMARY KEY(project_id,mapping_revision,feature_id));
+CREATE TABLE IF NOT EXISTS domain_feature_terms(
+ project_id TEXT NOT NULL,mapping_revision TEXT NOT NULL,feature_id TEXT NOT NULL,term_id TEXT NOT NULL,
+ PRIMARY KEY(project_id,mapping_revision,feature_id,term_id));
+CREATE TABLE IF NOT EXISTS domain_feature_bindings(
+ project_id TEXT NOT NULL,mapping_revision TEXT NOT NULL,feature_id TEXT NOT NULL,entity_id TEXT NOT NULL,
+ entity_version_id TEXT NOT NULL,code_generation TEXT NOT NULL,
+ PRIMARY KEY(project_id,mapping_revision,feature_id,entity_version_id));
+CREATE TABLE IF NOT EXISTS domain_mapping_decisions(
+ project_id TEXT NOT NULL,mapping_revision TEXT NOT NULL,reviewer TEXT NOT NULL,reason TEXT NOT NULL,
+ requirement_revision TEXT NOT NULL,decision TEXT NOT NULL,PRIMARY KEY(project_id,mapping_revision));
+'''
+
+
+def import_bundle(path, project, bundle, expected, code_conn, generation):
+    if not project or len(project) > 200:
+        raise ValueError('project_id required (max 200 characters)')
+    if not isinstance(bundle, dict) or len(json.dumps(bundle)) > 2_000_000:
+        raise ValueError('invalid or oversized mapping bundle')
+    revision = bundle.get('mapping_revision')
+    if not isinstance(revision, str) or not revision or len(revision) > 200:
+        raise ValueError('mapping_revision required (max 200 characters)')
+    if bundle.get('code_generation') != generation:
+        raise ValueError('mapping code_generation mismatch')
+    status = bundle.get('status', 'candidate')
+    if status not in {'candidate', 'pending_review', 'approved', 'rejected', 'historical_unmapped'}:
+        raise ValueError('invalid mapping lifecycle status')
+    decision = bundle.get('decision', {})
+    if status in {'approved', 'rejected'} and not all(isinstance(v, str) and v.strip() for v in [
+            decision.get('reviewer'), decision.get('reason'), bundle.get('requirement_revision')]):
+        raise ValueError('review decision requires reviewer, reason and requirement_revision')
+    terms = bundle.get('terms', [])
+    features = bundle.get('features', [])
+    if not terms or not features or len(terms) + len(features) > 1000:
+        raise ValueError('bundle requires 1..1000 terms and features')
+    term_ids = {term['id'] for term in terms}
+    feature_ids = {feature['id'] for feature in features}
+    if len(term_ids) != len(terms) or len(feature_ids) != len(features):
+        raise ValueError('duplicate term or feature id')
+    for feature in features:
+        if not set(feature.get('term_ids', [])).issubset(term_ids):
+            raise ValueError('unknown term reference')
+        for binding in feature.get('bindings', []):
+            row = code_conn.execute('SELECT entity_version_id,content_hash FROM entity_versions WHERE snapshot_id=? AND logical_id=?', (generation, binding['entity_id'])).fetchone()
+            if row is None or binding.get('entity_version_id') != row[0] or binding.get('content_hash') != row[1]:
+                raise ValueError('binding entity version or content hash mismatch')
+    path.parent.mkdir(parents=True, exist_ok=True)
+    conn = sqlite3.connect(path)
+    try:
+        conn.executescript(SCHEMA)
+        if 'decision' not in {row[1] for row in conn.execute('PRAGMA table_info(domain_mapping_decisions)')}:
+            conn.execute("ALTER TABLE domain_mapping_decisions ADD COLUMN decision TEXT NOT NULL DEFAULT 'approved'")
+        immutable_tables = ['domain_mapping_revisions', 'domain_term_versions', 'domain_term_alias_versions', 'domain_feature_versions', 'domain_feature_terms', 'domain_feature_bindings', 'domain_mapping_decisions']
+        for table in immutable_tables:
+            for operation in ['UPDATE','DELETE']:
+                conn.execute(f"CREATE TRIGGER IF NOT EXISTS immutable_{table}_{operation} BEFORE {operation} ON {table} BEGIN SELECT RAISE(ABORT, 'mapping revisions are append-only'); END")
+        revision_children = ['domain_term_versions', 'domain_term_alias_versions', 'domain_feature_versions', 'domain_feature_terms', 'domain_feature_bindings', 'domain_mapping_decisions']
+        for table in revision_children:
+            conn.execute(f'''CREATE TRIGGER IF NOT EXISTS sealed_{table}_insert BEFORE INSERT ON {table}
+              WHEN EXISTS(SELECT 1 FROM domain_mapping_revisions r
+                WHERE r.project_id=NEW.project_id AND r.mapping_revision=NEW.mapping_revision)
+              BEGIN SELECT RAISE(ABORT, 'mapping revision is sealed'); END''')
+        for operation in ['INSERT','UPDATE']:
+            conn.execute(f'''CREATE TRIGGER IF NOT EXISTS approved_current_{operation} BEFORE {operation} ON domain_mapping_current
+              WHEN NOT EXISTS(SELECT 1 FROM domain_mapping_revisions r JOIN domain_mapping_decisions d
+              ON d.project_id=r.project_id AND d.mapping_revision=r.mapping_revision
+              WHERE r.project_id=NEW.project_id AND r.mapping_revision=NEW.current_revision
+              AND r.status='approved' AND d.decision='approved' AND length(d.reviewer)>0 AND length(d.reason)>0)
+              BEGIN SELECT RAISE(ABORT, 'current must reference an approved revision with decision'); END''')
+        conn.commit()
+        conn.execute('BEGIN IMMEDIATE')
+        current = conn.execute('SELECT current_revision FROM domain_mapping_current WHERE project_id=?', (project,)).fetchone()
+        if (current[0] if current else None) != expected:
+            raise ValueError('mapping current CAS conflict')
+        previous = bundle.get('previous_revision')
+        if previous:
+            prior = conn.execute('SELECT status,bundle_json FROM domain_mapping_revisions WHERE project_id=? AND mapping_revision=?', (project,previous)).fetchone()
+            if prior is None:
+                raise ValueError('previous mapping revision does not exist in project')
+            transitions = {'candidate': {'candidate','pending_review','rejected','historical_unmapped'}, 'pending_review': {'approved','rejected','candidate'}, 'approved': {'candidate','historical_unmapped'}, 'rejected': {'candidate'}, 'historical_unmapped': {'candidate'}}
+            if status not in transitions[prior[0]]:
+                raise ValueError('invalid mapping status transition')
+            if status == 'approved':
+                prior_bundle = json.loads(prior[1])
+                for field in ['terms','features','code_generation','requirement_revision']:
+                    if bundle.get(field) != prior_bundle.get(field):
+                        raise ValueError('approved mapping differs from pending review bundle')
+        elif status not in {'candidate','historical_unmapped'}:
+            raise ValueError('review states require a previous mapping revision')
+        for term in terms:
+            conn.execute('INSERT INTO domain_term_versions VALUES(?,?,?,?)', (project,revision,term['id'],term['name']))
+            for alias in set(term.get('aliases', [])):
+                conn.execute('INSERT INTO domain_term_alias_versions VALUES(?,?,?,?)', (project,revision,term['id'],alias))
+        for feature in features:
+            conn.execute('INSERT INTO domain_feature_versions VALUES(?,?,?,?)', (project,revision,feature['id'],feature['name']))
+            for term in feature.get('term_ids', []):
+                conn.execute('INSERT INTO domain_feature_terms VALUES(?,?,?,?)', (project,revision,feature['id'],term))
+            for binding in feature.get('bindings', []):
+                conn.execute('INSERT INTO domain_feature_bindings VALUES(?,?,?,?,?,?)', (project,revision,feature['id'],binding['entity_id'],binding['entity_version_id'],generation))
+        if status in {'approved','rejected'}:
+            conn.execute('INSERT INTO domain_mapping_decisions VALUES(?,?,?,?,?,?)', (project,revision,decision['reviewer'],decision['reason'],bundle['requirement_revision'],status))
+        # The revision row is the seal: child rows are staged first in this
+        # transaction and no child INSERT is allowed after the seal exists.
+        conn.execute('INSERT INTO domain_mapping_revisions VALUES(?,?,?,?,?,?,?,?)', (
+            project,revision,generation,bundle.get('requirement_revision'),status,previous,
+            json.dumps(bundle, ensure_ascii=False, sort_keys=True),datetime.now(timezone.utc).isoformat()))
+        if status == 'approved':
+            conn.execute('INSERT INTO domain_mapping_current VALUES(?,?) ON CONFLICT(project_id) DO UPDATE SET current_revision=excluded.current_revision', (project,revision))
+        conn.commit()
+    finally:
+        conn.close()
+    return {'mapping_revision': revision, 'status': status, 'project_id': project}
+
+
+def resolve(path, project, terms, generation, revision='approved-current', statuses=None, requirement=None):
+    if not path.is_file():
+        return {'status': 'capability_unavailable', 'mappings': [], 'mapping_revision': None}
+    statuses = statuses or ['approved']
+    if not set(statuses).issubset({'approved', 'candidate', 'pending_review', 'rejected', 'historical_unmapped'}):
+        raise ValueError('invalid mapping statusFilter')
+    conn = sqlite3.connect(path.as_uri() + '?mode=ro', uri=True)
+    conn.row_factory = sqlite3.Row
+    try:
+        conn.execute('BEGIN')
+        if revision == 'approved-current':
+            row = conn.execute('SELECT current_revision FROM domain_mapping_current WHERE project_id=?', (project,)).fetchone()
+            revision = row[0] if row else None
+        row = conn.execute('SELECT * FROM domain_mapping_revisions WHERE project_id=? AND mapping_revision=?', (project,revision)).fetchone()
+        result = {'status': 'no_domain_match', 'mapping_revision': revision, 'mappings': [], 'requirement_revision': row['requirement_revision'] if row else None}
+        if row is None or row['status'] not in statuses:
+            return result
+        if requirement and requirement != row['requirement_revision']:
+            raise ValueError('requirement revision mismatch')
+        if row['code_generation'] != generation:
+            result['status'] = 'mapping_snapshot_mismatch'
+            return result
+        bundle = json.loads(row['bundle_json'])
+        requested = {term.casefold() for term in terms}
+        matched = {term['id'] for term in bundle['terms'] if requested.intersection(value.casefold() for value in [term['name'], *term.get('aliases', [])])}
+        result['mappings'] = [{**feature, 'mapping_status': row['status'], 'mapping_revision': revision, 'code_generation': generation,
+                               'provenance': {'source_type': 'reviewer_attestation' if row['status'] == 'approved' else 'candidate_import', 'decision': bundle.get('decision')}}
+                              for feature in bundle['features'] if matched.intersection(feature.get('term_ids', []))]
+        result['status'] = 'ambiguous' if len(result['mappings']) > 1 else 'ok' if result['mappings'] else 'no_domain_match'
+        return result
+    finally:
+        conn.close()

package/plugins/devflow-intel/skills/workflow-code-index/scripts/hybrid_query.py

@@ -0,0 +1,367 @@
+"""Bounded structured query executor; callers never supply SQL."""
+import json
+import re
+import sqlite3
+import time
+from pathlib import PurePosixPath
+from adapters.capabilities import confidence_for_parser
+from source_content import verify_span
+from domain_registry import resolve
+
+PHASES = ['resolve_domain', 'search_symbols', 'search_content', 'rank_seeds', 'traverse_relations', 'impact_change', 'verify_evidence', 'compose_result']
+FIELDS = {'codeGeneration','mappingRevision','requirementRevision','featureTerms','identifiers','repositoryFilter','pathPrefix','phases','operations','seedEntityIds','changeType','coveragePolicy','direction','depth','limit','statusFilter','includeHeuristic','language','matchKind'}
+CHANGES = {'remove_field','rename_field','change_type','optional_to_required','required_to_optional','change_nullability','change_enum'}
+
+
+def validate_plan(plan):
+    if not isinstance(plan, dict) or set(plan) - FIELDS:
+        raise ValueError('QueryPlan contains unknown fields')
+    plan = dict(plan)
+    phases = plan.get('phases', plan.get('operations', ['resolve_domain', 'search_symbols', 'search_content', 'rank_seeds', 'verify_evidence', 'compose_result']))
+    if not isinstance(phases, list) or any(p not in PHASES for p in phases) or len(phases) != len(set(phases)):
+        raise ValueError('invalid query phases')
+    plan['phases'] = [p for p in PHASES if p in phases]
+    for key in ['featureTerms', 'identifiers', 'seedEntityIds', 'repositoryFilter', 'statusFilter']:
+        value = plan.get(key, ['approved'] if key == 'statusFilter' else [])
+        maximum = 16 if key != 'seedEntityIds' else 20
+        if not isinstance(value, list) or len(value) > maximum or any(not isinstance(v, str) or not v or len(v) > (1000 if key == 'seedEntityIds' else 256) or '\x00' in v for v in value):
+            raise ValueError('invalid or oversized ' + key)
+        plan[key] = value
+    for key, default, maximum in [('limit', 20, 100), ('depth', 2, 5)]:
+        value = plan.get(key, default)
+        if type(value) is not int or not 0 <= value <= maximum or key == 'limit' and value == 0:
+            raise ValueError('invalid ' + key)
+        plan[key] = value
+    prefix = plan.get('pathPrefix', '')
+    if not isinstance(prefix, str) or len(prefix) > 1000 or '\\' in prefix or '\x00' in prefix or PurePosixPath(prefix).is_absolute() or '..' in PurePosixPath(prefix).parts:
+        raise ValueError('pathPrefix must be a repository-relative path without traversal')
+    plan['pathPrefix'] = prefix.strip('/')
+    if plan.get('direction', 'outgoing') not in {'incoming','outgoing','both'}:
+        raise ValueError('invalid direction')
+    if plan.get('changeType') is not None and plan['changeType'] not in CHANGES:
+        raise ValueError('invalid changeType')
+    if 'impact_change' in phases and plan.get('changeType') not in CHANGES:
+        raise ValueError('impact_change requires changeType')
+    if plan.get('coveragePolicy', 'local_only') != 'local_only':
+        raise ValueError('only local_only coverage is supported')
+    if plan.get('matchKind', 'literal') not in {'literal','substring','identifier','exact_phrase'}:
+        raise ValueError('invalid matchKind')
+    if plan.get('language') is not None and (not isinstance(plan['language'], str) or len(plan['language']) > 80):
+        raise ValueError('invalid language')
+    if not set(plan['statusFilter']).issubset({'approved','candidate','pending_review','rejected','historical_unmapped'}):
+        raise ValueError('invalid statusFilter')
+    search = bool({'search_symbols','search_content'}.intersection(phases))
+    domain = 'resolve_domain' in phases
+    has_seed = bool(plan['seedEntityIds'])
+    if not phases:
+        raise ValueError('QueryPlan requires at least one phase')
+    if 'rank_seeds' in phases and not (search or domain or has_seed):
+        raise ValueError('rank_seeds requires search, domain resolution or explicit seeds')
+    if {'traverse_relations','impact_change'}.intersection(phases) and not (has_seed or domain or (search and 'rank_seeds' in phases)):
+        raise ValueError('traversal requires explicit seeds, resolve_domain, or search + rank_seeds')
+    if 'verify_evidence' in phases and not (search or domain or {'traverse_relations','impact_change'}.intersection(phases)):
+        raise ValueError('verify_evidence requires a result-producing phase')
+    if phases == ['compose_result']:
+        raise ValueError('compose_result requires a result-producing phase')
+    return plan
+
+
+def read_connection(path):
+    conn = sqlite3.connect(path.as_uri() + '?mode=ro&immutable=1', uri=True)
+    conn.row_factory = sqlite3.Row
+    conn.execute('PRAGMA query_only=ON')
+    deadline = time.monotonic() + 3
+    conn.set_progress_handler(lambda: int(time.monotonic() > deadline), 1000)
+    conn.execute('BEGIN')
+    return conn
+
+
+def _scope(plan, snapshot):
+    scope = snapshot.get('workspace', {}).get('scanScope', {})
+    repos = scope.get('codebases', [])
+    known = {r['name']: r for r in repos}
+    if plan['repositoryFilter'] and (not known or not set(plan['repositoryFilter']).issubset(known)):
+        raise ValueError('repositoryFilter is outside snapshot scan scope')
+    prefixes = []
+    selected = plan['repositoryFilter'] or ([r['name'] for r in repos] if plan['pathPrefix'] else [])
+    for name in selected:
+        base = known[name].get('workspacePath', '')
+        prefix = '/'.join(p for p in [base.strip('/'), plan['pathPrefix']] if p and p != '.')
+        prefixes.append((name, prefix))
+    if not prefixes:
+        prefixes = [(None, plan['pathPrefix'])]
+    return prefixes
+
+
+def _where(plan, prefixes, alias='s'):
+    parts, args = [], []
+    for repository, prefix in prefixes:
+        p, values = [], []
+        if repository:
+            p.append(f'{alias}.codebase=?'); values.append(repository)
+        if prefix:
+            p.append(f'({alias}.path=? OR substr({alias}.path,1,?)=?)')
+            values.extend([prefix, len(prefix) + 1, prefix + '/'])
+        parts.append('(' + (' AND '.join(p) or '1') + ')'); args.extend(values)
+    where = '(' + ' OR '.join(parts) + ')'
+    if plan.get('language'):
+        where += f' AND {alias}.language=?'; args.append(plan['language'])
+    return where, args
+
+
+def _decorate(item, generation, kind):
+    item['snapshot'] = generation
+    item['entity_id'] = (item.get('id') or item.get('entity_id')) if kind == 'symbol' else item.get('entity_id')
+    item['entity_version_id'] = generation + ':' + item['entity_id'] if item.get('entity_id') else None
+    item['parser'] = item.get('parser') or 'unknown'
+    item['confidence'] = item.get('confidence') or ('exact' if kind == 'content' else confidence_for_parser(item['parser'], 'symbol'))
+    item['result_type'] = kind
+    item['provenance'] = {'relation_parser': item.get('relation_parser'), 'source_file_parser': item.get('source_file_parser', item['parser']), 'source': 'snapshot_source' if kind == 'content' else 'code_index', 'snapshot': generation, 'parser': item['parser'], 'content_hash': item.get('content_hash')}
+    return item
+
+
+def execute(conn, snapshot, plan, registry_path, project):
+    plan = validate_plan(plan)
+    generation = snapshot['generation']
+    phases = plan['phases']; limit = plan['limit']; prefixes = _scope(plan, snapshot)
+    tables = {r[0] for r in conn.execute("SELECT name FROM sqlite_master WHERE type='table'")}
+    terms = list(dict.fromkeys([*plan['featureTerms'], *plan['identifiers']]))
+    conn.create_function('identifier_match', 2, lambda content, term: int(bool(re.search(r'(?<!\w)' + re.escape(term) + r'(?!\w)', content))), deterministic=True)
+    results, phase_status, seeds = {}, {}, set(plan['seedEntityIds'])
+    truncated = False
+    mappings = {'mapping_revision': None, 'requirement_revision': None, 'mappings': []}
+    if 'resolve_domain' in phases:
+        if not project:
+            raise ValueError('resolve_domain requires project_id')
+        mappings = resolve(registry_path, project, terms, generation, plan.get('mappingRevision', 'approved-current'), plan['statusFilter'], plan.get('requirementRevision'))
+        phase_status['resolve_domain'] = mappings['status']
+        if mappings['status'] == 'ok':
+            for feature in mappings['mappings']:
+                # Candidate mapping is visible but never silently becomes a traversal seed.
+                if feature['mapping_status'] == 'approved':
+                    seeds.update(binding['entity_id'] for binding in feature.get('bindings', []))
+    where, scope_args = _where(plan, prefixes)
+    for seed in sorted(seeds)[:20]:
+        row = conn.execute(f'SELECT s.* FROM symbols s WHERE {where} AND s.id=?', (*scope_args,seed)).fetchone()
+        if row and any(seed == binding['entity_id'] for feature in mappings['mappings'] for binding in feature.get('bindings', [])):
+            item = _decorate(dict(row), generation, 'symbol')
+            item.update(match_kind='approved_domain_binding', score=100, matched_terms=terms, score_contributions=[{'kind':'approved_domain_binding','score':100,'reason':'approved domain feature bound to this entity version'}])
+            results[('symbol',item['id'])] = item
+    if 'search_symbols' in phases:
+        count = 0
+        for term in terms:
+            rows = conn.execute(f'''SELECT s.* FROM symbols s WHERE {where}
+              AND (instr(lower(s.name),lower(?))>0 OR instr(lower(s.qualified_name),lower(?))>0 OR instr(lower(s.path),lower(?))>0)
+              ORDER BY CASE WHEN lower(s.name)=lower(?) THEN 0
+                            WHEN instr(lower(s.name),lower(?))>0 OR instr(lower(s.qualified_name),lower(?))>0 THEN 1
+                            ELSE 2 END, s.path,s.line_start,s.id LIMIT ?''',
+              (*scope_args,term,term,term,term,term,term,limit + 1)).fetchall()
+            truncated |= len(rows) > limit
+            for row in rows[:limit]:
+                item = _decorate(dict(row), generation, 'symbol')
+                if item['name'].casefold() == term.casefold() and term in plan['identifiers']:
+                    kind, score = 'identifier_exact', 90
+                elif item['name'].casefold() == term.casefold():
+                    kind, score = 'symbol_exact', 80
+                elif term.casefold() in item['name'].casefold() or term.casefold() in (item.get('qualified_name') or '').casefold():
+                    kind, score = 'symbol_substring', 60
+                else:
+                    kind, score = 'path_match', 50
+                item['match_kind'] = kind
+                item['score'] = score
+                item['score_contributions'] = [{'kind':kind,'term':term,'score':score,'reason':'literal match against indexed symbol or path'}]
+                item['matched_terms'] = [term]
+                key = ('symbol', item['id'])
+                if key in results:
+                    results[key]['matched_terms'].append(term)
+                    results[key]['score'] = max(results[key]['score'], item['score'])
+                    results[key]['score_contributions'].extend(item['score_contributions'])
+                else:
+                    results[key] = item
+                count += 1
+        phase_status['search_symbols'] = 'ok' if count else 'no_symbol_match'
+    if 'search_content' in phases:
+        if 'source_content_chunks' not in tables:
+            phase_status['search_content'] = 'capability_unavailable'
+        else:
+            count = 0
+            for term in terms:
+                fts = 'source_content_fts' in tables and len(term) >= 3
+                match = ' AND c.rowid IN (SELECT rowid FROM source_content_fts WHERE source_content_fts MATCH ?)' if fts else ''
+                identifier = ' AND identifier_match(c.content,?)=1' if plan.get('matchKind') == 'identifier' else ''
+                params = [*scope_args, term]
+                if identifier:
+                    params.append(term)
+                if fts:
+                    params.append('"' + term.replace('"', '""') + '"')
+                rows = conn.execute(f'SELECT c.*,s.codebase,s.parser FROM source_content_chunks c JOIN code_files s ON s.id=c.code_file_id WHERE {where} AND instr(c.content,?)>0{identifier}{match} ORDER BY c.path,c.chunk_no LIMIT ?', (*params,limit + 1)).fetchall()
+                truncated |= len(rows) > limit
+                for row in rows[:limit]:
+                    item = dict(row)
+                    position = re.search(r'(?<!\w)' + re.escape(term) + r'(?!\w)', item['content']).start() if identifier else item['content'].find(term)
+                    before = item['content'][:position]
+                    item['line_start'] += before.count('\n')
+                    item['line_end'] = item['line_start'] + term.count('\n')
+                    item['matchedText'] = term
+                    item.pop('content', None)
+                    owner = conn.execute('''SELECT id FROM symbols
+                      WHERE codebase=? AND path=? AND line_start<=? AND line_end>=? AND kind<>?
+                      ORDER BY line_end-line_start,id LIMIT 1''',
+                      (item['codebase'],item['path'],item['line_start'],item['line_start'],'file')).fetchone()
+                    if owner:
+                        item['entity_id'] = owner[0]
+                    else:
+                        # File-level content (constants/configuration outside a
+                        # symbol) still needs a stable snapshot-bound identity.
+                        item['entity_id'] = item['code_file_id']
+                    item = _decorate(item, generation, 'content')
+                    item['match_kind'] = plan.get('matchKind', 'literal')
+                    item['score'] = 40
+                    item['score_contributions'] = [{'kind':'content_' + item['match_kind'],'term':term,'score':40,'reason':'literal occurrence in immutable source chunk'}]
+                    results[('content', item['chunk_id'], term)] = item
+                    count += 1
+            phase_status['search_content'] = 'ok' if count else 'no_content_match'
+    ranked = sorted(results.values(), key=lambda x: (-x['score'], x['path'], x['line_start']))
+    if 'rank_seeds' in phases:
+        seeds.update(item['id'] for item in ranked if item['result_type'] == 'symbol' and item.get('kind') != 'file')
+        for item in ranked:
+            if item['result_type'] == 'content':
+                rows = conn.execute('SELECT id FROM symbols WHERE codebase=? AND path=? AND line_start<=? AND line_end>=? AND kind<>? ORDER BY line_end-line_start,id LIMIT 2', (item['codebase'],item['path'],item['line_start'],item['line_start'],'file')).fetchall()
+                seeds.update(row[0] for row in rows)
+    # Validate and scope every explicit, domain, and traversal seed against the pinned index.
+    valid_seeds = []
+    for seed in sorted(seeds):
+        if 'impact_change' in phases and 'entity_versions' in tables:
+            row = conn.execute(f'SELECT e.logical_id FROM entity_versions e JOIN code_files s ON s.path=e.path AND s.codebase=e.codebase WHERE {where} AND e.logical_id=? AND e.snapshot_id=?', (*scope_args, seed, generation)).fetchone()
+        else:
+            row = conn.execute(f'SELECT s.id FROM symbols s WHERE {where} AND s.id=?', (*scope_args, seed)).fetchone()
+        if row:
+            valid_seeds.append(seed)
+    truncated |= len(valid_seeds) > 20
+    valid_seeds = valid_seeds[:20]
+    edges = []
+    for phase in ['traverse_relations','impact_change']:
+        if phase not in phases:
+            continue
+        table = 'relations' if phase == 'traverse_relations' else 'semantic_flows'
+        if table not in tables:
+            phase_status[phase] = 'capability_unavailable'; continue
+        if mappings.get('status') == 'ambiguous' and not plan['seedEntityIds']:
+            phase_status[phase] = 'ambiguous'; continue
+        frontier = list(valid_seeds); visited = set(frontier); seen_edges = set()
+        before_count = len(edges)
+        for depth in range(1, plan['depth'] + 1):
+            next_frontier = []
+            for seed in frontier:
+                source, target = ('from_id','to_id') if table == 'relations' else ('source_id','target_id')
+                direction = plan.get('direction','outgoing')
+                condition = f'{source}=?' if direction == 'outgoing' else f'{target}=?' if direction == 'incoming' else f'({source}=? OR {target}=?)'
+                args = [seed,seed] if direction == 'both' else [seed]
+                if not plan.get('includeHeuristic', False):
+                    condition += " AND confidence <> 'heuristic'"
+                rows = conn.execute(f'SELECT rowid AS _edge_rowid,* FROM {table} WHERE {condition} ORDER BY rowid LIMIT 102', args).fetchall()
+                truncated |= len(rows) > 100
+                for row in rows[:100]:
+                    item = dict(row)
+                    key = (table, item.pop('_edge_rowid'))
+                    if key in seen_edges:
+                        continue
+                    seen_edges.add(key)
+                    path = item.get('evidence_path') or item.get('source_path')
+                    if table == 'relations':
+                        owner = conn.execute('SELECT codebase FROM symbols WHERE id=?', (item[source],)).fetchone()
+                    else:
+                        owner = conn.execute('SELECT codebase FROM entity_versions WHERE snapshot_id=? AND logical_id=?', (generation,item[source])).fetchone()
+                    if not owner:
+                        continue
+                    file = conn.execute(f'SELECT s.parser,s.content_hash FROM code_files s WHERE {where} AND s.codebase=? AND s.path=?', (*scope_args,owner[0],path)).fetchone()
+                    if not file:
+                        continue
+                    item['relation_parser'] = item.get('parser') or item.get('extractor') or 'unknown'
+                    item['source_file_parser'] = file['parser']
+                    item['content_hash'] = file['content_hash']
+                    item['parser'] = item['relation_parser']
+                    item.update(path=path, depth=depth, line_start=item.get('evidence_line') or item.get('line_start'), result_type=phase)
+                    item = _decorate(item, generation, phase)
+                    if phase == 'impact_change':
+                        item['impact_kind'] = plan['changeType']
+                    edges.append(item)
+                    node = item[target] if item[source] == seed else item[source]
+                    if node and node not in visited:
+                        if table == 'relations':
+                            scoped_node = conn.execute(f'SELECT s.id FROM symbols s WHERE {where} AND s.id=?', (*scope_args,node)).fetchone()
+                        else:
+                            scoped_node = conn.execute(f'SELECT e.logical_id FROM entity_versions e JOIN code_files s ON s.path=e.path AND s.codebase=e.codebase WHERE {where} AND e.logical_id=? AND e.snapshot_id=?', (*scope_args,node,generation)).fetchone()
+                        if scoped_node:
+                            visited.add(node); next_frontier.append(node)
+                    if len(edges) >= limit:
+                        truncated = True; break
+                if len(edges) >= limit:
+                    break
+            frontier = next_frontier
+            if not frontier or len(edges) >= limit:
+                break
+        phase_status[phase] = 'ok' if len(edges) > before_count else 'no_index_evidence'
+    if 'verify_evidence' in phases:
+        for item in [*ranked, *edges]:
+            if 'source_artifacts' in tables:
+                verify_span(conn, item)
+            else:
+                item['evidence_status'] = 'evidence_unavailable'
+    raw_combined = [*ranked, *edges]
+    combined, by_entity = [], {}
+    for item in raw_combined:
+        version = item.get('entity_version_id')
+        if not version:
+            combined.append(item)
+            continue
+        evidence = {key: item.get(key) for key in ('result_type','match_kind','path','line_start','line_end','matchedText','content_hash','score','evidence_status') if item.get(key) is not None}
+        if version not in by_entity:
+            item['evidence_sources'] = [evidence]
+            by_entity[version] = item
+            combined.append(item)
+            continue
+        primary = by_entity[version]
+        primary['evidence_sources'].append(evidence)
+        primary['score_contributions'] = [*primary.get('score_contributions', []), *item.get('score_contributions', [])]
+        primary['matched_terms'] = list(dict.fromkeys([*primary.get('matched_terms', []), *item.get('matched_terms', [])]))
+        if item.get('score', 0) > primary.get('score', 0):
+            position = combined.index(primary)
+            item['evidence_sources'] = primary['evidence_sources']
+            item['score_contributions'] = primary['score_contributions']
+            item['matched_terms'] = primary['matched_terms']
+            combined[position] = item
+            by_entity[version] = item
+    combined.sort(key=lambda x: (-x.get('score', 0), x.get('path') or '', x.get('line_start') or 0))
+    truncated |= len(combined) > limit
+    status = 'ok' if combined else 'no_index_evidence'
+    if ranked and all(r['result_type'] == 'content' for r in ranked) and not edges:
+        status = 'content_match_only'
+    if not combined and len(phase_status) == 1:
+        status = next(iter(phase_status.values()))
+    if any(value == 'capability_unavailable' for value in phase_status.values()):
+        status = 'partial' if combined else 'capability_unavailable'
+    if truncated:
+        status = 'partial'
+    if mappings.get('status') == 'ambiguous':
+        status = 'ambiguous'
+    if any(item.get('evidence_status') == 'evidence_unavailable' or any(source.get('evidence_status') == 'evidence_unavailable' for source in item.get('evidence_sources', [])) for item in combined[:limit]):
+        status = 'evidence_unavailable'
+    coverage = {'policy': 'local_only','status': 'not_assessed'}
+    if 'impact_change' in phases and 'coverage_metrics' in tables:
+        coverage_row = conn.execute('SELECT * FROM coverage_metrics WHERE snapshot_id=?', (generation,)).fetchone()
+        if coverage_row:
+            coverage = dict(coverage_row)
+            coverage['policy'] = 'local_only'
+            coverage['status'] = 'partial' if coverage.get('files_parsed', 0) < coverage.get('files_scanned', 0) or coverage.get('dynamic_limitations', 0) else 'complete'
+            if coverage['status'] == 'partial' and status == 'ok':
+                status = 'partial'
+    # Revision consistency outranks result/evidence availability: callers must
+    # never mistake code hits for facts from an incompatible mapping snapshot.
+    if mappings.get('status') == 'mapping_snapshot_mismatch':
+        status = 'mapping_snapshot_mismatch'
+    return {'results': combined[:limit], 'mappings': mappings['mappings'], '_meta': {
+        'status': status,'snapshot': generation,'mapping_revision': mappings.get('mapping_revision'),
+        'requirement_revision': mappings.get('requirement_revision'), 'scope_hash': snapshot.get('workspace', {}).get('scopeHash'),
+        'phases': phase_status,'seedEntityIds': valid_seeds,'truncated': truncated,'planSchemaVersion': 1,
+        'coverage': coverage, 'resolvedPlan': {**plan,'codeGeneration': generation,'mappingRevision': mappings.get('mapping_revision')}}}

package/plugins/devflow-intel/skills/workflow-code-index/scripts/source_content.py

@@ -0,0 +1,88 @@
+"""Snapshot-owned source evidence. No query reads the live working tree."""
+import hashlib
+import json
+import sqlite3
+from pathlib import Path
+
+
+def digest(data):
+    return 'sha256:' + hashlib.sha256(data).hexdigest()
+
+
+def build_content(conn, root, files, generation, scope):
+    conn.executescript('''
+    CREATE TABLE snapshot_metadata(key TEXT PRIMARY KEY, value TEXT NOT NULL);
+    CREATE TABLE source_artifacts(content_hash TEXT PRIMARY KEY, content BLOB NOT NULL);
+    CREATE TABLE source_content_chunks(
+      chunk_id TEXT PRIMARY KEY, code_generation TEXT NOT NULL, code_file_id TEXT NOT NULL,
+      path TEXT NOT NULL, language TEXT NOT NULL, chunk_no INTEGER NOT NULL,
+      line_start INTEGER NOT NULL, line_end INTEGER NOT NULL, byte_start INTEGER NOT NULL,
+      byte_end INTEGER NOT NULL, content_hash TEXT NOT NULL, content TEXT NOT NULL);
+    CREATE INDEX source_chunks_file ON source_content_chunks(code_file_id, line_start);
+    ''')
+    mode = 'trigram'
+    try:
+        conn.execute("CREATE VIRTUAL TABLE source_content_fts USING fts5(content, content='source_content_chunks', content_rowid='rowid', tokenize='trigram')")
+    except sqlite3.OperationalError:
+        mode = 'bounded_literal_scan'
+    for record in files:
+        data = (Path(root) / record['path']).read_bytes()
+        if digest(data) != record['content_hash']:
+            raise ValueError('source changed during snapshot build: ' + record['path'])
+        conn.execute('INSERT OR IGNORE INTO source_artifacts VALUES(?,?)', (record['content_hash'], data))
+        lines = data.splitlines(keepends=True)
+        offset = 0
+        for number, start in enumerate(range(0, len(lines), 80)):
+            chunk = b''.join(lines[start:start + 80])
+            conn.execute('INSERT INTO source_content_chunks VALUES(?,?,?,?,?,?,?,?,?,?,?,?)', (
+                generation + ':' + record['id'] + ':' + str(number), generation, record['id'],
+                record['path'], record['language'], number, start + 1, min(start + 80, len(lines)),
+                offset, offset + len(chunk), record['content_hash'], chunk.decode('utf-8', errors='replace')))
+            offset += len(chunk)
+    if mode == 'trigram':
+        conn.execute("INSERT INTO source_content_fts(source_content_fts) VALUES('rebuild')")
+        conn.execute("INSERT INTO source_content_fts(source_content_fts, rank) VALUES('integrity-check', 1)")
+    capability = {'version': 1, 'tokenizer': mode, 'shortTerms': 'bounded_literal_scan', 'historicalEvidence': True}
+    conn.executemany('INSERT INTO snapshot_metadata VALUES(?,?)', [
+        ('scanScope', json.dumps(scope, sort_keys=True)), ('contentSearch', json.dumps(capability))])
+    conn.commit()  # Flush FTS pending segments before fingerprinting its immutable shadow tables.
+    conn.execute('INSERT INTO snapshot_metadata VALUES(?,?)', ('contentIntegrity', json.dumps(content_integrity(conn), sort_keys=True)))
+    return capability
+
+
+def verify_span(conn, item):
+    row = conn.execute('SELECT content FROM source_artifacts WHERE content_hash=?', (item.get('content_hash'),)).fetchone()
+    if row is None or digest(row[0]) != item.get('content_hash'):
+        item['evidence_status'] = 'evidence_unavailable'
+        return item
+    lines = row[0].decode('utf-8', errors='replace').splitlines()
+    start = max(1, item.get('line_start') or item.get('evidence_line') or 1)
+    end = min(item.get('line_end') or start, start + 19)
+    item['evidence'] = '\n'.join(lines[start - 1:end])[:4000]
+    item['evidence_status'] = 'verified'
+    return item
+
+
+def content_integrity(conn):
+    """Fingerprint the build-time integrity-checked source/FTS projection without writes."""
+    tables = {row[0] for row in conn.execute("SELECT name FROM sqlite_master WHERE type='table'")}
+    checks = {}
+    for table in ['source_content_chunks', 'source_content_fts_data', 'source_content_fts_idx', 'source_content_fts_docsize', 'source_content_fts_config']:
+        if table not in tables:
+            continue
+        checksum = hashlib.sha256()
+        count = 0
+        for row in conn.execute(f'SELECT * FROM {table} ORDER BY 1,2'):
+            for value in row:
+                data = value if isinstance(value, bytes) else str(value).encode('utf-8')
+                checksum.update(len(data).to_bytes(8, 'big')); checksum.update(data)
+            count += 1
+        checks[table] = {'count': count, 'sha256': checksum.hexdigest()}
+    rowids = hashlib.sha256()
+    for row in conn.execute('SELECT rowid FROM source_content_chunks ORDER BY rowid'):
+        rowids.update(str(row[0]).encode() + b'\0')
+    checks['chunk_rowids'] = rowids.hexdigest()
+    if 'source_content_fts_docsize' in tables:
+        invalid = conn.execute('SELECT count(*) FROM source_content_chunks c LEFT JOIN source_content_fts_docsize f ON f.id=c.rowid WHERE f.id IS NULL').fetchone()[0]
+        checks['missing_fts_rowids'] = invalid
+    return checks

package/plugins/devflow-intel/skills/workflow-code-index/scripts/writers/sqlite_writer.py

@@ -4,6 +4,7 @@ from pathlib import Path
 
 from adapters.capabilities import confidence_for_parser
 from core.schema import json_dumps
+from source_content import build_content
 
 
 SCHEMA = """
@@ -195,7 +196,7 @@ CREATE INDEX IF NOT EXISTS idx_relations_external ON relations(to_external);
 
 
 def write_sqlite(path: Path, files, symbols, relations, diagnostics, snapshot_id="pending",
-                 workspace_state=None, semantic_entities=None, semantic_flows=None, feature_bindings=None) -> None:
+                 workspace_state=None, semantic_entities=None, semantic_flows=None, feature_bindings=None, source_root=None) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
     if path.exists():
         path.unlink()
@@ -210,7 +211,7 @@ def write_sqlite(path: Path, files, symbols, relations, diagnostics, snapshot_id
         parsed_count = sum(1 for item in files if item.get("path") not in parse_failed_paths)
         conn.execute(
             "INSERT INTO analysis_snapshots(snapshot_id, schema_version, source_revision, content_manifest_hash, extractor_set_hash, created_at, status) VALUES(?,?,?,?,?,?,?)",
-            (snapshot_id, 3, workspace_state.get("repositoryRevision", ""), workspace_state.get("contentManifestHash", ""),
+            (snapshot_id, 4 if source_root is not None else 3, workspace_state.get("repositoryRevision", ""), workspace_state.get("contentManifestHash", ""),
              workspace_state.get("extractorSetHash", ""), workspace_state.get("generatedAt", ""), "current"),
         )
         # Structural symbols and files are first-class graph nodes as well.
@@ -304,6 +305,8 @@ def write_sqlite(path: Path, files, symbols, relations, diagnostics, snapshot_id
             """,
             [_symbol_row(record) for record in symbols],
         )
+        if source_root is not None:
+            workspace_state["contentSearch"] = build_content(conn, source_root, files, snapshot_id, workspace_state.get("scanScope", {}))
         conn.commit()
     finally:
         conn.close()

package/src/constants.ts

@@ -1,5 +1,5 @@
 export const PRODUCT_NAME = "Devflow Pi";
-export const PRODUCT_VERSION = "0.1.80";
+export const PRODUCT_VERSION = "0.1.82";
 export const PROJECT_SCHEMA_VERSION = 1;
 export const OMP_RUNTIME_VERSION = "17.2.7";
 

package/src/initialization-store.ts

@@ -32,6 +32,7 @@ export interface ScanConfigInput {
   repositories: ScanRepository[];
   includes?: string[];
   excludes?: string[];
+  maxFileSize?: number;
   requiredKinds?: FactKind[];
   adapterVersions?: Record<string, string>;
 }

package/src/project-initializer.ts

@@ -219,7 +219,12 @@ async function buildCodeIndex(context: ProjectContext, config: ScanConfigInput):
   const script = path.resolve(import.meta.dir, "../plugins/devflow-intel/skills/workflow-code-index/scripts/code_index.py");
   const output = `.planning/.code-index-pending-${randomUUID()}`;
   const codebases = config.repositories.flatMap(repository => ["--codebase", `${repository.name}:${path.resolve(context.root, repository.relativePath)}:${repository.role}`]);
-  await runProcess(["python3", script, "scan", "--root", context.root, "--output", output, ...codebases], context.root, "code-index scan");
+  const scopeArgs = [
+    ...(config.includes ?? ["**/*"]).flatMap(pattern => ["--include", pattern]),
+    ...(config.excludes ?? [".git/**", ".planning/**", ".devflow/**"]).flatMap(pattern => ["--exclude", pattern]),
+    "--max-file-size", String(config.maxFileSize ?? 2 * 1024 * 1024),
+  ];
+  await runProcess(["python3", script, "scan", "--root", context.root, "--output", output, ...scopeArgs, ...codebases], context.root, "code-index scan");
   await runProcess(["python3", script, "validate", "--index", output, "--level", "publish"], context.root, "code-index validate");
   await runProcess(["python3", script, "audit", "--root", context.root, "--index", output, "--skill-root", path.resolve(import.meta.dir, "../plugins/devflow-intel/skills"), "--level", "publish"], context.root, "code-index audit");
   const snapshotPath = path.join(context.root, output, "SNAPSHOT.json");