knodin 0.7.5 → 0.8.2

package/docs/MCP.md

@@ -17,10 +17,13 @@ recoverable hard-budget continuations. See `docs/PROGRESSIVE-EVIDENCE.md`.
 - **CLI-only:** `knodin init --scope cli-only` keeps the local graph and Git
   refresh behavior without MCP registration.
 
-knodin supports project adapters for Claude Code, Codex, Gemini CLI, and
-Antigravity. A generic MCP handshake is release-gated. Named-client status is
-reported only when its adapter/configuration is detected; it is not proof of
-every client version or platform.
+knodin supports project adapters for GitHub Copilot in VS Code, Claude Code,
+Codex, Gemini CLI, and Antigravity. A generic MCP handshake is release-gated.
+Named-client status is reported only when its adapter/configuration is
+detected; it is not proof of every client version or platform. Personal-scope
+Copilot detection requires the VS Code CLI and an installed `GitHub.copilot`
+or `GitHub.copilot-chat` extension; team scope can write the adapter without
+claiming that the local client is installed.
 
 ## Canonical command
 
@@ -48,6 +51,21 @@ Manual JSON configuration:
 }
 ```
 
+GitHub Copilot in VS Code uses `.vscode/mcp.json` and the VS Code `servers`
+shape:
+
+```json
+{
+  "servers": {
+    "knodin": {
+      "type": "stdio",
+      "command": "knodin",
+      "args": ["serve"]
+    }
+  }
+}
+```
+
 Codex TOML:
 
 ```toml
@@ -103,10 +121,43 @@ If the handshake fails:
 MCP requests never trigger update-network checks. Cached update state is
 available through the `doctor` operation without changing stdio framing.
 When local diagnostics have been explicitly enabled for the repository, an MCP
-operation failure records the same bounded, sanitized failure envelope as the
-CLI. It never records request arguments, queries, source, or raw responses. Use
-the CLI `knodin diagnostics collect` and `inspect` workflow to review and share
-support evidence; no MCP failure is uploaded automatically.
+operation failure records the same bounded failure envelope as the CLI. It
+never records request arguments, queries, source, or raw responses. The single
+gateway also exposes `operation: "diagnostics"` with `telemetryAction: "report"`
+for preview or `"export"` for archive. It uses the exact schema-v2 explicit-allowlist builder
+as `knodin diagnostics preview|archive`; no failure or archive is uploaded
+automatically. See `docs/DIAGNOSTICS.md`.
+
+## Request reliability and recovery
+
+Every tool call has a client request ID and generated trace ID. Graph operations
+are serialized inside one warm child process per repository/worktree; no engine
+or database handle is shared across those workers. The gateway owns deadlines,
+cancellation, a 250 ms cooperative cleanup grace, hard termination, and a
+bounded three-start-per-minute restart policy. The graph-independent `docs`
+operation remains available in the gateway while a worker is being replaced.
+`KNODIN_MCP_DEADLINE_MS` may be set to a positive value up to 300000 for local
+testing of the cooperative repair path.
+
+Checked-in process replays prove a real SQLite held lock, abrupt worker exit,
+disconnect/cancellation race against a stuck worker, hard kill, bounded restart,
+warm-worker reuse, worktree isolation, and the next independent success. The
+raw CLI stdio replay also executes a real MCP status call through the child
+boundary. Memory and deadline diagnoses remain bounded signals, not proof of an
+operating-system root cause.
+
+The gateway appends metadata-only lifecycle records to
+`.knodin/mcp-reliability.jsonl`. Synchronously appended complete JSONL records
+are retained after ordinary or abrupt worker exit, rotate at 256 KiB or
+seven days (one prior generation), and contain only operation, correlation,
+timing, progress sequence, and classified state. Restart and recovery records
+link the failed predecessor trace to the next successful request.
+They never include request arguments, queries, source, responses, environment,
+credentials, remotes, or repository paths. Progress is advisory, emitted only
+when the client supplies a progress token, and bounded to the request deadline;
+the journal retains at most 64 progress records per request. Each linked
+worktree writes only inside its own `.knodin` directory. Power-loss durability
+beyond complete synchronous records is not claimed.
 
 The `review` operation serializes graph impact, test gaps, structural
 centrality, and bounded Git-history facts separately. Churn, co-change, and

package/docs/PT-ACCESS-RECOMMENDATION.md

@@ -1,12 +1,10 @@
 # P&T access through Docusign GitHub Enterprise Server
 
-The knodin GHES path is planned as
-`github.docusignhq.com/Enterprise-Apps/knodin`, but this repository rename does
-not create or verify that external repository. Until the mirror is renamed and
-its knodin artifact is certified, P&T engineers must use the existing legacy
-mirror and its documented release asset. `Enterprise-Apps` is a legacy
-namespace; product changes must continue to originate in the authoritative
-GitHub SaaS repository, not the downstream mirror.
+The knodin GHES path is
+`github.docusignhq.com/Enterprise-Apps/knodin`. It is a read-only downstream
+mirror of the authoritative GitHub SaaS repository
+`DTS-Productivity-Engineering/knodin`; product changes must originate in
+that source repository, never in the mirror or the `knodin/knodin` Homebrew tap.
 
 The legacy `v0.3.0` release and its original artifact digest were verified on
 2026-08-01. That evidence does not certify a renamed knodin artifact or path.

package/docs/REPOSITORIES-AND-WORKTREES.md

@@ -55,14 +55,26 @@ doctor` and the single MCP gateway are unchanged.
 
 Sibling location never establishes system membership or a relationship.
 `repos init` works sequentially and performs each live repository operation in
-a disposable process with a 768 MiB RSS ceiling. A worker that exceeds the
+a disposable process. Memory is uncapped by default so a legitimate large
+repository is not killed by a product-wide guess. Operators can set an explicit
+per-repository RSS ceiling for one run with `--memory-limit-mib <mib>` or for a
+configured portfolio in `knodin.yaml`; the CLI value takes precedence:
+
+```yaml
+schemaVersion: 1
+repositoryInitialization:
+  memoryLimitMiB: 1024
+```
+
+The minimum explicit ceiling is 128 MiB. A worker that exceeds a configured
 ceiling or its deadline has its process group terminated, produces a
 repository-scoped failure, and does not prevent later repositories from being
-processed. JSON records the observed per-repository peak, enforced ceiling,
-and count of ceiling failures. The 50 ms RSS heartbeat is a bounded enforcement
-interval rather than a claim that transient allocation can never overshoot by
-one sample. Windows can terminate the worker process but cannot provide the
-same descendant process-group guarantee as macOS/Linux.
+processed. JSON records the observed per-repository peak, the enforced ceiling
+or `null` when uncapped, and the count of ceiling failures. The 250 ms RSS
+heartbeat is a bounded enforcement interval rather than a claim that transient
+allocation can never overshoot by one sample. Windows can terminate the worker
+process but cannot provide the same descendant process-group guarantee as
+macOS/Linux.
 
 Initialization supports `--dry-run` and preserves a healthy graph when only
 managed integration needs refreshing. Dry-run never starts a worker, opens a

package/docs/SCIP-IMPORT.md

@@ -1,5 +1,10 @@
 # Optional SCIP import
 
+> **Bounds are overridable.** Every limit below can be raised with a flag, and
+> each refusal names the flag and a value that would admit the file:
+> `--scip-max-bytes`, `--scip-max-files`, `--scip-max-facts`,
+> `--scip-timeout-ms`. A ceiling the operator cannot move is just a failure.
+
 knodin can add compiler-produced SCIP facts to its local graph without running a
 language server. The tier is deliberately opt-in:
 

package/docs/TOKEN-OPTIMIZER-SCORECARD.md

@@ -0,0 +1,79 @@
+# Reckon vs Token Optimizer — evidence-linked scorecard
+
+This scorecard evaluates Token Optimizer at immutable commit
+`a2b9cef5efdfcf0393e9e7a5ded229ffd9f613d7`. The machine-auditable
+[scorecard manifest](../benchmarks/evaluations/token-optimizer-20260730/scorecard.json)
+links every disposition to implementation, verification source/test paths, benchmark
+evidence, and a limitation. The [methodology](../benchmarks/evaluations/token-optimizer-20260730/methodology.md)
+and [raw replay](../benchmarks/evaluations/token-optimizer-20260730/raw-behavior-replay-20260730.json)
+are the authority for measured values.
+
+## Executive result
+
+Reckon passes the pinned operation-level oracle for all five safe structural
+workflows and is smaller in real tokens and faster at warm p50/p95 for each. The
+oracles are deliberately narrow: three Python names, one byte-exact Python
+method body, two exact file sets, and one eligible-file count. They do not prove
+signature, nesting, kind, or construct accuracy across all seven languages.
+Reckon has the stronger
+verified compression budget/recovery contract, local opt-in real-token
+telemetry, graph-backed failure diagnosis, freshness evidence, lifecycle
+automation, and implemented signed-update machinery. These are bounded results,
+not proof that Reckon is better in every repository or environment.
+
+Knodin does not copy the competitor's unrestricted shell command runner. C58's
+portable prototype remains rejected. C88 instead ships immutable, doubly
+enabled repository profiles on the certified macOS boundary; Linux and Windows
+fail closed as `containment-unavailable` pending native adapters.
+Reckon's onboarding readiness remains incomplete because native Windows
+named-client and timed two-minute trials are missing. Trusted distribution is implemented but
+not production-complete: the root ceremony, five-channel signed release,
+sandbox/manager drills, and adversarial live exercises remain C62–C67 gates.
+
+| Dimension | Comparative disposition | Readiness | Reproducible result and boundary |
+|---|---|---|---|
+| File outline | Stronger on pinned oracle | Implemented/verified | Three Python names pass; 56 vs 64 tokens and 0.203 vs 0.478 ms warm p50; cold startup is slower |
+| Exact symbol source | Stronger on pinned oracle | Implemented/verified | One Python body is byte-exact; 33 vs 37 tokens and 0.258 vs 0.419 ms warm p50 |
+| Symbol search | Stronger on pinned oracle | Implemented/verified | Exact seven-file set; 76 vs 84 tokens and 0.227 vs 1.112 ms warm p50 |
+| Batch outline | Stronger on pinned oracle | Implemented/verified | Exact seven-file set; 331 vs 377 tokens and 0.184 vs 1.387 ms warm p50; Reckon bytes are larger |
+| Project overview | Stronger on pinned oracle | Implemented/verified | Exact eligible-file count; 14 vs 127 tokens and 0.135 vs 0.589 ms warm p50 |
+| Parser/language fidelity | Not comparatively verified | Implemented with limitations | Seven languages participate, but no shared construct-accuracy oracle exists |
+| Output compression | Stronger on pinned oracle | Implemented/verified | 7/7 signals in 14/20 lines with hard recovery; competitor is faster warm, and Reckon's full envelope is 18 tokens larger |
+| Command execution | Stronger control contract; portability limited | Implemented on certified macOS boundary | No shell/caller argv, double opt-in, sanitized environment, network/user-data/fork denial, hard time/output bounds, compression + diagnosis; Linux/Windows fail closed |
+| Telemetry/privacy | Stronger source contract | Implemented/verified | Reckon is opt-in with real tokens; competitor defaults on and records sensitive paths/command text |
+| Dashboard UX | Not comparatively verified | Implemented/verified | Both have local HTML; only Reckon's rendering/data contract is exercised here |
+| Structural depth/freshness | Additional capability | Implemented/verified | Stable identity, relationships, and commit freshness; no comparative production study |
+| Failure-to-code intelligence | Additional capability | Implemented/verified | Retained diagnostics map to code/tests/impact; static relations are not runtime proof |
+| Cross-platform onboarding | Not comparatively verified | Implemented with limitations | macOS/Linux gates exist; timed and native Windows named-client trials are absent |
+| Lifecycle/portfolio | Additional capability | Implemented with limitations | Live 61-repository bounded certification; async refresh can still require repair |
+| Installation/maintenance | Stronger source contract | Implemented with limitations | Packaged install/uninstall versus competitor clone/venv/manual registration; Windows certification remains open |
+| Trusted distribution | Stronger source contract | Production incomplete | Competitor has no trust mechanism; Reckon ceremony, drills, and five-channel release remain open |
+| Natural routing | Claim not reproducible | Unverified claim | Neither product has a controlled versioned routing-frequency dataset |
+| Claimed savings | Claim not reproducible | Unverified claim | Competitor percentages lack equivalent-case raw production data |
+
+## What is factual to say
+
+It is factual to say that Reckon is a more complete local code-intelligence
+system than the pinned Token Optimizer implementation: it passes the pinned
+operation-level structural and compression oracles and adds graph
+relationships, impact/review context, failure diagnosis, freshness, lifecycle,
+portfolio, private measurement, and update-trust machinery.
+
+It is not yet factual to say “better across all dimensions” or “production
+supply-chain complete.” Contained execution is macOS-only, onboarding
+certification has named gaps, and the production trust
+and distribution exercises remain open. Release-facing language must retain
+those qualifications until C60, C62–C67 close with live evidence.
+
+## Reproduce
+
+```bash
+npm run audit:token-optimizer
+REPLAY_OUTPUT="$(mktemp -t reckon-token-optimizer-replay.XXXXXX.json)"
+npm run bench:token-optimizer -- "$REPLAY_OUTPUT"
+npx vitest run src/__tests__/unit/docs-integrity.spec.ts
+```
+
+The source audit requires authenticated GHES access. The replay is pinned to
+immutable competitor blobs and records cold/warm latency, serialized bytes,
+real `o200k_base` tokens, shared correctness oracles, and explicit gaps.

package/docs/releases/0.5.1.md

@@ -5,13 +5,13 @@ distribution surface.
 
 ## Canonical identity
 
-- The GitHub organization and repository are `knodin/knodin`.
-- Package metadata, release attestations, documentation, and planned Homebrew
-  paths no longer use the temporary `knowdin` organization spelling.
+- The product and npm package use the `knodin` name.
+- Correction: `knodin/knodin` is the Homebrew-tap repository. The authoritative
+  source repository remains `DTS-Productivity-Engineering/reckon-graph` until a
+  separately authorized GitHub repository rename occurs.
 
 ## npm branding
 
 - The caret-beak SVG is included in the published package.
 - The README loads the logo through the public npm CDN, so it renders on npm
   even while the source repository remains private.
-

package/docs/releases/0.8.0.md

@@ -0,0 +1,74 @@
+# knodin 0.8.0
+
+This release makes repository-wide setup more dependable, strengthens the
+one-tool MCP gateway, adds a whole-repository architecture visualization, and
+completes the move to knodin's authoritative source repository.
+
+It is a minor rather than a patch release because `knodin visualize` and
+`knodin index` each gain a new user-facing capability. Note that npm published
+0.7.6 from the previous source repository; 0.7.7 was prepared but never
+released, and its changes are included here.
+
+- Repository initialization is uncapped by default, preventing large checkouts
+  from being terminated at the former 768 MiB ceiling. Teams that need a bound
+  can set `repositoryInitialization.memoryLimitMiB` or pass
+  `--memory-limit-mib`; the minimum configured limit is 128 MiB.
+- Multi-repository initialization reports bounded progress and per-repository
+  outcomes while continuing to skip linked worktrees by default.
+- `knodin visualize --scope repo` draws the repository's dependency graph as a
+  self-contained SVG artifact, with `--granularity file` or `symbol`. It reads
+  every recorded dependency rather than a ranked summary, states how much the
+  node, edge, and byte budgets withheld, and distinguishes edges backed by a
+  narrow source declaration from heuristic or inferred ones. Coordinates are
+  computed when the artifact is written, so it contains no script, makes no
+  network request, and reproduces byte-identical output from identical
+  evidence. The `--max-bytes` ceiling rises to 2097152 to accommodate it.
+- `knodin index --sarif <file>` imports another analyzer's findings from a SARIF
+  log. SARIF rather than a specific tool means one importer covers Salesforce
+  Code Analyzer, ESLint, Semgrep, CodeQL, PMD and Trivy. Findings are stored
+  separately from symbols and references and never merged into them: knodin
+  resolves references from source, while a finding is another tool's judgement
+  about a location. What the graph adds is ranking, since an analyzer reports
+  findings file by file and cannot know which files matter. Locations resolve
+  through symlinks, and a finding that cannot be placed inside the repository is
+  counted rather than attached to a guessed path.
+- Every import bound is now overridable, for both SARIF and SCIP, and each
+  refusal names the flag and a value that would admit the input. A ceiling the
+  operator cannot move is just a failure. Two limits remain outside knodin's
+  control and are reported as such: a SARIF log is parsed whole, so one beyond
+  roughly 512 MiB cannot be read by this runtime at all, and a smaller log can
+  still exhaust the default heap.
+- `knodin index --scip <file>` no longer treats the SCIP index itself as a
+  source file to index. Command-scoped flag values were being mistaken for
+  positional paths.
+- Indexing no longer overflows the call stack on large repositories. Appending
+  the file list by spreading it as arguments exceeded the runtime's argument
+  limit; observed on a 40,000-file checkout.
+- Independent CLI or MCP processes can no longer run repair concurrently
+  against one worktree. A second repair reports the holding process and its
+  start time, and a lease left by a crashed process recovers automatically.
+- Invoking knodin from a Node.js 20 project no longer fails. The launcher
+  locates a supported Node.js 24 or newer runtime and relaunches into it,
+  exiting with that runtime's status or signal. The Node.js 20-to-24 handoff
+  is covered by unit tests; the packaged smoke test certifies it on Node.js 26
+  only.
+- The MCP gateway enforces documented freshness and diagnostics bounds at the
+  schema boundary and resolves Git only from trusted installation locations.
+- Diagnostics documentation now uses `sinceHours` consistently, and repository
+  documentation accurately describes the 250 ms memory-enforcement interval.
+- Package metadata, release verification, and mirror policy now point to the
+  authoritative `DTS-Productivity-Engineering/knodin` repository. Homebrew
+  installs from the `knodin/homebrew-tap` formula, which consumes the published
+  npm tarball, and the Enterprise Apps GHES repository remains a read-only
+  mirror.
+- Competitive outcome and behavior-contract evaluations remain reproducible
+  from checked-in fixtures without turning narrow results into unsupported
+  superiority claims.
+
+Knodin remains local-first: indexing and diagnostics do not require a hosted
+service, authentication, or source-code upload. Diagnostics bundles are created
+only on explicit request and are never uploaded automatically.
+
+This is an ordinary 0.x release, not a GA declaration. External certification
+and enterprise-governance evidence remain outside this release and are not
+claimed by it.

package/docs/releases/0.8.2.md

@@ -0,0 +1,34 @@
+# knodin 0.8.2
+
+This patch release makes command startup resilient to a deleted working
+directory and completes a full-baseline Sonar audit of the repository.
+
+- `knodin --version` no longer crashes with `uv_cwd` when the directory inherited
+  by the process has been removed. Cold structural and compression fast paths now
+  resolve the working directory only when the selected command actually needs a
+  repository. The built launcher is exercised from a deleted directory as part
+  of release verification.
+- Fixes inert Terraform indexing code that prepared reference and dependency
+  inserts from collections that could only be empty.
+- Makes the impact-query test-file regular expression's alternation explicit,
+  preserving its intended matching precedence.
+- Records the disposition of the complete Sonar baseline: 1,351 retained issue
+  records were inspected, including 375 that were open at the start. Correctness
+  findings were fixed; security and maintainability findings rejected after
+  validation now have checked-in, rule-scoped exclusions and rationale.
+- The post-remediation SonarQube scan passes its quality gate with zero open and
+  zero unresolved issues. The exclusions do not disable unreviewed rules,
+  coverage, duplication analysis, or the quality gate.
+
+If Homebrew is invoked from a directory that has already been deleted, change
+to an existing directory before upgrading because Homebrew itself requires a
+valid working directory:
+
+```sh
+cd /
+brew update
+brew upgrade knodin/tap/knodin
+knodin --version
+```
+
+This remains an ordinary 0.x release, not a dogfood-only build and not GA.

package/package.json

@@ -1,15 +1,15 @@
 {
 	"name": "knodin",
-	"version": "0.7.5",
+	"version": "0.8.2",
 	"description": "knodin — source-evidenced local code intelligence with known bounds. Stable identity, fresh evidence, truthful budgets, and recoverable bounded views.",
 	"license": "MIT",
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/knodin/knodin.git"
+		"url": "git+https://github.com/DTS-Productivity-Engineering/knodin.git"
 	},
-	"homepage": "https://github.com/knodin/knodin#readme",
+	"homepage": "https://github.com/DTS-Productivity-Engineering/knodin#readme",
 	"bugs": {
-		"url": "https://github.com/knodin/knodin/issues"
+		"url": "https://github.com/DTS-Productivity-Engineering/knodin/issues"
 	},
 	"publishConfig": {
 		"access": "public",
@@ -24,7 +24,11 @@
 		"docs/DEAD-CODE-AND-IMPACT.md",
 		"docs/DOCTOR-AND-UPDATES.md",
 		"docs/DIAGNOSTICS.md",
+		"docs/BEHAVIORAL-CONTRACT.md",
+		"docs/COMPARISON.md",
+		"docs/COMPETITIVE-LANDSCAPE-2026-08.md",
 		"docs/INDEXING-POLICY-AND-PROVENANCE.md",
+		"docs/HANDOFF.md",
 		"docs/INSTALLATION.md",
 		"docs/MCP.md",
 		"docs/COMMAND-OUTPUT-COMPRESSION.md",
@@ -51,10 +55,16 @@
 		"docs/releases/0.7.3.md",
 		"docs/releases/0.7.4.md",
 		"docs/releases/0.7.5.md",
+		"docs/releases/0.8.0.md",
+		"docs/releases/0.8.2.md",
 		"docs/assets/knodin-favicon.svg",
 		"docs/SYSTEMS-AND-RELATIONSHIPS.md",
 		"docs/TELEMETRY.md",
+		"docs/TOKEN-OPTIMIZER-SCORECARD.md",
+		"benchmarks/competitors/SYNTHESIS.md",
+		"roadmap/competitive-roadmap.md",
 		"schemas/release-attestation-v1.schema.json",
+		"schemas/support-bundle-v2.schema.json",
 		"*.wasm"
 	],
 	"engines": {
@@ -101,6 +111,9 @@
 		"verify:c87": "tsx scripts/verify-c87.ts",
 		"bench:c88": "tsx benchmarks/evaluations/c88-contained-execution/runner.ts",
 		"verify:c88": "tsx scripts/verify-c88.ts",
+		"bench:c93": "tsx benchmarks/evaluations/c93-engineering-outcomes/runner.ts",
+		"verify:c93": "tsx scripts/verify-c93.ts",
+		"verify:c95": "tsx scripts/verify-c95.ts && vitest run src/__tests__/unit/behavior-contract.spec.ts src/__tests__/unit/failure-diagnosis.spec.ts src/__tests__/unit/impact.spec.ts src/__tests__/unit/freshness.spec.ts",
 		"bench:ann": "bun scripts/ann-bench.ts",
 		"bench:perf": "tsx scripts/perf-bench.ts",
 		"bench:competitive": "tsx scripts/competitive-bakeoff.ts",