codebaseiq 0.1.0 → 0.3.0

package/docs/NPM_RELEASE.md

@@ -0,0 +1,323 @@
+# npm Release
+
+`codebaseiq` is published to npm as one package. This runbook covers how a
+release is prepared, published, and recovered, and is the publisher checklist
+for the workstation that runs it.
+
+A release is one irreversible registry publication of an exact tarball.
+Unlike a database transaction, it cannot be rolled back. Its essential safety
+property is therefore not atomicity: it is that every registry state the
+process can leave behind identifies the intended bytes, is observed before the
+next irreversible step, and can be reconciled by rerunning one command.
+
+## Authority and guarantees
+
+The registry and the immutability of npm versions are the release authority. A
+local checkout, a local state record, and a successful `npm publish` exit code
+are all evidence, never proof. A release is eligible to publish only when all
+of these facts agree:
+
+1. The Git checkout is clean, and `HEAD` is the same object ID before and after
+   the preflight and the pack.
+2. One canonical, credential-free HTTPS npm registry is resolved and retained
+   for the complete run.
+3. Typecheck, the production dependency audit, the complete test suite, and
+   lint (which includes formatting, the production build, API compatibility,
+   downstream compilation, and skill link checks) all pass.
+4. The packed tarball's own `package.json` names the reviewed package and
+   version.
+5. The registry either does not have that version (an explicit `E404`) or has
+   it with bytes identical to the local tarball.
+
+## Publisher checklist
+
+This checklist covers a release run from a workstation. It is the entry point
+for the operator runbook below.
+
+A workstation release is the only one available. The repository's release
+workflow is a preflight: it reports the plan, carries no registry credential,
+and cannot publish. Two facts keep it that way. The declaration build needs more
+memory than a standard hosted runner has, for the reason recorded in the
+`//build` note in `package.json`. And the release lock is checkout-local, so it
+could not serialize a runner against a workstation: exactly one host may run
+the coordinator in publish mode at a time.
+
+### Workstation prerequisites
+
+None of these are checked by the coordinator, and each one fails late if it is
+missing.
+
+- **Repository credentials.** The remote is private, so the clone needs a
+  credential helper, a token, or an SSH remote. Nothing in the repository
+  provisions this, and the coordinator only ever reads local `HEAD`.
+- **A Git identity**, because the release change must be committed before the
+  coordinator will run. A signing configuration inherited from another machine
+  needs a usable key: suite cases that commit do not disable signing.
+- **A checkout whose line endings are LF.** `format:check` is the first thing
+  `lint` runs, and `lint` is the last preflight command, so a checkout made with
+  `core.autocrlf=true` fails after typecheck, the audit, and the complete suite
+  have already passed. Put the checkout on the Linux filesystem.
+- **Node.js** at or above the `engines` floor.
+- **Memory above the declaration build's requirement**, recorded with its
+  measured thresholds in the `//build` note in `package.json`. Under WSL2 this
+  is a `.wslconfig` setting on the Windows host, outside the checkout, and it
+  takes effect only after the virtual machine is restarted.
+- **Disk for work that never appears in the checkout**: a temporary tree holding
+  the packed tarball and, when the version already exists, the tarball
+  downloaded from the registry. `TMPDIR` must be writable; the coordinator
+  creates its temporary tree before anything else.
+- **Network reachability** for the npm registry and for the production
+  dependency audit.
+- **A registry credential keyed to the registry the coordinator resolves.**
+  Authentication is never checked before publication. A token stored under a
+  different host key still produces a clean dry run, because an anonymous
+  lookup answers `E404` and the package reads as absent; it fails only at
+  publication, after the complete preflight.
+- **Development dependencies installed.** Every release entry point runs through
+  `vite-node`, which arrives only as a transitive development dependency. An
+  install that omits them, including one caused by an exported
+  `NODE_ENV=production`, fails before any gate runs.
+- **A terminal, or an exported `CI`.** The reporter is selected on that variable
+  alone. Redirecting or piping a run with `CI` unset selects the reporter whose
+  main-process cost fails a suite in which every test passed.
+- **Knowledge of which optional toolchains are present.** Cases that skip on a
+  bare machine become real work when their toolchain exists: `cargo` on `PATH`
+  compiles a Rust kernel, and a Java runtime with the cached model-checker jar
+  runs a specification. A developer workstation is where these are present.
+
+### Order of work
+
+1. Establish credentials and Git identity, then clone.
+2. Confirm the checkout is clean with `git status --porcelain=v1
+--untracked-files=all`. The cleanliness gate runs twice, before preflight and
+   again after the pack, so anything a run leaves behind aborts it at the end.
+3. Install dependencies.
+4. Follow the operator runbook below.
+
+### First publish
+
+Three traps have no representation in the failure table, because each one is
+reachable before the coordinator reports anything:
+
+- **Do not move `HEAD` between the dry run and the publication.** The dry run
+  writes the durable record before its own branch is taken, and that record
+  pins the source revision. Committing a fix the dry run revealed is enough to
+  make the publication refuse. The recovery for a first publish is to move the
+  recorded file out of the coordinate-stable path, which is ignored by Git, and
+  rerun the dry run at the new revision. Do not bump a version to satisfy a
+  local bookkeeping file when nothing has reached the registry.
+- **Confirm the name is ownable before burning a preflight.** Registry presence
+  is decided per version, and only `E404` counts as absent. A name owned by
+  someone else without this version reads as absent, so the coordinator runs
+  everything and fails at publication on a permission error it does not
+  interpret.
+- **A malformed lock is the one thing a rerun cannot clear.** A lock whose owner
+  is a dead process is reclaimed automatically; a corrupt record fails closed and
+  reports contention until it is removed by hand.
+
+A release that bumps the version must update the version expectations in
+`tests/scripts/runtime-support-contract.test.ts` and the recorded version in
+`package-lock.json` in the same commit. The suite runs as a preflight command,
+so a bump without that edit fails before anything is packed.
+
+## Registry identity gate
+
+A packed package identity is the npm package coordinate plus the exact tarball
+SHA-1, SHA-512, and size, observed from one locally created `.tgz`. What
+distinguishes it from a version-existence check is that it identifies the bytes
+intended for installation, not merely the name under which some bytes were
+published.
+
+Before any registry mutation, the release flow:
+
+1. packs the package once, with lifecycle scripts disabled, into a private
+   temporary directory;
+2. recomputes the tarball hashes and size instead of trusting npm's JSON
+   report; and
+3. extracts `package/package.json` from the tar archive under a 64 MiB
+   decompression ceiling and requires its name and version to equal the
+   reviewed `package.json`.
+
+For an existing version, the flow reads npm's `dist` identity, downloads the
+published tarball with lifecycle scripts disabled, recomputes its hashes, and
+requires all of the following to agree:
+
+- registry metadata and downloaded tarball SHA-1 and SHA-512;
+- local and registry package names and versions; and
+- local and registry tarball SHA-1 and SHA-512.
+
+An explicit npm `E404` is the only evidence that authorizes the
+not-yet-published branch. Authentication failures, timeouts, output-limit
+failures, malformed metadata, generic proxy errors, and server failures are
+ambiguous registry states and stop the release. Pack and registry commands
+have finite 120-second and 30-second deadlines respectively, a 4 MiB captured
+output ceiling, and typed timeout/output/exit failure classification.
+
+The coordinator publishes an already verified local `.tgz`, not a directory
+that npm could repack differently. If a publish command fails because another
+process won the race, the coordinator rereads and downloads the winning
+registry version. It may continue only when the winner has the same complete
+identity; a different winner requires a new package version.
+
+## Release coordinator
+
+The release coordinator is the repository command that owns the whole
+sequence. It differs from a lifecycle hook by packing and validating the
+artifact before any registry mutation, recording local recovery evidence, and
+verifying registry truth after the publication:
+
+1. acquire the token-owned release lock;
+2. require a clean Git checkout and record the exact `HEAD` object ID;
+3. resolve one canonical credential-free HTTPS npm registry and retain it for
+   the complete run;
+4. run typecheck, the production dependency audit, the complete test suite, and
+   lint;
+5. pack the package with lifecycle scripts disabled;
+6. extract the packed `package.json` and require its coordinate;
+7. require Git `HEAD` and complete tracked/untracked working-tree cleanliness
+   to be unchanged;
+8. durably record the registry and the local tarball identity before reading
+   the registry;
+9. observe and fully verify the registry coordinate, always passing the
+   retained registry URL explicitly, before the publish;
+10. publish and verify the package if absent, then durably record that fact; and
+11. remove the private pack and release the owned lock.
+
+Every Git, npm pack, registry, publish, test, and lint process has a finite
+deadline and captured-output limit. A cleanup or lock-release failure produces
+a nonzero outcome without erasing an earlier build, registry, or publication
+failure from the diagnostic.
+
+### Operator runbook
+
+Prepare and commit the complete release change first. The checkout must be
+clean because the recorded source revision is the wider evidence from which
+the packed artifact was tested and produced.
+
+1. Bump the package version.
+2. Review and commit the version, lockfile, changelog, schemas, release code,
+   and tests.
+3. Run:
+
+   ```bash
+   npm run release:npm:dry-run
+   ```
+
+   This runs the complete local preflight, packs the artifact, writes the
+   local recovery record, and reads/downloads any existing registry version.
+   It never invokes `npm publish`.
+
+4. Review the reported coordinate, integrity, registry state, and the JSON
+   record under `.codebaseiq/releases/`.
+5. Run:
+
+   ```bash
+   npm run release:npm
+   ```
+
+6. Require the final output to say that the exact registry identity is
+   verified. A later retry of the same command is safe: it repeats local
+   preflight and registry verification, but it does not republish an already
+   identical coordinate.
+
+Do not run `npm publish` directly. The root `prepublishOnly` guard refuses that
+path because npm's lifecycle cannot run the preflight, record or recover local
+state, or reconcile an ambiguous publish against the registry. An operator can
+deliberately bypass lifecycle scripts with npm's `--ignore-scripts` option;
+that is an administrative capability outside the repository's enforcement
+boundary, not an alternate supported release path. The coordinator itself uses
+`--ignore-scripts` only when publishing the tarball it has already packed,
+hashed, inspected, and recorded.
+
+### Durable local release state
+
+A local release-state record is a schema-versioned JSON recovery fact stored
+outside the npm tarball under `.codebaseiq/releases/`. It is distinguished
+from registry authority by recording what this checkout intended and what an
+earlier run verified, while never permitting a later run to skip fresh
+registry observation.
+
+Schema version 2 records:
+
+- a content-derived `releaseId`;
+- the clean Git revision used for preflight and packing;
+- the canonical HTTPS npm registry on which the coordinate is interpreted;
+- the package's name, version, byte size, SHA-1, and SHA-512 integrity;
+- `createdAt` and nondecreasing `updatedAt` timestamps;
+- the writer identity; and
+- a canonical set of completed facts: `local-preflight-complete` and
+  `main-registry-verified`.
+
+The registry fact is an independent observation, not a fictional transaction
+log. For example, an old or manually created state may lack
+`main-registry-verified` while the registry already has the exact package. The
+next coordinator run still verifies the coordinate and records the fact without
+publishing.
+
+The path is stable for one package coordinate. Repacking different bytes,
+using a different source revision, or selecting a different registry under
+that same version therefore collides with the existing record and stops before
+registry work. The record is atomically replaced while the release lock is
+owned. The coordinator reports `directory-durable` when the host synchronizes
+the containing directory and `file-flushed; directory sync unsupported` when
+Windows exposes only the bounded file guarantee; a real synchronization failure
+aborts the run. It is intentionally ignored by Git and omitted from the npm
+package: it is local recovery state, not portable release authority. Fresh
+registry observation, immutable npm versions, and exact package identity remain
+the external safety authority regardless of the local result. The normative
+shape is `docs/schemas/npm-release-state.schema.json`.
+
+Current-schema additive fields are tolerated. Malformed JSON, a wrong
+discriminator, an invalid identity, a noncanonical stage list, or an
+unsupported schema fails closed. Do not hand-edit a damaged record. Preserve it
+for diagnosis, move it out of the coordinate-stable path, and rerun from the
+exact recorded source revision; the new run will recompute local bytes and
+reverify the registry coordinate before acquiring publication authority.
+
+## Failure and recovery
+
+| Observed state or failure                                           | Safe outcome and recovery                                                                                                  |
+| ------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| Dirty checkout before preflight                                     | Stop before tests and registry reads; commit, remove, or intentionally ignore/restore every tracked or untracked path      |
+| Missing, insecure, credential-bearing, or malformed registry URL    | Stop before tests and registry reads; configure one canonical credential-free HTTPS npm registry                           |
+| Git revision or any tracked/untracked path changes during preflight | Stop before the state record and registry reads; remove the concurrent editor and rerun from one completely clean revision |
+| Test, lint, build, API, or pack fails                               | No registry mutation has occurred; fix the local failure and rerun                                                         |
+| Packed `package.json` names a different coordinate                  | Stop before the state record and registry reads; fix the package metadata and rerun                                        |
+| Initial state publication fails                                     | No registry read or mutation has occurred; repair local filesystem durability/permissions and rerun                        |
+| State contains only `local-preflight-complete`                      | Registry is freshly reconciled; an absent package is published                                                             |
+| Package is exact, state is stale or absent                          | Record the observed fact and finish without publication                                                                    |
+| Publish succeeds but its state write fails                          | Retry observes the exact registry identity and records completion                                                          |
+| Publish reports failure but an identical winner is visible          | Accept the registry fact after downloading and hashing it; continue                                                        |
+| Publish and its immediate registry reconciliation both fail         | Report both causal failures; rerun the coordinator to establish registry truth before another publication decision         |
+| Publish returns success but identity is not yet visible             | Stop after bounded visibility retries; rerun the coordinator rather than publishing blindly                                |
+| Registry query times out, is unauthorized, or is malformed          | Stop; ambiguity is not converted to absence                                                                                |
+| Published tarball disagrees with `dist` metadata                    | Stop; treat the download or registry metadata as corrupt                                                                   |
+| Existing coordinate has different bytes                             | Stop; npm versions are immutable, so bump the package version                                                              |
+| State records different source or bytes under the same version      | Stop before registry reads; resume the recorded revision, or bump the package version                                      |
+| Configured registry differs from the recorded release registry      | Stop before registry reads; restore the intended registry or begin a new package version for the other registry            |
+| Malformed or unsupported local state                                | Preserve and move the artifact for diagnosis; rerun from the recorded revision so local and registry facts are rebuilt     |
+| Release lock is held by a live owner                                | Wait; a dead attributable owner is reclaimed conservatively, while unverifiable ownership fails closed                     |
+| Cleanup and an earlier operation both fail                          | Both failures are reported; inspect registry/state first, then rerun to reconcile                                          |
+| Lock ownership changes before release                               | Command exits nonzero; do not infer failure or success from the local message—rerun and require exact registry identity    |
+
+## Compatibility
+
+The local release-state schema is versioned independently of the package.
+Version 2 is the single-package record. Additive current fields are
+compatible; removing or reinterpreting a required identity, source, stage, or
+timestamp field requires a new schema and an explicit recovery policy.
+
+Version 1 recorded two packages and is not read: a version 1 record is
+rejected as an unsupported schema rather than migrated. It would also never be
+found, because the record path is now derived from the single package
+coordinate. Records are local, ignored by Git, and describe only an earlier
+run's intent, so leaving one in place is harmless; the registry remains the
+authority.
+
+## Retired Windows sidecar
+
+Earlier releases published a second package, `codebaseiq-windows`, ahead of the
+main package. It existed only to carry the `scip` index converter's Windows
+executables, which codebaseiq no longer invokes. Releases now neither build,
+pin, nor publish it. Versions already on the registry are untouched, and
+nothing here unpublishes them.

package/docs/schemas/npm-release-state.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/PlunderStruck/codebaseiq/blob/main/docs/schemas/npm-release-state.schema.json",
   "title": "codebaseiq npm release state",
-  "description": "Durable local progress for one exact main-package and Windows-sidecar npm release.",
+  "description": "Durable local progress for one exact codebaseiq npm release.",
   "type": "object",
   "required": [
     "kind",
@@ -20,7 +20,7 @@
       "const": "codebaseiq-npm-release-state"
     },
     "schemaVersion": {
-      "const": 1
+      "const": 2
     },
     "releaseId": {
       "type": "string",
@@ -56,13 +56,10 @@
     },
     "packages": {
       "type": "object",
-      "required": ["main", "sidecar"],
+      "required": ["main"],
       "properties": {
         "main": {
           "$ref": "#/$defs/packageIdentity"
-        },
-        "sidecar": {
-          "$ref": "#/$defs/packageIdentity"
         }
       },
       "additionalProperties": true
@@ -72,20 +69,14 @@
       "minItems": 1,
       "uniqueItems": true,
       "items": {
-        "enum": ["local-preflight-complete", "sidecar-registry-verified", "main-registry-verified"]
+        "enum": ["local-preflight-complete", "main-registry-verified"]
       },
       "oneOf": [
         {
           "const": ["local-preflight-complete"]
         },
-        {
-          "const": ["local-preflight-complete", "sidecar-registry-verified"]
-        },
         {
           "const": ["local-preflight-complete", "main-registry-verified"]
-        },
-        {
-          "const": ["local-preflight-complete", "sidecar-registry-verified", "main-registry-verified"]
         }
       ]
     },

package/docs/schemas/project-config.schema.json

@@ -39,6 +39,8 @@
       },
       "description": "Resident query execution settings."
     },
+    "builder": { "$ref": "#/$defs/builder" },
+    "sentinel": { "$ref": "#/$defs/sentinel" },
     "indexer": {
       "type": "object",
       "propertyNames": { "$ref": "#/$defs/supportedLanguage" },
@@ -313,6 +315,163 @@
       "properties": {
         "snapshotPaths": { "$ref": "#/$defs/stringArray" }
       }
+    },
+    "builderEmbeddingsEndpoint": {
+      "type": "object",
+      "required": ["name", "baseUrl", "model"],
+      "additionalProperties": true,
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_.-]{1,64}$"
+        },
+        "baseUrl": {
+          "type": "string",
+          "pattern": "^https?://"
+        },
+        "model": {
+          "type": "string",
+          "minLength": 1
+        },
+        "queryPrefix": {
+          "type": "string"
+        },
+        "documentPrefix": {
+          "type": "string"
+        },
+        "healthTimeoutMs": {
+          "type": "integer",
+          "exclusiveMinimum": 0
+        },
+        "warmTimeoutMs": {
+          "type": "integer",
+          "exclusiveMinimum": 0
+        },
+        "requestTimeoutMs": {
+          "type": "integer",
+          "exclusiveMinimum": 0
+        },
+        "batchSize": {
+          "type": "integer",
+          "exclusiveMinimum": 0
+        },
+        "dimensions": {
+          "type": "integer",
+          "exclusiveMinimum": 0
+        },
+        "apiKeyEnv": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Name of the environment variable holding a bearer token. Ignored in the committed config; set it in .codebaseiq.local.json."
+        },
+        "allowRemote": {
+          "type": "boolean",
+          "description": "Permit a host outside loopback and private networks. Ignored in the committed config; set it in .codebaseiq.local.json."
+        }
+      }
+    },
+    "builderAgentCommand": {
+      "type": "object",
+      "required": ["name", "argv"],
+      "additionalProperties": true,
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_.-]{1,64}$"
+        },
+        "argv": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          },
+          "description": "Command line without a shell. {schemaJson}, {schemaFile}, and {outputFile} may appear only as whole arguments."
+        },
+        "timeoutMs": {
+          "type": "integer",
+          "exclusiveMinimum": 0
+        },
+        "maxOutputBytes": {
+          "type": "integer",
+          "exclusiveMinimum": 0
+        }
+      }
+    },
+    "builder": {
+      "type": "object",
+      "additionalProperties": true,
+      "description": "Symbol builder settings. Per-developer endpoints, credentials, and agent commands belong in .codebaseiq.local.json, whose builder block overrides this one.",
+      "properties": {
+        "mode": {
+          "enum": ["agent", "embeddings", "auto"]
+        },
+        "chain": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^(embeddings|agent):[A-Za-z0-9_.-]{1,64}$"
+          },
+          "description": "Ordered provider references such as embeddings:homelab or agent:claude."
+        },
+        "embeddings": {
+          "type": "object",
+          "additionalProperties": true,
+          "properties": {
+            "endpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/builderEmbeddingsEndpoint"
+              }
+            },
+            "indexBudgetMs": {
+              "type": "integer",
+              "exclusiveMinimum": 0
+            },
+            "minCoverage": {
+              "type": "number",
+              "minimum": 0,
+              "maximum": 1
+            },
+            "maxCardChars": {
+              "type": "integer",
+              "exclusiveMinimum": 0
+            },
+            "topBandMargin": {
+              "type": "number",
+              "minimum": 0,
+              "maximum": 1
+            }
+          }
+        },
+        "agent": {
+          "type": "object",
+          "additionalProperties": true,
+          "properties": {
+            "commands": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/builderAgentCommand"
+              },
+              "description": "Ignored in the committed config; set it in .codebaseiq.local.json."
+            },
+            "cacheTtlHours": {
+              "type": "integer",
+              "exclusiveMinimum": 0
+            }
+          }
+        }
+      }
+    },
+    "sentinel": {
+      "type": "object",
+      "additionalProperties": true,
+      "description": "Trailing sentinel for agent sessions. Delivery mode and mute state are per-user and not committed.",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Run the trailing sentinel for agent sessions in this project (default: false)."
+        }
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebaseiq",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Evidence and verification for AI coding agents: map code, reuse concepts, finish migrations, and gate diffs.",
   "repository": {
     "type": "git",
@@ -24,12 +24,10 @@
     "docs/assets/**/*",
     "docs/schemas/**/*",
     "docs/*.md",
-    "scripts/build-codebaseiq-windows.mjs",
     "scripts/evidence-product-contract.mjs",
-    "scripts/codebaseiq-windows-provenance.mjs",
-    "scripts/verify-codebaseiq-windows.mjs",
     "skills/**/*.md",
-    "skills/**/agents/*.yaml"
+    "skills/**/agents/*.yaml",
+    "ui/view/**/*"
   ],
   "sideEffects": false,
   "exports": {
@@ -370,8 +368,8 @@
   "scripts": {
     "build": "node --max-old-space-size=12288 ./node_modules/tsup/dist/cli-default.js",
     "dev": "tsup --watch",
-    "format": "prettier --write \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"*.{ts,js,json}\"",
-    "format:check": "prettier --check \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"*.{ts,js,json}\"",
+    "format": "prettier --write \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"ui/view/**/*.{js,css,html}\" \"*.{ts,js,json}\"",
+    "format:check": "prettier --check \"{src,tests,scripts}/**/*.{ts,tsx,js,mjs,json}\" \"ui/view/**/*.{js,css,html}\" \"*.{ts,js,json}\"",
     "test": "vitest run",
     "soak:cache-lifecycle": "npm run build && vite-node scripts/cache-lifecycle-soak.ts",
     "test:watch": "vitest",
@@ -380,21 +378,19 @@
     "api:report": "node scripts/api-surface-contract.mjs report",
     "api:check": "npm run build && node scripts/api-surface-contract.mjs check && tsc -p tests/fixtures/public-api-consumer/tsconfig.json",
     "api:update": "npm run build && node scripts/api-surface-contract.mjs update",
-    "lint": "npm run format:check && eslint src tests tsup.config.ts scripts/api-surface-contract.mjs scripts/audit-production-dependencies.mjs scripts/build-codebaseiq-windows.mjs scripts/cache-lifecycle-soak.ts scripts/codex-exploration-sandbox.mjs scripts/codex-exploration-trial-core.mjs scripts/codex-exploration-trial.mjs scripts/compare-exploration-trials.mjs scripts/exploration-benchmark-core.mjs scripts/exploration-benchmark.mjs scripts/npm-release-state.ts scripts/npm-release.ts scripts/publish-codebaseiq-windows.ts scripts/release-npm-guard.ts scripts/release-npm.ts scripts/codebaseiq-windows-package-identity.ts scripts/codebaseiq-windows-provenance.mjs scripts/codebaseiq-windows-release.ts scripts/verify-identity-collision-cli.mjs scripts/verify-codebaseiq-windows.mjs scripts/verify-codebaseiq-windows-registry.ts && npm run api:check && node scripts/check-skill-links.mjs",
-    "build:codebaseiq-windows": "node scripts/build-codebaseiq-windows.mjs",
-    "verify:codebaseiq-windows": "node scripts/verify-codebaseiq-windows.mjs",
+    "lint": "npm run format:check && eslint src tests ui/view tsup.config.ts scripts/api-surface-contract.mjs scripts/audit-production-dependencies.mjs scripts/cache-lifecycle-soak.ts scripts/codex-exploration-sandbox.mjs scripts/codex-exploration-trial-core.mjs scripts/codex-exploration-trial.mjs scripts/compare-exploration-trials.mjs scripts/exploration-benchmark-core.mjs scripts/exploration-benchmark.mjs scripts/npm-release-state.ts scripts/npm-release.ts scripts/release-npm-guard.ts scripts/release-npm.ts scripts/npm-package-identity.ts scripts/npm-release-runtime.ts scripts/verify-identity-collision-cli.mjs && npm run api:check && node scripts/check-skill-links.mjs",
     "verify:identity-collision-cli": "node scripts/verify-identity-collision-cli.mjs",
-    "verify:codebaseiq-windows-registry": "vite-node scripts/verify-codebaseiq-windows-registry.ts",
     "bench:evidence-products": "node scripts/evidence-product-contract.mjs",
     "bench:exploration": "node scripts/exploration-benchmark.mjs",
     "bench:exploration:codex": "node scripts/codex-exploration-trial.mjs",
     "bench:exploration:compare": "node scripts/compare-exploration-trials.mjs",
     "bench:native-symbol-leaf": "node scripts/bench-native-symbol-leaf.mjs",
     "calibrate": "node scripts/accuracy-calibration.mjs",
+    "calibrate:sentinel": "vite-node scripts/sentinel-replay.ts",
+    "calibrate:sentinel-review": "vite-node scripts/sentinel-shadow-review.ts",
     "docs:commands": "vite-node scripts/render-command-reference.ts --write",
     "prepublishOnly": "vite-node scripts/release-npm-guard.ts",
     "postinstall": "node dist/postinstall.js || true",
-    "publish:codebaseiq-windows": "vite-node scripts/publish-codebaseiq-windows.ts",
     "release:npm": "vite-node scripts/release-npm.ts",
     "release:npm:dry-run": "vite-node scripts/release-npm.ts --dry-run"
   },
@@ -417,7 +413,7 @@
   ],
   "license": "Apache-2.0",
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22.15.0"
   },
   "dependencies": {
     "@bufbuild/protobuf": "^2.11.0",
@@ -427,6 +423,7 @@
     "better-sqlite3": "^13.0.2",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",
+    "cytoscape": "^3.34.3",
     "ignore": "^7.0.3",
     "ts-morph": "^28.0.0"
   },
@@ -434,7 +431,6 @@
   "optionalDependencies": {
     "@sourcegraph/scip-typescript": "0.4.0",
     "scip-python-plus": "0.7.5",
-    "codebaseiq-windows": "0.1.0",
     "tree-sitter": "0.21.1",
     "tree-sitter-c": "0.23.2",
     "tree-sitter-c-sharp": "0.23.1",

package/skills/codebaseiq/SKILL.md

@@ -72,4 +72,4 @@ Read request, observed facts, calibration, coverage, and recovery together. A co
 
 Before answering, compare the draft to the selected statement-complete behavior—not merely to a remembered narrative. Preserve every observed behavior-changing predicate, returned default, separately merged field, cache invalidation, and cleanup effect that is material to the question. When two named fields use different merge or lifecycle operations, do not collapse them into a generic word such as “properties.” If the evidence already contains a missing detail, repair the answer; do not reopen exploration.
 
-Use codebaseiq rather than a parallel grep/read workflow for tracked text. Native tools are for edits, checks, binary content, or an explicitly reported unsupported gap. After edits, use `diff-impact` when consumers matter, `architecture` for declared boundaries, and `health` for quality or cleanup analysis.
+Use codebaseiq rather than a parallel grep/read workflow for tracked text. Native tools are for edits, checks, binary content, or an explicitly reported unsupported gap. After edits, use `diff-impact` when consumers matter, `architecture` for declared boundaries, and `health` for quality or cleanup analysis. Before adding a new helper, run `codebaseiq reuse` with `--term`, `--name`, and `--calls` probes you choose; its results are heuristic candidates to confirm with `code` or `evidence`, not exact facts.

package/skills/concrete-plan/SKILL.md

@@ -67,7 +67,7 @@ Include this section only when an unknown can change the implementation. Name th
 ## Required reasoning
 
 - Cite direct evidence for each changed owner and material consumer.
-- Compare an existing reuse candidate before adding a new helper, wrapper, hook, component, or module.
+- Compare an existing reuse candidate before adding a new helper, wrapper, hook, component, or module; `codebaseiq reuse` with probes you choose lists candidates to confirm with `code`.
 - Name behavior that must remain true.
 - Name residue that the change must remove.
 - Include architecture rules that constrain dependency direction.