graphite-code 0.5.3__tar.gz → 1.0.0__tar.gz

{graphite_code-0.5.3 → graphite_code-1.0.0}/CHANGELOG.md

@@ -1,7 +1,8 @@
 # Changelog
 
 Notable changes to graphite. Format follows [Keep a Changelog]; versioning is
-semver, pre-1.0 (minor versions may break things).
+semantic. From 1.0.0 the surfaces listed in `docs/compatibility.md` are
+stable: a breaking change to any of them is a major release.
 
 **A version number here is a coarse release label, not a fix marker.** Several
 behavioural fixes have shipped with no version change at all — the `-P`
@@ -12,6 +13,90 @@ machine-checkable identity; the version is for humans.
 
 [Keep a Changelog]: https://keepachangelog.com/en/1.1.0/
 
+## [1.0.0] — 2026-08-29
+
+The production-grade release. Nothing here is a claim CI cannot turn red:
+each item names the gate or test that enforces it. The declaration criteria
+and their evidence are in `docs/superpowers/specs/2026-08-29-production-grade-design.md`.
+
+### Fixed
+
+**The cycle report could not finish on a repository with dense import
+cycles** (#64). `analyze()` enumerated every simple cycle of the project
+graph before sorting and keeping twenty; on Django 5.2 (2 930 source files,
+`tests/` and `django/` importing each other) that is exponential — 13 GB and
+unfinished after thirty minutes, while each half alone reported cycles in
+seconds. The search is now bounded: cycles are enumerated inside strongly
+connected components one length level at a time up to length 8, under a
+10 000-cycle budget, and stop once a completed level holds the twenty
+shortest — exact whenever it stops that way, and deterministic across
+processes even when the budget bites. `analysis.cycle_search` records
+`length_bound`, `budget`, `examined`, `budget_exhausted`,
+`complete_through_length`, `cyclic_components` and `largest_component`, so a
+truncated answer says so. Django 5.2 now builds in 82 s (45 620 nodes,
+109 373 edges, 53 MB). Found by the real-repository benchmark; the synthetic
+corpus alone would never have shown it.
+
+**A lifecycle event claiming "no prior observation" over an UNAVAILABLE row
+raised `AttributeError`** instead of `lifecycle_transition_stale`
+(`routing/lifecycle_storage.py`); found while making the type gate clean.
+
+### Added
+
+- **Every supported cell gates merges.** The CI matrix is windows/ubuntu/macos
+  × CPython 3.11–3.14, all twelve cells blocking; the advisory `portability`
+  job is gone. Ubuntu and macOS 3.13 ran for the first time and pass.
+- **A type gate.** `python -m mypy` over `src/graphite` runs in the lint
+  job; 142 findings were fixed with zero `type: ignore` comments added, and
+  the gate is clean under `--platform` win32, linux and darwin.
+  `graphite/py.typed` ships (the artifact verifier refuses a wheel without
+  it) and the distribution carries `Typing :: Typed`.
+- **A coverage floor.** Branch coverage is collected on the 3.12 leg of each
+  OS, combined (83.04 % on the first measurement), and enforced at
+  `COVERAGE_FLOOR = 83`; a `workflow_dispatch` input overrides the floor for
+  one run as the negative control (floor 84 turns the job red).
+- **The security gates run in CI, unmodified.** A `security` job creates the
+  dev venv `aramid.toml` names and runs `aramid check --gate pre-commit|pre-push
+  --all --strict` against the committed configuration, asserting the tools
+  that ran (gitleaks, ruff, shadow; gitleaks, mypy, the suite, semgrep,
+  shadow) and refusing any degraded tool. A planted repo-root `graphite.py`
+  fails it at the pre-commit gate — and, under `python -m pytest`, every test
+  leg with it, which is the hazard the `-P` launch shape exists for.
+- `SECURITY.md` (GitHub private vulnerability reporting), `CODEOWNERS`, issue
+  templates, dependabot for actions and pip, `authors` metadata.
+- `daemon-install-linux` (systemd user unit), `daemon-install-macos`
+  (launchd agent), `daemon-uninstall-*` and `daemon-service-status`; all
+  three supervisors build their launch argv from one place, so `-P` is
+  present by construction. `daemon-health` reports the platform's supervisor.
+- `benchmarks/`: a deterministic synthetic corpus and a build benchmark; a CI
+  `benchmark` job records a 3 000-file build as an artifact and fails only
+  past a catastrophic budget. `capabilities` declares
+  `supported_repo_files: 7000` with its basis; `docs/benchmarks.md` holds the
+  measurements, including Django 5.2.
+- Reference documentation that cannot drift: `docs/reference/cli.md`
+  (generated from the parser; a test fails when stale),
+  `docs/reference/configuration.md` (every `Config` field and every
+  `GRAPHITE_*` variable the code reads, both directions tested),
+  `docs/reference/exit-codes.md` (every subcommand has a row),
+  `docs/compatibility.md` (what 1.x promises, the deprecation policy, the
+  support matrix).
+- Releases are built in CI from the approved tag with pinned tools
+  (`release-build-constraints.txt`), refused unless both digests equal the
+  reviewed ones, attached to the GitHub Release, and published with PEP 740
+  attestations that are true because this workflow built the bytes.
+
+### Changed
+
+- `Development Status :: 5 - Production/Stable`. From 1.0.0 the surfaces in
+  `docs/compatibility.md` are stable; a breaking change to any of them is a
+  major release.
+- The CI security job pins aramid 0.6.0 (the version the maintainer's
+  machine runs). mypy's configuration lives in `setup.cfg` for now: aramid
+  0.6.0's typecheck runner arms on `[tool.mypy]` and hands non-Python files
+  to mypy (accepted in channel round 140, fixed in aramid 0.6.1); both
+  files say when to move it back. Two reasoned entries in
+  `.aramid-suppressions.toml` from the same defect retire themselves.
+
 ## [0.5.3] — 2026-08-28
 
 ### Fixed

{graphite_code-0.5.3 → graphite_code-1.0.0}/CONTRIBUTING.md

@@ -101,6 +101,15 @@ Doctor changes require focused tests for stable doctor JSON, deterministic order
 
 No live provider calls in automated tests are permitted. Exercise network and subprocess behavior through a fake worker, fake provider, and fake process boundary with controlled time, output, failures, and descendants. Tests must remain offline, deterministic, and safe to run without credentials.
 
+### Coverage floor
+
+CI collects branch coverage on the 3.12 leg of every OS, combines the three
+data files in the `coverage` job, and fails under `COVERAGE_FLOOR` in
+`.github/workflows/ci.yml`. The floor is the integer part of the measured
+total: raise it when a release measures higher, and never lower it without a
+CHANGELOG entry saying what was removed and why. No single leg's figure is
+the measurement -- platform-only code is covered on one OS each.
+
 ## Security expectations
 
 Treat repository files, file names, symlinks, Git metadata, generated graph data, and model output as untrusted input. Pass subprocess arguments as an argument vector and never interpolate untrusted values into a shell command. Preserve path containment, bounded I/O, explicit timeouts, atomic writes, output encoding, and safe error redaction at every relevant boundary.

{graphite_code-0.5.3 → graphite_code-1.0.0}/PKG-INFO

@@ -1,24 +1,27 @@
 Metadata-Version: 2.5
 Name: graphite-code
-Version: 0.5.3
+Version: 1.0.0
 Summary: Local-first, zero-LLM knowledge graph extraction for codebases.
 Project-URL: Homepage, https://github.com/jared0565/graphite
 Project-URL: Repository, https://github.com/jared0565/graphite
 Project-URL: Changelog, https://github.com/jared0565/graphite/blob/main/CHANGELOG.md
 Project-URL: Issues, https://github.com/jared0565/graphite/issues
+Author-email: jared0565 <jared0565@gmail.com>
 License-Expression: MIT
 License-File: LICENSE
-Classifier: Development Status :: 4 - Beta
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: Microsoft :: Windows
 Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Requires-Dist: networkx>=3.3
 Requires-Dist: pydantic>=2.0
@@ -31,6 +34,7 @@ Requires-Dist: tree-sitter-rust>=0.23
 Requires-Dist: tree-sitter-typescript>=0.23
 Requires-Dist: tree-sitter>=0.23
 Provides-Extra: dev
+Requires-Dist: mypy>=1.14; extra == 'dev'
 Requires-Dist: pytest-cov>=5.0; extra == 'dev'
 Requires-Dist: pytest-timeout>=2.3; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
@@ -175,6 +179,13 @@ After upgrading graphite itself, restart the daemon: a long-running daemon keeps
 
 ## Usage
 
+Reference pages, each kept in lockstep with the code by a test:
+[CLI](docs/reference/cli.md) (generated from the parser),
+[configuration](docs/reference/configuration.md) (every `GRAPHITE_*` variable),
+[exit codes](docs/reference/exit-codes.md),
+[compatibility and support](docs/compatibility.md) (what 1.x promises), and
+[benchmarks](docs/benchmarks.md) (what `supported_repo_files` rests on).
+
 ```bash
 # Scan a repo (zero tokens)
 graphite scan .
@@ -508,6 +519,24 @@ graphite daemon-uninstall-startup-windows C:\Projects
 
 The fallback writes a hidden VBS launcher in the current user's Startup folder and an idempotent PowerShell launcher in `C:\Projects\.graphite-daemon`.
 
+Linux and macOS supervision, same daemon, same bounded defaults:
+
+```bash
+# Linux: a systemd USER unit (~/.config/systemd/user/graphite-daemon.service),
+# reloaded, enabled and started; no privilege needed
+graphite daemon-install-linux ~/Projects
+graphite daemon-service-status
+graphite daemon-uninstall-linux
+
+# macOS: a launchd agent (~/Library/LaunchAgents/com.graphite.daemon.plist),
+# bootstrapped into the user's GUI domain; logs under ~/Library/Logs/graphite
+graphite daemon-install-macos ~/Projects
+graphite daemon-service-status
+graphite daemon-uninstall-macos
+```
+
+`daemon-service-status` answers for whichever supervisor the platform uses (on Windows it reports the scheduled task and the startup launcher), and `daemon-health` reports the same fact as `startup installed`. Every generated launcher runs the interpreter with `-P` -- the systemd unit and the plist are built from the same argument vector as the Windows task. A systemd user unit runs only while you have a login session unless you enable lingering (`loginctl enable-linger $USER`); that is a policy choice graphite does not make for you.
+
 ## Canonical graph and enrichment isolation
 
 `scan`, `build`, `report`, `check`, `validate`, `query`, `context`, `impact`, `watch`, and `daemon` are canonical operations. They force an internal no-inference configuration, ignore ambient `GRAPHITE_LLM*` values, exclude provider data from graph artifacts, and reject legacy non-`none` `--llm` or provider flags. `--llm none` remains a temporary compatibility no-op.