@quolu/lattice 0.1.0

package/LICENSE

@@ -0,0 +1,25 @@
+MIT License
+
+Copyright (c) 2026 quolu (kitepon-rgb)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+The bundled sensor (sensor/) is a fork of @colbymchenry/codegraph (MIT);
+its original license and attribution are preserved in sensor/LICENSE and
+sensor/NOTICE.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,20 @@
+# Lattice
+
+Latticeは、codebaseの境界を観測・変換し、multi-agent開発の並列TODO graphを生成する
+schedulability compilerです。
+
+現在はbootstrap段階です。実装状況は[docs/plan_lattice_rc4_dotagents_dogfood.md](docs/plan_lattice_rc4_dotagents_dogfood.md)、製品思想は
+[PLAN.md](PLAN.md)、公開予定contractは[docs/00_product-contract.md](docs/00_product-contract.md)を参照してください。
+
+## 開発
+
+```bash
+npm test
+npm run check
+npm run ci
+codegraph status .
+spotter doctor
+codex-sidecar diagnostics --project . --preset auditor --json
+```
+
+Node.js 22.13以上を使用します。CodegraphとSpotterはproject単位で初期化し、生成stateの所有境界を守ります。

package/bin/lattice-mcp.mjs

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+/**
+ * Lattice MCP server entrypoint (ADR 0049 Decision 8).
+ *
+ * Thin bin that delegates to the sensor's MCP server — the same server
+ * `codegraph serve --mcp` starts (see sensor/src/bin/codegraph.ts `serve`
+ * command and sensor/src/mcp/index.ts `MCPServer`). Deliberately a SEPARATE
+ * bin from `bin/lattice.mjs`: the CLI 6 面 axioms (stdout versioned JSON 1
+ * 行, exit 0/1/2, `lattice.cli_error.v1`) apply ONLY to lattice.mjs, never
+ * to this MCP surface (ADR 0049 Decision 1/8).
+ *
+ * Contract (ADR 0049 Decision 8):
+ *   ① stdout is MCP protocol frames ONLY — every diagnostic goes to stderr.
+ *      (The sensor's own MCPServer already honors this; nothing here writes
+ *      to stdout.)
+ *   ② Accepts the INTERNAL daemon re-invoke form (`serve --mcp --path
+ *      <root>` + CODEGRAPH_DAEMON_INTERNAL=1 env). The shared daemon
+ *      re-execs `process.argv[1]` with exactly this argv shape
+ *      (sensor/src/mcp/index.ts `spawnDetachedDaemon`) — when this process
+ *      IS `process.argv[1]` (an MCP host launched it directly as
+ *      `lattice-mcp`), rejecting that re-invoke would leave the daemon
+ *      unable to ever start, silently pinning every session to direct mode
+ *      (the exact silent-degradation trap the ADR calls out).
+ *   ③ Exit semantics: usage violation before startup = exit 2; startup
+ *      scrutiny failure = exit 1 + one `lattice.cli_error.v1` line on
+ *      stderr; normal session end = exit 0 (delegated entirely to
+ *      MCPServer, which calls process.exit on every one of its lifecycle
+ *      paths — direct/proxy/daemon alike); session-established failures are
+ *      MCP protocol errors and never reach this file (MCPServer keeps the
+ *      process alive for those).
+ *   ④ Node version guard (wave2レビューでのスコープ外発見の修理): this bin
+ *      imports `../sensor/dist/index.js` directly, bypassing the sensor
+ *      CLI's own Node-version guard (sensor/src/bin/codegraph.ts, guarding
+ *      against a Node 25.x V8 turboshaft WASM JIT Zone allocator OOM during
+ *      tree-sitter grammar compilation, and a MIN_NODE_MAJOR floor). This
+ *      file re-applies the SAME check — reusing thresholds/banners from
+ *      `sensor/dist/bin/node-version-check.js` via `../src/node-version-
+ *      guard.mjs`, never duplicating them — as the very first thing this
+ *      script does, before argv parsing or the sensor import. That ordering
+ *      also covers the internal daemon re-invoke path (②): the daemon
+ *      re-execs this same file, so it re-enters at the top and hits the
+ *      guard again unconditionally.
+ */
+
+import { evaluateNodeVersionGuard } from '../src/node-version-guard.mjs';
+
+const CLI_ERROR_SCHEMA = 'lattice.cli_error.v1';
+
+/** Usage violation BEFORE startup — exit 2, plain-text stderr (mirrors bin/lattice.mjs's own usageFailure shape). */
+function usageFailure(message) {
+  process.stderr.write(`lattice-mcp: ${message}\n`);
+  process.exitCode = 2;
+}
+
+/** Startup-time scrutiny failure — exit 1, one lattice.cli_error.v1 JSON line on stderr. */
+function startupFailure(code, message) {
+  const payload = { schema: CLI_ERROR_SCHEMA, code, message };
+  process.stderr.write(`${JSON.stringify(payload)}\n`);
+  process.exitCode = 1;
+}
+
+/**
+ * Parse argv into an optional project path. Accepts, in any order/presence:
+ *   - `serve` — accepted, ignored (this bin IS always "serve --mcp"; the
+ *     token only exists so the daemon's re-invoke argv shape parses cleanly)
+ *   - `--mcp` — accepted, ignored (same reason)
+ *   - `-p <path>` / `--path <path>` — explicit project root. The daemon
+ *     re-invoke form always supplies this; a direct MCP-host launch may
+ *     omit it and rely on `rootUri` reported by the client at `initialize`.
+ * Any other token is a usage violation (exit 2) — no implicit fallback.
+ */
+function parseArgs(argv) {
+  let path;
+  const unknown = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === 'serve' || arg === '--mcp') continue;
+    if (arg === '-p' || arg === '--path') {
+      const value = argv[i + 1];
+      if (value === undefined) {
+        return { error: `${arg} requires a value` };
+      }
+      path = value;
+      i += 1;
+      continue;
+    }
+    unknown.push(arg);
+  }
+  if (unknown.length > 0) {
+    return { error: `unsupported argument(s): ${unknown.join(' ')}` };
+  }
+  return { path };
+}
+
+// Node version guard (④) — runs before anything else, including argv
+// parsing, so it also covers the internal daemon re-invoke form (②) which
+// re-execs this exact file. Same semantics as the sensor CLI: nodeMajor >=
+// 25 or < MIN_NODE_MAJOR blocks unless CODEGRAPH_ALLOW_UNSAFE_NODE is set,
+// in which case the banner is shown for visibility only and startup
+// continues.
+const nodeVersionGuard = evaluateNodeVersionGuard(
+  process.versions.node,
+  Boolean(process.env.CODEGRAPH_ALLOW_UNSAFE_NODE),
+);
+if (nodeVersionGuard.banner) {
+  process.stderr.write(`${nodeVersionGuard.banner}\n`);
+}
+
+if (nodeVersionGuard.blocked) {
+  startupFailure('NODE_VERSION_UNSUPPORTED', nodeVersionGuard.banner);
+} else {
+  const parsed = parseArgs(process.argv.slice(2));
+
+  if (parsed.error) {
+    usageFailure(parsed.error);
+  } else {
+    try {
+      const { MCPServer } = await import('../sensor/dist/index.js');
+      const server = new MCPServer(parsed.path);
+      // MCPServer.start() resolves only when startup itself declined to serve
+      // (there is no such path today — every mode keeps the process alive via
+      // stdin/net.Server and exits through its own process.exit calls) or
+      // throws on a genuine startup failure (e.g. the sentinel-version fatal
+      // in MCPServer.start — ADR 0049 Decision 3(c)). Either way, nothing more
+      // to do here on a clean resolve.
+      await server.start();
+    } catch (err) {
+      // opt-in runtime error store（既定OFF・config有効時のみ）。観測失敗はstderr一行のbest-effort。
+      const { observeRuntimeError } = await import('../src/runtime-errors.mjs');
+      observeRuntimeError('LATTICE.MCP_SERVER_FAILED');
+      startupFailure('MCP_STARTUP_FAILED', err instanceof Error ? err.message : String(err));
+    }
+  }
+}

package/bin/lattice.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+
+import { buildBootstrapDiagnostics } from '../src/bootstrap.mjs';
+import { runRuntimeCli } from '../src/runtime-cli.mjs';
+import packageJson from '../package.json' with { type: 'json' };
+
+const args = process.argv.slice(2);
+
+if (args.length === 1 && args[0] === '--version') {
+  process.stdout.write(`${packageJson.version}\n`);
+} else if (args.length === 2 && args[0] === 'doctor' && args[1] === '--json') {
+  process.stdout.write(`${JSON.stringify(buildBootstrapDiagnostics())}\n`);
+} else if (args.length === 2 && args[0] === 'factory-diagnostics' && args[1] === '--json') {
+  const { buildFactoryDiagnostics } = await import('../src/factory-diagnostics.mjs');
+  const diagnostics = await buildFactoryDiagnostics();
+  process.stdout.write(`${JSON.stringify(diagnostics)}\n`);
+  process.exitCode = diagnostics.overall === 'ok' ? 0 : 1;
+} else if (args[0] === 'runtime-errors') {
+  process.exitCode = await runRuntimeErrorsCli(args.slice(1));
+} else {
+  try {
+    process.exitCode = await runRuntimeCli({
+      argv: args,
+      cwd: process.cwd(),
+      stdout: process.stdout,
+      stderr: process.stderr,
+    });
+  } catch (error) {
+    // typed契約（cli_error.v1＋exit 1/2）の外へ漏れた例外＝内部故障。opt-in時のみ観測を残す。
+    const { observeRuntimeError } = await import('../src/runtime-errors.mjs');
+    observeRuntimeError('LATTICE.CLI_INTERNAL_FAILED', { version: packageJson.version });
+    process.stderr.write(`${JSON.stringify({ schema: 'lattice.cli_error.v1', code: 'INTERNAL_FAILURE', message: error?.constructor?.name ?? 'Error' })}\n`);
+    process.exitCode = 1;
+  }
+}
+
+async function runRuntimeErrorsCli(rest) {
+  const runtimeErrors = await import('../src/runtime-errors.mjs');
+  const usage = () => {
+    process.stderr.write(`${JSON.stringify({ schema: 'lattice.cli_error.v1', code: 'USAGE', message: 'usage: lattice runtime-errors <snapshot [--after-cursor N] [--limit N]|ack <cursor>|diagnostics|resolve <fingerprint>|reopen <fingerprint>|compact> --json' })}\n`);
+    return 2;
+  };
+  const options = { version: packageJson.version };
+  if (rest.at(-1) !== '--json') return usage();
+  const words = rest.slice(0, -1);
+  try {
+    let result;
+    if (words[0] === 'snapshot') {
+      let afterCursor = 0;
+      let limit = 256;
+      const flags = words.slice(1);
+      while (flags.length > 0) {
+        const flag = flags.shift();
+        const raw = flags.shift();
+        if (raw === undefined || !/^\d+$/.test(raw)) return usage();
+        if (flag === '--after-cursor') afterCursor = Number(raw);
+        else if (flag === '--limit') limit = Number(raw);
+        else return usage();
+      }
+      result = runtimeErrors.runtimeErrorsSnapshot(afterCursor, limit, options);
+    } else if (words[0] === 'ack' && words.length === 2 && /^\d+$/.test(words[1])) {
+      result = runtimeErrors.acknowledgeRuntimeErrors(Number(words[1]), options);
+    } else if (words[0] === 'diagnostics' && words.length === 1) {
+      result = runtimeErrors.runtimeErrorsDiagnostics(options);
+    } else if ((words[0] === 'resolve' || words[0] === 'reopen') && words.length === 2) {
+      result = runtimeErrors.setRuntimeErrorStatus(words[1], words[0] === 'resolve' ? 'resolved' : 'open', options);
+    } else if (words[0] === 'compact' && words.length === 1) {
+      result = runtimeErrors.compactRuntimeErrors(options);
+    } else {
+      return usage();
+    }
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    return 0;
+  } catch (error) {
+    process.stderr.write(`${JSON.stringify({ schema: 'lattice.cli_error.v1', code: 'RUNTIME_ERRORS_FAILED', message: error?.message ?? 'unknown' })}\n`);
+    return 1;
+  }
+}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@quolu/lattice",
+  "version": "0.1.0",
+  "description": "Lattice — parallel TODO graph compiler and conflict-aware orchestration runtime with isolated executor landing",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kitepon-rgb/Lattice.git"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "bin": {
+    "lattice": "bin/lattice.mjs",
+    "lattice-mcp": "bin/lattice-mcp.mjs"
+  },
+  "files": [
+    "bin",
+    "src",
+    "sensor/dist",
+    "sensor/package.json",
+    "sensor/LICENSE",
+    "sensor/NOTICE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@clack/prompts": "^1.3.0",
+    "commander": "^14.0.2",
+    "fast-string-width": "^3.0.2",
+    "fast-wrap-ansi": "^0.2.0",
+    "ignore": "^7.0.5",
+    "jsonc-parser": "^3.3.1",
+    "picomatch": "^4.0.3",
+    "sisteransi": "^1.0.5",
+    "tree-sitter-wasms": "^0.1.11",
+    "web-tree-sitter": "^0.25.3"
+  },
+  "scripts": {
+    "test": "node --test test/*.mjs test/integration/*.mjs",
+    "test:sensor": "npm --prefix sensor test",
+    "check": "node --check bin/lattice.mjs && node --check bin/lattice-mcp.mjs && node --check src/bootstrap.mjs && node --check src/factory-diagnostics.mjs && node --check src/runtime-errors.mjs && node --check src/runtime-contracts.mjs && node --check src/runtime-event-store.mjs && node --check src/runtime-projection.mjs && node --check src/runtime-decision-verifier.mjs && node --check src/runtime-front-end.mjs && node --check src/runtime-cli.mjs && node --check src/rc3-dogfood-scaffold.mjs && node --check src/runtime-engine.mjs && node --check src/runtime-scripted-executor.mjs && node --check src/runtime-diff-observer.mjs && node --check src/runtime-worktree-executor.mjs && node --check src/runtime-hold-recompile.mjs && node --check src/rc3-scripted-campaign.mjs && node --check src/rc3-actual-dogfood.mjs && node --check src/rc4-stage1-dogfood.mjs && node --check research/fixtures/dispatch-record/src/dispatch-record.mjs && node --check test/bootstrap.test.mjs && node --check test/research-dispatch-record.test.mjs",
+    "ci": "npm run test && npm run test:sensor && npm run check"
+  }
+}

package/sensor/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Colby Mchenry
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/sensor/NOTICE

@@ -0,0 +1,30 @@
+# NOTICE — sensor/ の出自
+
+このディレクトリは CodeGraph (https://github.com/colbymchenry/codegraph) を
+Lattice の構造 sensor として吸収したものである（Lattice ADR 0047 / 0048）。
+
+- upstream: @colbymchenry/codegraph（MIT License — 同梱の LICENSE を保持）
+- 吸収時点: upstream commit 04ab45c91fff97263d2d305ecb2908bce80bd159 (2026-07-17)
+- 取り込み方法: `git archive`（pristine tree。改変は吸収後の履歴が持つ）
+- 取り込み時の唯一の改変: upstream `CLAUDE.md` → `docs/UPSTREAM-CLAUDE.md` へ移動
+  （Lattice 内での AI セッションへ upstream 正典が自動注入されるのを防ぐ。内容は不変）
+## upstream 追従方針（cherry-pick 基準・ADR 0048 Decision 4 の消化）
+
+- 既定は**選択的 cherry-pick**。全量 merge 追従はしない（sensor は Lattice 所有で、
+  改良(a)(b)(c) により upstream と意図的に分岐しているため）。
+- 取り込む: (i) グラフ構築の correctness に関わる修正（extraction / resolution /
+  storage / migration）(ii) Lattice が sensor として使う CLI 面（index / affected /
+  explore 等）の欠陥修正 (iii) security fix。
+- 取り込まない: site / telemetry / install channel / UI、および Lattice 側で置換・
+  改良済みの経路（corroboration filter・動的 import 抽出等）と衝突する変更。
+  衝突する場合は自前実装を優先し、必要なら考え方だけ手移植する。
+- 手順: upstream diff を実読 → cherry-pick または手移植 → schema migration は
+  **Lattice 採番（v9 以降は Lattice が所有。upstream の同番 migration は振替）** →
+  focused test → `npm run ci` green → 本 NOTICE 末尾の「追従記録」へ
+  upstream commit を追記。
+- 監視は定期ジョブ化しない。sensor の欠陥・機能不足に当たった時に upstream を
+  確認する（必要駆動）。
+
+## 追従記録
+
+（吸収時点 04ab45c 以降の取り込みなし）

package/sensor/dist/bin/codegraph.d.ts

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+/**
+ * CodeGraph CLI
+ *
+ * Command-line interface for CodeGraph code intelligence.
+ *
+ * Usage:
+ *   codegraph                    Run interactive installer (when no args)
+ *   codegraph install            Run interactive installer
+ *   codegraph uninstall          Remove CodeGraph from your agents
+ *   codegraph init [path]        Initialize CodeGraph in a project
+ *   codegraph uninit [path]      Remove CodeGraph from a project
+ *   codegraph index [path]       Index all files in the project
+ *   codegraph sync [path]        Sync changes since last index
+ *   codegraph status [path]      Show index status
+ *   codegraph query <search>     Search for symbols
+ *   codegraph files [options]    Show project file structure
+ *   codegraph context <task>     Build context for a task
+ *   codegraph callers <symbol>   Find what calls a function/method
+ *   codegraph callees <symbol>   Find what a function/method calls
+ *   codegraph impact <symbol>    Analyze what code is affected by changing a symbol
+ *   codegraph affected [files]   Find test files affected by changes
+ *   codegraph upgrade [version]  Update CodeGraph to the latest release
+ */
+import '../mcp/early-ppid';
+//# sourceMappingURL=codegraph.d.ts.map

package/sensor/dist/bin/codegraph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codegraph.d.ts","sourceRoot":"","sources":["../../src/bin/codegraph.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,mBAAmB,CAAC"}