roam-code 12.1.0__tar.gz → 12.2.0__tar.gz

{roam_code-12.1.0/src/roam_code.egg-info → roam_code-12.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: roam-code
-Version: 12.1.0
+Version: 12.2.0
 Summary: Instant codebase comprehension for AI coding agents
 Author: CosmoHac
 License-Expression: MIT
@@ -37,6 +37,15 @@ Provides-Extra: semantic
 Requires-Dist: numpy>=1.24; extra == "semantic"
 Requires-Dist: onnxruntime>=1.16; extra == "semantic"
 Requires-Dist: tokenizers>=0.15; extra == "semantic"
+Provides-Extra: leiden
+Requires-Dist: igraph>=0.11; extra == "leiden"
+Requires-Dist: leidenalg>=0.10; extra == "leiden"
+Provides-Extra: graph-fast
+Requires-Dist: rustworkx>=0.14; extra == "graph-fast"
+Provides-Extra: sbom
+Requires-Dist: cyclonedx-python-lib>=8.0; extra == "sbom"
+Provides-Extra: learned
+Requires-Dist: lightgbm>=4.0; extra == "learned"
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"
 Requires-Dist: pytest-xdist>=3.0; extra == "dev"
@@ -51,7 +60,7 @@ Dynamic: license-file
 
 **The architectural intelligence layer for AI coding agents. Structural graph, architecture governance, multi-agent orchestration, vulnerability mapping, runtime analysis -- one CLI, zero API keys.**
 
-*150 commands · 112 MCP tools · 27 languages · 100% local*
+*150 commands · 116 MCP tools · 27 languages · 100% local*
 
 [![PyPI version](https://img.shields.io/pypi/v/roam-code?style=flat-square&color=blue)](https://pypi.org/project/roam-code/)
 [![GitHub stars](https://img.shields.io/github/stars/Cranot/roam-code?style=flat-square)](https://github.com/Cranot/roam-code/stargazers)
@@ -128,7 +137,7 @@ $ roam diff                    # blast radius of uncommitted changes
 - **`personalized_pagerank()`** in `graph/pagerank.py`: NetworkX `personalization=` wrapper with empty-seed fallback to global PR; biases ranking toward query-relevant nodes for the retrieve reranker.
 - **`.roam/config.toml`** (new): zero-dep TOML loader (stdlib `tomllib` → `tomli` → in-tree subset parser). Tunable retrieve weights (`alpha`/`beta`/`gamma`/`delta`/`epsilon`), `tokens_per_line`, `lexical_baseline`, `first_stage_token_cap`, `default_budget`, `default_k`, `default_rerank`.
 - **DX corrections from dogfood pass**: `roam --detail <cmd>` is the canonical group-level flag; misleading "use --detail" hints in 7 commands rewritten to point users at `roam --detail <cmd>`. `--top N` aliased on `complexity`/`algo`/`rules` (`--top 0` means unlimited on `rules`). `roam fingerprint` no longer refuses graphs ≥5,000 symbols (new soft-warn threshold 20k, hard cap 100k).
-- **150 CLI commands, 112 MCP tools** (`fleet`, `ask`, `taint`, `cga`, `eval-retrieve` remain CLI-only; v12 exposes `roam_retrieve`, `roam_critique`, `roam_fleet_plan`, plus 5 v12.1 boolean oracles (`roam_oracle_*`) and `roam_taint_classify` as MCP tools). 33-tool `core` preset is the default for token-budget-conscious clients.
+- **150 CLI commands, 116 MCP tools** (`fleet`, `ask`, `taint`, `cga`, `eval-retrieve` remain CLI-only; v12 exposes `roam_retrieve`, `roam_critique`, `roam_fleet_plan`, plus 5 v12.1 boolean oracles (`roam_oracle_*`) and `roam_taint_classify` as MCP tools). 33-tool `core` preset is the default for token-budget-conscious clients.
 
 ## What's New in v11
 
@@ -159,7 +168,7 @@ $ roam diff                    # blast radius of uncommitted changes
 - MCP token overhead for default core context dropped from ~36K to <3K tokens (about 92% reduction).
 
 ### Performance and Retrieval
-- Symbol search moved to SQLite FTS5/BM25: typical search moved from seconds to milliseconds (about 1000x on benchmarked paths).
+- Symbol search moved to SQLite FTS5/BM25: typical search moved from seconds to tens of milliseconds on the indexed cohort (mileage varies by repo size and query selectivity — see `bench/retrieve/` for the methodology).
 - Incremental indexing shifted from O(N) full-edge rebuild behavior to O(changed) updates.
 - DB/runtime optimizations (`mmap_size`, safer large-graph guards, batched writes) reduce first-run and reindex friction on larger repos.
 
@@ -299,7 +308,7 @@ roam health
 
 ## Commands
 
-The [5 core commands](#core-commands) shown above cover ~80% of agent workflows. All 150 commands are organized into 7 categories.
+**Lead with the 5 verbs.** The [5 core commands](#core-commands) cover ~80% of agent workflows: `understand`, `context`, `retrieve`, `preflight`, `critique`. The remaining 145 commands are detail surface for specialised workflows (taint, fleet, cga, oracle, eval, …) — they're called by agents on demand, not memorised. This is intentional design; under the hood the canonical surface is **150 commands organised into 7 categories**, but you don't need to know that to start.
 
 <details>
 <summary><strong>Full command reference</strong></summary>
@@ -937,7 +946,7 @@ ROAM_MCP_LITE=0 roam mcp
 Core preset tools: `roam_affected_tests`, `roam_batch_get`, `roam_batch_search`, `roam_complete`, `roam_complexity_report`, `roam_context`, `roam_dead_code`, `roam_deps`, `roam_diagnose`, `roam_diagnose_issue`, `roam_diff`, `roam_expand_toolset`, `roam_explore`, `roam_file_info`, `roam_health`, `roam_impact`, `roam_pr_risk`, `roam_preflight`, `roam_prepare_change`, `roam_review_change`, `roam_search_symbol`, `roam_syntax_check`, `roam_trace`, `roam_understand`, `roam_uses`.
 
 <details>
-<summary><strong>MCP tool list (all 112)</strong></summary>
+<summary><strong>MCP tool list (all 116)</strong></summary>
 
 | Tool | Description |
 |------|-------------|
@@ -957,6 +966,10 @@ Core preset tools: `roam_affected_tests`, `roam_batch_get`, `roam_batch_search`,
 | `roam_oracle_is_reachable_from_entry` | Boolean oracle: can BFS reach this symbol from any entry-point? |
 | `roam_oracle_is_clone_of` | Boolean oracle: does this symbol participate in a persisted clone cluster? |
 | `roam_taint_classify` | LLM-augmented taint classification (IDOR/AUTHZ/SQLI/...) via MCP sampling |
+| `roam_taint` | Static taint analysis — graph-reach BFS with OpenVEX-correct findings |
+| `roam_sbom` | CycloneDX 1.7 / SPDX 2.3 SBOM emit with optional AIBOM extension (EU AI Act) |
+| `roam_cga_emit` | Emit a Code Graph Attestation (in-toto v1) with optional cosign signing |
+| `roam_cga_verify` | Verify a CGA statement — re-derives Merkle + edge digest, checks cosign signature |
 | `roam_trace` | Dependency path between two symbols |
 | `roam_impact` | Blast radius of changing a symbol |
 | `roam_file_info` | File skeleton with all definitions |
@@ -1568,7 +1581,7 @@ roam-code/
 ├── src/roam/
 │   ├── __init__.py                    # Version (from pyproject.toml)
 │   ├── cli.py                         # Click CLI (150 commands)
-│   ├── mcp_server.py                  # MCP server (112 tools, 10 resources, 5 prompts)
+│   ├── mcp_server.py                  # MCP server (116 tools, 10 resources, 5 prompts)
 │   ├── db/
 │   │   ├── connection.py              # SQLite (WAL, pragmas, batched IN)
 │   │   ├── schema.py                  # Tables, indexes, migrations
@@ -1662,7 +1675,7 @@ Optional: Local semantic ONNX stack (`numpy`, `onnxruntime`, `tokenizers`) via `
 ### Shipped
 
 - [x] MCP v2 agent surface: in-process execution, compound operations, presets, schemas, annotations, and compatibility profiles.
-- [x] Full command and MCP inventory parity in docs: 150 CLI commands and 112 MCP tools.
+- [x] Full command and MCP inventory parity in docs: 150 CLI commands and 116 MCP tools.
 - [x] CI hardening: composite action, changed-only mode, trend-aware gates, sticky PR updater, and SARIF guardrails.
 - [x] Performance foundation: FTS5/BM25 search, O(changed) incremental indexing, DB/index optimizations.
 - [x] Agent governance suite: `vibe-check`, `ai-readiness`, `verify`, `ai-ratio`, `duplicates`, advanced `algo` scoring/SARIF.

{roam_code-12.1.0 → roam_code-12.2.0}/README.md

@@ -4,7 +4,7 @@
 
 **The architectural intelligence layer for AI coding agents. Structural graph, architecture governance, multi-agent orchestration, vulnerability mapping, runtime analysis -- one CLI, zero API keys.**
 
-*150 commands · 112 MCP tools · 27 languages · 100% local*
+*150 commands · 116 MCP tools · 27 languages · 100% local*
 
 [![PyPI version](https://img.shields.io/pypi/v/roam-code?style=flat-square&color=blue)](https://pypi.org/project/roam-code/)
 [![GitHub stars](https://img.shields.io/github/stars/Cranot/roam-code?style=flat-square)](https://github.com/Cranot/roam-code/stargazers)
@@ -81,7 +81,7 @@ $ roam diff                    # blast radius of uncommitted changes
 - **`personalized_pagerank()`** in `graph/pagerank.py`: NetworkX `personalization=` wrapper with empty-seed fallback to global PR; biases ranking toward query-relevant nodes for the retrieve reranker.
 - **`.roam/config.toml`** (new): zero-dep TOML loader (stdlib `tomllib` → `tomli` → in-tree subset parser). Tunable retrieve weights (`alpha`/`beta`/`gamma`/`delta`/`epsilon`), `tokens_per_line`, `lexical_baseline`, `first_stage_token_cap`, `default_budget`, `default_k`, `default_rerank`.
 - **DX corrections from dogfood pass**: `roam --detail <cmd>` is the canonical group-level flag; misleading "use --detail" hints in 7 commands rewritten to point users at `roam --detail <cmd>`. `--top N` aliased on `complexity`/`algo`/`rules` (`--top 0` means unlimited on `rules`). `roam fingerprint` no longer refuses graphs ≥5,000 symbols (new soft-warn threshold 20k, hard cap 100k).
-- **150 CLI commands, 112 MCP tools** (`fleet`, `ask`, `taint`, `cga`, `eval-retrieve` remain CLI-only; v12 exposes `roam_retrieve`, `roam_critique`, `roam_fleet_plan`, plus 5 v12.1 boolean oracles (`roam_oracle_*`) and `roam_taint_classify` as MCP tools). 33-tool `core` preset is the default for token-budget-conscious clients.
+- **150 CLI commands, 116 MCP tools** (`fleet`, `ask`, `taint`, `cga`, `eval-retrieve` remain CLI-only; v12 exposes `roam_retrieve`, `roam_critique`, `roam_fleet_plan`, plus 5 v12.1 boolean oracles (`roam_oracle_*`) and `roam_taint_classify` as MCP tools). 33-tool `core` preset is the default for token-budget-conscious clients.
 
 ## What's New in v11
 
@@ -112,7 +112,7 @@ $ roam diff                    # blast radius of uncommitted changes
 - MCP token overhead for default core context dropped from ~36K to <3K tokens (about 92% reduction).
 
 ### Performance and Retrieval
-- Symbol search moved to SQLite FTS5/BM25: typical search moved from seconds to milliseconds (about 1000x on benchmarked paths).
+- Symbol search moved to SQLite FTS5/BM25: typical search moved from seconds to tens of milliseconds on the indexed cohort (mileage varies by repo size and query selectivity — see `bench/retrieve/` for the methodology).
 - Incremental indexing shifted from O(N) full-edge rebuild behavior to O(changed) updates.
 - DB/runtime optimizations (`mmap_size`, safer large-graph guards, batched writes) reduce first-run and reindex friction on larger repos.
 
@@ -252,7 +252,7 @@ roam health
 
 ## Commands
 
-The [5 core commands](#core-commands) shown above cover ~80% of agent workflows. All 150 commands are organized into 7 categories.
+**Lead with the 5 verbs.** The [5 core commands](#core-commands) cover ~80% of agent workflows: `understand`, `context`, `retrieve`, `preflight`, `critique`. The remaining 145 commands are detail surface for specialised workflows (taint, fleet, cga, oracle, eval, …) — they're called by agents on demand, not memorised. This is intentional design; under the hood the canonical surface is **150 commands organised into 7 categories**, but you don't need to know that to start.
 
 <details>
 <summary><strong>Full command reference</strong></summary>
@@ -890,7 +890,7 @@ ROAM_MCP_LITE=0 roam mcp
 Core preset tools: `roam_affected_tests`, `roam_batch_get`, `roam_batch_search`, `roam_complete`, `roam_complexity_report`, `roam_context`, `roam_dead_code`, `roam_deps`, `roam_diagnose`, `roam_diagnose_issue`, `roam_diff`, `roam_expand_toolset`, `roam_explore`, `roam_file_info`, `roam_health`, `roam_impact`, `roam_pr_risk`, `roam_preflight`, `roam_prepare_change`, `roam_review_change`, `roam_search_symbol`, `roam_syntax_check`, `roam_trace`, `roam_understand`, `roam_uses`.
 
 <details>
-<summary><strong>MCP tool list (all 112)</strong></summary>
+<summary><strong>MCP tool list (all 116)</strong></summary>
 
 | Tool | Description |
 |------|-------------|
@@ -910,6 +910,10 @@ Core preset tools: `roam_affected_tests`, `roam_batch_get`, `roam_batch_search`,
 | `roam_oracle_is_reachable_from_entry` | Boolean oracle: can BFS reach this symbol from any entry-point? |
 | `roam_oracle_is_clone_of` | Boolean oracle: does this symbol participate in a persisted clone cluster? |
 | `roam_taint_classify` | LLM-augmented taint classification (IDOR/AUTHZ/SQLI/...) via MCP sampling |
+| `roam_taint` | Static taint analysis — graph-reach BFS with OpenVEX-correct findings |
+| `roam_sbom` | CycloneDX 1.7 / SPDX 2.3 SBOM emit with optional AIBOM extension (EU AI Act) |
+| `roam_cga_emit` | Emit a Code Graph Attestation (in-toto v1) with optional cosign signing |
+| `roam_cga_verify` | Verify a CGA statement — re-derives Merkle + edge digest, checks cosign signature |
 | `roam_trace` | Dependency path between two symbols |
 | `roam_impact` | Blast radius of changing a symbol |
 | `roam_file_info` | File skeleton with all definitions |
@@ -1521,7 +1525,7 @@ roam-code/
 ├── src/roam/
 │   ├── __init__.py                    # Version (from pyproject.toml)
 │   ├── cli.py                         # Click CLI (150 commands)
-│   ├── mcp_server.py                  # MCP server (112 tools, 10 resources, 5 prompts)
+│   ├── mcp_server.py                  # MCP server (116 tools, 10 resources, 5 prompts)
 │   ├── db/
 │   │   ├── connection.py              # SQLite (WAL, pragmas, batched IN)
 │   │   ├── schema.py                  # Tables, indexes, migrations
@@ -1615,7 +1619,7 @@ Optional: Local semantic ONNX stack (`numpy`, `onnxruntime`, `tokenizers`) via `
 ### Shipped
 
 - [x] MCP v2 agent surface: in-process execution, compound operations, presets, schemas, annotations, and compatibility profiles.
-- [x] Full command and MCP inventory parity in docs: 150 CLI commands and 112 MCP tools.
+- [x] Full command and MCP inventory parity in docs: 150 CLI commands and 116 MCP tools.
 - [x] CI hardening: composite action, changed-only mode, trend-aware gates, sticky PR updater, and SARIF guardrails.
 - [x] Performance foundation: FTS5/BM25 search, O(changed) incremental indexing, DB/index optimizations.
 - [x] Agent governance suite: `vibe-check`, `ai-readiness`, `verify`, `ai-ratio`, `duplicates`, advanced `algo` scoring/SARIF.

{roam_code-12.1.0 → roam_code-12.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "roam-code"
-version = "12.1.0"
+version = "12.2.0"
 description = "Instant codebase comprehension for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -55,6 +55,29 @@ semantic = [
     "onnxruntime>=1.16",
     "tokenizers>=0.15",
 ]
+leiden = [
+    # Strictly better community detection than Louvain (no badly-connected
+    # communities). Auto-detected at runtime; falls back to seeded Louvain
+    # when these aren't installed.
+    "igraph>=0.11",
+    "leidenalg>=0.10",
+]
+graph-fast = [
+    # rustworkx is a Rust-backed drop-in for many NetworkX algorithms;
+    # 3-100× speedup at >250k nodes per the v12.2 architecture review.
+    # Auto-detected via ``ROAM_GRAPH_BACKEND=rustworkx``.
+    "rustworkx>=0.14",
+]
+sbom = [
+    # CycloneDX 1.7 SBOM emit (with AIBOM extension) for `roam sbom`.
+    # Falls back to in-tree minimal emitter when not installed.
+    "cyclonedx-python-lib>=8.0",
+]
+learned = [
+    # LightGBM LambdaMART distillation for `roam retrieve --rerank learned`.
+    # Optional — current `--rerank fast` blend stays the default.
+    "lightgbm>=4.0",
+]
 dev = [
     "pytest>=7.0",
     "pytest-xdist>=3.0",

{roam_code-12.1.0 → roam_code-12.2.0}/src/roam/attest/cga.py

@@ -31,6 +31,11 @@ from typing import Any
 from roam.security.taint_engine import OPENVEX_JUSTIFICATIONS, OPENVEX_STATUSES
 
 PREDICATE_TYPE = "https://roam-code.dev/CodeGraph/v1"
+# v12.2: fused CodeGraph + AIBOM predicate. Owns the "structurally bound
+# AI authorship for tamper-evident codebases" lane that SLSA + SPDX +
+# CycloneDX 1.7 + OpenVEX leave gapped. Reference impl candidate for
+# the in-toto attestation registry.
+PREDICATE_TYPE_AIBOM = "https://roam-code.dev/CodeGraph-AIBOM/v1"
 STATEMENT_TYPE = "https://in-toto.io/Statement/v1"
 SCHEMA_VERSION = "1"
 
@@ -218,6 +223,7 @@ def build_cga_statement(
     project_root: Path,
     tool_version: str | None = None,
     taint_findings: list | None = None,
+    include_aibom: bool = False,
 ) -> dict[str, Any]:
     """Build the full in-toto v1 Statement wrapping the CGA predicate.
 
@@ -225,9 +231,15 @@ def build_cga_statement(
         {
           "_type": "https://in-toto.io/Statement/v1",
           "predicateType": "https://roam-code.dev/CodeGraph/v1",
+                              # → CodeGraph-AIBOM/v1 when include_aibom=True
           "subject": [{"name": "...", "digest": {...}}],
           "predicate": {...}
         }
+
+    With ``include_aibom=True``, the predicate type promotes to
+    ``CodeGraph-AIBOM/v1`` and embeds an ``aibom`` block binding
+    AI-authored commits to the indexed symbols they touched. Required
+    for EU AI Act Art. 50 disclosure (effective 2026-08-02).
     """
     sha = _git_commit_sha(project_root) or "unknown"
     remote = _git_remote_url(project_root)
@@ -236,16 +248,26 @@ def build_cga_statement(
         "name": subject_name,
         "digest": {"git_commit_sha1": sha},
     }
+    predicate = build_cga_predicate(
+        conn,
+        project_root=project_root,
+        tool_version=tool_version,
+        taint_findings=taint_findings,
+    )
+    predicate_type = PREDICATE_TYPE
+    if include_aibom:
+        try:
+            from roam.security.aibom_extension import build_aibom_block
+
+            predicate["aibom"] = build_aibom_block(project_root, conn)
+            predicate_type = PREDICATE_TYPE_AIBOM
+        except Exception as exc:
+            predicate["aibom_error"] = str(exc)
     return {
         "_type": STATEMENT_TYPE,
-        "predicateType": PREDICATE_TYPE,
+        "predicateType": predicate_type,
         "subject": [subject],
-        "predicate": build_cga_predicate(
-            conn,
-            project_root=project_root,
-            tool_version=tool_version,
-            taint_findings=taint_findings,
-        ),
+        "predicate": predicate,
     }
 
 
@@ -270,8 +292,11 @@ def verify_cga_statement(
     errors: list[str] = []
     if statement.get("_type") != STATEMENT_TYPE:
         errors.append(f"_type mismatch: got {statement.get('_type')!r}, expected {STATEMENT_TYPE!r}")
-    if statement.get("predicateType") != PREDICATE_TYPE:
-        errors.append(f"predicateType mismatch: got {statement.get('predicateType')!r}, expected {PREDICATE_TYPE!r}")
+    accepted_types = (PREDICATE_TYPE, PREDICATE_TYPE_AIBOM)
+    if statement.get("predicateType") not in accepted_types:
+        errors.append(
+            f"predicateType mismatch: got {statement.get('predicateType')!r}, expected one of {accepted_types!r}"
+        )
     predicate = statement.get("predicate") or {}
     if not isinstance(predicate, dict):
         return False, errors + ["predicate is not a JSON object"]

{roam_code-12.1.0 → roam_code-12.2.0}/src/roam/commands/cmd_cga.py

@@ -110,9 +110,25 @@ def _default_output_path(project_root: Path, statement: dict) -> Path:
         "browser flow."
     ),
 )
+@click.option(
+    "--aibom",
+    is_flag=True,
+    help=(
+        "Promote the predicate to ``CodeGraph-AIBOM/v1`` and embed an "
+        "AIBOM block binding AI-authored commits to the indexed symbols "
+        "they touched. Required for EU AI Act Art. 50 disclosure (effective "
+        "2026-08-02) and the GPAI Code of Practice provenance mandate. "
+        "Reference impl candidate for the in-toto attestation registry."
+    ),
+)
 @click.pass_context
-def cga_emit(ctx, output_path, no_write, include_taint, taint_rules_dir, sign, key_path, keyless):
-    """Emit a Code Graph Attestation (in-toto v1, optionally cosign-signed)."""
+def cga_emit(ctx, output_path, no_write, include_taint, taint_rules_dir, sign, key_path, keyless, aibom):
+    """Emit a Code Graph Attestation (in-toto v1, optionally cosign-signed).
+
+    With ``--aibom`` the predicate type promotes to
+    ``roam-code.dev/CodeGraph-AIBOM/v1`` and the predicate gains an
+    ``aibom`` block binding AI-authored commits to indexed symbols.
+    """
     json_mode = ctx.obj.get("json") if ctx.obj else False
     token_budget = ctx.obj.get("budget", 0) if ctx.obj else 0
 
@@ -137,6 +153,7 @@ def cga_emit(ctx, output_path, no_write, include_taint, taint_rules_dir, sign, k
             conn,
             project_root=project_root,
             taint_findings=taint_findings,
+            include_aibom=aibom,
         )
 
     canonical = serialize_statement(statement)
@@ -198,7 +215,7 @@ def cga_emit(ctx, output_path, no_write, include_taint, taint_rules_dir, sign, k
                         "edge_bundle_digest": pred["edge_bundle_digest"],
                         "symbol_count": pred["symbol_count"],
                         "edge_count": pred["edge_count"],
-                        "predicate_type": PREDICATE_TYPE,
+                        "predicate_type": statement.get("predicateType", PREDICATE_TYPE),
                         "statement_type": STATEMENT_TYPE,
                         "written_to": written_to,
                         "signed": bool(sign_result and sign_result.get("signed")),
@@ -212,7 +229,7 @@ def cga_emit(ctx, output_path, no_write, include_taint, taint_rules_dir, sign, k
         return
 
     click.echo(f"VERDICT: {verdict}")
-    click.echo(f"Predicate type: {PREDICATE_TYPE}")
+    click.echo(f"Predicate type: {statement.get('predicateType', PREDICATE_TYPE)}")
     click.echo(f"Statement type: {STATEMENT_TYPE}")
     click.echo(f"Languages:      {', '.join(pred['languages']) or '(none)'}")
     if written_to:

{roam_code-12.1.0 → roam_code-12.2.0}/src/roam/commands/cmd_mcp_setup.py

@@ -60,8 +60,19 @@ _CONFIGS = {
 
 @click.command("mcp-setup")
 @click.argument("platform", type=click.Choice(sorted(_CONFIGS.keys())), required=False)
+@click.option(
+    "--preset",
+    type=click.Choice(["core", "review", "refactor", "debug", "architecture", "compliance", "full"]),
+    default=None,
+    help=(
+        "Pre-fill the generated config with ``ROAM_MCP_PRESET=<preset>``. "
+        "Default = no env var (uses 'core'). v12.2 adds the 'compliance' "
+        "preset for the EU AI Act / NIS2 buyer wedge — 14 tools covering "
+        "preflight, taint, sbom, cga emit/verify."
+    ),
+)
 @click.pass_context
-def mcp_setup(ctx, platform):
+def mcp_setup(ctx, platform, preset):
     """Generate MCP server config for AI coding platforms.
 
     Prints the exact JSON config block to paste into your AI coding tool.
@@ -77,10 +88,17 @@ def mcp_setup(ctx, platform):
       gemini-cli    Gemini CLI
       codex-cli     OpenAI Codex CLI
 
+    \b
+    Presets (v12.2):
+      core          33 tools — default, balanced for daily agent use
+      compliance    14 tools — EU AI Act / NIS2 audit (taint, sbom, cga, …)
+      full          116 tools — every tool exposed
+      review/refactor/debug/architecture — task-specific subsets
+
     \b
     Examples:
       roam mcp-setup claude-code
-      roam mcp-setup cursor
+      roam mcp-setup cursor --preset compliance
       roam --json mcp-setup vscode
     """
     json_mode = ctx.obj.get("json") if ctx.obj else False
@@ -106,6 +124,25 @@ def mcp_setup(ctx, platform):
 
     cfg = _CONFIGS[platform]
 
+    # v12.2: when --preset is supplied, deep-copy the config and inject the
+    # ROAM_MCP_PRESET env var into the server block. Each platform stores
+    # its server entry under a slightly different key shape (mcpServers vs
+    # servers) — handle both. Mutates a copy, not the module-level dict.
+    if preset:
+        import copy
+
+        cfg = copy.deepcopy(cfg)
+        jc = cfg.get("json_config") or {}
+        # Walk to the first server entry and add an "env" block.
+        for outer_key in ("mcpServers", "servers"):
+            if outer_key not in jc:
+                continue
+            for server_name, server_block in jc[outer_key].items():
+                env = server_block.setdefault("env", {})
+                env["ROAM_MCP_PRESET"] = preset
+        cfg["json_config"] = jc
+        cfg["preset"] = preset
+
     if json_mode:
         click.echo(
             to_json(

{roam_code-12.1.0 → roam_code-12.2.0}/src/roam/commands/cmd_retrieve.py

@@ -38,9 +38,14 @@ from roam.retrieve.pipeline import run_retrieve
 )
 @click.option(
     "--rerank",
-    type=click.Choice(["fast", "off"], case_sensitive=False),
+    type=click.Choice(["fast", "off", "learned"], case_sensitive=False),
     default=None,
-    help="'fast' = structural rerank with personalized PageRank (default). 'off' = lexical only.",
+    help=(
+        "'fast' = structural rerank (default). 'off' = lexical only. "
+        "'learned' = LightGBM LambdaMART trained on your bench (requires "
+        '``pip install "roam-code[learned]"`` + a trained model at '
+        "``$ROAM_LEARNED_MODEL``; falls back to 'fast' when unavailable)."
+    ),
 )
 @click.option(
     "--seed-files",

{roam_code-12.1.0 → roam_code-12.2.0}/src/roam/commands/cmd_sbom.py

@@ -270,7 +270,7 @@ def _generate_cyclonedx(
 
     bom: dict = {
         "bomFormat": "CycloneDX",
-        "specVersion": "1.5",
+        "specVersion": "1.7",
         "version": 1,
         "serialNumber": f"urn:uuid:{serial}",
         "metadata": metadata,
@@ -413,8 +413,19 @@ def _generate_spdx(
     default=False,
     help="Skip call-graph reachability analysis (faster)",
 )
+@click.option(
+    "--aibom",
+    is_flag=True,
+    default=False,
+    help=(
+        "Embed the AIBOM extension (CycloneDX only) — bind AI-authored "
+        "commits (mined via committer email + Co-Authored-By trailers + "
+        "AI-keyword scan) to the indexed symbols they touched. Required "
+        "for EU AI Act Art. 50 disclosure (effective 2026-08-02)."
+    ),
+)
 @click.pass_context
-def sbom(ctx, fmt, output_path, no_reachability):
+def sbom(ctx, fmt, output_path, no_reachability, aibom):
     """Generate a Software Bill of Materials (SBOM) enriched with call-graph reachability.
 
     Produces CycloneDX 1.5 or SPDX 2.3 JSON output.  Each dependency is
@@ -468,6 +479,19 @@ def sbom(ctx, fmt, output_path, no_reachability):
     else:
         sbom_data = _generate_cyclonedx(project_name, deps, reachability)
 
+    # AIBOM extension (CycloneDX 1.7 only) — bind AI-authored commits to
+    # indexed symbols. Required for EU AI Act Art. 50 disclosure.
+    if aibom and fmt.lower() == "cyclonedx":
+        try:
+            from roam.security.aibom_extension import build_aibom_block
+
+            ensure_index()
+            with open_db(readonly=True) as conn:
+                aibom_block = build_aibom_block(project_root, conn)
+            sbom_data["aibom"] = aibom_block
+        except Exception as exc:
+            sbom_data["aibom"] = {"error": str(exc), "version": "0.1"}
+
     # Build summary for verdict / JSON envelope
     total_deps = len(deps)
     reachable_count = 0

{roam_code-12.1.0 → roam_code-12.2.0}/src/roam/competitor_site_data.py

@@ -1360,7 +1360,7 @@ MAP_METADATA: dict[str, dict[str, object]] = {
         "relationship": "self",
         "peer": True,
         "graph": "PageRank + Tarjan + Louvain + layers",
-        "note": "Graph algorithms (PageRank, SCC, Louvain, Fiedler) on tree-sitter ASTs fused with git history in SQLite. 112 MCP tools, 150 CLI commands.",
+        "note": "Graph algorithms (PageRank, SCC, Louvain, Fiedler) on tree-sitter ASTs fused with git history in SQLite. 116 MCP tools, 150 CLI commands.",
         "version_evaluated": "11.1.2",
         "repo_url": "https://github.com/Cranot/roam-code",
     },

{roam_code-12.1.0 → roam_code-12.2.0}/src/roam/config.py

@@ -46,6 +46,10 @@ DEFAULT_RETRIEVE_WEIGHTS: dict[str, float] = {
     "gamma": 0.15,  # inverse layer distance
     "delta": 0.15,  # runtime hotspot signal
     "epsilon": 0.05,  # clone-canonical boost
+    "zeta": 0.20,  # v12.2: semantic similarity (bge-small + sqlite-vec)
+    # Activates only when [semantic] extras are installed AND the
+    # symbol-embedding table is populated; otherwise contributes 0 and
+    # the original blend is preserved exactly.
 }
 
 DEFAULT_RETRIEVE: dict[str, Any] = {

{roam_code-12.1.0 → roam_code-12.2.0}/src/roam/graph/clusters.py

@@ -1,4 +1,4 @@
-"""Louvain community detection for the symbol graph."""
+"""Community detection for the symbol graph (Leiden → Louvain → greedy)."""
 
 from __future__ import annotations
 
@@ -11,10 +11,56 @@ import networkx as nx
 from roam.db.connection import batched_in
 
 
+def _try_leiden_communities(undirected: nx.Graph, out: list[set[int]]) -> bool:
+    """Run Leiden via the optional ``leidenalg`` + ``igraph`` extras.
+
+    Returns ``True`` and fills *out* in place when Leiden succeeded, else
+    ``False`` so the caller can fall back to NetworkX Louvain. Leiden is
+    strictly better than Louvain per Traag et al. 2019 (Nature Sci. Rep.) —
+    no badly-connected communities, fully deterministic with the seed.
+
+    Install with::
+
+        pip install "roam-code[leiden]"
+
+    Skip with ``ROAM_LEIDEN=0`` (e.g., for offline / ABI-pin environments
+    where the C extension fails to load).
+    """
+    if os.environ.get("ROAM_LEIDEN", "1") == "0":
+        return False
+    try:
+        import igraph as ig  # type: ignore
+        import leidenalg  # type: ignore
+    except ImportError:
+        return False
+    try:
+        # Build an igraph from the undirected NetworkX graph. Map node ids
+        # so we can translate back. Edge weights default to 1.0.
+        node_list = list(undirected.nodes())
+        index_for: dict[int, int] = {n: i for i, n in enumerate(node_list)}
+        edges = [(index_for[u], index_for[v]) for u, v in undirected.edges() if u in index_for and v in index_for]
+        ig_graph = ig.Graph(n=len(node_list), edges=edges, directed=False)
+        partition = leidenalg.find_partition(
+            ig_graph,
+            leidenalg.ModularityVertexPartition,
+            seed=42,
+        )
+        for community in partition:
+            out.append({node_list[idx] for idx in community})
+        return True
+    except Exception:
+        # leidenalg / igraph ABI mismatch or memory pressure — fall back.
+        out.clear()
+        return False
+
+
 def detect_clusters(G: nx.DiGraph) -> dict[int, int]:
-    """Detect communities using Louvain on the undirected projection of *G*.
+    """Detect communities on the undirected projection of *G*.
+
+    Algorithm preference: **Leiden** (via optional ``[leiden]`` extra) →
+    seeded **Louvain** (NetworkX) → **greedy modularity** (NetworkX
+    classic, last-resort).
 
-    Falls back to greedy modularity if Louvain is unavailable.
     Returns ``{node_id: cluster_id}``.
     """
     if len(G) == 0:
@@ -24,12 +70,21 @@ def detect_clusters(G: nx.DiGraph) -> dict[int, int]:
 
     # Remove isolates -- community detection on disconnected singletons just
     # assigns each its own community, which is not useful.
+    #
+    # Algorithm preference (best → fallback):
+    #   1. Leiden (via leidenalg + igraph extras): no badly-connected
+    #      communities, fully deterministic with seed. Strictly better than
+    #      Louvain per Traag et al. 2019 (Nature Sci. Rep.).
+    #   2. Louvain (NetworkX) with seed=42: deterministic but may produce
+    #      badly-connected communities — the Leiden paper's main critique.
+    #   3. Greedy modularity: very old NetworkX fallback for offline envs.
     communities: list[set[int]] = []
-    try:
-        communities = list(nx.community.louvain_communities(undirected, seed=42))
-    except (AttributeError, TypeError):
-        # NetworkX < 3.1 or missing optional dependency
-        communities = list(nx.community.greedy_modularity_communities(undirected))
+    if not _try_leiden_communities(undirected, communities):
+        try:
+            communities = list(nx.community.louvain_communities(undirected, seed=42))
+        except (AttributeError, TypeError):
+            # NetworkX < 3.1 or missing optional dependency
+            communities = list(nx.community.greedy_modularity_communities(undirected))
 
     mapping: dict[int, int] = {}
     for cluster_id, members in enumerate(communities):