codna 0.2.98__tar.gz → 0.2.100__tar.gz

{codna-0.2.98 → codna-0.2.100}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.98
+Version: 0.2.100
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
@@ -60,6 +60,7 @@ Requires-Dist: wordllama>=0.3; extra == "memory-rerank"
 Provides-Extra: durable
 Requires-Dist: temporalio[langgraph]<2,>=1.34; extra == "durable"
 Requires-Dist: langgraph<2,>=1; extra == "durable"
+Requires-Dist: langgraph-checkpoint<5,>=4; extra == "durable"
 Requires-Dist: langchain-core<2,>=1; extra == "durable"
 Requires-Dist: pyjwt<3,>=2.8; extra == "durable"
 Provides-Extra: memory-languages

{codna-0.2.98 → codna-0.2.100}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.98"
+__version__ = "0.2.100"

{codna-0.2.98 → codna-0.2.100}/codna/doctor.py

@@ -19,7 +19,14 @@ API_KEY_KEYS = ("CODNA_API_KEY", "ALGENTA_API_KEY", "DE_API_KEY")
 PUBLIC_CONFIGURED_VALUE = "<configured>"
 PUBLIC_STATE_PATH = Path.home() / ".codna" / "runtime" / "local-stack.json"
 _URL_CREDENTIAL_RE = re.compile(r"(https?://)([^/@\s\"']+@)")
-_SECRET_FIELD_RE = re.compile(r"(?i)\b(password|token|secret|api[_-]?key)([\"']?\s*[:=]\s*)[^\s,}\]]+")
+_SECRET_FIELD_RE = re.compile(
+    r"""
+    \b(?P<field>password|token|secret|api[_-]?key)
+    (?P<separator>[\"']?\s*[:=]\s*)
+    (?P<value>\"(?:\\.|[^\"\\])*\"|'(?:\\.|[^'\\])*'|[^\s,}\]]+)
+    """,
+    re.IGNORECASE | re.VERBOSE,
+)
 
 
 def _first_config_source(env: Mapping[str, str], keys: tuple[str, ...]) -> str | None:
@@ -201,9 +208,18 @@ def render_report(report: Mapping[str, Any]) -> str:
     return "\n".join(lines)
 
 
+def _redact_secret_field(match: re.Match[str]) -> str:
+    value = match.group("value")
+    quote = value[0] if value.startswith(("\"", "'")) else ""
+    if not quote:
+        separator = match.group("separator").lstrip()
+        quote = separator[0] if separator.startswith(("\"", "'")) else ""
+    return f"{match.group('field')}{match.group('separator')}{quote}<redacted>{quote}"
+
+
 def redact_display_text(text: str) -> str:
     without_url_credentials = _URL_CREDENTIAL_RE.sub(r"\1<redacted>@", text)
-    return _SECRET_FIELD_RE.sub(r"\1\2<redacted>", without_url_credentials)
+    return _SECRET_FIELD_RE.sub(_redact_secret_field, without_url_credentials)
 
 
 def format_public_output(report: Mapping[str, Any], *, json_output: bool) -> str:

{codna-0.2.98 → codna-0.2.100}/codna/durable/__init__.py

@@ -59,9 +59,10 @@ class Requirement:
         return self.minimum <= version < self.maximum
 
 
-# The two LangGraph entries are transitive, pinned because they carry the checkpoint semantics
-# `interrupt()`/`Command(resume=...)` depend on. Kept in sync with cli/constraints-durable.txt by
-# tests/durable/test_durable_extra.py, so a release cannot pin one version and ship another.
+# The checkpoint package is pinned as well as declared in the extra because it carries the
+# checkpoint semantics `interrupt()`/`Command(resume=...)` depend on. All entries are kept in sync
+# with cli/constraints-durable.txt by tests/durable/test_durable_extra.py, so a release cannot pin
+# one version and ship another.
 DURABLE_PINS: Final[tuple[Requirement, ...]] = (
     Requirement(
         distribution="temporalio",
@@ -102,6 +103,7 @@ PLUGIN_MODULE: Final = "temporalio.contrib.langgraph"
 DURABLE_RANGES: Final[dict[str, str]] = {
     "temporalio": ">=1.34,<2",
     "langgraph": ">=1,<2",
+    "langgraph-checkpoint": ">=4,<5",
     "langchain-core": ">=1,<2",
 }
 

{codna-0.2.98 → codna-0.2.100}/codna/gitpush.py

@@ -8,9 +8,17 @@ build/test/scanner code), and is exercised offline against a local bare remote i
 """
 from __future__ import annotations
 
+import re
 import subprocess
 
 
+_URL_CREDENTIAL_RE = re.compile(r"(https?://)([^/@\s\"']+@)")
+
+
+def _redact_url_credentials(text: str) -> str:
+    return _URL_CREDENTIAL_RE.sub(r"\1<redacted>@", text)
+
+
 class GitPushError(Exception):
     pass
 
@@ -21,7 +29,9 @@ def _git(repo_dir: str, *args: str, stdin: str | None = None) -> str:
         input=stdin, capture_output=True, text=True,
     )
     if proc.returncode != 0:
-        raise GitPushError(f"git {' '.join(args)} -> {proc.returncode}: {proc.stderr.strip()}")
+        command = _redact_url_credentials(" ".join(args))
+        stderr = _redact_url_credentials(proc.stderr.strip())
+        raise GitPushError(f"git {command} -> {proc.returncode}: {stderr}")
     return proc.stdout
 
 

{codna-0.2.98 → codna-0.2.100}/codna/memory.py

@@ -47,6 +47,7 @@ from .codeunits import FILTER_COLUMNS, UnsupportedLanguageError, extract_repo, r
 # re-exported here because `codna.memory` is the public import surface every caller and test uses.
 from .memory_install import activate_install_site_packages as _activate_install_site_packages
 from .memory_install import candidate_install_roots as _candidate_codna_install_roots
+from .runtime_capabilities import require_compact_export
 from .memory_manifest import legacy_manifest_id_belongs_to_repo, manifest_entry, manifest_hash, manifest_scope
 
 COLLECTION = "repo_symbols"
@@ -922,12 +923,19 @@ class CodeMemory:
 
         The compact tiers keep the int8 slab, which only exists when the collection was sealed at
         dtype="int8". If this memory's collection is f32, a ONE-TIME transparent reset+reindex at
-        int8 runs first — search quality is tier-validated (int8 == f32 recall on the quant PoC)."""
+        int8 runs first — search quality is tier-validated (int8 == f32 recall on the quant PoC).
+
+        A runtime that *declares* ``export_compact`` but does not implement it (it is part of the SDK's
+        ``RuntimeHandle`` contract, so the method always exists) is rejected up front with the runtime's
+        own guidance, instead of failing midway through a rebuild with a bare ``NotImplementedError``.
+        ``hasattr`` cannot detect that, and the check runs BEFORE the int8 rebuild, which would
+        otherwise discard a working f32 index only to fail on the export."""
         col = self._collection()
         export = getattr(col, "export_compact", None)
         if export is None:
             raise CodeMemoryError(
                 "the resolved telys predates compact serve artifacts (telys#99) — upgrade telys")
+        require_compact_export(getattr(getattr(self, "_eng", None), "_runtime", None), CodeMemoryError)
         if getattr(col, "dtype", "f32") != "int8":
             self.reset()
             self._col = None

codna-0.2.100/codna/runtime_capabilities.py

@@ -0,0 +1,77 @@
+"""Runtime capability decisions — one source of truth for "can this runtime do X?".
+
+`hasattr(collection, "export_compact")` cannot answer any of this: every method on the SDK's
+`RuntimeHandle` contract EXISTS on every runtime, so the attribute is always present even when calling it
+raises `NotImplementedError`. That is why a missing capability used to surface as a crash inside the
+caller instead of a clean, early refusal.
+
+The decision is made here, once, and used by both the product and the tests, so they cannot drift apart:
+
+  1. a runtime that declares the flag answers definitively;
+  2. otherwise (an SDK older than the flag) a method inherited unchanged from `RuntimeHandle` is the base
+     class's ``raise NotImplementedError`` body — present, supporting nothing;
+  3. anything else is assumed capable, which keeps pre-flag runtimes that DID implement the method working.
+
+This module lives in `codna` deliberately. A verified `telys runtime install` ships a SLIM `memengine`
+(`native_runtime.py` only), so capability logic placed in `memengine` would be absent from exactly the
+production installs that need it.
+"""
+
+from __future__ import annotations
+
+COMPACT_EXPORT = "supports_compact_export"
+COMPACT_OPEN = "supports_compact_open"
+
+
+def _overrides(runtime, method: str) -> bool:
+    """True when `runtime` supplies its own `method` rather than the SDK's unimplemented base body.
+
+    Resolved on the INSTANCE (not the class): a runtime may provide the method per-instance, and a bound
+    method is a fresh object on every access, so compare the underlying function. With no SDK importable
+    there is no base class to compare against, so assume it does (the caller's error handling still
+    applies) rather than refusing a runtime that may well work.
+    """
+    impl = getattr(runtime, method, None)
+    if impl is None:
+        return False
+    func = getattr(impl, "__func__", impl)
+    try:
+        from telys.runtime import RuntimeHandle
+    except Exception:  # noqa: BLE001 — no SDK base class to compare against
+        return True
+    return func is not getattr(RuntimeHandle, method, object())
+
+
+def _declares(runtime, capability: str, method: str) -> tuple[bool, str]:
+    name = type(runtime).__name__
+    flag = getattr(runtime, capability, None)
+    if flag is not None:
+        return bool(flag), f"{name}.{capability}={flag}"
+    if not _overrides(runtime, method):
+        return False, f"{name} inherits the SDK's unimplemented {method}"
+    return True, f"{name} implements {method} (no {capability} flag)"
+
+
+def supports_compact_export(runtime) -> tuple[bool, str]:
+    """(supported, detail) for WRITING a compact serve artifact with `runtime`."""
+    return _declares(runtime, COMPACT_EXPORT, "export_compact")
+
+
+def require_compact_export(runtime, error_type):
+    """Raise `error_type` unless `runtime` can write a compact serve artifact.
+
+    Kept here rather than at the call site so `memory.py` does not grow past its 1000-line ceiling
+    (`test_modularity.py`), and because this is the same decision `supports_compact_export` makes —
+    one source of truth, two presentations: a predicate for tests, an exception for the product.
+    """
+    supported, detail = supports_compact_export(runtime)
+    if not supported:
+        raise error_type(
+            f"the resolved runtime cannot export compact serve artifacts ({detail}) — "
+            "export from the local runtime (TELYS_RUNTIME=local)"
+        )
+
+
+def supports_compact_open(runtime) -> tuple[bool, str]:
+    """(supported, detail) for READING a compact serve artifact with `runtime`."""
+    return _declares(runtime, COMPACT_OPEN, "open_compact")

{codna-0.2.98 → codna-0.2.100}/codna/telys_onboarding.py

@@ -157,10 +157,42 @@ def ensure_provisioned(*, access_token: str | None = None, plan: str = _DEFAULT_
         install=status["kernel_source"] is None,
         open_browser=open_browser,
     )
+    # ``runtime_installed`` asks whether this device HAS a usable on-device runtime, so it is answered
+    # by the SAME resolver `codna status` and `ensure_licensed` use — never by ``result["installed"]``.
+    # ``telys.login`` reports ``installed`` for "this call downloaded a bundle", which is a different
+    # question: a device whose kernel already resolves passes ``install=False``, so provisioning
+    # succeeds and used to report ``runtime_installed: false`` — the flag described the branch taken,
+    # not the machine. Re-probing is also what makes the answer true for every path (a fresh download,
+    # a pre-existing kernel, a packaged runtime) instead of only the one this function happened to take.
+    after = provision_status()
+    if not after["provisioned"]:
+        # ``provisioned`` is "license AND kernel", so name WHICH half is missing rather than always
+        # blaming the kernel. A device whose kernel resolves but whose license was never written is a
+        # real state (a platform wheel ships a kernel; `run_login` may fail to write the license), and
+        # pointing that user at CODNA_TELYS_INSTALL_ROOT/TELYS_KERNEL would send them to fix the one
+        # thing that already works. Exit 0 means signed in AND provisioned (cmd_login's contract), so
+        # this must not return a success payload either way.
+        missing: list[str] = []
+        if not after["license_source"]:
+            missing.append(
+                "the per-device license was not written (re-run `codna login`; if it persists, check "
+                "that $TELYS_HOME is writable)"
+            )
+        if not after["kernel_source"]:
+            missing.append(
+                "no Telys kernel resolves (re-run `codna login`; if it persists, set "
+                "CODNA_TELYS_INSTALL_ROOT or TELYS_KERNEL to a Codna-managed runtime)"
+            )
+        raise OnboardingError(
+            "Codna device authorization succeeded but the on-device runtime is not fully provisioned: "
+            + "; ".join(missing)
+        )
     return {
         "provisioned": True,
         "already_provisioned": False,
-        "runtime_installed": bool(result.get("installed")),
+        # True now: ``after["provisioned"]`` requires a license AND a resolved kernel.
+        "runtime_installed": True,
+        "runtime_source": after["kernel_source"],
         "tier": result.get("tier"),
     }
 

{codna-0.2.98 → codna-0.2.100}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.98
+Version: 0.2.100
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
@@ -60,6 +60,7 @@ Requires-Dist: wordllama>=0.3; extra == "memory-rerank"
 Provides-Extra: durable
 Requires-Dist: temporalio[langgraph]<2,>=1.34; extra == "durable"
 Requires-Dist: langgraph<2,>=1; extra == "durable"
+Requires-Dist: langgraph-checkpoint<5,>=4; extra == "durable"
 Requires-Dist: langchain-core<2,>=1; extra == "durable"
 Requires-Dist: pyjwt<3,>=2.8; extra == "durable"
 Provides-Extra: memory-languages

{codna-0.2.98 → codna-0.2.100}/codna.egg-info/SOURCES.txt

@@ -67,6 +67,7 @@ codna/review_findings.py
 codna/review_github.py
 codna/review_grounding.py
 codna/review_manifests.py
+codna/runtime_capabilities.py
 codna/runtime_config.py
 codna/sandbox.py
 codna/sarif.py
@@ -247,6 +248,7 @@ tests/test_memory_rerank.py
 tests/test_memory_wordllama_rerank.py
 tests/test_memory_wrapper.py
 tests/test_modularity.py
+tests/test_native_compact_export.py
 tests/test_netjail.py
 tests/test_packaged_confidence.py
 tests/test_packaged_git_clone.py

{codna-0.2.98 → codna-0.2.100}/codna.egg-info/requires.txt

@@ -21,6 +21,7 @@ tree-sitter-ruby
 [durable]
 temporalio[langgraph]<2,>=1.34
 langgraph<2,>=1
+langgraph-checkpoint<5,>=4
 langchain-core<2,>=1
 pyjwt<3,>=2.8
 

{codna-0.2.98 → codna-0.2.100}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.98"
+version = "0.2.100"
 description = "Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -105,6 +105,7 @@ memory-rerank = [
 durable = [
   "temporalio[langgraph]>=1.34,<2",
   "langgraph>=1,<2",
+  "langgraph-checkpoint>=4,<5",
   "langchain-core>=1,<2",
   "pyjwt>=2.8,<3",
 ]

{codna-0.2.98 → codna-0.2.100}/tests/test_admission_control.py

@@ -106,19 +106,58 @@ def test_contention_grows_with_concurrency():
 
 
 # ── never stall ────────────────────────────────────────────────────────────────────────────────
-def test_a_raising_predictor_degrades_instead_of_blocking_admission():
-    """A predictor/engine outage must never wedge the gate. make_mojo_breach_fn wraps the kernel with
-    exactly this fallback, so verify the wrapper, not just the docstring."""
+def test_a_raising_predictor_degrades_instead_of_blocking_admission(capsys):
+    """A predictor/engine outage must never wedge the gate.
+
+    THE CONTRACT, stated twice in production code: the module docstring — "the gate can NEVER stall: a
+    kernel hiccup degrades to in-process math, it does not block admission" — and `make_mojo_breach_fn`
+    — "falling back to ``fallback`` (numpy by default) on any error so a predictor/engine outage never
+    stalls admission". So a raising kernel must DEGRADE to the fallback predictor and keep deciding; it
+    must not refuse admission and it must not raise out of the gate. The one error that does surface is
+    a fallback that ALSO raises: no predictor at all is the one case where "degrade" has no value to
+    degrade to, and swallowing it would turn a caller bug into an invisible admission.
+
+    The kernel is made to fail through an INJECTED client, which is the seam this file already uses for
+    the same purpose (`test_fallback_is_announced_not_silent`,
+    `test_the_kernel_predictor_reports_which_branch_answered`). Leaving it to the environment was the
+    defect this test carried: with a working in-process kernel `mojo_breach_probability` answers, the
+    fallback is never consulted — so the second half below was unreachable and the test pinned whether
+    the CI box happened to have a usable kernel, not the behaviour (it failed on this machine, where the
+    `build/local-telys` kernel answers). Both halves are now deterministic on any machine.
+    """
+    class _EngineDown:
+        def _request(self, *_a, **_k):
+            raise RuntimeError("engine down")
+
+    degraded_value = 0.25
+
+    def fallback(*_a):
+        return degraded_value
+
+    fn = ac.make_mojo_breach_fn(client=_EngineDown(), fallback=fallback)
+
+    # The fallback answered — asserted by BRANCH and by a value only the fallback can produce, because
+    # a breach probability alone cannot show which predictor computed it.
+    assert fn.probe([10.0, 11.0], 1.5, 900.0, 128) == (0.25, "numpy")
+    assert fn([10.0, 11.0], 1.5, 900.0, 128) == 0.25
+    assert fn.last_predictor == "numpy"
+    assert "fell back to in-process numpy" in capsys.readouterr().err
+
+    # ...and the gate still DECIDES with it, in the MC zone, instead of raising out of try_admit.
+    d = ac.MCAdmissionDecider(_cfg(model_rate_budget=1, ceiling=4), mc_fn=fn)
+    d.finish(10.0)
+    assert d.try_admit().admit is True       # deterministic floor: no prediction needed
+    verdict = d.try_admit()                  # MC zone, decided by the DEGRADED predictor
+    assert verdict.p_breach == 0.25
+    assert verdict.admit is False            # 0.25 >= breach_threshold: throttled, never raised
+
+    # An explicitly exploding fallback has nothing left to degrade to, so it surfaces rather than
+    # letting the gate continue on an invented number.
     def _boom(*_a, **_k):
         raise RuntimeError("engine down")
 
-    fn = ac.make_mojo_breach_fn(fallback=lambda *a: 0.0)
-    # mojo_breach_probability will fail (no client/daemon here) -> falls back to the given predictor.
-    assert fn([10.0, 11.0], 1.5, 900.0, 128) == 0.0
-
-    # And an explicitly exploding fallback surfaces rather than hanging.
-    fn_bad = ac.make_mojo_breach_fn(fallback=_boom)
-    with pytest.raises(RuntimeError):
+    fn_bad = ac.make_mojo_breach_fn(client=_EngineDown(), fallback=_boom)
+    with pytest.raises(RuntimeError, match="engine down"):
         fn_bad([10.0], 1.5, 900.0, 8)
 
 

{codna-0.2.98 → codna-0.2.100}/tests/test_doctor.py

@@ -6,6 +6,24 @@ from types import SimpleNamespace
 import pytest
 
 import codna.cli as cli_module
+from codna.doctor import redact_display_text
+
+
+@pytest.mark.parametrize("value", ["secretvalue", "secret,value with spaces", "", 123])
+def test_redact_display_text_preserves_json_output(value) -> None:
+    raw = json.dumps({"api_key": value})
+
+    redacted = redact_display_text(raw)
+
+    assert json.loads(redacted) == {"api_key": "<redacted>"}
+    if value:
+        assert str(value) not in redacted
+
+
+def test_redact_display_text_preserves_plain_assignments() -> None:
+    assert redact_display_text("api_key=secret token:another") == (
+        "api_key=<redacted> token:<redacted>"
+    )
 
 
 def _clean_mojo_workers() -> dict[str, object]:

{codna-0.2.98 → codna-0.2.100}/tests/test_gitpush_push_branch.py

@@ -14,6 +14,7 @@ import subprocess
 
 import pytest
 
+import codna.gitpush as gitpush_module
 from codna.gitpush import GitPushError, push_branch
 
 
@@ -67,3 +68,26 @@ def test_an_unknown_sha_is_refused_before_touching_the_remote(repo):
     with pytest.raises(GitPushError, match="rev-parse"):
         push_branch(str(path), branch="b", sha="0" * 40, remote=str(bare))
     assert _git(["ls-remote", str(bare), "b"], path).stdout.strip() == ""
+
+
+def test_push_errors_redact_credentials_from_the_command_and_git_stderr(monkeypatch, tmp_path):
+    credential = "ghs_synthetic_secret"
+    push_url = f"https://x-access-token:{credential}@github.com/example/repo.git"
+    redacted_url = "https://<redacted>@github.com/example/repo.git"
+
+    def fail_push(command, **_kwargs):
+        if "rev-parse" in command:
+            return subprocess.CompletedProcess(command, 0, stdout="a" * 40 + "\n", stderr="")
+        return subprocess.CompletedProcess(
+            command, 128, stdout="", stderr=f"fatal: {push_url} rejected"
+        )
+
+    monkeypatch.setattr(gitpush_module.subprocess, "run", fail_push)
+
+    with pytest.raises(GitPushError) as caught:
+        push_branch(str(tmp_path), branch="branch", sha="a" * 40, push_url=push_url)
+
+    message = str(caught.value)
+    assert credential not in message
+    assert "x-access-token" not in message
+    assert message.count(redacted_url) == 2

{codna-0.2.98 → codna-0.2.100}/tests/test_impact_cli.py

@@ -168,8 +168,23 @@ def test_export_without_compact_seam_raises(monkeypatch):
     assert not os.path.exists("/tmp/never-written")
 
 
+def _compact_export_capability(mem):
+    """(supported, detail) for the memory's resolved runtime, from a REAL capability signal.
+
+    ``hasattr(collection, "export_compact")`` is the wrong probe: the method exists on every runtime
+    (it is part of the SDK's ``RuntimeHandle`` contract), so the attribute is always present even when
+    calling it raises ``NotImplementedError``. That is exactly how this test rotted into an error in its
+    own body instead of a clean skip. The decision lives in ``memengine.capabilities`` so the product and
+    this test cannot disagree.
+    """
+    from codna.runtime_capabilities import supports_compact_export
+
+    runtime = getattr(getattr(mem, "_eng", None), "_runtime", None)
+    return supports_compact_export(runtime)
+
+
 def test_export_end_to_end(tmp_path, monkeypatch):
-    """Needs the Telys kernel + the compact seam; skips on older stacks (offline CI lane)."""
+    """Needs the Telys kernel + a runtime that IMPLEMENTS the compact seam (offline CI lane skips)."""
     monkeypatch.setenv("CODNA_MEMORY_EMBED", "local")
     repo = str(tmp_path / "repo")
     os.makedirs(repo, exist_ok=True)
@@ -182,8 +197,9 @@ def test_export_end_to_end(tmp_path, monkeypatch):
         mem = CodeMemory(repo, db_path=str(tmp_path / "db"))
     except Exception as exc:  # noqa: BLE001
         pytest.skip(f"telys/kernel unavailable: {type(exc).__name__}: {exc}")
-    if not hasattr(mem._collection(), "export_compact"):
-        pytest.skip("resolved telys predates the compact seam (telys#99)")
+    supported, detail = _compact_export_capability(mem)
+    if not supported:
+        pytest.skip(f"resolved runtime cannot export compact serve artifacts: {detail}")
 
     info = CodeMemory(repo, db_path=str(tmp_path / "db")).export_serve_artifact(
         str(tmp_path / "artifact"))
@@ -192,3 +208,48 @@ def test_export_end_to_end(tmp_path, monkeypatch):
     assert info["mode"] == "int8" and info["size_bytes"] > 0
     assert os.path.isfile(os.path.join(info["artifact"], "manifest.json"))
     assert not os.path.exists(os.path.join(info["artifact"], "ty_base.npy"))  # no f32 slab
+    assert not os.path.exists(os.path.join(info["artifact"], "vectors.f32"))  # no f32 slab
+
+
+def test_compact_capability_probe_rejects_unimplemented_runtime(monkeypatch):
+    """The capability probe must read the runtime flag, not merely the method's presence.
+
+    Regression guard for the exact defect that made ``test_export_end_to_end`` an ERROR in its own body:
+    a runtime that declares the method but raises ``NotImplementedError`` satisfies ``hasattr`` while
+    supporting nothing. The probe must call it unsupported.
+    """
+    from types import SimpleNamespace
+
+    from codna.memory import CodeMemory, CodeMemoryError
+
+    # A runtime that inherits the SDK's base-class stub: the method EXISTS (so `hasattr` says yes) and
+    # calling it raises NotImplementedError. This is the exact shape that made the export test error
+    # inside its own body instead of skipping. No SDK here -> genuine skip (the offline CI lane).
+    try:
+        from telys.runtime import RuntimeHandle
+    except ImportError as exc:
+        pytest.skip(f"telys SDK unavailable: {exc}")
+
+    class _UnimplementedRuntime(RuntimeHandle):
+        pass
+
+    mem = CodeMemory.__new__(CodeMemory)
+    mem._eng = SimpleNamespace(_runtime=_UnimplementedRuntime())
+
+    supported, detail = _compact_export_capability(mem)
+    assert supported is False, detail
+    assert "unimplemented export_compact" in detail
+
+    # The product surface refuses for the SAME reason, before doing any rebuild work. Reachable with no
+    # flag at all — the legacy case the review flagged: `not getattr(...)` and the base-stub check must
+    # both treat an absent attribute as unsupported, not silently pass it.
+    mem._col = SimpleNamespace(export_compact=lambda *a: None, dtype="int8")
+    with pytest.raises(CodeMemoryError, match="cannot export compact serve artifacts"):
+        mem.export_serve_artifact("/tmp/never-written")
+    assert not os.path.exists("/tmp/never-written")
+
+    # A pre-flag runtime that DOES implement the method is still assumed capable (no regression for the
+    # runtimes the flag exists for). `SimpleNamespace` has no `export_compact`, so give it one.
+    mem._eng = SimpleNamespace(_runtime=SimpleNamespace(export_compact=lambda *a, **k: "/tmp"))
+    supported, detail = _compact_export_capability(mem)
+    assert supported is True and "no supports_compact_export flag" in detail

{codna-0.2.98 → codna-0.2.100}/tests/test_login_provisions_runtime.py

@@ -41,6 +41,16 @@ def fresh_machine(monkeypatch, tmp_path):
         "CODNA_TELYS_ACCOUNTS_URL", "CODNA_TELYS_API_URL", "CODNA_TELYS_PACKAGES_URL",
     ):
         monkeypatch.delenv(name, raising=False)
+    # "Fresh" must include the kernel, not just the env. The resolver also consults this SOURCE
+    # CHECKOUT's `build/local-telys` (`memory_install.candidate_install_roots` -> the checkout root
+    # derived from codna/memory.py), which `TELYS_HOME` does not redirect. Without this, a machine with
+    # a built runtime reports a kernel BEFORE any provisioning and a runner with none reports none —
+    # so `ensure_provisioned` takes a different branch per machine and the tests below would pin the
+    # developer's disk. Only the checkout fallback is neutralised: the `$CODNA_TELYS_INSTALL_ROOT`
+    # override the fake provisioning sets is still honoured, which is the path under test. The full
+    # resolution order is covered by `test_memory_errors.py` / `test_mcp_recall.py`.
+    monkeypatch.setattr("codna.memory_install.source_checkout_root",
+                        lambda package_file: tmp_path / "no-source-checkout")
     # The gate must see only what the test provisions — never the developer's real OS keychain.
     monkeypatch.setattr("codna.keystore.config_values", lambda: {})
     monkeypatch.setattr("codna.byok_cli.ensure_local_provider_key", lambda **kwargs: "present")
@@ -252,18 +262,73 @@ def test_ensure_provisioned_fast_path_never_calls_run_login(monkeypatch):
 def test_ensure_provisioned_skips_download_when_a_kernel_already_resolves(monkeypatch):
     # License missing but a kernel is already resolvable (e.g. a platform wheel): authorize the
     # device without re-downloading the runtime.
-    monkeypatch.setattr(memory_module, "_configured_license_token", lambda: (None, None))
+    #
+    # THE FLAG, which is why this test also matters for `runtime_installed`: this is the branch that
+    # passes `install=False`, and it used to report `runtime_installed: false` even though the device
+    # HAS a usable runtime — the flag echoed "nothing was downloaded" instead of "a kernel resolves".
+    # `telys.login` with install=False reports `installed: false` by construction, so the two can never
+    # agree; the status now comes from the resolver (see `ensure_provisioned`).
+    licenses = [("no license yet", None)]
+    monkeypatch.setattr(
+        memory_module, "_configured_license_token",
+        lambda: (None, None) if licenses[0][1] is None else ("device.jwt", "codna:onboarding-license"),
+    )
     monkeypatch.setattr(memory_module, "_resolve_telys_kernel",
                         lambda *, configure_env: {"found": True, "source": "codna:package-runtime"})
+
+    def fake_run_login(**kwargs):
+        licenses[0] = ("device authorized", "device.jwt")
+        return {"installed": False, "tier": "telys_developer"}
+
     captured: dict = {}
     monkeypatch.setattr(onb, "run_login",
-                        lambda **kwargs: captured.update(kwargs) or {"installed": False,
-                                                                     "tier": "telys_developer"})
+                        lambda **kwargs: captured.update(kwargs) or fake_run_login(**kwargs))
     status = onb.ensure_provisioned(access_token="tok")
     assert captured == {"token": "tok", "plan": "telys_developer", "install": False,
                         "open_browser": None}
     assert status["provisioned"] is True
     assert status["already_provisioned"] is False
+    # Downloaded nothing (install=False) yet the runtime IS installed — the regression this pins.
+    assert status["runtime_installed"] is True
+    assert status["runtime_source"] == "codna:package-runtime"
+
+
+def test_ensure_provisioned_refuses_to_report_success_without_a_runtime(monkeypatch):
+    """Provisioning that authorized the device but left NO resolvable kernel is a failure, not a
+    0-exit `codna login`: the documented contract is "0 = signed in AND provisioned", and a success
+    payload here would defer the failure to the first `codna_recall`."""
+    monkeypatch.setattr(memory_module, "_configured_license_token",
+                        lambda: ("device.jwt", "codna:onboarding-license"))
+    monkeypatch.setattr(memory_module, "_resolve_telys_kernel",
+                        lambda *, configure_env: {"found": False, "source": "missing"})
+    monkeypatch.setattr(onb, "run_login",
+                        lambda **kwargs: {"installed": False, "tier": "telys_developer"})
+
+    with pytest.raises(onb.OnboardingError, match="no Telys kernel resolves"):
+        onb.ensure_provisioned(access_token="tok")
+
+
+def test_ensure_provisioned_names_the_license_when_the_kernel_already_resolves(monkeypatch):
+    """`provisioned` is "license AND kernel", so the error must name which half is missing.
+
+    The kernel half can already be satisfied when the license is not — a platform wheel ships a
+    kernel, and `run_login` writing the license is a separate step. Blaming the kernel there sends
+    the user to `CODNA_TELYS_INSTALL_ROOT`/`TELYS_KERNEL`, i.e. to reconfigure the one thing that
+    works. Regression: the first version of this guard did exactly that.
+    """
+    monkeypatch.setattr(memory_module, "_configured_license_token", lambda: (None, None))
+    monkeypatch.setattr(memory_module, "_resolve_telys_kernel",
+                        lambda *, configure_env: {"found": True, "source": "codna:package-runtime"})
+    monkeypatch.setattr(onb, "run_login",
+                        lambda **kwargs: {"installed": False, "tier": "telys_developer"})
+
+    with pytest.raises(onb.OnboardingError) as excinfo:
+        onb.ensure_provisioned(access_token="tok")
+
+    message = str(excinfo.value)
+    assert "license was not written" in message
+    assert "TELYS_HOME" in message
+    assert "TELYS_KERNEL" not in message, "the kernel already resolves; do not send the user to it"
 
 
 # ---- login(): the access token is returned for the provisioning step --------------------------------

{codna-0.2.98 → codna-0.2.100}/tests/test_mcp_recall.py

@@ -90,7 +90,7 @@ def test_recall_uses_external_mcp_memory_root(monkeypatch, tmp_path):
 
 
 # ── runtime-gated: the happy path returns real symbols + a plan ───────────────────────────────────
-from telys_gate import require_telys_runtime  # noqa: E402 — must follow the sys.path setup above
+from tests.telys_gate import require_telys_runtime  # noqa: E402 — `tests` is a package (see tests/__init__.py)
 
 # NOT a bare `skipif(not telys_kernel_ready())` any more. That form could only ever SKIP, so a present but
 # unusable install (exactly the defect this file's happy path caught) reported as "not installed" and the