graphlin 0.1.3 → 0.2.0

package/runtime/model/records.mjs

@@ -0,0 +1,239 @@
+import { opaque, plain, integer } from '../core/common.mjs';
+import { excluded, safeText } from '../core/privacy.mjs';
+
+export const DEFAULT_LIMITS = Object.freeze({
+  entities: 20_000, relations: 40_000, artifacts: 10_000, interpretations: 512,
+  imports: 20_000, scopes: 1_024, activity: 2_048, sessions: 64, checkpoints: 8,
+  bytes: 48 * 1024 * 1024, softBytes: 32 * 1024 * 1024,
+  checkpointBytes: 32 * 1024 * 1024, refs: 16,
+});
+export const id = value => typeof value === 'string' &&
+  /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,159}$/.test(value) && safeText(value, 160) ? value : null;
+export const token = (value, fallback = 'unknown') => typeof value === 'string' &&
+  /^[a-z][a-z0-9_.-]{0,63}$/.test(value) && safeText(value, 64) ? value : fallback;
+export const label = (value, fallback = 'Unknown') => typeof value === 'string' &&
+  safeText(value, 240) && !/[\r\n<>]/.test(value) && !/^(?:\/|[a-z]+:)/i.test(value) ? value : fallback;
+export const validity = value => ['current', 'stale', 'retracted'].includes(value) ? value : 'stale';
+export const classification = value => ['accepted', 'tentative', 'unknown', 'stale', 'pending', 'abstained'].includes(value)
+  ? value : 'unknown';
+export const basis = value => ['metadata', 'parsed', 'lexical', 'decision', 'legacy'].includes(value) ? value : 'legacy';
+export const byteSize = value => Buffer.byteLength(JSON.stringify(value));
+export const key = (prefix, ...parts) => opaque(prefix, ...parts);
+const version = value => typeof value === 'string' && value.length <= 256 &&
+  /^[@A-Za-z0-9][A-Za-z0-9_.@+/-]*$/.test(value) && safeText(value, 256) ? value : null;
+
+export function relativePath(value, policy = {}) {
+  if (typeof value !== 'string' || value.length > 512 || !value ||
+      /[\\:\0\r\n<>%]/.test(value) || value.split('/').some(p => !p || p === '.' || p === '..') ||
+      !safeText(value, 512) || excluded(value, policy)) return null;
+  return value;
+}
+
+export function currentPolicy(provider) {
+  const value = (typeof provider === 'function' ? provider() : provider) ?? {};
+  return {
+    readSource: value.readSource === true || value.transmitSource === true,
+    displayEvidence: value.displayEvidence !== false,
+    persistEvidence: value.persistEvidence === true,
+    excludePaths: Array.isArray(value.excludePaths) ? value.excludePaths : [],
+  };
+}
+
+export function lineageRecord(value) {
+  if (!plain(value) || !id(value.id)) return null;
+  const branch = label(value.branch, '');
+  return {
+    id: value.id, status: token(value.status),
+    ...(branch ? { branch } : {}),
+    ...(typeof value.head === 'string' && /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value.head) ? { head: value.head } : {}),
+  };
+}
+
+export function references(values, max = DEFAULT_LIMITS.refs) {
+  if (!Array.isArray(values) || values.length > max) return null;
+  const result = [];
+  for (const value of values) {
+    if (!plain(value) || !id(value.artifactId) || !integer(value.generation, 1) ||
+        typeof value.hash !== 'string' || !/^[a-f0-9]{64}$/.test(value.hash)) return null;
+    const ref = { artifactId: value.artifactId, hash: value.hash, generation: value.generation };
+    if (integer(value.startLine, 1, 10_000_000) && integer(value.endLine, value.startLine, 10_000_000)) {
+      ref.startLine = value.startLine;
+      ref.endLine = value.endLine;
+    }
+    if (id(value.eventId)) ref.eventId = value.eventId;
+    if (id(value.extractor)) ref.extractor = value.extractor;
+    if (version(value.extractorVersion)) ref.extractorVersion = value.extractorVersion;
+    if (version(value.identityVersion)) ref.identityVersion = value.identityVersion;
+    // Intent references cannot be promoted to deterministic source support.
+    if (value.sourceClass === 'public_intent') ref.sourceClass = 'public_intent';
+    result.push(ref);
+  }
+  return result;
+}
+
+export function entityRecord(value, maxRefs) {
+  if (!plain(value) || !id(value.id)) return null;
+  const sourceRefs = references(value.sourceRefs ?? [], maxRefs);
+  if (!sourceRefs) return null;
+  const entity = {
+    id: value.id, label: label(value.label), kind: token(value.kind),
+    parentId: id(value.parentId), sourceRefs, basis: basis(value.basis),
+    validity: validity(value.validity), classification: classification(value.classification),
+  };
+  if (id(value.artifactId)) entity.artifactId = value.artifactId;
+  if (value.qualifiedName) entity.qualifiedName = label(value.qualifiedName);
+  if (id(value.sessionId)) entity.sessionId = value.sessionId;
+  if (id(value.legacyId)) entity.legacyId = value.legacyId;
+  if (relativePath(value.relativePath)) entity.relativePath = value.relativePath;
+  if (integer(value.knownAtSequence)) entity.knownAtSequence = value.knownAtSequence;
+  if (integer(value.createdAtSequence, 1)) entity.createdAtSequence = value.createdAtSequence;
+  if (value.ownership === 'unresolved') entity.ownership = 'unresolved';
+  return entity;
+}
+
+export function relationRecord(value, maxRefs) {
+  if (!plain(value) || !id(value.id) || !id(value.source) || !id(value.target)) return null;
+  const sourceRefs = references(value.sourceRefs ?? [], maxRefs);
+  if (!sourceRefs) return null;
+  return {
+    id: value.id, source: value.source, target: value.target, kind: token(value.kind),
+    basis: basis(value.basis), validity: validity(value.validity), sourceRefs,
+  };
+}
+
+export function interpretationRecord(value, maxRefs) {
+  if (!plain(value) || !id(value.id) || typeof value.namespace !== 'string' ||
+      !/^[a-z][a-z0-9_-]*(?:[.:][a-z0-9_-]+)+$/.test(value.namespace) || !safeText(value.namespace, 80)) return null;
+  const sourceRefs = references(value.sourceRefs ?? [], maxRefs);
+  if (!sourceRefs || !Array.isArray(value.entityIds) || value.entityIds.length > 256 ||
+      value.entityIds.some(value => !id(value))) return null;
+  return {
+    id: value.id, namespace: value.namespace, kind: token(value.kind),
+    label: label(value.label), entityIds: [...new Set(value.entityIds)],
+    basis: 'decision', validity: validity(value.validity),
+    classification: classification(value.classification),
+    support: ['supported', 'tentative', 'unknown', 'contradicted'].includes(value.support) ? value.support : 'unknown',
+    sourceRefs, version: id(String(value.version ?? '1')) ?? '1',
+    ...(id(value.sessionId) ? { sessionId: value.sessionId } : {}),
+  };
+}
+
+export function certificate(value) {
+  if (!plain(value) || !id(value.artifactId) || !id(value.scopeId) ||
+      !integer(value.generation, 1) || !/^[a-f0-9]{64}$/.test(value.hash)) return null;
+  const ranges = Array.isArray(value.coveredRanges) ? value.coveredRanges.slice(0, 128).flatMap(range => {
+    const startLine = Array.isArray(range) ? range[0] : range?.startLine;
+    const endLine = Array.isArray(range) ? range[1] : range?.endLine;
+    return integer(startLine, 1, 10_000_000) && integer(endLine, startLine, 10_000_000) ? [{ startLine, endLine }] : [];
+  }) : [];
+  const omissions = Array.isArray(value.omissions) ? value.omissions.slice(0, 32).map(v => token(v, 'unspecified')) : ['unspecified'];
+  const validVersions = version(String(value.version ?? '')) && version(String(value.identityVersion ?? '')) && id(value.extractor);
+  return {
+    artifactId: value.artifactId, scopeId: value.scopeId, hash: value.hash, generation: value.generation,
+    complete: value.complete === true && omissions.length === 0 && !!validVersions && ranges.length > 0 &&
+      value.coveredRanges.length === ranges.length && value.capability === 'parsed',
+    extractor: id(value.extractor) ?? 'unknown', version: version(String(value.version ?? '')) ?? 'unknown',
+    identityVersion: version(String(value.identityVersion ?? '')) ?? 'unknown',
+    coveredRanges: ranges, omissions, capability: token(value.capability),
+  };
+}
+
+export function activityRecord(value, sequence, now) {
+  if (!plain(value)) return null;
+  const at = time(value.at ?? value.timestamp, now);
+  const record = {
+    id: id(value.id) ?? key('activity', sequence, at),
+    kind: token(value.kind, 'capture.gap'), sequence, knownAtSequence: sequence,
+    at, recordedAt: time(now, now),
+    outcome: ['pending', 'succeeded', 'failed', 'interrupted', 'denied', 'unresolved', 'observed'].includes(value.outcome)
+      ? value.outcome : 'unresolved',
+    toolCategory: token(value.toolCategory, 'other'),
+    attribution: ['observed', 'correlated', 'unknown'].includes(value.attribution) ? value.attribution : 'unknown',
+  };
+  for (const field of ['sessionId', 'agentId', 'toolCallId']) if (id(value[field])) record[field] = value[field];
+  for (const field of ['entityIds', 'artifactIds']) {
+    record[field] = Array.isArray(value[field]) ? [...new Set(value[field].slice(0, 256).filter(id))] : [];
+  }
+  const sourceRefs = references(value.sourceRefs ?? []);
+  record.sourceRefs = sourceRefs ?? [];
+  // Creation is accepted only as an explicit successful observation with source
+  // version correlation. A write attempt or a new file in inventory is not one.
+  record.creation = value.creation === true && record.outcome === 'succeeded' &&
+    record.kind !== 'tool.requested' && record.sourceRefs.length > 0 &&
+    record.sourceRefs.every(ref => ref.sourceClass !== 'public_intent');
+  return record;
+}
+
+export function time(value, fallback = 0) {
+  const number = typeof value === 'string' ? Date.parse(value) : value;
+  const safe = Number.isFinite(number) && number >= 0 && number <= 8_640_000_000_000_000 ? number : fallback;
+  return new Date(Number.isFinite(safe) ? safe : 0).toISOString();
+}
+
+/** Projection is an allowlist, including for restored state and old checkpoints. */
+export function projectSnapshot(state, policy, { persistent = false, sessionId, scopeId } = {}) {
+  const sourceLabels = policy.readSource && policy.displayEvidence && (!persistent || policy.persistEvidence);
+  const blockedArtifacts = new Set((state.coverage.artifacts ?? []).filter(value =>
+    value.relativePath && !relativePath(value.relativePath, policy)).map(value => value.id));
+  let entities = state.entities.map(value => entityRecord(value)).filter(Boolean).map(entity => {
+    const path = relativePath(entity.relativePath, policy);
+    const metadata = path && (entity.basis === 'metadata' || ['file', 'module'].includes(entity.kind));
+    if (metadata) entity.label = path.split('/').at(-1);
+    if (!sourceLabels || blockedArtifacts.has(entity.artifactId) || entity.relativePath && !path) {
+      if (!metadata) {
+        entity.label = entity.kind === 'project' ? 'Project' : token(entity.kind, 'entity');
+      }
+      delete entity.qualifiedName;
+    }
+    if (entity.basis === 'metadata' && !path && entity.kind !== 'project') entity.label = entity.kind;
+    if (!path) delete entity.relativePath;
+    return entity;
+  });
+  if (scopeId) {
+    const children = new Map();
+    for (const entity of entities) {
+      if (!children.has(entity.parentId)) children.set(entity.parentId, []);
+      children.get(entity.parentId).push(entity.id);
+    }
+    const selected = new Set(), pending = [scopeId];
+    while (pending.length) {
+      const next = pending.pop();
+      if (selected.has(next)) continue;
+      selected.add(next);
+      pending.push(...(children.get(next) ?? []));
+    }
+    const byId = new Map(entities.map(entity => [entity.id, entity]));
+    let parent = byId.get(scopeId)?.parentId;
+    while (parent && !selected.has(parent)) { selected.add(parent); parent = byId.get(parent)?.parentId; }
+    entities = entities.filter(entity => selected.has(entity.id));
+  }
+  const entityIds = new Set(entities.map(entity => entity.id));
+  const relations = state.relations.map(value => relationRecord(value)).filter(value =>
+    value && entityIds.has(value.source) && entityIds.has(value.target));
+  const interpretations = state.interpretations.map(value => interpretationRecord(value)).filter(value =>
+    value && value.entityIds.every(entityId => entityIds.has(entityId))).map(value =>
+    sourceLabels && !value.sourceRefs.some(ref => blockedArtifacts.has(ref.artifactId)) ? value : { ...value, label: 'Interpretation' });
+  const activity = state.activity.filter(value => !sessionId || value.sessionId === sessionId).map(value => {
+    const record = activityRecord(value, value.sequence, Date.parse(value.recordedAt));
+    record.entityIds = record.entityIds.filter(value => entityIds.has(value));
+    return record;
+  });
+  const coverage = structuredClone(state.coverage);
+  coverage.scopes = (coverage.scopes ?? []).map(scope => {
+    const path = relativePath(scope.relativePath, policy);
+    return { ...scope, label: path ?? 'Scope', ...(path ? { relativePath: path } : { relativePath: undefined }) };
+  });
+  coverage.files = (coverage.files ?? []).map(file => {
+    const path = relativePath(file.relativePath, policy);
+    return { ...file, relativePath: path ?? undefined, root: relativePath(file.root, policy) ?? undefined };
+  });
+  coverage.artifacts = (coverage.artifacts ?? []).map(artifact => ({
+    ...artifact, relativePath: relativePath(artifact.relativePath, policy) ?? undefined,
+  }));
+  return {
+    schemaVersion: 2, projectId: state.projectId, revision: state.revision, sequence: state.sequence,
+    entities, relations, interpretations, activity, coverage,
+    sessions: state.sessions.filter(value => !sessionId || value.id === sessionId).map(value => ({ ...value })),
+    checkpoints: state.checkpoints.map(value => ({ ...value, label: sourceLabels ? label(value.label, 'Checkpoint') : 'Checkpoint' })),
+  };
+}

package/runtime/pipeline.mjs

@@ -1,6 +1,5 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { realpathSync } from 'node:fs';
-import { readdir } from 'node:fs/promises';
 import path from 'node:path';
 import {
   createPolicy, normalizeHostEvent, metadataEvent, EvidenceStore,
@@ -8,6 +7,7 @@ import {
   applyPatch, projectGraph,
 } from './core/index.mjs';
 import { safeLabel, safeText, excluded } from './core/privacy.mjs';
+import { createPlatform } from './platform.mjs';
 
 const MAX_ACTIVITY = 200;
 const MAX_HOOK_EVENTS = 200;
@@ -23,11 +23,6 @@ const CLASSIFICATION_QUEUE_TTL_MS = 120_000;
 const DEADLINE_MS = 2000;
 const PENDING_LEASE_MS = 60_000;
 const TERMINAL = new Set(['succeeded', 'failed', 'interrupted', 'unresolved']);
-const SOURCE_EXT = /\.(?:[cm]?[jt]sx?|py|go|rs|java|kt|rb|php|cs|swift|sql|ya?ml|json|toml|tf)$/i;
-const SKIP_DIR = new Set([
-  '.git', '.graphlin', '.graphlin-data', 'node_modules', 'dist', 'build',
-  'coverage', '.next', '.cache', '.venv', 'venv', 'vendor', 'research',
-]);
 const FIXED_CLASSIFIER = new Set([
   'ready', 'metadata_only', 'missing_key', 'paused', 'unavailable', 'timeout', 'demo',
 ]);
@@ -97,7 +92,7 @@ function restoreGraph(input, { stale = true } = {}) {
  */
 export function createPipeline({
   projectRoot, policy: policyOptions, decisionService, onChange = () => {},
-  onDiagnostic = () => {}, restoredState, mode = 'live', clock = Date.now,
+  onDiagnostic = () => {}, restoredState, restoredModel, mode = 'live', clock = Date.now,
   classificationDeadlineMs = DEADLINE_MS,
 } = {}) {
   if (!Number.isSafeInteger(classificationDeadlineMs) ||
@@ -107,13 +102,37 @@ export function createPipeline({
   const root = realpathSync(projectRoot);
   const inputRoot = path.resolve(projectRoot);
   const projectId = opaque(root);
+  const modelProjectId = createHash('sha256').update(root).digest('hex');
   const policy = createPolicy(policyOptions ?? {});
-  const evidence = new EvidenceStore({ projectRoot, policy });
+  // Restored claims stay stale until recaptured, and their versions must never
+  // collide with a new daemon's counters. No saved content is trusted here.
+  let generationFloor = 0;
+  const retainGeneration = value => {
+    if (Number.isSafeInteger(value) && value > generationFloor && value < Number.MAX_SAFE_INTEGER) generationFloor = value;
+  };
+  const retainRefs = rows => {
+    for (const row of Array.isArray(rows) ? rows.slice(0, 40000) : []) {
+      for (const ref of Array.isArray(row?.sourceRefs) ? row.sourceRefs.slice(0, 16) : []) retainGeneration(ref.generation);
+    }
+  };
+  if (restoredModel?.projectId === modelProjectId) {
+    const artifacts = restoredModel.coverage?.artifacts;
+    for (const artifact of Array.isArray(artifacts) ? artifacts.slice(0, 10000) : []) retainGeneration(artifact?.generation);
+    for (const rows of [restoredModel.entities, restoredModel.relations, restoredModel.interpretations]) retainRefs(rows);
+  }
+  if (restoredState?.projectId === projectId) {
+    const states = Array.isArray(restoredState.sessionStates) ? restoredState.sessionStates.slice(0, MAX_SESSIONS) : [];
+    for (const session of [restoredState, ...states]) {
+      retainRefs(session?.graph?.nodes); retainRefs(session?.graph?.edges);
+    }
+  }
+  const evidence = new EvidenceStore({ projectRoot, policy, maxTrackedPaths: 10000, generationFloor });
   const sessions = new Map();
   const dedup = new Map();
   const sessionStarts = new Map();
   const hookEvents = [];
   const knownArtifacts = new Map();
+  const lineageWork = new Set();
   const messageVersions = new Map();
   const deferredWork = new Map();
   const classificationQueue = [];
@@ -130,16 +149,26 @@ export function createPipeline({
   let pending = 0;
   let classifier = mode === 'demo' ? 'demo' : policy.transmitSource ? 'ready' : 'metadata_only';
   let serial = Promise.resolve();
-  let lastDiscoveryAt = -Infinity;
-  let discoveredPaths = [];
   let reconciliationTask = null;
   let resumeScheduled = false;
+  let lineageId = null;
 
   const serialized = (fn) => {
     const operation = serial.then(fn);
     serial = operation.catch(() => {});
     return operation;
   };
+  const platform = createPlatform({
+    projectRoot: root, projectId: modelProjectId,
+    policy, restoredState: restoredModel, now: clock,
+    accept: operation => serialized(operation),
+    revalidate: refs => serialized(async () => {
+      if (closed) return false;
+      registerArtifacts(await evidence.reconcile({ refs }));
+      return evidence.isCurrent(refs);
+    }),
+    onChange: notify,
+  });
 
   function artifactMetadata(artifact) {
     const relative = artifact.relativePath;
@@ -217,17 +246,24 @@ export function createPipeline({
     const session = freshSession(id, `Session ${sessions.size + 1}`);
     sessions.set(id, session);
     selectedSession ??= id;
+    platform.setSessions([...sessions.values()].map(item => ({ id: item.id, label: item.label })));
     return session;
   }
 
   function evictSession(id) {
     sessions.delete(id);
+    syncSessions();
     deferredWork.delete(id);
     for (const key of completedClassifications.keys()) {
       if (key.startsWith(`${id}:`)) completedClassifications.delete(key);
     }
   }
 
+  function syncSessions() {
+    platform.setSessions([...sessions.values()].map(({ id, label, host, status, startedAt, endedAt }) =>
+      ({ id, label, host, status, startedAt, endedAt })));
+  }
+
   if (restoredState?.projectId === projectId) {
     const saved = Array.isArray(restoredState.sessionStates)
       ? [restoredState, ...restoredState.sessionStates.filter(s => s.id !== restoredState.sessionId)].slice(-MAX_SESSIONS)
@@ -237,6 +273,7 @@ export function createPipeline({
       if (typeof id !== 'string' || !/^[a-zA-Z0-9_-]{1,100}$/.test(id)) continue;
       const session = ensureSession(id);
       session.graph = restoreGraph(entry.graph);
+      platform.observeLegacy(session.graph, { sessionId: session.id });
       // Activity is reconstructed through the metadata allowlist, never trusted verbatim.
       session.activity = (Array.isArray(entry.activity) ? entry.activity : [])
         .slice(-MAX_ACTIVITY).map(item => {
@@ -329,6 +366,7 @@ export function createPipeline({
   function recordPatch(session, patch) {
     if (!patch || !patch.operations?.length) return;
     session.graph = applyPatch(session.graph, patch);
+    platform.observeLegacy(session.graph, { sessionId: session.id, fresh: true });
     session.history.push({
       revision: session.graph.revision, at: new Date(clock()).toISOString(),
       graph: structuredClone(session.graph),
@@ -356,7 +394,7 @@ export function createPipeline({
     }
   }
 
-  function registerArtifacts(artifacts) {
+  function registerArtifacts(artifacts, event) {
     const changed = [];
     for (const artifact of artifacts) {
       const previous = knownArtifacts.get(artifact.id);
@@ -390,12 +428,14 @@ export function createPipeline({
         recordPatch(session, invalidateArtifacts(session.graph, changed));
       }
     }
+    platform.observeArtifacts(artifacts, event);
     return changed;
   }
 
   function addActivity(session, event) {
     const state = activityState(event);
     const row = { ...metadataEvent(event), label: activityLabel(event), state };
+    platform.recordActivity(row);
     const existing = event.toolCallId
       ? session.activity.findIndex(item => item.toolCallId === event.toolCallId &&
           item.agentId === event.agentId && item.kind?.startsWith('tool.'))
@@ -422,6 +462,7 @@ export function createPipeline({
           sequence: ++sequence, incomplete: true,
         });
         session.activity[index] = { ...event, label: activityLabel(event), state: 'unresolved' };
+        platform.recordActivity(event);
         changed = true;
       }
     }
@@ -429,31 +470,7 @@ export function createPipeline({
   }
 
   async function discoverPaths() {
-    // Bounded name discovery lets a shell-created file enter the next observation.
-    // Core still authorizes each resolved file before reading any content.
-    if (clock() - lastDiscoveryAt < 1000) return discoveredPaths;
-    lastDiscoveryAt = clock();
-    const found = [];
-    const dirs = [{ dir: root, depth: 0 }];
-    let visited = 0;
-    while (dirs.length && found.length < 64 && visited++ < 100) {
-      const { dir, depth } = dirs.shift();
-      let entries;
-      try { entries = await readdir(dir, { withFileTypes: true }); } catch { continue; }
-      entries.sort((a, b) => a.name.localeCompare(b.name));
-      for (const entry of entries) {
-        if (entry.isSymbolicLink() || entry.name.startsWith('.')) continue;
-        if (entry.isDirectory() && depth < 5 && !SKIP_DIR.has(entry.name)) {
-          dirs.push({ dir: path.join(dir, entry.name), depth: depth + 1 });
-        } else if (entry.isFile() && SOURCE_EXT.test(entry.name) &&
-            !/(?:package-lock|pnpm-lock|yarn\.lock)/.test(entry.name)) {
-          found.push(path.join(dir, entry.name));
-          if (found.length >= 64) break;
-        }
-      }
-    }
-    discoveredPaths = found;
-    return found;
+    return platform.discover({ limit: 64 });
   }
 
   function canonicalNamedPaths(paths, raw) {
@@ -555,7 +572,15 @@ export function createPipeline({
     if (closed || paused || !deferredWork.size) return;
     const work = [...deferredWork];
     deferredWork.clear();
-    const artifacts = await evidence.reconcile();
+    const needed = new Set(work.flatMap(([, entry]) => [...entry.artifacts]));
+    for (const [sessionId] of work) {
+      for (const edge of sessions.get(sessionId)?.graph.edges ?? []) {
+        if (edge.sourceRefs.some(ref => needed.has(ref.artifactId))) {
+          edge.sourceRefs.forEach(ref => needed.add(ref.artifactId));
+        }
+      }
+    }
+    const artifacts = await evidence.reconcile({ refs: [...needed].map(artifactId => ({ artifactId })) });
     registerArtifacts(artifacts);
     for (const [sessionId, entry] of work) {
       const session = sessions.get(sessionId);
@@ -602,7 +627,7 @@ export function createPipeline({
   const sourceIdentity = job => job.candidates.some(candidate => candidate.sourceRef?.type === 'message')
     ? null : sourceVersions(job.candidates).map(ref => ref.artifactId).sort().join(',');
   const classificationKey = job => `${job.event.sessionId}:${opaque(JSON.stringify([
-    policy.version,
+    policy.version, job.lineageId,
     { kind: job.event.kind, toolCategory: job.event.toolCategory,
       outcome: job.event.outcome, incomplete: job.event.incomplete !== false },
     job.candidates.map(candidate => candidate.digest),
@@ -650,7 +675,7 @@ export function createPipeline({
     const session = sessions.get(event.sessionId);
     if (!session) { skip('session_evicted'); return; }
     if (paused) { deferClassification(event, candidates); skip('paused_deferred'); return; }
-    const job = { event, candidates, sourceEventId, session, enqueuedAt: clock(),
+    const job = { event, candidates, sourceEventId, session, lineageId, enqueuedAt: clock(),
       needsRefresh: activeClassifications.size >= MAX_CLASSIFICATIONS };
     const covered = coverageReason(job);
     if (covered) { skipJob(job, covered); return; }
@@ -783,6 +808,7 @@ export function createPipeline({
         diagnostics: result?.diagnostics ?? {} });
       await serialized(async () => {
         if (closed || !sessions.has(event.sessionId)) { skip(closed ? 'pipeline_closed' : 'session_evicted'); return; }
+        if (job.lineageId !== lineageId) { skip('source_changed_during_classification'); return; }
         if (paused) { deferClassification(event, candidates); skip('paused_deferred'); notify(); return; }
         if (clock() >= deadlineAt) { classifier = 'timeout'; dropped++; skip('deadline_before_apply'); notify(); return; }
         if (result.status === 'timeout') classifier = 'timeout';
@@ -796,7 +822,7 @@ export function createPipeline({
             bundle?.policyVersion === policy.version && Array.isArray(bundle.candidates)) {
           // Reobserve the worktree before accepting remote answers; a tool could
           // have edited these files while either Jev request was in flight.
-          registerArtifacts(await evidence.reconcile());
+          registerArtifacts(await evidence.reconcile({ refs: sourceVersions(candidates) }));
           if (closed || sessions.get(event.sessionId) !== session) { skip(closed ? 'pipeline_closed' : 'session_evicted'); return; }
           if (paused) { deferClassification(event, candidates); skip('paused_deferred'); notify(); return; }
           const artifactRefs = sourceVersions(candidates);
@@ -825,6 +851,10 @@ export function createPipeline({
             const patch = compileDecision(before, { event, decision: result, policy,
               onDiagnostic: entry => admission.push(entry) });
             recordPatch(session, patch);
+            // The legacy canvas cap is not a semantic admission cap. Compile
+            // this bounded decision independently so the model can retain it.
+            const independent = compileDecision(emptyGraph(), { event, decision: result, policy });
+            if (independent) platform.observeLegacy(applyPatch(emptyGraph(), independent), { sessionId: session.id, fresh: true });
             remember();
             const after = session.graph;
             const counts = { revisionBefore: before.revision, revisionAfter: after.revision };
@@ -923,6 +953,11 @@ export function createPipeline({
           if (dedup.size > MAX_DEDUP) dedup.delete(dedup.keys().next().value);
         }
         const session = ensureSession(event.sessionId);
+        session.host = host;
+        session.startedAt ??= event.at;
+        session.status = event.kind === 'session.ended' ? 'ended' : 'active';
+        if (event.kind === 'session.ended') session.endedAt = event.at;
+        syncSessions();
         if (followSession) selectedSession = session.id;
         observeMessage(event, prepared.publicText);
         addActivity(session, event);
@@ -935,20 +970,22 @@ export function createPipeline({
           const named = Array.isArray(prepared.paths) ? canonicalNamedPaths(prepared.paths, raw) : [];
           const discover = event.kind === 'session.started' ||
             ['tool.succeeded', 'tool.failed'].includes(event.kind);
-          const paths = [...new Set([...named, ...(discover ? await discoverPaths() : [])])];
+          const sessionPaths = event.kind === 'session.started'
+            ? [...knownArtifacts.values()].filter(item => item.status === 'present').slice(0, 64).map(item => item.path) : [];
+          const paths = [...new Set([...named, ...sessionPaths, ...(discover ? await discoverPaths() : [])])];
           // EvidenceStore bounds each capture to 32 paths. Process the bounded
           // discovery list in chunks rather than silently losing its tail.
           for (let index = 0; index < paths.length; index += 32) {
             artifacts.push(...await evidence.capture(paths.slice(index, index + 32)));
           }
-          const changed = registerArtifacts(artifacts);
+          const changed = registerArtifacts(artifacts, metadataEvent(event));
           trace(event, 'capture', { status: 'observed', reason: 'artifacts_observed',
             artifacts: artifacts.map(artifact => ({ ...artifactMetadata(artifact),
               reason: changed.some(item => item.id === artifact.id) ? 'artifact_changed' : 'artifact_unchanged' })) });
           // A tool completion also reconciles prior support, including deletions
           // omitted from the tool's returned file list.
           if (event.kind.startsWith('tool.') && event.kind !== 'tool.requested') {
-            registerArtifacts(await evidence.reconcile());
+            registerArtifacts(await evidence.reconcile({ limit: 32 }));
           }
           namedSet = new Set(named.map(file => path.resolve(root, file)));
           // Global observation history is not a session's classification
@@ -998,10 +1035,26 @@ export function createPipeline({
     reconciliationTask = serialized(async () => {
       if (closed) return;
       const expired = expirePending();
-      const artifacts = await evidence.capture(await discoverPaths());
-      const known = await evidence.reconcile();
-      const changed = registerArtifacts([...artifacts, ...known]);
-      if (!changed.length) { if (expired) notify(); return; }
+      const beforeModel = platform.model.stats();
+      const paths = await discoverPaths();
+      const artifacts = [];
+      for (let index = 0; index < paths.length; index += 32) {
+        artifacts.push(...await evidence.capture(paths.slice(index, index + 32)));
+      }
+      const known = await evidence.reconcile({ limit: 32 });
+      const observed = [...artifacts, ...known];
+      const changed = registerArtifacts(observed);
+      // Parser revalidation may have already refreshed a file's generation.
+      // Retain canceled classifier work until this dispatch path sees it.
+      for (const artifact of observed) {
+        if (!lineageWork.delete(artifact.id)) continue;
+        if (!changed.some(item => item.id === artifact.id)) changed.push(artifact);
+      }
+      if (!changed.length) {
+        const afterModel = platform.model.stats();
+        if (expired || beforeModel.revision !== afterModel.revision || beforeModel.sequence !== afterModel.sequence) notify();
+        return;
+      }
       const session = selectedSession ? sessions.get(selectedSession) : null;
       if (session) {
         const event = observationEvent(session.id);
@@ -1037,6 +1090,23 @@ export function createPipeline({
     return getState();
   }
 
+  function observeLineage(lineage) {
+    return serialized(() => {
+      if (closed || lineage.id === lineageId) return;
+      platform.observeLineage(lineage);
+      lineageId = lineage.id;
+      completedClassifications.clear();
+      for (const job of activeClassifications) job.controller.abort();
+      for (const job of classificationQueue.splice(0)) {
+        pending--;
+        skipJob(job, 'source_changed_during_classification');
+      }
+      for (const artifactId of knownArtifacts.keys()) lineageWork.add(artifactId);
+      registerArtifacts(evidence.setLineage(lineage.id));
+      notify();
+    });
+  }
+
   function selectSession(id) {
     if (!sessions.has(id)) return false;
     selectedSession = id;
@@ -1045,12 +1115,15 @@ export function createPipeline({
   }
 
   async function whenIdle() {
+    await serial;
+    await platform.whenIdle();
     await serial;
     while (tasks.size || classificationQueue.length) {
       pumpClassifications();
       await Promise.allSettled([...tasks]);
       await serial;
     }
+    await platform.whenIdle();
     await serial;
   }
 
@@ -1064,8 +1137,14 @@ export function createPipeline({
     }
     for (const job of activeClassifications) job.controller.abort();
     decisionService?.close?.();
+    await platform.close();
     await whenIdle();
   }
 
-  return { ingest, getState, reconcile, setPaused, selectSession, whenIdle, close };
+  return {
+    ingest, getState, reconcile, observeLineage, setPaused, selectSession, whenIdle, close,
+    getModelState: options => platform.snapshot(options),
+    createCheckpoint: options => platform.checkpoint(options),
+    model: platform.model,
+  };
 }