deadtrace 0.1.0a1__tar.gz

deadtrace-0.1.0a1/.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.py]
+indent_style = space
+indent_size = 4
+
+[*.{md,yml,yaml,toml,json}]
+indent_style = space
+indent_size = 2

deadtrace-0.1.0a1/.gitattributes

@@ -0,0 +1,4 @@
+# Normalize every text file to LF in the repository and in each working tree.
+# Ruff is configured with line-ending = "lf", so a Windows checkout made with
+# core.autocrlf=true would otherwise fail `ruff format --check` on unmodified files.
+* text=auto eol=lf

deadtrace-0.1.0a1/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,29 @@
+name: Bug report
+description: Report incorrect behavior or a false positive/negative
+title: "[bug] "
+labels: ["bug"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What happened, and what did you expect?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Include source, config, command, and report state. Remove secrets.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Deadtrace version or commit
+    validations:
+      required: true
+  - type: textarea
+    id: limitations
+    attributes:
+      label: Relevant framework and environment details

deadtrace-0.1.0a1/.github/ISSUE_TEMPLATE/design.yml

@@ -0,0 +1,32 @@
+name: Design proposal
+description: Propose a language, framework capability, schema, or architectural change
+title: "[design] "
+labels: ["needs-design"]
+body:
+  - type: textarea
+    id: user_result
+    attributes:
+      label: User result
+      description: Which concrete decision becomes possible?
+    validations:
+      required: true
+  - type: textarea
+    id: case
+    attributes:
+      label: Real pattern and negative case
+      description: Show both the desired behavior and the unsafe false-positive boundary.
+    validations:
+      required: true
+  - type: textarea
+    id: evaluation
+    attributes:
+      label: Independent evaluation
+      description: How can the outcome be checked without trusting Deadtrace's own report?
+    validations:
+      required: true
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope and non-goals
+    validations:
+      required: true

deadtrace-0.1.0a1/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

deadtrace-0.1.0a1/.github/pull_request_template.md

@@ -0,0 +1,11 @@
+## Summary
+
+<!-- What user-visible problem does this solve, and why this approach? -->
+
+## Test plan
+
+<!-- List the checks and cases actually run. -->
+
+## Analysis and compatibility impact
+
+<!-- Roots/worlds/guards/gates, config/report schemas, limitations, or “none”. -->

deadtrace-0.1.0a1/.github/workflows/ci.yml

@@ -0,0 +1,84 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
+        with:
+          enable-cache: true
+      - run: uv python install 3.12
+      - run: uv sync --locked --all-groups
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run mypy
+      - run: uv run pytest --cov
+      - run: uv run deadtrace cases validate fixtures/cases
+      - run: uv run deadtrace cases validate corpus
+
+  tests:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
+        with:
+          enable-cache: true
+      - run: uv python install 3.12
+      - run: uv sync --locked --all-groups
+      - run: uv run pytest
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
+      - run: uv python install 3.12
+      - run: uv build --python 3.12
+      - name: Seal exact candidate distributions
+        env:
+          CANDIDATE_SHA: ${{ github.sha }}
+        run: uv run --isolated --no-project --python 3.12 python scripts/release_artifacts.py seal --sha "$CANDIDATE_SHA"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: deadtrace-${{ github.sha }}-distributions
+          path: dist/*
+          if-no-files-found: error
+
+  wheel-smoke:
+    needs: build
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
+      - run: uv python install 3.12
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: deadtrace-${{ github.sha }}-distributions
+          path: dist
+      - name: Verify and smoke installed candidate
+        shell: bash
+        env:
+          CANDIDATE_SHA: ${{ github.sha }}
+        run: |
+          uv run --isolated --no-project --python 3.12 python scripts/release_artifacts.py verify --sha "$CANDIDATE_SHA"
+          workspace="$PWD"
+          wheel="$(find "$workspace/dist" -name '*.whl' -print -quit)"
+          cd "$(mktemp -d)"
+          uv run --isolated --no-project --python 3.12 --with "$wheel" python "$workspace/scripts/wheel_smoke.py"

deadtrace-0.1.0a1/.github/workflows/performance.yml

@@ -0,0 +1,53 @@
+name: Performance
+
+on:
+  workflow_dispatch:
+    inputs:
+      lines:
+        description: Lines per generated fixture
+        default: "50000"
+      runs:
+        description: Benchmark runs per fixture
+        default: "3"
+
+permissions:
+  contents: read
+
+jobs:
+  budget:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - run: uv python install 3.12
+      - run: uv build
+      - name: Generate fixtures outside the repository
+        shell: bash
+        run: |
+          work="$RUNNER_TEMP/deadtrace-performance"
+          uv run --isolated --no-project --python 3.12 python benchmarks/generate_scale_fixture.py \
+            "$work/scale" --lines "${{ inputs.lines }}"
+          uv run --isolated --no-project --python 3.12 python benchmarks/generate_service_fixture.py \
+            "$work/service" --lines "${{ inputs.lines }}"
+      - name: Benchmark from the built wheel
+        shell: bash
+        run: |
+          work="$RUNNER_TEMP/deadtrace-performance"
+          wheel="$(find "$GITHUB_WORKSPACE/dist" -name '*.whl' -print -quit)"
+          mkdir -p "$GITHUB_WORKSPACE/performance"
+          cd "$work"
+          for fixture in scale service; do
+            uv run --isolated --no-project --python 3.12 --with "$wheel" deadtrace benchmark \
+              "$work/$fixture" --runs "${{ inputs.runs }}" --format json \
+              --output "$GITHUB_WORKSPACE/performance/$fixture-${{ runner.os }}.json"
+          done
+      - uses: actions/upload-artifact@v7
+        with:
+          name: performance-${{ runner.os }}
+          path: performance/*.json
+      - name: Check the budget
+        run: uv run --isolated --no-project --python 3.12 python benchmarks/check_budget.py performance/scale-${{ runner.os }}.json performance/service-${{ runner.os }}.json

deadtrace-0.1.0a1/.github/workflows/publish.yml

@@ -0,0 +1,94 @@
+name: Publish verified alpha
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing version tag on main (for example v0.1.0a1)
+        required: true
+        type: string
+      ci_run_id:
+        description: Successful main push CI run for the exact tagged commit
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: publish-${{ inputs.tag }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    outputs:
+      sha: ${{ steps.candidate.outputs.sha }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.tag }}
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
+      - run: uv python install 3.12
+      - name: Verify tag and successful exact-commit CI
+        id: candidate
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.tag }}
+          CI_RUN_ID: ${{ inputs.ci_run_id }}
+        run: |
+          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(a|b|rc)?[0-9]*$ ]]
+          [[ "$CI_RUN_ID" =~ ^[0-9]+$ ]]
+          sha="$(git rev-parse HEAD)"
+          test "$(git rev-parse "refs/tags/$RELEASE_TAG^{commit}")" = "$sha"
+          git merge-base --is-ancestor "$sha" origin/main
+          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$CI_RUN_ID" > candidate-ci.json
+          export CANDIDATE_SHA="$sha"
+          uv run --isolated --no-project --python 3.12 python - <<'PY'
+          import json, os, tomllib
+          from pathlib import Path
+          run = json.loads(Path('candidate-ci.json').read_text())
+          assert run['repository']['full_name'] == os.environ['GITHUB_REPOSITORY']
+          assert run['head_repository']['full_name'] == os.environ['GITHUB_REPOSITORY']
+          assert run['path'] == '.github/workflows/ci.yml'
+          assert run['event'] == 'push' and run['head_branch'] == 'main'
+          assert run['status'] == 'completed' and run['conclusion'] == 'success'
+          assert run['head_sha'] == os.environ['CANDIDATE_SHA']
+          project = tomllib.loads(Path('pyproject.toml').read_text())['project']
+          assert os.environ['RELEASE_TAG'] == 'v' + project['version']
+          PY
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: deadtrace-${{ steps.candidate.outputs.sha }}-distributions
+          path: dist
+          run-id: ${{ inputs.ci_run_id }}
+          github-token: ${{ github.token }}
+      - name: Verify distribution identity and checksums
+        env:
+          CANDIDATE_SHA: ${{ steps.candidate.outputs.sha }}
+        run: |
+          uv run --isolated --no-project --python 3.12 python scripts/release_artifacts.py verify --sha "$CANDIDATE_SHA"
+          mkdir publish-dist
+          cp dist/*.whl dist/*.tar.gz publish-dist/
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: verified-${{ steps.candidate.outputs.sha }}
+          path: publish-dist/*
+          if-no-files-found: error
+
+  publish:
+    needs: verify
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: verified-${{ needs.verify.outputs.sha }}
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

deadtrace-0.1.0a1/.gitignore

@@ -0,0 +1,25 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.mypy_cache/
+.pytest_cache/
+.pytest-tmp/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# Environments and builds
+.venv/
+build/
+dist/
+
+# Editors and operating systems
+.idea/
+.vscode/
+.DS_Store
+Thumbs.db
+
+# CodeGraph local index
+.codegraph/
+.benchmark-work/

deadtrace-0.1.0a1/.python-version

@@ -0,0 +1 @@
+3.12

deadtrace-0.1.0a1/AGENTS.md

@@ -0,0 +1,13 @@
+# Agent guide
+
+Read `CONTRIBUTING.md` and the decision records in `docs/adr/` before semantic changes.
+
+- Keep one active milestone. The current milestone is the public read-only alpha release
+  (ADR-0049); freeze scanner semantics at model 31 while preparing 0.1.0a1.
+- Never import or execute target code from scanner paths.
+- Do not infer future semantics from fixture expectations.
+- Update `CASE.md` and `CASE.toml` only when the independent expected behavior changes.
+- Do not hand-edit `uv.lock`; regenerate it with uv.
+- Run Ruff, mypy, pytest with coverage, the case validator, build, and wheel smoke checks.
+- Record changes to semantic invariants, trust boundaries, dependencies, or schemas in an ADR
+  under `docs/adr/`, in the same pull request.

deadtrace-0.1.0a1/CHANGELOG.md

@@ -0,0 +1,245 @@
+# Changelog
+
+All notable changes will be documented here. The project follows Semantic Versioning once public
+compatibility commitments are defined; alpha schemas may change between releases.
+
+## Unreleased
+
+## 0.1.0a1 - 2026-10-05
+
+First public alpha for Python 3.12. Scanner model `python-fastapi-dishka/31`; inventory schema 0,
+semantic report schema 1. Findings require human review; no deletion-safety guarantee is made.
+
+- Static scanning, saved explanations, baselines, report comparison and diagnostic bundles.
+- Documented analysis contract, supported scope and exact-commit release acceptance.
+- Python receiver control-flow joins, finite local dispatch names, external nominal reflection,
+  stored literal callable/re-export protection, and public object-field/declared-return API closure
+  accumulated through ADR-0033 to ADR-0046.
+- A single CI-built wheel and source distribution are sealed with SHA-256 checksums, exercised
+  on Linux and Windows, and published through GitHub OIDC without rebuilding (ADR-0049).
+- The independently pinned `object.__setattr__` recall gap remains guarded on model 31;
+  the selected model-32 refinement is deferred. General dynamic dispatch and unmodeled behavior
+  retain conservative protection. Field measurements are not market-wide precision claims.
+
+The entries below describe the development history included in this first public distribution.
+
+### Added
+
+- A portable installed-wheel smoke check exercises inventory, analysis, determinism, explanations,
+  baselines, comparisons, and no target execution on both CI operating systems (ADR-0030).
+- Hypothesis `@given` arguments, plugins loaded with `-p` in `addopts`, `unittest.main()`, aliases of
+  `unittest.TestCase`, conditional bases and imports, scripts run by file name, and lazy export
+  tables are understood (ADR-0028).
+- Dead methods are found in more classes: a class a Dishka binding builds, an instance kept in a
+  list or a dictionary, and a class read for an attribute no longer keep all their methods; an
+  implementation of an abstract method is retained with its class (ADR-0027).
+- `[tool.deadtrace].exclude` leaves data directories out of the source universe; reports list
+  the excluded files (ADR-0018).
+- `cli.commands` capability: Typer commands and callbacks, and Click subcommands and groups.
+- `DT4002` reports a pinned FastAPI or Dishka version that is supported but not oracle-tested.
+- Text reports and `doctor` name the widest guards of production worlds, with the number of
+  definitions only they keep possibly running and where they are, when unknown boundaries
+  protect much of the project.
+- Reports list the skipped environment and tool directories
+  (`source_universe.skipped_directories`, ADR-0015).
+- `alembic.migrations` capability: Alembic environments and revision functions are external
+  contracts (ADR-0017).
+- A manually dispatched `Performance` workflow that benchmarks the generated 50k-line scale and
+  service fixtures from the built wheel on Linux and Windows, uploads the artifacts, and fails
+  above the 30-second or 1-GiB budget (`benchmarks/check_budget.py`).
+- Installable Python package and `deadtrace` CLI.
+- Read-only inventory of functions and classes.
+- World-local reachability, conservative unknown propagation, retention, and negative gates.
+- FastAPI, Dishka, Pydantic, and pytest semantic capabilities with guarded unsupported patterns.
+- Stable review groups `RCH001`–`RCH004`, saved explanations, and schema-1 semantic reports.
+- Explicit baselines, report comparison, CI finding policies, doctor, and benchmark commands.
+- Safe baseline updates and three-state report comparability with explicit source/input changes.
+- Privacy-conscious troubleshooting bundles with a pre-write content preview.
+- Static PEP 621 entry-point worlds with root provenance and guarded dynamic metadata.
+- Automatic worlds without configuration (ADR-0011): `production:scripts` for main guards
+  and `__main__` modules, one world per application of Flask, Celery, Starlette, Litestar,
+  aiohttp, Sanic, Quart, Falcon, Bottle, or Typer, and `production:library` for the public
+  API of projects without applications or entry points, each with its root provenance.
+- Executable semantic corpus and pinned FastAPI/Dishka oracle application.
+- Safety retention for static Django `RunPython` migrations and implicit Python
+  property/protocol/metaclass hooks.
+- Whole-source snapshot retry with `DT1002` fallback when files keep changing during a scan.
+- Experimental inventory schema 0 remains available through `--inventory-only`.
+- Strict `[tool.deadtrace]` configuration and report exclusions that do not alter analysis scope.
+- Six independently described seed cases and a lexical manifest validator.
+- Windows/Linux CI, wheel smoke testing, contribution, governance, and security policies.
+- Architecture decision records under `docs/adr/`, starting with the decision to keep them in
+  the repository and the acceptance of Rich 15.
+- Sub-stage timings and deterministic size counters for every analysis run
+  (`deadtrace.timing`), threaded through source collection, inventory, the Python frontend,
+  and framework modeling without changing what any stage computes.
+- `benchmarks/profile_scan.py` and the first committed 50k-line profile under
+  `benchmarks/results/`.
+- `benchmarks/generate_service_fixture.py`, a deterministic FastAPI/Dishka/Pydantic service whose
+  size grows with symbols, calls, routes, and bindings, and `benchmarks/stage_installed_sources.py`,
+  which copies the sources of locked third-party packages as scan targets without importing them.
+  The scale fixture alone produces no edges or framework objects and could not show those costs.
+- `fixtures/known-violations/`: cases where a complete world reports code that may run as
+  unreached, pinned by `tests/test_known_violations.py` (ADR-0006), and the safety-only case
+  expectation `not_candidate`. Twenty-eight were recorded and are now met.
+
+### Changed
+
+- Model revision `python-fastapi-dishka/19` (ADR-0026), from 57 more installed packages: the API a
+  library's `__init__` re-exports explicitly is a root next to its command line (world
+  `production:exports`); quoted annotations name their classes; `return locals()` hands nested
+  functions on; `self.name` in a mixin reaches the member of a subclass; a member missing on a typed
+  receiver reaches subclass members and test stand-ins.
+- Model revision `python-fastapi-dishka/18` (ADR-0025), from 39 installed libraries: overrides of
+  public methods in private implementation classes, module `__getattr__` and `__dir__`, classes
+  named by a subscripted annotation, methods passed as values with their overrides and branch
+  definitions, `globals()[name]` lookups, test modules that create their tests when imported,
+  main-guard programs in test directories, classes derived from a computed base, a definition
+  and an import that bind one name, and `request.getfixturevalue("name")` in plugins.
+- Model revision `python-fastapi-dishka/17` (ADR-0024): test functions and classes that a test
+  module imports by name or with `*` are collected in the importer and resolve their fixtures from
+  its directory and conftests; a directory without Python files says so.
+- Model revision `python-fastapi-dishka/16` (ADR-0023): commands in Compose files, Dockerfiles,
+  `Procfile`, Makefiles, shell scripts, supervisord programs, and systemd units that start
+  `uvicorn`, `gunicorn`, `hypercorn`, `daphne`, `granian`, `faststream`, `taskiq`, `arq`,
+  `dramatiq`, `celery -A`, `python -m`, `python script.py`, or `locust -f` root the world
+  `production:commands` when no worlds are configured; gunicorn configuration hooks, locust
+  users, and classes that logging configurations name by `class` or `()` are conservative
+  roots with their methods (`deployment.commands` capability). A configured world named
+  `production:migrations` is rejected, and deployment reading has the timing stage
+  `frontend.deployment`.
+- Model revision `python-fastapi-dishka/15` (ADR-0021): reports and baselines stay comparable
+  when tests, routes, scripts, or applications are added, when dependencies other than
+  unsupported FastAPI or Dishka versions change, and when only the analyzer version changes;
+  `compare` lists added and removed worlds and roots as source changes. Fingerprints no longer
+  include worlds, so every fingerprint changes once. `baseline update` carries reviewed entries
+  over by code and members, and an incomparable baseline names the method fields that differ.
+- The same revision (ADR-0022), from a 624k-line monorepo: imports inside services that hold a
+  package of their own name, namespace service packages, and editable libraries such as
+  `libs/common/common` resolve; migrations run in their own world `production:migrations`;
+  FastStream applications, taskiq schedulers, and arq workers root worlds; unresolved method
+  dispatch and `import_module(f"{obj.__module__}.x")` protect only code whose module may run;
+  a union annotation gives no single type; `self` fields take the annotated type or the one
+  class all methods assign; `getattr` values of known receivers and `Cls(...).method`
+  arguments and project instances passed to libraries escape; deserializers such as
+  `pickle.loads` open the module gates; classes created for a metaclass or `__init_subclass__`
+  are kept; `pytest_asyncio.fixture`, assigned patchers, joined string
+  literals, transitive star imports, fixture defaults, conftest top-level code, `pytest_plugins`
+  per session, and `RunPython(code=...)` are modeled.
+- Reports and baselines are read back up to 256 MiB, and `scan` warns when a report is larger;
+  project inputs keep the 16 MiB limit.
+- A finding's explanation lists its worlds' limitations other than guards once, with counts, and
+  the number of guards, instead of copying every guard; reports of single-service projects are
+  up to ten times smaller and stay below 16 MiB.
+- Model revision `python-fastapi-dishka/14` (ADR-0020): `Sub.member` with an inherited member
+  uses `Sub`, so the hooks bases call on it are reached; pytest-click fixtures are known.
+- Model revision `python-fastapi-dishka/13` (ADR-0019): a FastAPI factory that returns its
+  application inside a wrapper, and the uncalled function that calls it, root a web world; a
+  package imports its own submodules by absolute name; a `pytest11` plugin's package is also a
+  library, and the classes its fixtures return expose their public methods; setuptools `build`
+  copies are skipped; nested test classes are collected.
+- Model revision `python-fastapi-dishka/12` (ADR-0018): FastAPI `>=0.100,<1` and Dishka
+  `>=1.0,<2` are supported, and only versions outside those ranges weaken worlds (`DT4001`);
+  methods of test stand-ins for values from outside the project, fixtures requested with
+  `getfixturevalue` or lazy fixtures, and fixtures of `pytest11` plugins are reachable;
+  importing a module that is loaded already and `with` targets of outside managers add no
+  unknown dispatch; a project without roots reports `DT3004`.
+- The solver marks each distinct boundary target set once per world, and the pytest model no
+  longer records per-test fixture visibility; results are unchanged.
+- Model revision `python-fastapi-dishka/11` (ADR-0017), from an audit of six real projects:
+  `include_router` in helpers and loops over literal router lists; entry points naming a
+  top-level value such as a Typer application; calls inside annotations; attribute chains
+  through enumeration members; nested `Config` and `Meta` classes; Django `AppConfig`,
+  ASGI/WSGI modules, and `MIGRATION_MODULES`; modules loaded from paths or by computed names and
+  their attributes; `Protocol` receivers and test stand-ins; pytest marks and fixtures as
+  transparent decorators; closures of retained declarations.
+- pytest facts are local to the tests world, and the model resolves arguments, parametrization,
+  plugins, fixture imports, collection patterns, inherited test methods, hooks, and xunit setup
+  the way pytest does (ADR-0016).
+- Source discovery skips virtual and conda environments, `site-packages`, `node_modules`,
+  `__pypackages__`, and hidden directories; a `src` directory is a package when code imports it,
+  and absolute imports also resolve against a script's own directory (ADR-0015).
+- Limitations that every world shares, such as an unreadable file, are printed once in text
+  reports.
+- Text reports and `doctor` count identical limitations once and summarize worlds with many
+  kinds of `DT2002` guard in one line; the JSON report still lists every guard.
+- A world's `frameworks` list accepts every modeled framework and is documented as declarative
+  (ADR-0014): every capability applies to every world.
+- Model revision `python-fastapi-dishka/10` (ADR-0013): a module assigning `INSTALLED_APPS`
+  is a Django settings module that imports its applications' packages and `apps`, `models`,
+  `admin`, template-tag, and management-command modules, registers model classes, and
+  instantiates commands; without configuration each settings module roots a
+  `production:django` world. A string may name a module through an attribute it binds.
+- Model revision `python-fastapi-dishka/9` (ADR-0012): `@overload` signatures belong to
+  their implementation; single-underscore hooks such as `_repr_html_` are protected like
+  special methods; a nested function bound in one branch is reachable through its name; a
+  class that escapes exposes its methods, except to `isinstance`, `issubclass`, and
+  consumers a capability models.
+- Model revision `python-fastapi-dishka/8` (ADR-0011): FastAPI factories that no module
+  calls are applications, and a factory's constructor resolves in its own module; Celery
+  `autodiscover_tasks()` may import every `tasks` module. Without `max-steps`, the solver
+  budget is twice the node count instead of 100,000 steps.
+- Model revision `python-fastapi-dishka/7` (ADR-0010): an import statement runs the project
+  modules on its path wherever it executes, whatever it binds, except under
+  `if TYPE_CHECKING:`; a module runs after its package; imports in nested blocks and in
+  functions bind names; star imports and package re-exports resolve, for configured roots
+  and entry points too; a name bound in alternative branches reaches every alternative.
+- Model revision `python-fastapi-dishka/6` (ADR-0009): every special method of a used class,
+  and the methods of classes with an external base that may call them, are protected
+  conservatively, with builtins, `abc`, `typing`, `pydantic.BaseModel`, and `dishka.Provider`
+  exempt; strings that name a project module or symbol are references; `importlib`
+  imports by literal, f-string prefix, or unknown name reach those modules. `DT2002` appears
+  only for boundaries that protect a node not otherwise resolved.
+- Model revision `python-fastapi-dishka/5` (ADR-0008): references to project functions and
+  classes, member-to-owner and inheritance edges, method resolution order and `super()`, class
+  hierarchy dispatch, conservative dispatch on values of unknown type, decorator application and
+  registration, evaluated annotations, Python name scoping with local shadowing, and Pydantic
+  hooks whenever their model is used. The thirteen recorded known violations are met and moved
+  to `corpus/`; `EdgeKind` gains `member`, `inherit`, and `annotation`. `Service` in two Dishka
+  corpus cases is now live through its endpoint annotation.
+- The analysis parses with the standard-library `ast` module instead of LibCST, which is no
+  longer a dependency (ADR-0007). The 50k-line fixtures scan in 0.6 and 1.2 instead of 11.8 and
+  16.3 seconds and mypy's 129k lines in 2.6 instead of 65.8, with peak RSS roughly halved.
+  Reports are byte-identical; `DT1001` messages for unparseable
+  files now read `syntax error at line L, column C: <message>`. The benchmark artifact is schema 4:
+  `descriptor.libcst_version` is replaced by `descriptor.parser`.
+- Symbol, member, container-binding, and adjacency lookups use indexes built once per analysis
+  instead of scanning whole collections per query, and the frontend walks each called function's
+  body once instead of once per call site (ADR-0005). On the 50k-line service fixture the affected
+  stages take 2.2 instead of 15.9 seconds at the median, and they no longer grow faster than the
+  source. Reports are byte-identical.
+- Each module is parsed once and its source positions are resolved once; inventory, the
+  Python frontend, and framework discovery share the result (ADR-0004). The 50k-line
+  benchmark is 2.7 times faster at the median with byte-identical reports.
+- The benchmark artifact is schema 3: `collect.inventory_parse` is replaced by
+  `collect.parse`, which covers the single parse and position pass.
+- The benchmark artifact is schema 2: it records host and tool versions, deterministic
+  counters, per-sub-stage seconds, a separate `report_seconds`, and the list of volatile
+  fields. `memory_note` moved to `notes.memory`.
+
+### Fixed
+
+- Source traversal errors and non-text encoding cookies produce `DT1001` instead of silently
+  dropping source or crashing. Configuration reads enforce the 16-MiB input limit; invalid UTF-8
+  uses existing input diagnostics. Invalid modeled dependency versions produce the `DT4001`
+  compatibility guard (ADR-0030).
+- Package API worlds follow re-exports from all conditional imports, including alternatives to
+  absent compiled modules. Class-body and chained annotations retain the classes they name
+  (ADR-0029, model revision 22).
+- A report with input issues is comparable with a baseline created from it; the issues were
+  stored as tuples and read back as lists.
+- The `pytest.fixtures` capability is listed whether or not the project has tests, so a first
+  test no longer changes the analysis method.
+- Repository-wide LF normalization through `.gitattributes`, so a Windows checkout made with
+  `core.autocrlf=true` no longer fails `ruff format --check` on unmodified files.
+- The documented wheel smoke command selects Python 3.12 explicitly instead of relying on the
+  default interpreter on PATH.
+- Strict mypy no longer fails on Linux. The Windows-only peak working set helper now declares
+  its platform precondition instead of relying on a runtime `AttributeError`, which `ctypes`
+  raises only at runtime and which mypy reports as `Module has no attribute "WinDLL"`.
+
+### Safety
+
+- Static scans never import or execute target modules.
+- Unsupported target versions and unresolved framework assembly block strong negative findings.
+- Baselines annotate findings but never suppress blockers or alter semantic analysis.

deadtrace-0.1.0a1/CODE_OF_CONDUCT.md

@@ -0,0 +1,29 @@
+# Code of Conduct
+
+## Our commitment
+
+We are committed to a welcoming, safe, and constructive community regardless of age, body size,
+disability, ethnicity, sex characteristics, gender identity or expression, experience level,
+education, socioeconomic status, nationality, appearance, race, caste, color, religion, or
+sexual identity and orientation.
+
+## Expected behavior
+
+- Be respectful, specific, and patient.
+- Critique ideas and evidence, not people.
+- Accept responsibility, apologize when appropriate, and learn from feedback.
+- Protect private information and avoid public speculation about security reports.
+- Prioritize the health of the project and community over individual status.
+
+Harassment, threats, discriminatory language, sexualized attention, deliberate intimidation,
+doxxing, and sustained disruption are not acceptable.
+
+## Enforcement
+
+Report conduct concerns privately to the repository maintainers through an appropriate private
+GitHub channel. Maintainers will review reports confidentially, avoid conflicts of interest, and
+may remove content, issue warnings, impose temporary restrictions, or permanently exclude a
+participant. Good-faith reporters will not face retaliation.
+
+This policy applies in project spaces and when someone is publicly representing the project.
+It is adapted from the Contributor Covenant, version 2.1.