pactkit 2.12.0__tar.gz → 2.14.0__tar.gz

pactkit-2.14.0/.codegraph/.gitignore

@@ -0,0 +1,16 @@
+# CodeGraph data files
+# These are local to each machine and should not be committed
+
+# Database
+*.db
+*.db-wal
+*.db-shm
+
+# Cache
+cache/
+
+# Logs
+*.log
+
+# Hook markers
+.dirty

{pactkit-2.12.0 → pactkit-2.14.0}/.gitignore

@@ -62,3 +62,6 @@ coder/
 docker/
 docs/slides/
 
+
+# Call graph SQLite output (STORY-slim-121)
+docs/architecture/graphs/*.db

{pactkit-2.12.0 → pactkit-2.14.0}/.opencode/pactkit.yaml

@@ -143,6 +143,7 @@ agent_models:
 
 # Visualize — configure directory scan exclusions
 visualize:
+  graph_provider: codegraph
   scan_excludes:
     - venv
     - _venv

{pactkit-2.12.0 → pactkit-2.14.0}/CHANGELOG.md

@@ -4,6 +4,33 @@ All notable changes to PactKit will be documented in this file.
 
 Format follows [Keep a Changelog](https://keepachangelog.com/).
 
+## [2.14.0] - 2026-05-26
+
+### Added
+- **Codegraph integration** (STORY-slim-124) — `pactkit query` now reads from `.codegraph/codegraph.db` (generated by `@colbymchenry/codegraph`) when `visualize.graph_provider: codegraph` is configured. Provides 2.6x more edges than pactkit's own suffix-match resolution (6580 vs 2483 in real projects), with qualified names, line numbers, and type-aware resolution.
+- **Auto-init codegraph** — When `graph_provider: codegraph` is set and `.codegraph/codegraph.db` is missing, `pactkit query` auto-runs `codegraph init -i` if the CLI is on PATH. Plan/Act phases also auto-setup codegraph when detected.
+- **Graph Query Protocol dual-mode** — PDCA commands now support two modes: Codegraph Mode (`pactkit query` + codegraph CLI + MCP tools) and Grep Mode (default fallback on `.mmd` files).
+
+### Removed
+- **`_write_sqlite_db()`** — Pactkit no longer generates its own `call_graph.db`. The upstream codegraph tool produces a superior graph with tree-sitter + import-aware resolution.
+- **`visualize.sqlite_output` config** — Replaced by `visualize.graph_provider: codegraph`. Existing configs should migrate.
+
+### Changed
+- **`pactkit query`** — Now reads `.codegraph/codegraph.db` (codegraph schema with hash IDs, JOIN edges+nodes) instead of pactkit's own `call_graph.db`.
+- **PDCA prompts updated** — All references to `call_graph.db` / "SQLite Mode" removed from Plan, Act, Check, Done, Hotfix, and Trace skills. Impact analysis uses `pactkit query --callers` (codegraph) or grep `.mmd` (default).
+
+## [2.13.0] - 2026-05-25
+
+### Added
+- **Call graph SQLite output** (STORY-slim-121) — `pactkit visualize --mode call` now optionally writes `call_graph.db` alongside the existing `.mmd` file. Enable via `visualize.sqlite_output: true` in `pactkit.yaml`. Atomic write (tmp+rename), zero new dependencies (`sqlite3` stdlib).
+- **`pactkit query` CLI** (STORY-slim-121) — New subcommand for structured call graph queries: `--callers <func>` (fan-in), `--callees <func>` (fan-out), `--chain <func> [--down]` (transitive upstream/downstream via recursive CTE). Reads from `call_graph.db`; exits with helpful message when db is missing.
+- **Graph Query Protocol upgrade** (STORY-slim-121) — `SKILL_VISUALIZE_MD` now routes to `pactkit query` as primary path when `call_graph.db` exists, with grep as fallback for mmd-only projects.
+- **Enhanced Python call graph coverage** (STORY-slim-119) — `_extract_calls` now captures non-self attribute calls (`engine.run()`), function references in list/tuple/keyword/assign contexts, and nested functions via `ast.walk` + parent map. Edge count on medium-large projects: 1,360 → 3,764 (+177%).
+- **Test and script scanning in call graph** (STORY-slim-120) — `visualize --mode call` now scans `tests/`, `scripts/`, and `alembic/` directories in addition to `src/`. Locality-based `_resolve_callee` prefers same-file/same-package candidates when multiple matches exist.
+- **`pactkit interface-summary` CLI** (STORY-slim-113) — AST-based interface extraction that physically outputs only signatures, types, and docstrings. Enforces "Code Enforces, Prompt Instructs" for Act Phase 1 layered loading — AI receives truncated content by design.
+- **Journey Sync in Act Phase 4** (STORY-slim-114) — Conditional step that updates `docs/e2e/journey.md` when a Story modifies journey-relevant steps. Closes the create→consume→update lifecycle gap.
+- **Journey Segment in Plan Phase 3.2a** (STORY-slim-114) — Conditional Spec annotation that links Stories to journey steps, enabling Act Phase 4 auto-detection.
+
 ## [2.12.0] - 2026-05-06
 
 ### Changed

{pactkit-2.12.0 → pactkit-2.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pactkit
-Version: 2.12.0
+Version: 2.14.0
 Summary: Spec-driven agentic DevOps toolkit for AI coding assistants
 Project-URL: Homepage, https://pactkit.dev
 Project-URL: Repository, https://github.com/pactkit/pactkit-public
@@ -55,7 +55,7 @@ Description-Content-Type: text/markdown
 
 > **PactKit** (Pact 契约 + Kit) is a governance framework that enforces the **P.A.C.T.** contract between humans and AI agents. Deterministic operations run as code, not prompts. Decisions are grounded in data, not memory. AI does what it's best at — creativity and language — while code handles everything that must be repeatable and correct.
 >
-> 25 CLI subcommands, 9 specialized agents, 11 commands, 10 skills, and a full Plan-Act-Check-Done lifecycle. One `pip install` deploys to all 3 supported IDEs.
+> 26 CLI subcommands, 9 specialized agents, 11 commands, 10 skills, and a full Plan-Act-Check-Done lifecycle. One `pip install` deploys to all 3 supported IDEs.
 
 ### Supported AI Tools
 
@@ -247,7 +247,7 @@ PactKit deploys 10 skills (3 scripted + 7 prompt-only), auto-invoked by commands
 
 | Skill | Type | Purpose |
 |-------|------|---------|
-| **pactkit-visualize** | Scripted | Code dependency graph (Mermaid): file-level, class-level, call-level |
+| **pactkit-visualize** | Scripted | Code dependency graph (Mermaid .mmd): file-level, class-level, call-level |
 | **pactkit-board** | Scripted | Sprint board operations: add story, update task, archive |
 | **pactkit-scaffold** | Scripted | File scaffolding: create spec, test files, git branches, skills |
 | **pactkit-trace** | Prompt-only | Deep code tracing and execution flow analysis |
@@ -260,7 +260,7 @@ PactKit deploys 10 skills (3 scripted + 7 prompt-only), auto-invoked by commands
 
 ## CLI Subcommands
 
-PactKit ships 25 deterministic CLI subcommands — operations that were previously delegated to AI prompts are now enforced in Python code (the "C" in P.A.C.T.):
+PactKit ships 26 deterministic CLI subcommands — operations that were previously delegated to AI prompts are now enforced in Python code (the "C" in P.A.C.T.):
 
 | Command | Purpose |
 |---------|---------|
@@ -281,6 +281,7 @@ PactKit ships 25 deterministic CLI subcommands — operations that were previous
 | `pactkit test-map` | Map source files to test files |
 | `pactkit coverage-gate` | Enforce 3-tier coverage thresholds (80/50/block) |
 | `pactkit visualize` | Conditional graph regeneration (lazy mode) |
+| `pactkit query` | Query call graph via codegraph: `--callers`, `--callees`, `--chain [--down]` (requires `graph_provider: codegraph`) |
 | `pactkit lesson-append` | Append lesson with specificity check and dedup |
 | `pactkit invariants-refresh` | Update test count invariant in rules.md |
 | `pactkit sec-scope` | Detect security scope for changed files |
@@ -375,6 +376,7 @@ docs/
 | `skills` | list | all 10 | Skills to deploy |
 | `rules` | list | all 8 | Constitution rule modules to deploy |
 | `exclude` | object | `{}` | Components to exclude (e.g., `exclude.agents: [agent-name]`) |
+| `visualize.graph_provider` | string | (absent) | Graph query backend. Set `codegraph` to use `.codegraph/codegraph.db` for `pactkit query`. Absent = grep `.mmd` |
 | `ci` | object | `provider: none` | CI/CD pipeline generation (`github`, `gitlab`, `none`). Sub-fields: `runner` (default: `ubuntu-latest`), `language_version` (default: auto per stack), `github_host` (GHE server address), `actions_ref` (GHE actions prefix) |
 | `issue_tracker` | object | `provider: none` | External issue tracker (`github`, `none`) |
 | `hooks` | object | disabled | Opt-in hook templates (pre-commit, post-test, pre-push) |

{pactkit-2.12.0 → pactkit-2.14.0}/README.md

@@ -13,7 +13,7 @@
 
 > **PactKit** (Pact 契约 + Kit) is a governance framework that enforces the **P.A.C.T.** contract between humans and AI agents. Deterministic operations run as code, not prompts. Decisions are grounded in data, not memory. AI does what it's best at — creativity and language — while code handles everything that must be repeatable and correct.
 >
-> 25 CLI subcommands, 9 specialized agents, 11 commands, 10 skills, and a full Plan-Act-Check-Done lifecycle. One `pip install` deploys to all 3 supported IDEs.
+> 26 CLI subcommands, 9 specialized agents, 11 commands, 10 skills, and a full Plan-Act-Check-Done lifecycle. One `pip install` deploys to all 3 supported IDEs.
 
 ### Supported AI Tools
 
@@ -205,7 +205,7 @@ PactKit deploys 10 skills (3 scripted + 7 prompt-only), auto-invoked by commands
 
 | Skill | Type | Purpose |
 |-------|------|---------|
-| **pactkit-visualize** | Scripted | Code dependency graph (Mermaid): file-level, class-level, call-level |
+| **pactkit-visualize** | Scripted | Code dependency graph (Mermaid .mmd): file-level, class-level, call-level |
 | **pactkit-board** | Scripted | Sprint board operations: add story, update task, archive |
 | **pactkit-scaffold** | Scripted | File scaffolding: create spec, test files, git branches, skills |
 | **pactkit-trace** | Prompt-only | Deep code tracing and execution flow analysis |
@@ -218,7 +218,7 @@ PactKit deploys 10 skills (3 scripted + 7 prompt-only), auto-invoked by commands
 
 ## CLI Subcommands
 
-PactKit ships 25 deterministic CLI subcommands — operations that were previously delegated to AI prompts are now enforced in Python code (the "C" in P.A.C.T.):
+PactKit ships 26 deterministic CLI subcommands — operations that were previously delegated to AI prompts are now enforced in Python code (the "C" in P.A.C.T.):
 
 | Command | Purpose |
 |---------|---------|
@@ -239,6 +239,7 @@ PactKit ships 25 deterministic CLI subcommands — operations that were previous
 | `pactkit test-map` | Map source files to test files |
 | `pactkit coverage-gate` | Enforce 3-tier coverage thresholds (80/50/block) |
 | `pactkit visualize` | Conditional graph regeneration (lazy mode) |
+| `pactkit query` | Query call graph via codegraph: `--callers`, `--callees`, `--chain [--down]` (requires `graph_provider: codegraph`) |
 | `pactkit lesson-append` | Append lesson with specificity check and dedup |
 | `pactkit invariants-refresh` | Update test count invariant in rules.md |
 | `pactkit sec-scope` | Detect security scope for changed files |
@@ -333,6 +334,7 @@ docs/
 | `skills` | list | all 10 | Skills to deploy |
 | `rules` | list | all 8 | Constitution rule modules to deploy |
 | `exclude` | object | `{}` | Components to exclude (e.g., `exclude.agents: [agent-name]`) |
+| `visualize.graph_provider` | string | (absent) | Graph query backend. Set `codegraph` to use `.codegraph/codegraph.db` for `pactkit query`. Absent = grep `.mmd` |
 | `ci` | object | `provider: none` | CI/CD pipeline generation (`github`, `gitlab`, `none`). Sub-fields: `runner` (default: `ubuntu-latest`), `language_version` (default: auto per stack), `github_host` (GHE server address), `actions_ref` (GHE actions prefix) |
 | `issue_tracker` | object | `provider: none` | External issue tracker (`github`, `none`) |
 | `hooks` | object | disabled | Opt-in hook templates (pre-commit, post-test, pre-push) |

{pactkit-2.12.0 → pactkit-2.14.0}/docs/architecture/governance/archive/lessons_archive_202603.md

@@ -54,3 +54,11 @@
 | 2026-03-24 | _scan_hooks() only accepts files with 'use' prefix in hook dirs (src/hooks/, composables/) to prevent utility files from becoming hook nodes | visualize.py:_scan_hooks |
 | 2026-03-24 | regression_workflow_impact hook/store matching uses node.id substring of changed file path, not reverse — e.g. 'useAuth' in 'src/hooks/useAuth.ts' | visualize.py:regression_workflow_impact |
 | 2026-03-25 | export_focus_graphs() in visualize.py uses forward_reach() (not reverse_reach()) because entry points (command/service/page) are graph roots that invoke downward — forward BFS shows their dependency tree | src/pactkit/skills/visualize.py:export_focus_graphs |
+| 2026-03-26 | board.py update_task: added 3-tier fuzzy fallback (single-task auto-mark, substring match, numeric index) to handle real-world callers that don't know exact task names on the board | src/pactkit/skills/board.py:update_task |
+| 2026-03-26 | Position-based block removal (start, end tuples) is safer than str.find() for board operations — prevents substring false matches on similar story IDs | board.py:_parse_story_blocks |
+| 2026-03-26 | Fixing _parse_story_blocks to return adjusted_end (len match) inherently fixed fix_board offset compensation — root cause fix in board.py:_parse_story_blocks eliminated downstream R2 symptom in board.py:fix_board | board.py:_parse_story_blocks,board.py:fix_board |
+| 2026-03-26 | Helpers added to visualize.py standalone header get stripped by load_script(); always place new functions below the SCRIPT BODY marker | visualize.py:_mermaid_escape |
+| 2026-03-26 | dict.pop() in shared config references causes caller mutation; use .get() for read-only access to avoid breaking multi-call scenarios | deployer.py:_deploy_ci |
+| 2026-03-26 | _atomic_mmd_write() in visualize.py prevents truncated .mmd on crash via tmp+rename; all 4 write sites converted | visualize.py:_atomic_mmd_write |
+| 2026-03-26 | test_story_slim056.py _init_project() helper creates realistic pactkit project fixture for subprocess E2E tests; 60 tests cover all 25 subcommands | test_story_slim056.py:_init_project |
+| 2026-03-26 | entry_points auto-discovery with _load_entry_point_deployers() enables pip install pactkit-opencode to self-register; pre-existing tests referencing extracted functions must be updated to import from adapter package | deployer.py:_load_entry_point_deployers |

{pactkit-2.12.0 → pactkit-2.14.0}/docs/architecture/governance/lessons.md

@@ -2,14 +2,6 @@
 
 | Date | Lesson | Context |
 |------|--------|---------|
-| 2026-03-26 | board.py update_task: added 3-tier fuzzy fallback (single-task auto-mark, substring match, numeric index) to handle real-world callers that don't know exact task names on the board | src/pactkit/skills/board.py:update_task |
-| 2026-03-26 | Position-based block removal (start, end tuples) is safer than str.find() for board operations — prevents substring false matches on similar story IDs | board.py:_parse_story_blocks |
-| 2026-03-26 | Fixing _parse_story_blocks to return adjusted_end (len match) inherently fixed fix_board offset compensation — root cause fix in board.py:_parse_story_blocks eliminated downstream R2 symptom in board.py:fix_board | board.py:_parse_story_blocks,board.py:fix_board |
-| 2026-03-26 | Helpers added to visualize.py standalone header get stripped by load_script(); always place new functions below the SCRIPT BODY marker | visualize.py:_mermaid_escape |
-| 2026-03-26 | dict.pop() in shared config references causes caller mutation; use .get() for read-only access to avoid breaking multi-call scenarios | deployer.py:_deploy_ci |
-| 2026-03-26 | _atomic_mmd_write() in visualize.py prevents truncated .mmd on crash via tmp+rename; all 4 write sites converted | visualize.py:_atomic_mmd_write |
-| 2026-03-26 | test_story_slim056.py _init_project() helper creates realistic pactkit project fixture for subprocess E2E tests; 60 tests cover all 25 subcommands | test_story_slim056.py:_init_project |
-| 2026-03-26 | entry_points auto-discovery with _load_entry_point_deployers() enables pip install pactkit-opencode to self-register; pre-existing tests referencing extracted functions must be updated to import from adapter package | deployer.py:_load_entry_point_deployers |
 | 2026-03-26 | VALID_FORMATS auto-derives from FORMAT_PROFILES.keys() — removing a profile cascades to config, CLI, and deployer with zero manual sync | profiles.py:FORMAT_PROFILES |
 | 2026-03-26 | DeployerBase static methods use lazy imports to avoid circular dependencies between deploy_base.py and deployer.py | deploy_base.py:DeployerBase.render_prompt |
 | 2026-03-26 | Thin adapter conversion: pactkit-codex reduced from 15,356 lines (full fork) to 668 lines (thin adapter) by importing core via DeployerBase. Key: deploy_codex_playbooks needs explicit path replacement for ALL format prefixes (~/.claude/, ~/.config/opencode/ → ~/.codex/) | pactkit_codex/deployer.py:deploy_codex_playbooks |
@@ -54,3 +46,9 @@
 | 2026-04-24 | Plan Phase横向扫描(Lateral Scan)比纵向trace更重要——PactSearch的10个技术债中60%源于缺少水平重复检测。修复方向是改Plan playbook引导Architect用已有工具(LSP/visualize/grep)做横向扫描，而非新建CLI | commands.py:Plan_Phase_1 |
 | 2026-04-24 | When migrating functionality (e.g., version checking from pactkit.yaml to global marker), grep all references across source, prompts, tests, and CLI help text — partial migration leaves ghost behavior | board.py:update_version |
 | 2026-04-27 | When extracting project-specific rules into a framework, generalize by removing project names, library references, and spec IDs — keep only the anti-pattern/fix-pattern structure that applies to any codebase | rules.py:RULES_MODULES |
+| 2026-05-07 | Code Enforces implementation: pactkit interface-summary uses ast.parse() to physically output only signatures—AI receives truncated content, not a prompt instruction to self-truncate. Pattern: CLI tool as enforcement layer (interface_summary.py:generate_summary) | src/pactkit/skills/interface_summary.py:generate_summary |
+| 2026-05-07 | Lifecycle gap pattern: when artifact has create+consume but no update mechanism, add conditional sync in the modifying command. Applied: Act Phase 4 Journey Sync step in commands.py COMMANDS_CONTENT['project-act.md'] | src/pactkit/prompts/commands.py:COMMANDS_CONTENT |
+| 2026-05-25 | code_graph.mmd uses sanitized node IDs (src_pactkit_generators_deployer_py), not bare filenames — grep patterns for fan-in/fan-out must use .* wildcard or they silently never match | src/pactkit/prompts/skills.py:SKILL_VISUALIZE_MD |
+| 2026-05-25 | When SCAN_EXCLUDES is a module-level constant shared across graph modes, add mode-specific exclusion logic at the call site rather than modifying the constant — pass call_extra_excludes = SCAN_EXCLUDES - {'tests'} only for call mode to avoid affecting file/class modes | visualize.py:_build_call_graph |
+| 2026-05-25 | _write_sqlite_db reuses func_registry and rel_edges already in memory from _build_call_graph — no second AST scan; pactkit query reads db directly without touching pactkit.yaml | visualize.py:_build_call_graph |
+| 2026-05-26 | SKILL.md model: frontmatter is passed through by deployer without transformation — source prompts in commands.py/workflows.py are the single source of truth for deployed skill metadata | commands.py:COMMANDS_CONTENT |

{pactkit-2.12.0 → pactkit-2.14.0}/docs/architecture/governance/rules.md

@@ -15,7 +15,7 @@
 
 ## Invariants
 
-1. All 3841+ tests must pass before any commit to `main`.
+1. All 3986+ tests must pass before any commit to `main`.
 2. Specs (`docs/specs/`) are the source of truth — code conforms to specs, not the reverse.
 3. CLI entry point is `pactkit` via `src/pactkit/cli.py:main`.
 4. No runtime dependencies beyond `pyyaml`.

pactkit-2.14.0/docs/product/archive/archive_202605.md

@@ -0,0 +1,109 @@
+
+### [STORY-slim-113] pactkit interface-summary CLI — Code Enforce 接口摘要
+> Spec: docs/specs/STORY-slim-113.md
+
+- [x] 新建 interface_summary.py 提取逻辑
+- [x] CLI 注册 interface-summary 命令
+- [x] Act Phase 1 改为显式步骤
+- [x] pactkit-trace 更新输出指引
+- [x] 单元测试
+
+### [STORY-slim-112] Rules 架构重构：全局原则 vs 按需操作规程
+> Spec: docs/specs/STORY-slim-112.md
+
+- [x] 拆分 RULES_CORE/ONDEMAND + 新建 05-principles
+- [x] 更新 deployer 双目录部署
+- [x] 更新所有 skill @import 路径
+- [x] 更新测试断言
+
+### [STORY-slim-111] Check Phase 4 Playwright 断言策略指南
+> Spec: docs/specs/STORY-slim-111.md
+
+- [x] 修改 project-check SKILL.md Phase 4 增加断言策略
+
+### [STORY-slim-110] project-design 集成 User Journey 生成
+> Spec: docs/specs/STORY-slim-110.md
+
+- [x] 修改 project-design SKILL.md Phase 1 Group B
+
+### [STORY-slim-109] E2E journey.md 规范定义与 File Atlas 集成
+> Spec: docs/specs/STORY-slim-109.md
+
+- [x] 注册 File Atlas
+- [x] 创建 journey.md 格式规范
+- [x] 修改 project-check Phase 4
+
+### [STORY-slim-108] pactkit-trace --summary 模式：接口摘要输出
+> Spec: docs/specs/STORY-slim-108.md
+
+- [x] 修改 pactkit-trace SKILL.md Phase 3
+- [x] 修改 project-act SKILL.md Phase 1
+
+### [STORY-slim-114] Act Phase 4 Journey Sync — journey.md 维护闭环
+> Spec: docs/specs/STORY-slim-114.md
+
+- [x] Act Phase 4 新增 Journey Sync 步骤
+- [x] Plan Phase 3.2a 条件 Journey Segment
+- [x] 单元测试
+
+### [HOTFIX-slim-117] Fix Graph Query Protocol grep patterns
+> Spec: docs/specs/HOTFIX-slim-117.md
+
+- [x] Fix fan-in/fan-out grep patterns in SKILL_VISUALIZE_MD
+- [x] Fix importer-count grep in project-act.md Phase 3
+
+### [STORY-slim-116] Skill Model Precision and Graph Query Optimization
+> Spec: docs/specs/STORY-slim-116.md
+
+- [x] Add graph query protocol to project-act and project-plan
+- [x] Add model field to pactkit-visualize SKILL.md
+- [x] Add model fields to 28 skills missing model assignment
+- [x] Update project-plan and project-sprint to opus
+- [x] Add haiku to pure I/O skills (scaffold, board, doctor, status, report, draw, arch-diagram, profile, find-skills, docx, pdf, pptx, xlsx)
+
+### [STORY-slim-120] Improve Call Graph Coverage: Test Files, Scripts, Locality Resolution
+> Spec: docs/specs/STORY-slim-120.md
+
+- [x] Write TDD tests for AC1-AC4
+- [x] R1: scan tests/ in call mode
+- [x] R2: scan scripts/ and alembic/
+- [x] R3: locality-based _resolve_callee
+- [x] Run pactkit update
+
+### [STORY-slim-121] call graph SQLite output with pactkit query CLI
+> Spec: docs/specs/STORY-slim-121.md
+
+- [x] Add visualize.sqlite_output config toggle
+- [x] Add _load_sqlite_config() helper
+- [x] Add _write_sqlite_db() with atomic write
+- [x] Wire into _build_call_graph()
+- [x] Add pactkit query subcommand (fan-in/fan-out/chain)
+- [x] Update SKILL_VISUALIZE_MD with pactkit query examples
+- [x] Add *.db to .gitignore
+
+### [STORY-slim-124] codegraph integration — read .codegraph/codegraph.db as graph provider
+> Spec: docs/specs/STORY-slim-124.md
+
+- [x] Add graph_provider config to pactkit.yaml
+- [x] Guard _write_sqlite_db when codegraph
+- [x] Implement codegraph SQL in pactkit query
+- [x] Update Graph Query Protocol in skills.py
+- [x] Update PDCA prompts to prefer pactkit query
+
+### [HOTFIX-slim-123] Fix: call_graph.db duplicate edges and orphan nodes
+> Spec: docs/specs/HOTFIX-slim-123.md
+
+- [x] Dedup rel_edges before insert
+- [x] Filter edges to only reference existing nodes
+
+### [HOTFIX-slim-122] Fix: focus/entry overwrites call_graph.db
+> Spec: docs/specs/HOTFIX-slim-122.md
+
+- [x] Guard sqlite write against focus/entry mode
+
+### [STORY-slim-125] Add model frontmatter to all PDCA command/skill prompts
+> Spec: docs/specs/STORY-slim-125.md
+
+- [x] Add model to commands.py
+- [x] Add model to workflows.py
+- [x] Add regression test

pactkit-2.14.0/docs/product/context.md

@@ -0,0 +1,29 @@
+# Project Context (Auto-generated)
+> Last updated: 2026-05-26T17:29:18+08:00 by pactkit context
+
+## Sprint Status
+Backlog: 2 | In Progress: 0 | Done: 0 stories
+
+## Current Stories
+None
+
+## Recent Completions
+None
+
+## Active Branches
++ claude/naughty-euclid-e6a787
+  develop
+* main
+
+## Key Decisions
+- Lifecycle gap pattern: when artifact has create+consume but no update mechanism, add conditional sync in the modifying command. Applied: Act Phase 4 Journey Sync step in commands.py COMMANDS_CONTENT['project-act.md']
+- code_graph.mmd uses sanitized node IDs (src_pactkit_generators_deployer_py), not bare filenames — grep patterns for fan-in/fan-out must use .* wildcard or they silently never match
+- When SCAN_EXCLUDES is a module-level constant shared across graph modes, add mode-specific exclusion logic at the call site rather than modifying the constant — pass call_extra_excludes = SCAN_EXCLUDES - {'tests'} only for call mode to avoid affecting file/class modes
+- _write_sqlite_db reuses func_registry and rel_edges already in memory from _build_call_graph — no second AST scan; pactkit query reads db directly without touching pactkit.yaml
+- SKILL.md model: frontmatter is passed through by deployer without transformation — source prompts in commands.py/workflows.py are the single source of truth for deployed skill metadata
+
+## Next Recommended Action
+`/project-plan`
+
+## Agent Continuation
+No active work session.

pactkit-2.14.0/docs/product/sprint_board.md

@@ -0,0 +1,24 @@
+# Sprint Board
+
+## 📋 Backlog
+
+### [STORY-slim-118] codegraph MCP Integration for Semantic Code Queries
+> Spec: docs/specs/STORY-slim-118.md
+
+- [ ] Document replacement vs augmentation decision
+- [ ] Add codegraph MCP conditional note to SKILL_VISUALIZE_MD Graph Query Protocol
+- [ ] Run pactkit update to redeploy
+
+### [STORY-slim-119] Improve Python Call Graph Coverage
+> Spec: docs/specs/STORY-slim-119.md
+
+- [ ] Extend _extract_calls to capture non-self attribute method calls (R1)
+- [ ] Capture function references in list/assignment contexts (R2)
+- [ ] Use ast.walk to scan nested functions (R3)
+- [ ] Write TDD tests for AC1-AC4
+- [ ] Run pactkit update to redeploy
+
+## 🔄 In Progress
+
+## ✅ Done
+

pactkit-2.14.0/docs/specs/HOTFIX-slim-117.md

@@ -0,0 +1,18 @@
+# HOTFIX-slim-117: Fix Graph Query Protocol grep patterns for code_graph.mmd
+
+| Field | Value |
+|-------|-------|
+| ID | HOTFIX-slim-117 |
+| Status | Done |
+| Release | 2.14.0 |
+
+## Background
+
+Graph Query Protocol (added in STORY-slim-116) uses `grep " --> deployer"` and `grep "deployer --> "` to filter edges in `code_graph.mmd`. However, nodes in `code_graph.mmd` are sanitized IDs (`src_pactkit_generators_deployer_py`), not bare filenames. These patterns never match — silent no-op. Correct patterns require `.*` wildcard: `grep " --> .*deployer"` (fan-in) and `grep "deployer.* --> "` (fan-out).
+
+Same issue in `project-act.md` Phase 3 importer-count: `grep " --> <file>"` → `grep " --> .*<file>"`.
+
+## Target Files
+
+- `src/pactkit/prompts/skills.py` — SKILL_VISUALIZE_MD lines 93, 96, 99
+- `src/pactkit/prompts/commands.py` — project-act.md Phase 3 line 237

pactkit-2.14.0/docs/specs/HOTFIX-slim-122.md

@@ -0,0 +1,20 @@
+# HOTFIX-slim-122: prevent focus/entry mode from overwriting full call_graph.db
+
+| Field | Value |
+|-------|-------|
+| ID | HOTFIX-slim-122 |
+| Status | In Progress |
+| Priority | P2 |
+| Release | 2.13.0 |
+
+## Background
+
+`_build_call_graph()` writes `call_graph.db` unconditionally when `sqlite_output: true`, including when running in `--focus` or `--entry` mode. These modes produce a subgraph (not the full call graph), so writing them to `call_graph.db` overwrites the complete dataset with a partial one.
+
+## Fix
+
+Only write `call_graph.db` when both `focus` and `entry` are falsy (i.e., full graph mode).
+
+- **Target**: `src/pactkit/skills/visualize.py`
+- **Line 855**: Add `and not focus` guard (BFS/entry path)
+- **Line 891**: Add `and not focus` guard (full graph path with focus filter)

pactkit-2.14.0/docs/specs/HOTFIX-slim-123.md

@@ -0,0 +1,17 @@
+# HOTFIX-slim-123: call_graph.db dedup edges and filter orphan nodes
+
+| Field | Value |
+|-------|-------|
+| ID | HOTFIX-slim-123 |
+| Status | Done |
+| Priority | P1 |
+
+## Background
+
+`_write_sqlite_db()` had two data quality issues: (1) duplicate edges (35.8% in pactsearch) because `rel_edges` was inserted without dedup, and (2) orphan edges referencing nodes not in `func_registry` (e.g., `__module__` synthetic callers).
+
+## Fix
+
+- Target: `src/pactkit/skills/visualize.py:_write_sqlite_db()`
+- Dedup `rel_edges` via set conversion before INSERT
+- Filter edges to only include caller/callee pairs where both exist in `func_registry`

pactkit-2.14.0/docs/specs/STORY-slim-113.md

@@ -0,0 +1,175 @@
+# STORY-slim-113: pactkit interface-summary CLI — Code Enforce 接口摘要
+
+| Field | Value |
+|-------|-------|
+| ID | STORY-slim-113 |
+| Status | Done |
+| Priority | P1 |
+| Release | 2.13.0 |
+
+## Background
+
+### 问题
+
+STORY-slim-108 引入了"接口摘要"概念——Act Phase 1 对 trace 发现的非目标模块只读签名+docstring。但当前实现**完全依赖 Prompt 指导**（pactkit-trace SKILL.md 的 "Layered Output" 表格 + Act Phase 1.2 的一句 "Layered Loading"），AI 实际执行时仍然直接 Read 完整文件，因为：
+
+1. 没有工具约束——AI 调用 Read 工具时没有 `--summary-only` 限制
+2. 一句文字指导不足以改变 AI 的默认行为
+3. 违反了 PactKit 自己的 "Code Enforces, Prompt Instructs" 原则（架构原则 §10）
+
+### 方案
+
+新增 `pactkit interface-summary <file>` CLI 命令：
+- 基于现有 `python_analyzer.py` 的 AST 能力（已有 `extract_classes`、`extract_functions_and_calls`）
+- 输出经代码裁剪的接口摘要，AI 拿到的物理上就是精简内容
+- Act Phase 1 改为**显式步骤**：对非目标模块调用此 CLI 而非 Read
+
+### 为什么不用 hook
+
+用户明确要求不使用 hook。本方案通过 CLI 输出 + playbook 步骤变更来实现 Code Enforce，无需 harness 层面的文件拦截。
+
+## Requirements
+
+### R1: 新增 `pactkit interface-summary` CLI 命令 (MUST)
+
+新增子命令接受一个或多个文件路径，输出接口摘要：
+
+```
+pactkit interface-summary src/pactkit/generators/deployer.py
+```
+
+输出格式（per file）：
+```
+# deployer.py — Interface Summary
+
+class ClassicDeployer(BaseDeployer):
+    """Deploy PactKit to ~/.claude/ (Classic format)."""
+    +deploy(target, config) -> DeployResult
+    +_deploy_rules(claude_root, enabled_rules) -> None
+    +_deploy_skills(claude_root, enabled_skills) -> None
+    -_cleanup_legacy(target) -> None
+
+def atomic_write(path: Path, content: str) -> None:
+    """Write content atomically via tempfile + rename."""
+
+def _render_prompt(template: str, profile: FormatProfile) -> str:
+    """Replace placeholders with profile-specific values."""
+```
+
+提取规则：
+- **Class**: class name + bases + docstring 第一行 + public/private methods with signature
+- **Function**: def name + params with type hints + return type + docstring 第一行
+- **Skip**: 函数体、局部变量、内部逻辑
+- **Constants/Enums**: 顶层 `UPPER_CASE` 赋值保留名称和类型
+
+### R2: 多语言支持通过 LANG_PROFILES 分派 (SHOULD)
+
+使用已有的 `LANG_PROFILES` + analyzer 架构：
+- Python: `ast` 模块提取（已有基础设施）
+- TypeScript: `tree_sitter_typescript` 提取 exported declarations
+- Go: `tree_sitter_go` 提取 exported (大写) func/struct
+
+初始版本 MUST 支持 Python。TS/Go 为 SHOULD。
+
+### R3: Act Phase 1 增加显式步骤 (MUST)
+
+修改 `project-act/SKILL.md` Phase 1.2，从当前的一句指导：
+> "Layered Loading: For non-target modules discovered by trace, read interface summary..."
+
+改为显式步骤：
+```
+2b. **Interface Summary** (for non-target modules):
+    - For each module discovered by trace that is NOT the modification target:
+      `pactkit interface-summary <file>`
+    - Only escalate to `Read <file>` when you confirm the module needs modification.
+```
+
+### R4: pactkit-trace SKILL.md 更新输出格式指引 (MUST)
+
+修改 pactkit-trace SKILL.md Phase 3 "Layered Output" 部分，从"建议 AI 自行精简"改为"调用 CLI 获取"：
+
+> For related (non-target) modules, run `pactkit interface-summary <file>` instead of reading full source.
+
+### R5: 不修改 Read 工具行为 (MUST NOT)
+
+本 story 不修改 Claude Code harness 的 Read 工具、不添加 hook、不拦截文件访问。通过提供更好的替代工具来引导行为，而非限制现有工具。
+
+## Acceptance Criteria
+
+### AC1: CLI 输出接口摘要 (R1)
+
+- **Given** 一个 Python 文件 `src/pactkit/generators/deployer.py`（含多个 class 和函数）
+- **When** 运行 `pactkit interface-summary src/pactkit/generators/deployer.py`
+- **Then** 输出包含所有 class（带 bases 和 methods 签名）和顶层函数（带参数和返回类型），不包含函数体
+
+### AC2: 输出行数显著小于原文件 (R1)
+
+- **Given** `deployer.py` 约 600+ 行
+- **When** 运行 `pactkit interface-summary` 对其生成摘要
+- **Then** 输出行数 ≤ 原文件行数的 25%（即 ≤ 150 行）
+
+### AC3: 多文件支持 (R1)
+
+- **Given** 两个 Python 文件 A.py 和 B.py
+- **When** 运行 `pactkit interface-summary A.py B.py`
+- **Then** 输出两个文件的摘要，以 `# filename — Interface Summary` 分隔
+
+### AC4: Act Phase 1 步骤可验证 (R3)
+
+- **Given** 修改后的 project-act SKILL.md
+- **When** 读取 Phase 1 内容
+- **Then** 存在显式编号步骤 "2b" 包含 `pactkit interface-summary` 命令
+
+### AC5: 非 Python 文件 graceful fallback (R2)
+
+- **Given** 一个 .go 文件但 tree-sitter-go 未安装
+- **When** 运行 `pactkit interface-summary file.go`
+- **Then** 输出警告 "Unsupported or unavailable analyzer for .go" 并退出 0（不阻塞）
+
+## Target Call Chain
+
+```
+pactkit interface-summary <files>
+  → cli.py: main() → parse args → _interface_summary_command(args)
+  → interface_summary.py: generate_summary(file_paths)
+    → detect language from extension
+    → LANG_PROFILES dispatch → python_analyzer / ts_analyzer / go_analyzer
+    → For Python:
+      → ast.parse(source)
+      → Extract: class defs (name, bases, docstring, method signatures)
+      → Extract: top-level functions (name, params, return type, docstring)
+      → Extract: top-level constants (UPPER_CASE assignments)
+    → Format output as structured text
+    → Print to stdout
+```
+
+## Implementation Steps
+
+| Step | File | Action | Dependencies | Risk |
+|------|------|--------|-------------|------|
+| 1 | `src/pactkit/skills/interface_summary.py` | 新建：接口摘要提取逻辑，复用 python_analyzer AST 能力 | None | Medium |
+| 2 | `src/pactkit/cli.py` | 注册 `interface-summary` 子命令 | Step 1 | Low |
+| 3 | `~/.claude/skills/project-act/SKILL.md` (source: `src/pactkit/prompts/commands.py`) | Phase 1.2 → 1.2a + 1.2b 显式步骤 | Step 1-2 | Low |
+| 4 | `~/.claude/skills/pactkit-trace/SKILL.md` (source: `src/pactkit/prompts/skills.py`) | Phase 3 Layered Output 改为 CLI 调用指引 | Step 1-2 | Low |
+| 5 | `tests/unit/test_interface_summary.py` | 新建：单元测试覆盖 Python 文件摘要输出 | Step 1 | Low |
+
+## Security Scope
+
+| Check | Applicable | Reason |
+|-------|------------|--------|
+| SEC-1 | No | 无秘钥变更 |
+| SEC-2 | No | 输入为本地文件路径，已有 file_path.stat() 大小检查 |
+| SEC-3 | No | 无数据库 |
+| SEC-4 | No | 无 UI |
+| SEC-5 | No | 无认证 |
+| SEC-6 | No | 无接口暴露 |
+| SEC-7 | No | CLI 输出，无敏感信息 |
+| SEC-8 | No | 无新依赖（复用现有 ast + tree_sitter） |
+
+## Out of Scope
+
+- 修改 Claude Code Read 工具行为
+- Hook 机制
+- 自动拦截 AI 的 Read 调用
+- Java analyzer 支持（已有但不在本 story 优先级内）
+- `pactkit trace` CLI 命令（本 story 只做 interface-summary，trace 仍是 skill）