codegraph-brain 0.7.1__tar.gz → 0.7.3__tar.gz

{codegraph_brain-0.7.1 → codegraph_brain-0.7.3}/.github/workflows/ci.yml

@@ -19,6 +19,11 @@ jobs:
         with:
           enable-cache: true
 
+      - name: Lockfile in step with pyproject
+        # MUST run before `uv sync`: sync silently re-resolves and rewrites
+        # uv.lock, so a check placed after it would always pass.
+        run: uv lock --check
+
       - name: Install Dependencies
         run: uv sync --group dev
 

{codegraph_brain-0.7.1 → codegraph_brain-0.7.3}/.github/workflows/guardian.yml

@@ -67,7 +67,7 @@ jobs:
         uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
 
       - name: Install dependencies
-        run: uv sync --group guardian
+        run: uv sync --extra guardian
 
       - name: Build code graph
         run: uv run cgis ingest ./src --output graph.db

codegraph_brain-0.7.3/.github/workflows/release-please.yml

@@ -0,0 +1,147 @@
+name: Release Please
+
+on:
+  push:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  release-please:
+    name: Release Please
+    runs-on: ubuntu-latest
+    permissions:
+      # Scoped to this job only: the publish job below must never inherit
+      # write access to the repository.
+      contents: write
+      pull-requests: write
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+      release_pr: ${{ steps.release.outputs.pr }}
+    steps:
+      - name: Mint a GitHub App token
+        id: app-token
+        # A GITHUB_TOKEN-authored PR leaves its checks parked in
+        # `action_required` forever, so release-please needs an identity of its
+        # own. App tokens beat a PAT: one hour of life, auto-rotated, scoped to
+        # this repo, and not tied to anyone's personal account.
+        # continue-on-error: an unconfigured App must degrade, not break the release.
+        continue-on-error: true
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
+        with:
+          # Accepted from either store: the App ID is not sensitive, so a repo
+          # variable is conventional, but it is commonly filed as a secret.
+          app-id: ${{ vars.CGIS_APP_ID || secrets.CGIS_APP_ID }}
+          private-key: ${{ secrets.CGIS_APP_PRIVATE_KEY }}
+
+      - name: Run release-please
+        id: release
+        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071  # v4.4.1
+        with:
+          # Falls back to GITHUB_TOKEN when the App is not configured — the
+          # release still opens, its checks just need a manual nudge.
+          token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  relock:
+    name: Re-lock the release PR
+    needs: release-please
+    # Only when release-please actually has an open release PR to amend.
+    if: needs.release-please.outputs.release_pr != ''
+    runs-on: ubuntu-latest
+    permissions:
+      # Narrower than the release job: this one only pushes a lockfile.
+      contents: write
+    steps:
+      - name: Mint a GitHub App token
+        id: app-token
+        # A GITHUB_TOKEN-authored PR leaves its checks parked in
+        # `action_required` forever, so release-please needs an identity of its
+        # own. App tokens beat a PAT: one hour of life, auto-rotated, scoped to
+        # this repo, and not tied to anyone's personal account.
+        # continue-on-error: an unconfigured App must degrade, not break the release.
+        continue-on-error: true
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
+        with:
+          # Accepted from either store: the App ID is not sensitive, so a repo
+          # variable is conventional, but it is commonly filed as a secret.
+          app-id: ${{ vars.CGIS_APP_ID || secrets.CGIS_APP_ID }}
+          private-key: ${{ secrets.CGIS_APP_PRIVATE_KEY }}
+
+      - name: Checkout the release branch
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          ref: ${{ fromJSON(needs.release-please.outputs.release_pr).headBranchName }}
+          token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
+        with:
+          enable-cache: true
+
+      - name: Re-lock and push if the version moved
+        run: |
+          set -euo pipefail
+          # release-please bumps pyproject.toml but never re-resolves uv.lock, so
+          # the lockfile's own version entry falls a release behind and the CI
+          # `uv lock --check` gate fails on every release PR (#303).
+          uv lock
+          if git diff --quiet -- uv.lock; then
+            echo "uv.lock already in step with pyproject.toml"
+            exit 0
+          fi
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add uv.lock
+          git commit -m "chore: re-lock uv.lock for the release"
+          git push
+
+  publish:
+    name: Publish to PyPI
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/codegraph-brain
+    permissions:
+      # Mints the short-lived OIDC token PyPI exchanges for an upload token.
+      # This is the whole point of trusted publishing: no API token in secrets.
+      id-token: write
+      # Lets the publish action attach PEP 740 provenance attestations.
+      attestations: write
+      contents: read
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
+        with:
+          enable-cache: true
+
+      - name: Build sdist and wheel
+        run: uv build
+
+      - name: Verify metadata
+        # Pinned and wheel-only: this job holds publish rights, so the tooling
+        # it pulls in must not be a floating version that can run setup scripts.
+        run: uvx --no-build --from "twine==7.0.0" twine check dist/*
+
+      - name: Verify version matches the tag
+        env:
+          TAG_NAME: ${{ needs.release-please.outputs.tag_name }}
+        run: |
+          set -euo pipefail
+          built=$(ls dist/*.whl | sed -E 's/.*-([0-9][^-]*)-py3.*/\1/')
+          echo "tag=$TAG_NAME built=$built"
+          case "$TAG_NAME" in
+            *"$built") ;;
+            *) echo "::error::tag $TAG_NAME does not match built version $built"; exit 1 ;;
+          esac
+
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2

codegraph_brain-0.7.3/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.7.3"
+}

{codegraph_brain-0.7.1 → codegraph_brain-0.7.3}/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [0.7.3](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.7.2...codegraph-brain-v0.7.3) (2026-07-31)
+
+
+### Bug Fixes
+
+* **assets:** drop the argv-driven output path from the avatar generator ([#308](https://github.com/zaebee/codegraph-brain/issues/308)) ([d118074](https://github.com/zaebee/codegraph-brain/commit/d118074a6b2137f789b4978f870f5496ee1135b5))
+* **ci:** read the App ID from a secret as well as a variable ([#306](https://github.com/zaebee/codegraph-brain/issues/306)) ([90513bc](https://github.com/zaebee/codegraph-brain/commit/90513bc3f588241848fd7404f9be5b6479a72293))
+
+## [0.7.2](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.7.1...codegraph-brain-v0.7.2) (2026-07-31)
+
+
+### Bug Fixes
+
+* **ci:** install guardian deps with --extra, not --group ([#300](https://github.com/zaebee/codegraph-brain/issues/300)) ([1da003d](https://github.com/zaebee/codegraph-brain/commit/1da003d811db8e60201693905a6f83c2fccf48cf))
+* **cli:** escape data interpolated into Rich console output ([#298](https://github.com/zaebee/codegraph-brain/issues/298)) ([dd4943d](https://github.com/zaebee/codegraph-brain/commit/dd4943d0fea1100b47130fcb0790e940da83276a))
+* **drift:** pin measured depth when a domain is shallower than its gate ([#297](https://github.com/zaebee/codegraph-brain/issues/297)) ([1ebb93a](https://github.com/zaebee/codegraph-brain/commit/1ebb93a888037af5ad333ddffc7896af61f6eb5e)), closes [#229](https://github.com/zaebee/codegraph-brain/issues/229)
+
+
+### Documentation
+
+* add the chunked-review lab note (a negative result worth keeping) ([#299](https://github.com/zaebee/codegraph-brain/issues/299)) ([265fefd](https://github.com/zaebee/codegraph-brain/commit/265fefda7ee30ece692d13ea0bb171d99ac18bd9)), closes [#160](https://github.com/zaebee/codegraph-brain/issues/160)
+
 ## [0.7.1](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.7.0...codegraph-brain-v0.7.1) (2026-07-31)
 
 

{codegraph_brain-0.7.1 → codegraph_brain-0.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codegraph-brain
-Version: 0.7.1
+Version: 0.7.3
 Summary: Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP.
 Project-URL: Homepage, https://github.com/zaebee/codegraph-brain
 Project-URL: Repository, https://github.com/zaebee/codegraph-brain

codegraph_brain-0.7.3/docs/assets/.gitignore

@@ -0,0 +1 @@
+_variants/

codegraph_brain-0.7.3/docs/assets/cgis-app-avatar.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" width="200" height="200"><rect width="200" height="200" rx="44" fill="#0d1526"/><line x1="113.2" y1="55.7" x2="142.8" y2="86.3" stroke="#64748b" stroke-width="8" stroke-linecap="round"/><line x1="142.8" y1="113.7" x2="113.2" y2="144.3" stroke="#64748b" stroke-width="8" stroke-linecap="round"/><line x1="86.8" y1="55.7" x2="57.2" y2="86.3" stroke="#fbbf24" stroke-width="9" stroke-linecap="round"/><line x1="57.2" y1="113.7" x2="86.8" y2="144.3" stroke="#fbbf24" stroke-width="9" stroke-linecap="round"/><circle cx="100" cy="42" r="18" fill="#22d3ee"/><circle cx="44" cy="100" r="18" fill="#fbbf24"/><circle cx="156" cy="100" r="18" fill="#a78bfa"/><circle cx="100" cy="158" r="18" fill="#22d3ee"/></svg>

codegraph_brain-0.7.3/docs/assets/generate_avatar.py

@@ -0,0 +1,123 @@
+"""Generate the cgis GitHub App avatar.
+
+Ships `v3-lit-path` as `cgis-app-avatar.png`; the other two are kept so the
+alternatives are on the record rather than lost in a chat log.
+
+The motif comes from the domain rather than decoration: cgis's drift alphabet is
+built on directed triads (`_TRICODES` / `TRIAD_ORDER`), so the glyphs are actual
+triad shapes — 021D (diverging) and the layered_dag ideal.
+
+No arrowheads. SVG markers scale by stroke-width by default (a 4.5-unit head at
+stroke 9 renders as a 40-unit blob), and even sized correctly an arrowhead is
+mush at the 40px a bot avatar occupies in a PR thread. Hierarchy is carried by
+node size and colour instead.
+
+Rendered at 400px for upload and 40px to check legibility at comment size.
+"""
+
+import pathlib
+
+import cairosvg
+
+BG = "#0d1526"
+EDGE = "#64748b"
+CYAN = "#22d3ee"
+VIOLET = "#a78bfa"
+AMBER = "#fbbf24"
+
+HEAD = (
+    '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" width="200" height="200">'
+    f'<rect width="200" height="200" rx="44" fill="{BG}"/>'
+)
+TAIL = "</svg>"
+
+
+def edge(
+    p1: tuple[float, float], p2: tuple[float, float], *, colour: str = EDGE, w: float = 8
+) -> str:
+    """A graph edge, trimmed at both ends so it meets the node rims cleanly."""
+    (x1, y1), (x2, y2) = p1, p2
+    dx, dy = x2 - x1, y2 - y1
+    length = (dx * dx + dy * dy) ** 0.5
+    ux, uy = dx / length, dy / length
+    pad = 19
+    return (
+        f'<line x1="{x1 + ux * pad:.1f}" y1="{y1 + uy * pad:.1f}" '
+        f'x2="{x2 - ux * pad:.1f}" y2="{y2 - uy * pad:.1f}" '
+        f'stroke="{colour}" stroke-width="{w}" stroke-linecap="round"/>'
+    )
+
+
+def node(p: tuple[float, float], colour: str, r: float = 18) -> str:
+    """A graph node."""
+    return f'<circle cx="{p[0]}" cy="{p[1]}" r="{r}" fill="{colour}"/>'
+
+
+TOP, LEFT, RIGHT, BOTTOM = (100, 42), (44, 100), (156, 100), (100, 158)
+
+# 1. layered_dag — diverge at the top, converge at the bottom.
+v1 = (
+    HEAD
+    + edge(TOP, LEFT)
+    + edge(TOP, RIGHT)
+    + edge(LEFT, BOTTOM)
+    + edge(RIGHT, BOTTOM)
+    + node(TOP, CYAN)
+    + node(LEFT, VIOLET)
+    + node(RIGHT, VIOLET)
+    + node(BOTTOM, CYAN)
+    + TAIL
+)
+
+# 2. 021D on its own — fewest strokes, best legibility at 40px.
+T2, BL2, BR2 = (100, 54), (48, 144), (152, 144)
+v2 = (
+    HEAD
+    + edge(T2, BL2, w=9)
+    + edge(T2, BR2, w=9)
+    + node(T2, CYAN, 21)
+    + node(BL2, VIOLET, 21)
+    + node(BR2, VIOLET, 21)
+    + TAIL
+)
+
+# 3. layered_dag with one path lit — structure, plus the analysis laid over it.
+v3 = (
+    HEAD
+    + edge(TOP, RIGHT)
+    + edge(RIGHT, BOTTOM)
+    + edge(TOP, LEFT, colour=AMBER, w=9)
+    + edge(LEFT, BOTTOM, colour=AMBER, w=9)
+    + node(TOP, CYAN)
+    + node(LEFT, AMBER)
+    + node(RIGHT, VIOLET)
+    + node(BOTTOM, CYAN)
+    + TAIL
+)
+
+HERE = pathlib.Path(__file__).parent
+# Variants land in a gitignored scratch dir; only the chosen one is versioned,
+# so re-running this never litters docs/assets.
+VARIANTS = HERE / "_variants"
+VARIANTS.mkdir(parents=True, exist_ok=True)
+
+CHOSEN = "v3-lit-path"
+
+for name, svg in (("v1-layered-dag", v1), ("v2-fanout", v2), ("v3-lit-path", v3)):
+    (VARIANTS / f"{name}.svg").write_text(svg)
+    for px in (400, 40):
+        cairosvg.svg2png(
+            bytestring=svg.encode(),
+            write_to=str(VARIANTS / f"{name}-{px}.png"),
+            output_width=px,
+            output_height=px,
+        )
+    if name == CHOSEN:
+        (HERE / "cgis-app-avatar.svg").write_text(svg)
+        cairosvg.svg2png(
+            bytestring=svg.encode(),
+            write_to=str(HERE / "cgis-app-avatar.png"),
+            output_width=400,
+            output_height=400,
+        )
+    print(f"rendered {name}" + ("  <- shipped as cgis-app-avatar.*" if name == CHOSEN else ""))

codegraph_brain-0.7.3/docs/lab-notes/2026-06-11-chunked-review-negative-result.md

@@ -0,0 +1,132 @@
+# Lab note: the chunked-review experiment — a negative result worth keeping
+
+**Date:** 2026-06-11
+**Experiment:** #154 slices 1–2 · **Code:** PR #157 (`6178bae`), PR #159 (`2030eb8`)
+**Verdict:** gate FAILED 3/4 — feature stays behind a flag, off in production
+**Specs:** [`2026-06-11-guardian-chunker-design.md`](../specs/2026-06-11-guardian-chunker-design.md) ·
+[`2026-06-11-guardian-chunked-review-design.md`](../specs/2026-06-11-guardian-chunked-review-design.md)
+
+The headline: the hypothesis survived contact with reality only partially, and the
+honest negative result is the most valuable artifact.
+
+## The problem
+
+Guardian (our in-repo LLM reviewer, replacing gemini-code-assist before its
+2026-07-17 sunset) reliably LGTMs large PRs. Baseline bench (6 replayed PRs with
+hand-curated ground truth, 3 runs each): mean recall 0.22, but **recall = 0 on all
+three largest PRs** (36–62K prompt tokens). Plan-2 ablations proved more context
+doesn't help: feeding 94K tokens of full files still produced LGTMs.
+
+Diagnosis: **attention dilution** — the finder skims, it doesn't read.
+
+## The hypothesis (#154)
+
+If the finder can't read a big diff, give it small ones: split changed files into
+connected components over the code graph (IMPORTS/CALLS from `cgis ingest`), run a
+finder pass per chunk with a per-chunk context budget, merge, dedup, run ONE
+skeptic pass, post one report. Each chunk = a small, complete world.
+
+## What we built
+
+- **Slice 1 (PR #157, `6178bae`)** — `chunker.py`, pure logic. Per-file diff
+  splitting (rename/deletion/binary/git-quoted-path handling), union-find over
+  graph edges, test-pairing heuristic, deterministic ordering, honest degradation
+  to isolated chunks when the graph DB is missing.
+- **Slice 2 (PR #159, `2030eb8`)** — wiring behind `GUARDIAN_FEATURES=chunked`.
+  `run_review_routed` entry point, per-chunk finder passes with per-chunk
+  `full_files` (120K char budget) + impact graph, out-of-chunk hallucination
+  filter with LLM-path-artifact normalization (`a/x.py` → `x.py`),
+  `(file,line,category)` dedup, single skeptic over finding-bearing chunks only,
+  `MAX_CHUNKS=8` cap with overflow merge, `cumulative_usage` token accounting
+  (which incidentally fixed a latent retry-loses-tokens bug).
+
+Both slices SDD-executed (subagent implementer + spec reviewer + quality
+reviewer), bench-gated by spec §7 **before** enabling anything in prod.
+
+## The gate (pre-registered, spec §7)
+
+1. mean recall (6 PRs) ≥ 0.27 — baseline + 0.05
+2. mean recall over large PRs {140, 143, 144} > 0 — the hypothesis must show where it matters
+3. mean noise ≤ 1.5/PR
+4. no PR drops > 0.05 below its baseline
+
+## The result: FAIL 3/4
+
+18 runs (6 PRs × 3, finder `gemini-2.5-flash`, skeptic `gemini-3.5-flash`), data in
+`benchmarks/guardian/results.jsonl`:
+
+| PR | chunks | recall base → chunked | noise base → chunked |
+|---|---|---|---|
+| 122 | 8 (cap) | 0.152 → 0.152 | 1.0 → **6.0** |
+| 140 | 5 | 0 → **0.067** ✨ | 3.3 → 3.3 |
+| 141 (noise probe) | 5 | 1.0 → 1.0 | 0.7 → 2.7 |
+| 142 | 1 (degenerate) | 0.167 → 0 | 0 → 0 |
+| 143 | 7 | 0 → 0 | 0 → 2.7 |
+| 144 | 5 | 0 → 0 | 0.7 → 1.3 |
+
+Mean recall 0.203 (❌ vs 0.27), large-PR recall 0.022 (✅ — but only PR 140
+contributed), noise 2.67/PR (❌ vs 1.5), PR 142 regression (❌, with a variance
+caveat: its baseline rested on one lucky 0.5 run out of three).
+
+## What we learned
+
+1. **Attention dilution is real but not the whole story.** Chunking produced the
+   first-ever nonzero recall on a large PR (140). But 143/144 stayed at zero across
+   21 small, focused finder calls. Those ground-truth bugs are invisible to this
+   finder *regardless of context size* — a model/prompt capability ceiling, not a
+   context problem.
+2. **Chunking multiplies noise superlinearly.** Every chunk invents its own false
+   positives (122: 8 chunks → noise 6.0/run). A single skeptic pass over
+   concatenated chunk contexts can't compensate.
+3. **Pre-registered gates work.** Writing pass/fail criteria into the spec before
+   spending money made the no-go decision mechanical instead of motivated. The flag
+   stays OFF in prod; the code sleeps behind it, fully tested, waiting for a better
+   noise story.
+4. **Honest degradation pays off.** Every failure mode (no graph DB, flaky chunk,
+   unparsable finder output, dead skeptic) degrades to something useful instead of
+   crashing — which also made the bench itself survivable.
+
+## Where this goes next (slice 3 candidates, not committed)
+
+- Noise mitigation: stricter per-chunk finder prompt, per-chunk findings cap,
+  skeptic hardening for chunked volume.
+- Ensemble finder (#155): union of N runs matched *different* GT findings
+  (122: 0.09/0.09/0.18 → union ~0.27) — possibly a cheaper recall lever than chunking.
+- Eyeball the 143/144 ground truths: if they need cross-file reasoning the finder
+  can't do, no amount of context plumbing will fix it.
+- Quotient-level "architectural chunk" (domain-graph drift as its own review unit).
+
+Total experiment cost: ~5 PLN of gemini billing for the slice-2 bench (1.03M prompt
+tokens), on top of Plan-2's bench budget. Money well burned.
+
+## Reproducing these numbers
+
+`benchmarks/guardian/results.jsonl` is committed, so the chunked side of this
+experiment is re-derivable. Group rows by `pr`, take the 3 rows whose `features`
+field contains `chunked` (all share `guardian_sha` `a866a2ac`), and average per PR:
+
+| Figure | Note | Recomputed |
+|---|---|---|
+| mean recall (6 PRs) | 0.203 | 0.203 |
+| mean noise / PR | 2.67 | 2.667 |
+| large-PR recall {140,143,144} | 0.022 | 0.022 |
+
+Every cell of the table's **chunked** column reproduces exactly.
+
+**The `base` column does not.** No single `guardian_sha` slice of the
+`features == ""` rows reproduces it, and the baseline headline of 0.22 mean recall
+does not fall out of any of them either — the two candidate slices with exactly 3
+runs per PR give 0.191 and 0.167, and the earliest slice gives 0.271 on uneven run
+counts. The file has also been appended to since (there are July 2026 rows from
+later work), so the working set used to compute the baseline in June is no longer
+recoverable from it.
+
+This is recorded rather than corrected: a lab journal is a historical record, and
+silently restating the baseline would be worse than flagging it. The gate
+conclusions do not rest on it — gates 1 and 3 failed on absolute values (0.203 <
+0.27, 2.67 > 1.5), and both reproduce. Gate 4 (per-PR regression vs baseline) is
+the one that cannot be independently re-checked today.
+
+## Refs
+
+#154, #155, #160 · PR #157, PR #159

codegraph_brain-0.7.3/docs/ontology/tolerances.lock

@@ -0,0 +1,27 @@
+# Drift-tolerance ratchet lock (#151) — generated from patterns.yaml, edited by hand.
+#
+# Project convention since #140/#141: drift_tolerance is a RATCHET. Values may
+# only go DOWN as domains get healthier, never up to mask a regression.
+#
+# test_tolerances_never_exceed_the_lock enforces it: lowering a tolerance means
+# updating this file in the same PR, which puts the change in the diff where a
+# reviewer sees it. Raising one fails the suite.
+#
+# Deliberate re-baselining (e.g. the Part B re-baseline in #144) is allowed —
+# update the lock and justify it in the PR description.
+
+project_domains:
+  extraction: 0.40
+  resolution: 0.40
+  pipeline: 0.25
+  storage: 0.20
+  query: 0.20
+  components: 0.20
+  layout: 0.50
+  hooks: 0.15
+  store: 0.15
+  providers: 0.15
+  utils: 0.15
+
+project_level:
+  cgis-project: 0.15

{codegraph_brain-0.7.1 → codegraph_brain-0.7.3}/pyproject.toml

@@ -7,7 +7,7 @@ packages = ["src/cgis"]
 
 [project]
 name = "codegraph-brain"
-version = "0.7.1"
+version = "0.7.3"
 description = "Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -81,6 +81,7 @@ dev = [
     "interrogate>=1.7.0",
     "ipdb>=0.13.13",
     "mypy>=2.1.0",
+    "networkx>=3.3",
     "pre-commit>=4.6.0",
     "pytest>=9.0.3",
     "pytest-asyncio>=0.24.0",