nubos-pilot 1.2.1 → 1.2.2

package/CHANGELOG.md

@@ -4,7 +4,39 @@ All notable changes to nubos-pilot are documented in this file. Format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning
 follows [SemVer](https://semver.org/spec/v2.0.0.html).
 
-## [1.1.4] — 2026-05-25
+## [1.2.2] — 2026-06-05
+
+A dependency graph for the codebase you work in, plus stricter checks on nubos-pilot's own data.
+
+- `np:scan-codebase` now builds a module dependency graph and writes it to `.nubos-pilot/codebase/.graph.json`. The new `np:graph-impact` command shows what a change touches before you make it. It reports which modules depend on a file, what that file depends on, and any dependency cycle it sits in. The graph reads relative imports only. It builds no AST and adds no dependencies.
+- Persisted state files are now validated on read against versioned schemas. A corrupt single-document store fails with a clear error code. A bad line in an append-only log is skipped, not fatal.
+- The reference docs now list every error code. That list is generated from source and checked on each build, so it cannot drift from the code.
+- Internal logging goes through one structured logger. A test keeps `console.*` out of `lib/` and `bin/np-tools/`.
+- Added `ATTRIBUTIONS.md`. It names the third-party packages nubos-pilot uses and their licenses.
+
+Full documentation at <https://pilot.nubos.cloud>.
+
+## [1.2.1] — 2026-06-02
+
+Two always-on quality layers that act while the agent writes code.
+
+- In-session security review: nubos-pilot reviews the code it writes for
+  vulnerabilities while it works and fixes findings in the same session,
+  before they reach a pull request. Three non-blocking depths — an instant
+  per-edit pattern scan with no model call, a background semantic review of
+  the turn's diff at end of turn, and a deeper review that reads surrounding
+  code on each commit or push the agent makes.
+- The security reviewer runs independently with a fresh context, reports each
+  finding once, and never blocks a write or commit. Extend it with custom
+  pattern rules and a review guidance file; built-in checks stay on.
+- Requirements-aware executor: `/np:execute-phase` injects the milestone
+  success criteria into the executor as its acceptance target, so it writes
+  against the requirements from the first round, not just the verify command.
+- New configuration blocks `security.*` and `conformance.*`.
+
+Full documentation at <https://pilot.nubos.cloud>.
+
+## [1.2.0] — 2026-05-25
 
 Public release.
 

package/bin/np-tools/_commands.cjs

@@ -36,6 +36,7 @@ const COMMANDS = [
   { name: 'doctor',              category: 'Install', description: '12-check install-integrity scan (--fix for auto-safe fixes)', description_de: '12-Check-Install-Integritäts-Scan (--fix für auto-sichere Fixes)' },
   { name: 'scan-codebase',       category: 'Install', description: 'Initial deep codebase inventory → .nubos-pilot/codebase/ skill docs', description_de: 'Initiale tiefe Codebase-Inventur → .nubos-pilot/codebase/ Skill-Docs' },
   { name: 'update-docs',         category: 'Install', description: 'Refresh stale module docs after code changes', description_de: 'Aktualisiert veraltete Modul-Docs nach Code-Änderungen' },
+  { name: 'graph-impact',        category: 'Utility', description: 'Query the module dependency graph (.graph.json from np:scan-codebase): impact (transitive dependents), dependencies, cluster, cycle membership. Flags: --module <id> | --path <relpath> | --cycles', description_de: 'Fragt den Modul-Dependency-Graphen ab (.graph.json aus np:scan-codebase): Impact (transitive Dependents), Dependencies, Cluster, Zyklus-Zugehörigkeit. Flags: --module <id> | --path <relpath> | --cycles' },
 
   { name: 'resolve-model',       category: 'Utility', description: 'Resolve agent/tier to model alias or id (Tier×Profile matrix)', description_de: 'Löst Agent/Tier zu Model-Alias oder -ID auf (Tier×Profile-Matrix)' },
   { name: 'metrics',             category: 'Utility', description: 'Record JSONL metrics entry (record | now | start-timestamp | end-timestamp)', description_de: 'Schreibt JSONL-Metrics-Eintrag (record | now | start-timestamp | end-timestamp)' },

package/bin/np-tools/doctor.cjs

@@ -399,14 +399,27 @@ function _checkNubosloopKnowledgeStore(projectRoot) {
   }
   try {
     const parsed = JSON.parse(fs.readFileSync(learningsPath, 'utf-8'));
-    if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.learnings)) {
+    const { STORE_VERSION } = require('../../lib/learnings.cjs');
+    const { validate } = require('../../lib/validate.cjs');
+    const isObject = parsed && typeof parsed === 'object' && !Array.isArray(parsed);
+    let errors;
+    if (isObject && parsed.version === STORE_VERSION) {
+      errors = validate(parsed, 'learnings.v1');
+    } else if (!isObject || !Array.isArray(parsed.learnings)) {
+      errors = [{ message: 'expected JSON object with `version` and `learnings[]`' }];
+    } else {
+      errors = [];
+    }
+    if (errors.length) {
       issues.push({
         id: 'nubosloop-knowledge-store-corrupt',
         severity: 'warn',
         fixable: 'manual',
         details: {
           path: learningsPath,
-          hint: 'expected JSON with `version` and `learnings[]`; remove or restore from a backup.',
+          violations: errors.length,
+          first: errors[0].message,
+          hint: 'store violates the learnings.v1 schema; remove or restore from a backup.',
         },
       });
     }

package/bin/np-tools/graph-impact.cjs

@@ -0,0 +1,111 @@
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { NubosPilotError } = require('../../lib/core.cjs');
+const g = require('../../lib/codebase-graph.cjs');
+
+function _parseArgs(args) {
+  const flags = { cwd: null, module: null, filePath: null, cycles: false };
+  for (let i = 0; i < (args || []).length; i++) {
+    const a = args[i];
+    if (a === '--cwd') flags.cwd = args[++i];
+    else if (a === '--module') flags.module = args[++i];
+    else if (a === '--path') flags.filePath = args[++i];
+    else if (a === '--cycles') flags.cycles = true;
+  }
+  return flags;
+}
+
+function _graphPath(projectRoot) {
+  return path.join(projectRoot, '.nubos-pilot', 'codebase', '.graph.json');
+}
+
+function _load(projectRoot) {
+  const p = _graphPath(projectRoot);
+  let raw;
+  try {
+    raw = fs.readFileSync(p, 'utf-8');
+  } catch {
+    throw new NubosPilotError(
+      'graph-not-found',
+      'module graph not found — run np:scan-codebase first',
+      { path: '.nubos-pilot/codebase/.graph.json' },
+    );
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new NubosPilotError(
+      'graph-unreadable',
+      'module graph is not valid JSON — re-run np:scan-codebase',
+      { path: '.nubos-pilot/codebase/.graph.json', cause: err && err.message },
+    );
+  }
+}
+
+function _moduleForPath(graph, rel) {
+  const norm = rel.split(path.sep).join('/');
+  const dir = norm.includes('/') ? norm.slice(0, norm.lastIndexOf('/')) : '';
+  const node = (graph.nodes || []).find((n) => n.directory === dir);
+  return node ? node.id : null;
+}
+
+function run(args, ctx) {
+  const context = ctx || {};
+  const stdout = context.stdout || process.stdout;
+  const flags = _parseArgs(args);
+  const projectRoot = path.resolve(flags.cwd || context.cwd || process.cwd());
+  const graph = _load(projectRoot);
+
+  if (flags.cycles && !flags.module && !flags.filePath) {
+    stdout.write(JSON.stringify({
+      module_count: graph.module_count,
+      cycle_count: (graph.cycles || []).length,
+      cycles: graph.cycles || [],
+    }, null, 2));
+    return 0;
+  }
+
+  let moduleId = flags.module;
+  if (!moduleId && flags.filePath) {
+    moduleId = _moduleForPath(graph, flags.filePath);
+    if (!moduleId) {
+      throw new NubosPilotError(
+        'graph-path-unmapped',
+        'no module owns that path: ' + flags.filePath,
+        { path: flags.filePath },
+      );
+    }
+  }
+  if (!moduleId) {
+    throw new NubosPilotError(
+      'graph-missing-target',
+      '--module <id> or --path <relpath> required',
+      {},
+    );
+  }
+  if (!(graph.nodes || []).some((n) => n.id === moduleId)) {
+    throw new NubosPilotError(
+      'graph-unknown-module',
+      'module not in graph: ' + moduleId,
+      { module: moduleId },
+    );
+  }
+
+  stdout.write(JSON.stringify({
+    module: moduleId,
+    direct_dependents: g.directDependents(graph, moduleId),
+    impact: g.transitiveDependents(graph, moduleId),
+    direct_dependencies: g.directDependencies(graph, moduleId),
+    transitive_dependencies: g.transitiveDependencies(graph, moduleId),
+    cluster: g.clusterOf(graph, moduleId),
+    in_cycle: g.cycleFor(graph, moduleId),
+  }, null, 2));
+  return 0;
+}
+
+module.exports = { run, _parseArgs };
+
+if (require.main === module) {
+  process.exit(run(process.argv.slice(2)) || 0);
+}

package/bin/np-tools/graph-impact.test.cjs

@@ -0,0 +1,119 @@
+const { test, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+
+const cli = require('./graph-impact.cjs');
+
+const _sandboxes = [];
+
+function makeSandbox() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'np-gi-'));
+  _sandboxes.push(dir);
+  return dir;
+}
+
+function writeGraph(root, graph) {
+  const dir = path.join(root, '.nubos-pilot', 'codebase');
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(dir, '.graph.json'), JSON.stringify(graph));
+}
+
+function capture() {
+  let buf = '';
+  return { stream: { write: (s) => { buf += s; } }, read: () => buf };
+}
+
+const SAMPLE = {
+  schema_version: 1,
+  module_count: 3,
+  edge_count: 2,
+  nodes: [
+    { id: 'a', directory: 'a', primary_language: 'javascript', file_count: 1 },
+    { id: 'b', directory: 'b', primary_language: 'javascript', file_count: 1 },
+    { id: 'c', directory: 'c', primary_language: 'javascript', file_count: 1 },
+  ],
+  edges: [
+    { from: 'a', to: 'b', weight: 1 },
+    { from: 'b', to: 'c', weight: 1 },
+  ],
+  cycles: [],
+  clusters: [{ id: 0, members: ['a', 'b', 'c'] }],
+  metrics: { unresolved_internal_deps: 0, max_fan_in: 1, max_fan_out: 1, isolated_modules: 0 },
+};
+
+afterEach(() => {
+  while (_sandboxes.length) {
+    const dir = _sandboxes.pop();
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
+  }
+});
+
+test('GI-1: --module reports impact and dependencies', () => {
+  const root = makeSandbox();
+  writeGraph(root, SAMPLE);
+  const out = capture();
+  const rc = cli.run(['--module', 'c'], { cwd: root, stdout: out.stream });
+  assert.equal(rc, 0);
+  const res = JSON.parse(out.read());
+  assert.equal(res.module, 'c');
+  assert.deepEqual(res.direct_dependents, ['b']);
+  assert.deepEqual(res.impact, ['a', 'b']);
+  assert.deepEqual(res.transitive_dependencies, []);
+});
+
+test('GI-2: --path maps a file to its owning module', () => {
+  const root = makeSandbox();
+  writeGraph(root, SAMPLE);
+  const out = capture();
+  cli.run(['--path', 'a/login.js'], { cwd: root, stdout: out.stream });
+  const res = JSON.parse(out.read());
+  assert.equal(res.module, 'a');
+  assert.deepEqual(res.direct_dependencies, ['b']);
+});
+
+test('GI-3: missing graph throws graph-not-found', () => {
+  const root = makeSandbox();
+  assert.throws(
+    () => cli.run(['--module', 'a'], { cwd: root, stdout: capture().stream }),
+    (err) => err.code === 'graph-not-found',
+  );
+});
+
+test('GI-4: unknown module throws graph-unknown-module', () => {
+  const root = makeSandbox();
+  writeGraph(root, SAMPLE);
+  assert.throws(
+    () => cli.run(['--module', 'nope'], { cwd: root, stdout: capture().stream }),
+    (err) => err.code === 'graph-unknown-module',
+  );
+});
+
+test('GI-5: no target throws graph-missing-target', () => {
+  const root = makeSandbox();
+  writeGraph(root, SAMPLE);
+  assert.throws(
+    () => cli.run([], { cwd: root, stdout: capture().stream }),
+    (err) => err.code === 'graph-missing-target',
+  );
+});
+
+test('GI-6: --cycles dumps the cycle list', () => {
+  const root = makeSandbox();
+  writeGraph(root, Object.assign({}, SAMPLE, { cycles: [['a', 'b']] }));
+  const out = capture();
+  cli.run(['--cycles'], { cwd: root, stdout: out.stream });
+  const res = JSON.parse(out.read());
+  assert.equal(res.cycle_count, 1);
+  assert.deepEqual(res.cycles[0], ['a', 'b']);
+});
+
+test('GI-7: unmappable --path throws graph-path-unmapped', () => {
+  const root = makeSandbox();
+  writeGraph(root, SAMPLE);
+  assert.throws(
+    () => cli.run(['--path', 'ghost/x.js'], { cwd: root, stdout: capture().stream }),
+    (err) => err.code === 'graph-path-unmapped',
+  );
+});

package/bin/np-tools/scan-codebase.cjs

@@ -18,6 +18,7 @@ const {
   moduleDocPath,
   indexDocPath,
 } = require('../../lib/codebase-docs.cjs');
+const { buildModuleGraph } = require('../../lib/codebase-graph.cjs');
 
 function _parseArgs(args) {
   const flags = {
@@ -73,6 +74,16 @@ function _emitPlan(projectRoot, flags, stdout) {
       projectRoot,
       path.join(projectRoot, '.nubos-pilot', 'codebase', '.hashes.json'),
     ),
+    graph_path: path.relative(
+      projectRoot,
+      path.join(projectRoot, '.nubos-pilot', 'codebase', '.graph.json'),
+    ),
+    graph: {
+      module_count: modulesResult.graph.module_count,
+      edge_count: modulesResult.graph.edge_count,
+      cycle_count: modulesResult.graph.cycles.length,
+      unresolved_internal_deps: modulesResult.graph.metrics.unresolved_internal_deps,
+    },
   }, null, 2));
 }
 
@@ -103,6 +114,15 @@ function _scanAndBuild(projectRoot, flags) {
   fs.mkdirSync(path.dirname(indexMapPath), { recursive: true });
   atomicWriteFileSync(indexMapPath, JSON.stringify(docIndex, null, 2) + '\n');
 
+  const graph = buildModuleGraph(modules.map((m) => m.facts));
+  const graphPath = path.join(
+    projectRoot,
+    '.nubos-pilot',
+    'codebase',
+    '.graph.json',
+  );
+  atomicWriteFileSync(graphPath, JSON.stringify(graph, null, 2) + '\n');
+
   const indexPath = indexDocPath(projectRoot);
   fs.mkdirSync(path.dirname(indexPath), { recursive: true });
   atomicWriteFileSync(indexPath, buildIndexDoc(modules, { project_name: flags.projectName || null }));
@@ -115,7 +135,7 @@ function _scanAndBuild(projectRoot, flags) {
     atomicWriteFileSync(docPath, renderModuleDoc(mod.facts, null, hashLookup));
   }
 
-  return { scan: scanResult, modules, manifest, hashLookup };
+  return { scan: scanResult, modules, manifest, hashLookup, graph };
 }
 
 function _applyProse(projectRoot, flags, stdout) {

package/lib/checkpoint.cjs

@@ -10,8 +10,10 @@ const {
 } = require('./core.cjs');
 const { parseState, serializeState } = require('./state.cjs');
 const { TASK_ID_RE } = require('./ids.cjs');
+const { assertValid } = require('./validate.cjs');
 
 const CHECKPOINT_SCHEMA_VERSION = 1;
+const STORE_SCHEMA = 'checkpoint.v1';
 
 function _assertSafeTaskId(taskId) {
   if (typeof taskId !== 'string' || !TASK_ID_RE.test(taskId)) {
@@ -78,6 +80,7 @@ function _assertCompatibleSchema(existing, cpPath) {
       },
     );
   }
+  assertValid(existing, STORE_SCHEMA, 'checkpoint-corrupt', { path: cpPath });
 }
 
 function _sliceFromTaskId(taskId) {

package/lib/codebase-graph.test.cjs

@@ -0,0 +1,174 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+
+const g = require('./codebase-graph.cjs');
+
+function fact(id, directory, files, extra) {
+  const source_paths = files.map((f) => f.path);
+  return Object.assign({
+    id,
+    name: directory || 'root',
+    directory: directory || '',
+    primary_language: 'javascript',
+    language_distribution: { javascript: files.length },
+    file_count: files.length,
+    source_paths,
+    symbols: [],
+    internal_deps: [],
+    external_deps: [],
+    files,
+  }, extra || {});
+}
+
+test('CG-1: buildModuleGraph creates a node per fact', () => {
+  const facts = [
+    fact('src-auth', 'src/auth', [{ path: 'src/auth/login.js', language: 'javascript', symbols: [], deps: [] }]),
+    fact('src-db', 'src/db', [{ path: 'src/db/index.js', language: 'javascript', symbols: [], deps: [] }]),
+  ];
+  const graph = g.buildModuleGraph(facts);
+  assert.equal(graph.module_count, 2);
+  assert.deepEqual(graph.nodes.map((n) => n.id), ['src-auth', 'src-db']);
+});
+
+test('CG-2: relative import resolves to a cross-module edge', () => {
+  const facts = [
+    fact('src-auth', 'src/auth', [
+      { path: 'src/auth/login.js', language: 'javascript', symbols: [], deps: ['../db', 'bcrypt'] },
+    ]),
+    fact('src-db', 'src/db', [
+      { path: 'src/db/index.js', language: 'javascript', symbols: [], deps: [] },
+    ]),
+  ];
+  const graph = g.buildModuleGraph(facts);
+  assert.equal(graph.edge_count, 1);
+  assert.deepEqual(graph.edges[0], { from: 'src-auth', to: 'src-db', weight: 1 });
+});
+
+test('CG-3: external (non-relative) deps never become edges', () => {
+  const facts = [
+    fact('src-auth', 'src/auth', [
+      { path: 'src/auth/login.js', language: 'javascript', symbols: [], deps: ['bcrypt', 'node:fs'] },
+    ]),
+  ];
+  const graph = g.buildModuleGraph(facts);
+  assert.equal(graph.edge_count, 0);
+});
+
+test('CG-4: same-module relative import is not a self-edge', () => {
+  const facts = [
+    fact('src-auth', 'src/auth', [
+      { path: 'src/auth/login.js', language: 'javascript', symbols: [], deps: ['./session'] },
+      { path: 'src/auth/session.js', language: 'javascript', symbols: [], deps: [] },
+    ]),
+  ];
+  const graph = g.buildModuleGraph(facts);
+  assert.equal(graph.edge_count, 0);
+});
+
+test('CG-5: repeated imports raise edge weight', () => {
+  const facts = [
+    fact('a', 'a', [
+      { path: 'a/one.js', language: 'javascript', symbols: [], deps: ['../b'] },
+      { path: 'a/two.js', language: 'javascript', symbols: [], deps: ['../b/helper'] },
+    ]),
+    fact('b', 'b', [
+      { path: 'b/index.js', language: 'javascript', symbols: [], deps: [] },
+      { path: 'b/helper.js', language: 'javascript', symbols: [], deps: [] },
+    ]),
+  ];
+  const graph = g.buildModuleGraph(facts);
+  assert.equal(graph.edges.length, 1);
+  assert.equal(graph.edges[0].weight, 2);
+});
+
+test('CG-6: unresolved internal-looking deps are counted, not edged', () => {
+  const facts = [
+    fact('a', 'a', [
+      { path: 'a/one.js', language: 'javascript', symbols: [], deps: ['../nonexistent'] },
+    ]),
+  ];
+  const graph = g.buildModuleGraph(facts);
+  assert.equal(graph.edge_count, 0);
+  assert.equal(graph.metrics.unresolved_internal_deps, 1);
+});
+
+test('CG-7: Tarjan detects a 2-module cycle', () => {
+  const facts = [
+    fact('a', 'a', [{ path: 'a/x.js', language: 'javascript', symbols: [], deps: ['../b'] }]),
+    fact('b', 'b', [{ path: 'b/index.js', language: 'javascript', symbols: [], deps: ['../a'] }]),
+  ];
+  const graph = g.buildModuleGraph(facts);
+  assert.equal(graph.cycles.length, 1);
+  assert.deepEqual(graph.cycles[0], ['a', 'b']);
+});
+
+test('CG-8: acyclic graph reports no cycles', () => {
+  const facts = [
+    fact('a', 'a', [{ path: 'a/x.js', language: 'javascript', symbols: [], deps: ['../b'] }]),
+    fact('b', 'b', [{ path: 'b/index.js', language: 'javascript', symbols: [], deps: ['../c'] }]),
+    fact('c', 'c', [{ path: 'c/index.js', language: 'javascript', symbols: [], deps: [] }]),
+  ];
+  const graph = g.buildModuleGraph(facts);
+  assert.equal(graph.cycles.length, 0);
+});
+
+test('CG-9: transitive dependents (impact) walk the reverse graph', () => {
+  const facts = [
+    fact('a', 'a', [{ path: 'a/x.js', language: 'javascript', symbols: [], deps: ['../b'] }]),
+    fact('b', 'b', [{ path: 'b/index.js', language: 'javascript', symbols: [], deps: ['../c'] }]),
+    fact('c', 'c', [{ path: 'c/index.js', language: 'javascript', symbols: [], deps: [] }]),
+  ];
+  const graph = g.buildModuleGraph(facts);
+  assert.deepEqual(g.transitiveDependents(graph, 'c'), ['a', 'b']);
+  assert.deepEqual(g.directDependents(graph, 'c'), ['b']);
+  assert.deepEqual(g.transitiveDependencies(graph, 'a'), ['b', 'c']);
+  assert.deepEqual(g.directDependencies(graph, 'a'), ['b']);
+});
+
+test('CG-10: deterministic clustering groups a connected component together', () => {
+  const facts = [
+    fact('a', 'a', [{ path: 'a/x.js', language: 'javascript', symbols: [], deps: ['../b'] }]),
+    fact('b', 'b', [{ path: 'b/index.js', language: 'javascript', symbols: [], deps: ['../a'] }]),
+    fact('lonely', 'lonely', [{ path: 'lonely/z.js', language: 'javascript', symbols: [], deps: [] }]),
+  ];
+  const graph = g.buildModuleGraph(facts);
+  const first = g.buildModuleGraph(facts);
+  assert.deepEqual(graph.clusters, first.clusters);
+  const clusterAB = graph.clusters.find((c) => c.members.includes('a'));
+  assert.ok(clusterAB.members.includes('b'));
+  assert.ok(!clusterAB.members.includes('lonely'));
+});
+
+test('CG-11: cycleFor and clusterOf locate a module', () => {
+  const facts = [
+    fact('a', 'a', [{ path: 'a/x.js', language: 'javascript', symbols: [], deps: ['../b'] }]),
+    fact('b', 'b', [{ path: 'b/index.js', language: 'javascript', symbols: [], deps: ['../a'] }]),
+  ];
+  const graph = g.buildModuleGraph(facts);
+  assert.deepEqual(g.cycleFor(graph, 'a'), ['a', 'b']);
+  assert.equal(typeof g.clusterOf(graph, 'a'), 'number');
+  assert.equal(g.cycleFor(graph, 'missing'), null);
+  assert.equal(g.clusterOf(graph, 'missing'), null);
+});
+
+test('CG-12: root-relative (/-prefixed) deps resolve from project root', () => {
+  const facts = [
+    fact('src-auth', 'src/auth', [
+      { path: 'src/auth/login.js', language: 'javascript', symbols: [], deps: ['/src/db'] },
+    ]),
+    fact('src-db', 'src/db', [
+      { path: 'src/db/index.js', language: 'javascript', symbols: [], deps: [] },
+    ]),
+  ];
+  const graph = g.buildModuleGraph(facts);
+  assert.equal(graph.edge_count, 1);
+  assert.deepEqual(graph.edges[0], { from: 'src-auth', to: 'src-db', weight: 1 });
+});
+
+test('CG-13: empty facts yield an empty graph', () => {
+  const graph = g.buildModuleGraph([]);
+  assert.equal(graph.module_count, 0);
+  assert.equal(graph.edge_count, 0);
+  assert.deepEqual(graph.cycles, []);
+  assert.deepEqual(graph.clusters, []);
+});

package/lib/codebase-manifest.cjs

@@ -3,8 +3,10 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { atomicWriteFileSync, NubosPilotError } = require('./core.cjs');
+const { assertValid } = require('./validate.cjs');
 
 const SCHEMA_VERSION = 1;
+const STORE_SCHEMA = 'codebase-manifest.v1';
 const CODEBASE_DIR_NAME = 'codebase';
 const MANIFEST_FILENAME = '.hashes.json';
 
@@ -63,6 +65,7 @@ function readManifest(projectRoot) {
     );
   }
   if (!parsed.files || typeof parsed.files !== 'object') parsed.files = {};
+  assertValid(parsed, STORE_SCHEMA, 'manifest-invalid-shape', { path: p });
   return parsed;
 }