sigmap 8.34.0 → 8.35.0

package/CHANGELOG.md

@@ -10,6 +10,19 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [8.35.0] — 2026-09-13
+
+### Added
+- **Extractor ceilings raised to Java parity** (#576, PR #606) — completing the half of #576 that eec4a21 deliberately split out. Three layers of silent truncation raised together: per-class member ceilings 8 (6 for gdscript) → 120, per-file ceilings 25–50 → 200 so the configured `maxSigsPerFile` governs output rather than a literal buried in each extractor, and — the dominant hider on real repos — class-body scans capped at 2–5 KB in 11 extractors versus Java's 200 KB, which silently discarded every member past the window *and* anchored class end-lines short. akka's `scaladsl/Source.scala` now extracts 48 typed members spanning `:241-1033`; before, 8 members with the end anchor near the top of the file. The bare `methods.slice(0, 8)` in go/python/rust — missed by the disclosure pass because the guard regex only matched `members|sigs` — is now disclosed and raised, and the guard covers `methods`. The original attempt at this was rejected by CI reading hard hit@5 as 75.6% → 72.2%; re-measured with the order-invariant gate below, hard is 75.6% → 75.6% bit-stable. The rejection was the instrument. Cost, measured: jvm 23.0% → 21.3% (net −1 of 61, akka same-band reshuffles under a corpus with ~15× more visible members) and member-heavy repos keep 1–2pp more tokens (serilog 96.3% → 94.9%, okhttp 94.3% → 92.1%) with the token budget still capping context size
+- **`server/discover` (MCP spec 2026-07-28)** implemented session-less, per the schema: `CacheableResult` envelope (`resultType`/`cacheScope`/`ttlMs`) + `supportedVersions` + `capabilities` + `serverInfo`, deterministic so the TTL stability promise holds. Clients can learn the honest version list before any handshake — forward-compatible plumbing, deliberately *not* a claim to serve that revision's whole surface (#545, PR #607)
+
+### Fixed
+- **Gate scores no longer depend on git history depth** (#596, PR #604). The graph-boost hop-1 loop evaluated its seed condition (`score > 0`) while mutating scores in place, so a zero-scored file boosted by an earlier-visited seed became a seed itself — but only when it sat after its booster in the index, and index order is what git history changes via the recent-commits hoist. 108 of 113 gate queries had such cascade seeds; reversing index insertion order alone changed the top-5 on 76 of 113 tasks. A shallow CI checkout therefore scored differently from a developer clone of the same commit — the disagreement that kept the retrieval baseline deliberately un-recorded for two releases. Seeds are now snapshotted before the loop (as the call-graph block always did, with the comment "so boosts never cascade") and hop-2 eligibility is frozen after hop-1. Ranking is bit-identical across insertion orders and git depths; hard rose 72.2% → 75.6% as removed cascade noise stopped crediting near-hub files (`truncate.js` carried graphBoost up to +10.4) into top-5 slots they had not earned. Baseline re-recorded and trustworthy again, unblocking #592 and #576
+- **Token-budget drop order ran inverted on JVM repos** (#592, PR #605). "Drop test files first" only recognised `.test.`/`.spec.`/`_test.` filename patterns, so `src/test/java/**` and `*Tests.java` competed as ordinary production code — and won on recency. spring-petclinic's budget kept all 17 test files while dropping the application entry point, the `owner` entity package, and every owner template; the matrix retrieval benchmark could not return files that were not in the context, and no ranking change could have fixed it — the issue's original "sibling disambiguation" hypothesis did not survive measurement. Path-segment conventions (`test|tests|spec|specs|__tests__|e2e`) and PascalCase `*Test/*Tests/*Spec` suffixes now classify correctly (with a case guard so `contest.java` stays production), and entry points (`main.*`, `*Application.java`, `Program.cs`) get their own drop priority — the entry point is the most orientation-valuable file in a repo yet tiny, so the fewest-sigs tie-break was killing it. petclinic 60% → 80%, vapor 0% → 20%, riverpod 100% → 80% (three same-named `analysis_options.yaml` siblings became visible — completeness making ranking honestly harder), net +1 task across 18 repos; gated corpora untouched
+- **MCP handshake echoed unspeakable protocol versions** (#544, PR #607). `initialize` returned whatever `protocolVersion` the client offered — the exact violation `@hasmcp/mcp-spec-test` reported, and the root cause of the companion report: the echo made the suite believe 2026-07-28 was supported, producing six phantom `server/discover` failures on a revision the server never really claimed (#545). Negotiation now runs against an explicit supported list (`2025-11-25` … `2024-11-05`); an unsupported or absent offer gets the newest supported version, never an echo, and `tools/list` rejects cursors it never issued with `-32602` (the spec's SHOULD) instead of silently restarting from page one. Conformance verdicts on both tested revisions went from **not conformant** (1 and 6 violations) to **conformant on what could be checked** (0 failures; remaining skips are honest inapplicability)
+
+---
+
 ## [8.34.0] — 2026-09-13
 
 ### Added

package/README.md

@@ -59,10 +59,10 @@ That map is exactly what agentic grep is worst at: reproducible, auditable conte
 
 **Proof it pays off** (full benchmark below):
 <!--SM:whyMetrics-->
-- **78.9% hit@5** — right file in top 5 results (vs 44.0% single-shot grep baseline — 1.73× lift)
-- **96.8% token reduction** — average across 21 real repos
-- **62.9% task-success proxy** — modeled from retrieval tiers, not measured LLM sessions
-- **1.58 prompts per task** — down from 2.84 (44.4% fewer retries, modeled)
+- **78.6% hit@5** — right file in top 5 results (vs 44.0% single-shot grep baseline — 1.73× lift)
+- **96.6% token reduction** — average across 21 real repos
+- **61.0% task-success proxy** — modeled from retrieval tiers, not measured LLM sessions
+- **1.61 prompts per task** — down from 2.84 (43.4% fewer retries, modeled)
 <!--/SM:whyMetrics-->
 - **<!--SM:languages-->33<!--/SM:languages--> languages supported** — TypeScript, Python, Go, Rust, Java, R, and more
 - **No vendor lock-in** — works with any AI assistant or local LLM
@@ -122,13 +122,13 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 <!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v8.34-main (21 repositories, including R language)
+Benchmark : sigmap-v8.35-main (21 repositories, including R language)
 Date      : 2026-09-13
 
-Hit@5          : 78.9%   (grep-agent baseline 44.0%  — 1.73× lift)
-Token reduction: 96.8%   (across 21 repos)
-Prompt reduction : 44.4% (2.84 → 1.58 prompts per task, modeled)
-Task success   : 62.9%   (proxy — modeled from retrieval tiers)
+Hit@5          : 78.6%   (grep-agent baseline 44.0%  — 1.73× lift)
+Token reduction: 96.6%   (across 21 repos)
+Prompt reduction : 43.4% (2.84 → 1.61 prompts per task, modeled)
+Task success   : 61.0%   (proxy — modeled from retrieval tiers)
 Repos tested   : 21 (JavaScript, Python, Go, Rust, Java, R, C++, C#, Dart, Swift, Ruby, PHP, Scala, Kotlin, and more)
 ```
 <!--/SM:benchmarkBlock-->