codna 0.2.85__tar.gz → 0.2.87__tar.gz

{codna-0.2.85 → codna-0.2.87}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.85
+Version: 0.2.87
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
@@ -11,7 +11,7 @@ Project-URL: Source, https://github.com/thyn-ai/codna
 Project-URL: Issues, https://github.com/thyn-ai/codna/issues
 Project-URL: Security, https://codna.ai/security
 Keywords: agent,ai,code-intelligence,codna,debugging,mcp,repository-intelligence,telys
-Classifier: Development Status :: 3 - Alpha
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: MacOS
@@ -137,7 +137,7 @@ crashes the server:
 | --- | --- | --- |
 | `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | free `codna login` |
 | `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | free `codna login` |
-| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | free `codna login` (+ on-device runtime from the login-gated install) |
+| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | free `codna login` (which also installs the on-device runtime) |
 | `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | free `codna login` + provider key (BYOK; + `GITHUB_TOKEN` for `open_pr=true`) |
 | `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | free `codna login` + `GITHUB_TOKEN` (else returns a pre-filled URL) |
 
@@ -145,15 +145,15 @@ Introspection (`initialize`/`tools/list`) needs no credentials. Executing any of
 requires the one-time free community login (`codna login` — device authorization, free community
 license) — fully offline thereafter. `codna_fix` additionally needs a provider key (BYOK, e.g.
 `ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it returns a pre-filled issue
-URL; `codna_recall` additionally uses the on-device memory runtime from the login-gated install.
+URL; `codna_recall` additionally uses the on-device memory runtime that the same `codna login`
+installs.
 Full reference:
 [docs.codna.ai/guides/mcp](https://docs.codna.ai/guides/mcp).
 
 ## Code memory
 
 Code memory and recall run on your machine after a one-time free `codna login` (device
-authorization); the signed on-device runtime arrives via the login-gated install. From then on,
-recall runs fully
+authorization), which also installs the signed on-device runtime. From then on, recall runs fully
 offline: no key, no network calls. The optional
 `codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 
@@ -171,5 +171,5 @@ offline: no key, no network calls. The optional
 
 - Homepage: https://codna.ai
 - Documentation: https://docs.codna.ai
-- Source: https://github.com/thyn-ai/codna
+- Source (public mirror): https://github.com/thyn-ai/codna-cli
 - Security: https://codna.ai/security

{codna-0.2.85 → codna-0.2.87}/README.md

@@ -66,7 +66,7 @@ crashes the server:
 | --- | --- | --- |
 | `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | free `codna login` |
 | `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | free `codna login` |
-| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | free `codna login` (+ on-device runtime from the login-gated install) |
+| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | free `codna login` (which also installs the on-device runtime) |
 | `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | free `codna login` + provider key (BYOK; + `GITHUB_TOKEN` for `open_pr=true`) |
 | `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | free `codna login` + `GITHUB_TOKEN` (else returns a pre-filled URL) |
 
@@ -74,15 +74,15 @@ Introspection (`initialize`/`tools/list`) needs no credentials. Executing any of
 requires the one-time free community login (`codna login` — device authorization, free community
 license) — fully offline thereafter. `codna_fix` additionally needs a provider key (BYOK, e.g.
 `ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it returns a pre-filled issue
-URL; `codna_recall` additionally uses the on-device memory runtime from the login-gated install.
+URL; `codna_recall` additionally uses the on-device memory runtime that the same `codna login`
+installs.
 Full reference:
 [docs.codna.ai/guides/mcp](https://docs.codna.ai/guides/mcp).
 
 ## Code memory
 
 Code memory and recall run on your machine after a one-time free `codna login` (device
-authorization); the signed on-device runtime arrives via the login-gated install. From then on,
-recall runs fully
+authorization), which also installs the signed on-device runtime. From then on, recall runs fully
 offline: no key, no network calls. The optional
 `codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 
@@ -100,5 +100,5 @@ offline: no key, no network calls. The optional
 
 - Homepage: https://codna.ai
 - Documentation: https://docs.codna.ai
-- Source: https://github.com/thyn-ai/codna
+- Source (public mirror): https://github.com/thyn-ai/codna-cli
 - Security: https://codna.ai/security

{codna-0.2.85 → codna-0.2.87}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.85"
+__version__ = "0.2.87"

{codna-0.2.85 → codna-0.2.87}/codna/cli.py

@@ -720,44 +720,14 @@ def cmd_status(args) -> int:
 
 
 def cmd_login(args) -> int:
-    """Sign this machine into a Codna account (device-code login) — consistent with telys/algenta.
+    """One-time device authorization that also installs the on-device runtime — one command.
 
-    Device-code auth via the accounts portal → self-serve free-tier onboard → the first Codna API key
-    (stored in the OS keychain as CODNA_API_KEY). Then ensures a local LLM provider key so `codna fix`
-    runs on-device. Codna's Telys memory runtime is bundled in the wheel (+ embedded OEM license), so no
-    separate per-device provisioning is needed.
+    The body lives in ``codna.login.run`` (cli.py is at the module-size ceiling). Exit codes:
+    0 = signed in AND provisioned (or already provisioned); 1 = sign-in failed; 2 = signed in but
+    runtime provisioning incomplete (needs network on first run — re-run).
     """
-    from .login import LoginError, login as codna_login
-
-    try:
-        # Call for effect: stores the account key in the keychain, raises LoginError on failure. The
-        # return (which touches the API-key dataflow) is intentionally NOT bound/logged.
-        codna_login(
-            access_token=getattr(args, "token", None),
-            open_browser=not getattr(args, "no_browser", False),
-        )
-    except LoginError as exc:
-        print(json.dumps({"ok": False, "error": str(exc)}, indent=2), file=sys.stderr)
-        return 1
-
-    # After sign-in, make sure a local LLM provider key exists so `codna fix` can run on-device. The
-    # provider key stays on the machine (OS keychain) — never sent to the cloud (distinct from the account
-    # API key just minted). See `codna key`.
-    from . import byok_cli
-    provider_status = byok_cli.ensure_local_provider_key(
-        interactive=sys.stdin.isatty() and sys.stdout.isatty(),
-        runtime_keys=_runtime_keys(include_keychain=False),
-    )
-
-    # login() raised on failure, so reaching here means signed-in. Report ONLY sign-in + BYOK status —
-    # never anything on the account-key dataflow (login() already stored the key in the keychain; its
-    # return is deliberately not logged, so no credential-tainted value reaches this sink). CodeQL:
-    # clear-text logging of sensitive information.
-    print(json.dumps({
-        "ok": True,
-        "provider_key": provider_status,
-    }, indent=2))
-    return 0
+    from .login import run as login_run
+    return login_run(args, runtime_keys=_runtime_keys)
 
 
 def cmd_doctor(args) -> int:
@@ -936,7 +906,7 @@ def build_parser() -> argparse.ArgumentParser:
     _register_ci(sub)
     _register_report(sub)
 
-    pl = sub.add_parser("login", help="Sign this machine into a Codna account (device-code login).")
+    pl = sub.add_parser("login", help="Authorize this device and install the on-device runtime (one-time, free).")
     pl.add_argument("--token", help="headless access token (or env CODNA_TOKEN) — skips the browser step")
     pl.add_argument("--no-browser", dest="no_browser", action="store_true",
                     help="do not open a browser; print the verification URL + code to authorize elsewhere")

{codna-0.2.85 → codna-0.2.87}/codna/login.py

@@ -5,10 +5,12 @@ authorization grant), then self-serve onboards the free tier and mints the first
 generic product-onboard route (`POST /v1/products/codna/onboard`). The key is stored in the OS keychain
 as ``CODNA_API_KEY`` (codna.keystore) for control-plane calls.
 
-Unlike telys/algenta, codna's runtime license is **HS256** and its Telys memory runtime is already
-bundled in the wheel (+ the embedded OEM umbrella license), so login does NOT register an RS256
-per-device license or download a runtime — it is purely codna account auth + the API key. BYOK provider
-keys stay local and are handled separately (`codna key`).
+The runtime-provisioning half of `codna login` is deliberately NOT in :func:`login`: that stays
+purely codna account auth + the API key. :func:`run` below (the `codna login` command body) chains
+it with ``telys_onboarding`` (per-device RS256 license + signed runtime install), reusing this
+flow's Supabase access token so the user authorizes ONCE — the uniform fleet model
+(`telys login` / `algenta login` / `sqai login`). BYOK provider keys stay local and are handled
+separately (`codna key`).
 
 Hosts are env-overridable (``CODNA_ACCOUNTS_URL`` / ``CODNA_API_URL``) for staging or a local mock; the
 defaults are the shared accounts portal and codna's public API.
@@ -123,7 +125,12 @@ def onboard(*, api: str, access_token: str) -> str:
 
 # ── orchestration: the whole `codna login` in one call ───────────────────────────────────────────────────
 def login(*, access_token: str | None = None, open_browser: bool = True) -> dict:
-    """Device-login → onboard → store CODNA_API_KEY. Returns a status dict (never echoes the key)."""
+    """Device-login → onboard → store CODNA_API_KEY. Returns a status dict (never echoes the key).
+
+    The dict also carries the device flow's Supabase ``access_token``: ``cmd_login`` reuses it for
+    the same-command runtime provisioning (telys_onboarding) so the user authorizes ONCE. It is a
+    credential — callers must never print, log, or persist it beyond this process.
+    """
     accounts, api = accounts_url(), api_url()
     token = access_token or os.environ.get("CODNA_TOKEN")
     if token:
@@ -147,5 +154,91 @@ def login(*, access_token: str | None = None, open_browser: bool = True) -> dict
         stored = "env (this process) — set CODNA_API_KEY to persist; no OS keychain available"
 
     # Return ONLY where the key was stored (a literal location) — never the key or any prefix derived from
-    # it, so no credential-tainted value can reach a logging sink (CodeQL: clear-text logging of secrets).
-    return {"ok": True, "api_key_stored": stored}
+    # it — plus the device flow's access token for the provisioning step. No credential-tainted value may
+    # reach a logging sink (CodeQL: clear-text logging of sensitive information).
+    return {"ok": True, "api_key_stored": stored, "access_token": token}
+
+
+# ── `codna login` command body (kept here so cli.py stays under the module-size ceiling) ───────────
+def run(args, *, runtime_keys) -> int:
+    """One-time device authorization that ALSO installs the on-device runtime — one command.
+
+    Uniform with `telys login` / `algenta login` / `sqai login`: device-code auth via the accounts
+    portal → self-serve free-tier onboard → the first Codna API key (stored in the OS keychain as
+    CODNA_API_KEY) → a local LLM provider key check so `codna fix` runs on-device → the per-device
+    Telys license + signed memory runtime (telys_onboarding), reusing the SAME device-flow access
+    token so the user authorizes once. After this one command every `codna mcp` tool — including
+    `codna_recall` — works, fully offline thereafter.
+
+    Idempotent: an already fully provisioned device skips re-provisioning (no network). A partial
+    failure (Codna key stored, runtime fetch failed) is completed by re-running `codna login`.
+    Exit codes: 0 = signed in AND provisioned (or already provisioned); 1 = sign-in failed;
+    2 = signed in but runtime provisioning incomplete (needs network on first run — re-run).
+
+    ``runtime_keys`` is the CLI's key-resolution callable (passed in, never imported, so this
+    module stays free of cli.py).
+    """
+    import sys
+
+    try:
+        # The return is bound for exactly one field — the device flow's access token, handed to the
+        # provisioning step below so the user authorizes ONCE. It is a credential and never reaches
+        # output: the status JSON at the end is built from literals + non-secret fields only (the
+        # account key itself is stored by login() and never returned). CodeQL: clear-text logging
+        # of sensitive information.
+        login_result = login(
+            access_token=getattr(args, "token", None),
+            open_browser=not getattr(args, "no_browser", False),
+        )
+    except LoginError as exc:
+        print(json.dumps({"ok": False, "error": str(exc)}, indent=2), file=sys.stderr)
+        return 1
+
+    # After sign-in, make sure a local LLM provider key exists so `codna fix` can run on-device. The
+    # provider key stays on the machine (OS keychain) — never sent to the cloud (distinct from the account
+    # API key just minted). See `codna key`.
+    from . import byok_cli
+    provider_status = byok_cli.ensure_local_provider_key(
+        interactive=sys.stdin.isatty() and sys.stdout.isatty(),
+        runtime_keys=runtime_keys(include_keychain=False),
+    )
+
+    # The fleet-uniform half: provision the per-device license + signed on-device runtime so
+    # `codna_recall` works after ONE command (not only triage/secure). Already provisioned → an
+    # offline no-op. Offline first run → a clear, actionable error (never a traceback); re-running
+    # resumes provisioning without corrupting state.
+    from . import memory
+    from . import telys_onboarding
+
+    try:
+        provisioning = telys_onboarding.ensure_provisioned(
+            access_token=login_result.get("access_token"),
+            open_browser=not getattr(args, "no_browser", False),
+        )
+    except telys_onboarding.OnboardingError as exc:
+        print(json.dumps({
+            "ok": False,
+            "error": str(exc),
+            "hint": ("You are signed in and your Codna key is stored, but the on-device runtime is "
+                     "not fully provisioned — that step needs network access on this first run. "
+                     "Check your connection and re-run `codna login` (safe to re-run: it finishes "
+                     "provisioning without corrupting state). Everything runs offline after that."),
+        }, indent=2), file=sys.stderr)
+        return 2
+    except memory.CodeMemoryError as exc:
+        # A local runtime misconfig (e.g. TELYS_KERNEL pointing at a missing file, or a corrupt
+        # packaged-runtime manifest): not a network problem — surface the actionable message the
+        # memory layer already wrote, cleanly (never a traceback).
+        print(json.dumps({"ok": False, "error": str(exc)}, indent=2), file=sys.stderr)
+        return 2
+
+    # login() raised on failure and provisioning returned, so reaching here means signed-in AND
+    # provisioned. Report ONLY sign-in + BYOK + non-secret provisioning status — never anything on
+    # the account-key dataflow (login() already stored the key in the keychain; no credential-tainted
+    # value reaches this sink). CodeQL: clear-text logging of sensitive information.
+    print(json.dumps({
+        "ok": True,
+        "provider_key": provider_status,
+        "runtime": provisioning,
+    }, indent=2))
+    return 0

{codna-0.2.85 → codna-0.2.87}/codna/telys_onboarding.py

@@ -100,7 +100,10 @@ def run_login(
     except getattr(telys_login, "LoginError", Exception) as exc:
         raise OnboardingError(f"Codna device authorization failed: {exc}") from exc
     except Exception as exc:  # noqa: BLE001 - surface any onboarding failure with remediation
-        raise OnboardingError(f"Codna device authorization failed: {type(exc).__name__}: {exc}") from exc
+        # Non-LoginError failures past the auth step are provisioning failures (the signed-runtime
+        # download/verify, e.g. telys.installer.InstallError "could not reach install host" when
+        # offline) — name them accurately so `codna login` can point at the network, not at auth.
+        raise OnboardingError(f"Codna runtime provisioning failed: {type(exc).__name__}: {exc}") from exc
 
     # Make the device license discoverable by codna.memory in this process (belt-and-suspenders; the
     # cross-process default is the codna:onboarding-license source in memory._configured_license_token).
@@ -110,6 +113,58 @@ def run_login(
     return result
 
 
+def provision_status() -> dict:
+    """Offline, non-raising precheck: does this device already have a Telys license + a resolvable
+    kernel? Same two memory seams :func:`ensure_licensed` uses, but safe to call anywhere — no
+    network, no device flow, no raise. ``codna login`` uses it to stay idempotent: an already
+    fully provisioned device skips re-provisioning (and its download) entirely."""
+    from codna import memory
+
+    try:
+        token, source = memory._configured_license_token()
+    except memory.CodeMemoryError:
+        token, source = None, None
+    kernel = memory._resolve_telys_kernel(configure_env=False)
+    return {
+        "provisioned": bool(token and kernel.get("found")),
+        "license_source": source if token else None,
+        "kernel_source": kernel.get("source") if kernel.get("found") else None,
+    }
+
+
+def ensure_provisioned(*, access_token: str | None = None, plan: str = _DEFAULT_PLAN,
+                       open_browser: bool | None = None) -> dict:
+    """Guarantee this device has its per-device license AND the signed on-device runtime.
+
+    This is the provisioning half of `codna login` — the uniform fleet model (`telys login` /
+    `algenta login` / `sqai login` all authorize AND provision in one command). When the device is
+    already fully provisioned this is a pure offline status read (no network). Otherwise it runs
+    :func:`run_login`, reusing ``access_token`` from the codna device flow so the user authorizes
+    ONCE, and downloads the runtime only when no kernel already resolves. Re-running after a
+    partial failure is safe: the flow re-mints the device credentials and the runtime installer
+    promotes atomically, so a second `codna login` completes provisioning without corrupting state.
+
+    Returns a non-secret status dict (safe to print). Raises :class:`OnboardingError` with
+    remediation when provisioning cannot complete (e.g. offline first run).
+    """
+    status = provision_status()
+    if status["provisioned"]:
+        status["already_provisioned"] = True
+        return status
+    result = run_login(
+        token=access_token,
+        plan=plan,
+        install=status["kernel_source"] is None,
+        open_browser=open_browser,
+    )
+    return {
+        "provisioned": True,
+        "already_provisioned": False,
+        "runtime_installed": bool(result.get("installed")),
+        "tier": result.get("tier"),
+    }
+
+
 def ensure_licensed(*, allow_interactive_login: bool = False) -> dict:
     """Precheck before using codna memory: confirm this device is provisioned, or steer the user.
 
@@ -120,13 +175,9 @@ def ensure_licensed(*, allow_interactive_login: bool = False) -> dict:
     """
     from codna import memory
 
-    try:
-        token, source = memory._configured_license_token()
-    except memory.CodeMemoryError:
-        token, source = None, None
-    kernel = memory._resolve_telys_kernel(configure_env=False)
-    if token and kernel.get("found"):
-        return {"provisioned": True, "license_source": source, "kernel_source": kernel.get("source")}
+    status = provision_status()
+    if status["provisioned"]:
+        return status
 
     if allow_interactive_login:
         import sys

{codna-0.2.85 → codna-0.2.87}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.85
+Version: 0.2.87
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
@@ -11,7 +11,7 @@ Project-URL: Source, https://github.com/thyn-ai/codna
 Project-URL: Issues, https://github.com/thyn-ai/codna/issues
 Project-URL: Security, https://codna.ai/security
 Keywords: agent,ai,code-intelligence,codna,debugging,mcp,repository-intelligence,telys
-Classifier: Development Status :: 3 - Alpha
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: MacOS
@@ -137,7 +137,7 @@ crashes the server:
 | --- | --- | --- |
 | `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | free `codna login` |
 | `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | free `codna login` |
-| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | free `codna login` (+ on-device runtime from the login-gated install) |
+| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | free `codna login` (which also installs the on-device runtime) |
 | `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | free `codna login` + provider key (BYOK; + `GITHUB_TOKEN` for `open_pr=true`) |
 | `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | free `codna login` + `GITHUB_TOKEN` (else returns a pre-filled URL) |
 
@@ -145,15 +145,15 @@ Introspection (`initialize`/`tools/list`) needs no credentials. Executing any of
 requires the one-time free community login (`codna login` — device authorization, free community
 license) — fully offline thereafter. `codna_fix` additionally needs a provider key (BYOK, e.g.
 `ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it returns a pre-filled issue
-URL; `codna_recall` additionally uses the on-device memory runtime from the login-gated install.
+URL; `codna_recall` additionally uses the on-device memory runtime that the same `codna login`
+installs.
 Full reference:
 [docs.codna.ai/guides/mcp](https://docs.codna.ai/guides/mcp).
 
 ## Code memory
 
 Code memory and recall run on your machine after a one-time free `codna login` (device
-authorization); the signed on-device runtime arrives via the login-gated install. From then on,
-recall runs fully
+authorization), which also installs the signed on-device runtime. From then on, recall runs fully
 offline: no key, no network calls. The optional
 `codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 
@@ -171,5 +171,5 @@ offline: no key, no network calls. The optional
 
 - Homepage: https://codna.ai
 - Documentation: https://docs.codna.ai
-- Source: https://github.com/thyn-ai/codna
+- Source (public mirror): https://github.com/thyn-ai/codna-cli
 - Security: https://codna.ai/security

{codna-0.2.85 → codna-0.2.87}/codna.egg-info/SOURCES.txt

@@ -162,6 +162,7 @@ tests/test_local_runtime.py
 tests/test_local_runtime_lifecycle.py
 tests/test_localfix.py
 tests/test_login.py
+tests/test_login_provisions_runtime.py
 tests/test_manifest.py
 tests/test_mcp_default_repo.py
 tests/test_mcp_enrich.py

{codna-0.2.85 → codna-0.2.87}/memengine/native_runtime.py

@@ -14,6 +14,7 @@ from __future__ import annotations
 import ctypes
 import functools
 import os
+import sys
 import threading
 from contextlib import contextmanager
 
@@ -113,6 +114,16 @@ _LIB = None
 _LIB_PATH = None
 
 
+def _lib_ext() -> str:
+    """Shared-library extension for this platform — mirrors telys.paths.lib_ext() but standalone,
+    so native-lib resolution works even where importing telys.paths would be awkward."""
+    if sys.platform == "darwin":
+        return "dylib"
+    if sys.platform.startswith("win"):
+        return "dll"
+    return "so"
+
+
 def _installed_lib(stem: str):
     """Path to a verified `telys runtime install`ed lib (via telys.paths), or None. Stdlib-only; never raises."""
     try:
@@ -138,11 +149,12 @@ def _resolve_native_lib() -> str:
     installed = _installed_lib("libty_runtime")   # verified `telys runtime install` location (zero config)
     if installed:
         return installed
+    ext = _lib_ext()
     here = os.path.dirname(__file__)
-    bundled = os.path.join(here, "_runtime", "libty_runtime.dylib")   # internal full-engine wheel
+    bundled = os.path.join(here, "_runtime", f"libty_runtime.{ext}")   # internal full-engine wheel
     if os.path.exists(bundled):
         return bundled
-    return os.path.abspath(os.path.join(here, "..", "..", "..", "mojo_build", "libty_runtime.dylib"))
+    return os.path.abspath(os.path.join(here, "..", "..", "..", "mojo_build", f"libty_runtime.{ext}"))
 
 
 def _lib():
@@ -152,7 +164,8 @@ def _lib():
         if not os.path.exists(_LIB_PATH):
             raise FileNotFoundError(
                 f"Telys native runtime not found at {_LIB_PATH}. Build it: cd mojo_env && pixi run mojo "
-                "build --emit shared-lib ../mojo/engine/ty_runtime.mojo -o ../mojo_build/libty_runtime.dylib "
+                "build --emit shared-lib ../mojo/engine/ty_runtime.mojo "
+                f"-o ../mojo_build/libty_runtime.{_lib_ext()} "
                 "(or set TELYS_NATIVE_KERNEL).")
         lib = ctypes.CDLL(_LIB_PATH)
         lib.ty_runtime_format_version.restype = ctypes.c_int32
@@ -677,6 +690,16 @@ class NativeRuntime(RuntimeHandle):
         raise NotImplementedError("the lexical (BM25) index is not yet supported on the native runtime; "
                                   "use the local runtime (TELYS_RUNTIME=local) for mode='lexical'")
 
+    # compact serve artifacts — the native index handle has no quantized-export path yet; the engine-side
+    # sealer (PartitionedVectorIndex.save(compact=...)) lives in the local runtime. Fail closed (D-19 style).
+    def export_compact(self, index, path, mode):
+        raise NotImplementedError("compact serve artifacts are not yet supported on the native runtime; "
+                                  "export from the local runtime (TELYS_RUNTIME=local)")
+
+    def open_compact(self, path):
+        raise NotImplementedError("compact serve artifacts are not yet supported on the native runtime; "
+                                  "open with the local runtime (TELYS_RUNTIME=local)")
+
     # ── IVF-within-partition (PR-5; faiss clustering host-side, native exact rerank) ───────────────
     @_write
     def build_partition_ivf(self, index, min_rows, target_recall, max_nprobe=64):

{codna-0.2.85 → codna-0.2.87}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.85"
+version = "0.2.87"
 description = "Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -18,7 +18,7 @@ keywords = [
   "telys",
 ]
 classifiers = [
-  "Development Status :: 3 - Alpha",
+  "Development Status :: 5 - Production/Stable",
   "Environment :: Console",
   "Intended Audience :: Developers",
   "Operating System :: MacOS",