roam-code 12.1.0__tar.gz → 12.3.0__tar.gz

{roam_code-12.1.0/src/roam_code.egg-info → roam_code-12.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: roam-code
-Version: 12.1.0
+Version: 12.3.0
 Summary: Instant codebase comprehension for AI coding agents
 Author: CosmoHac
 License-Expression: MIT
@@ -29,7 +29,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: click>=8.0
 Requires-Dist: tree-sitter>=0.23
-Requires-Dist: tree-sitter-language-pack>=0.6
+Requires-Dist: tree-sitter-language-pack<1.6.3,>=0.6
 Requires-Dist: networkx>=3.0
 Provides-Extra: mcp
 Requires-Dist: fastmcp>=2.0; extra == "mcp"
@@ -37,9 +37,20 @@ Provides-Extra: semantic
 Requires-Dist: numpy>=1.24; extra == "semantic"
 Requires-Dist: onnxruntime>=1.16; extra == "semantic"
 Requires-Dist: tokenizers>=0.15; extra == "semantic"
+Provides-Extra: leiden
+Requires-Dist: igraph>=0.11; extra == "leiden"
+Requires-Dist: leidenalg>=0.10; extra == "leiden"
+Provides-Extra: graph-fast
+Requires-Dist: rustworkx>=0.14; extra == "graph-fast"
+Provides-Extra: sbom
+Requires-Dist: cyclonedx-python-lib>=8.0; extra == "sbom"
+Provides-Extra: learned
+Requires-Dist: lightgbm>=4.0; extra == "learned"
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"
 Requires-Dist: pytest-xdist>=3.0; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
+Requires-Dist: scipy>=1.11; extra == "dev"
 Requires-Dist: ruff>=0.4; extra == "dev"
 Requires-Dist: build>=1.0; extra == "dev"
 Requires-Dist: twine>=5.0; extra == "dev"
@@ -51,7 +62,7 @@ Dynamic: license-file
 
 **The architectural intelligence layer for AI coding agents. Structural graph, architecture governance, multi-agent orchestration, vulnerability mapping, runtime analysis -- one CLI, zero API keys.**
 
-*150 commands · 112 MCP tools · 27 languages · 100% local*
+*150 commands · 116 MCP tools · 27 languages · 100% local*
 
 [![PyPI version](https://img.shields.io/pypi/v/roam-code?style=flat-square&color=blue)](https://pypi.org/project/roam-code/)
 [![GitHub stars](https://img.shields.io/github/stars/Cranot/roam-code?style=flat-square)](https://github.com/Cranot/roam-code/stargazers)
@@ -128,7 +139,7 @@ $ roam diff                    # blast radius of uncommitted changes
 - **`personalized_pagerank()`** in `graph/pagerank.py`: NetworkX `personalization=` wrapper with empty-seed fallback to global PR; biases ranking toward query-relevant nodes for the retrieve reranker.
 - **`.roam/config.toml`** (new): zero-dep TOML loader (stdlib `tomllib` → `tomli` → in-tree subset parser). Tunable retrieve weights (`alpha`/`beta`/`gamma`/`delta`/`epsilon`), `tokens_per_line`, `lexical_baseline`, `first_stage_token_cap`, `default_budget`, `default_k`, `default_rerank`.
 - **DX corrections from dogfood pass**: `roam --detail <cmd>` is the canonical group-level flag; misleading "use --detail" hints in 7 commands rewritten to point users at `roam --detail <cmd>`. `--top N` aliased on `complexity`/`algo`/`rules` (`--top 0` means unlimited on `rules`). `roam fingerprint` no longer refuses graphs ≥5,000 symbols (new soft-warn threshold 20k, hard cap 100k).
-- **150 CLI commands, 112 MCP tools** (`fleet`, `ask`, `taint`, `cga`, `eval-retrieve` remain CLI-only; v12 exposes `roam_retrieve`, `roam_critique`, `roam_fleet_plan`, plus 5 v12.1 boolean oracles (`roam_oracle_*`) and `roam_taint_classify` as MCP tools). 33-tool `core` preset is the default for token-budget-conscious clients.
+- **150 CLI commands, 116 MCP tools** (`fleet`, `ask`, `taint`, `cga`, `eval-retrieve` remain CLI-only; v12 exposes `roam_retrieve`, `roam_critique`, `roam_fleet_plan`, plus 5 v12.1 boolean oracles (`roam_oracle_*`) and `roam_taint_classify` as MCP tools). 33-tool `core` preset is the default for token-budget-conscious clients.
 
 ## What's New in v11
 
@@ -159,7 +170,7 @@ $ roam diff                    # blast radius of uncommitted changes
 - MCP token overhead for default core context dropped from ~36K to <3K tokens (about 92% reduction).
 
 ### Performance and Retrieval
-- Symbol search moved to SQLite FTS5/BM25: typical search moved from seconds to milliseconds (about 1000x on benchmarked paths).
+- Symbol search moved to SQLite FTS5/BM25: typical search moved from seconds to tens of milliseconds on the indexed cohort (mileage varies by repo size and query selectivity — see `bench/retrieve/` for the methodology).
 - Incremental indexing shifted from O(N) full-edge rebuild behavior to O(changed) updates.
 - DB/runtime optimizations (`mmap_size`, safer large-graph guards, batched writes) reduce first-run and reindex friction on larger repos.
 
@@ -299,7 +310,7 @@ roam health
 
 ## Commands
 
-The [5 core commands](#core-commands) shown above cover ~80% of agent workflows. All 150 commands are organized into 7 categories.
+**Lead with the 5 verbs.** The [5 core commands](#core-commands) cover ~80% of agent workflows: `understand`, `context`, `retrieve`, `preflight`, `critique`. The remaining 145 commands are detail surface for specialised workflows (taint, fleet, cga, oracle, eval, …) — they're called by agents on demand, not memorised. This is intentional design; under the hood the canonical surface is **150 commands organised into 7 categories**, but you don't need to know that to start.
 
 <details>
 <summary><strong>Full command reference</strong></summary>
@@ -937,7 +948,7 @@ ROAM_MCP_LITE=0 roam mcp
 Core preset tools: `roam_affected_tests`, `roam_batch_get`, `roam_batch_search`, `roam_complete`, `roam_complexity_report`, `roam_context`, `roam_dead_code`, `roam_deps`, `roam_diagnose`, `roam_diagnose_issue`, `roam_diff`, `roam_expand_toolset`, `roam_explore`, `roam_file_info`, `roam_health`, `roam_impact`, `roam_pr_risk`, `roam_preflight`, `roam_prepare_change`, `roam_review_change`, `roam_search_symbol`, `roam_syntax_check`, `roam_trace`, `roam_understand`, `roam_uses`.
 
 <details>
-<summary><strong>MCP tool list (all 112)</strong></summary>
+<summary><strong>MCP tool list (all 116)</strong></summary>
 
 | Tool | Description |
 |------|-------------|
@@ -957,6 +968,10 @@ Core preset tools: `roam_affected_tests`, `roam_batch_get`, `roam_batch_search`,
 | `roam_oracle_is_reachable_from_entry` | Boolean oracle: can BFS reach this symbol from any entry-point? |
 | `roam_oracle_is_clone_of` | Boolean oracle: does this symbol participate in a persisted clone cluster? |
 | `roam_taint_classify` | LLM-augmented taint classification (IDOR/AUTHZ/SQLI/...) via MCP sampling |
+| `roam_taint` | Static taint analysis — graph-reach BFS with OpenVEX-correct findings |
+| `roam_sbom` | CycloneDX 1.7 / SPDX 2.3 SBOM emit with optional AIBOM extension (EU AI Act) |
+| `roam_cga_emit` | Emit a Code Graph Attestation (in-toto v1) with optional cosign signing |
+| `roam_cga_verify` | Verify a CGA statement — re-derives Merkle + edge digest, checks cosign signature |
 | `roam_trace` | Dependency path between two symbols |
 | `roam_impact` | Blast radius of changing a symbol |
 | `roam_file_info` | File skeleton with all definitions |
@@ -1568,7 +1583,7 @@ roam-code/
 ├── src/roam/
 │   ├── __init__.py                    # Version (from pyproject.toml)
 │   ├── cli.py                         # Click CLI (150 commands)
-│   ├── mcp_server.py                  # MCP server (112 tools, 10 resources, 5 prompts)
+│   ├── mcp_server.py                  # MCP server (116 tools, 10 resources, 5 prompts)
 │   ├── db/
 │   │   ├── connection.py              # SQLite (WAL, pragmas, batched IN)
 │   │   ├── schema.py                  # Tables, indexes, migrations
@@ -1662,7 +1677,7 @@ Optional: Local semantic ONNX stack (`numpy`, `onnxruntime`, `tokenizers`) via `
 ### Shipped
 
 - [x] MCP v2 agent surface: in-process execution, compound operations, presets, schemas, annotations, and compatibility profiles.
-- [x] Full command and MCP inventory parity in docs: 150 CLI commands and 112 MCP tools.
+- [x] Full command and MCP inventory parity in docs: 150 CLI commands and 116 MCP tools.
 - [x] CI hardening: composite action, changed-only mode, trend-aware gates, sticky PR updater, and SARIF guardrails.
 - [x] Performance foundation: FTS5/BM25 search, O(changed) incremental indexing, DB/index optimizations.
 - [x] Agent governance suite: `vibe-check`, `ai-readiness`, `verify`, `ai-ratio`, `duplicates`, advanced `algo` scoring/SARIF.

{roam_code-12.1.0 → roam_code-12.3.0}/README.md

@@ -4,7 +4,7 @@
 
 **The architectural intelligence layer for AI coding agents. Structural graph, architecture governance, multi-agent orchestration, vulnerability mapping, runtime analysis -- one CLI, zero API keys.**
 
-*150 commands · 112 MCP tools · 27 languages · 100% local*
+*150 commands · 116 MCP tools · 27 languages · 100% local*
 
 [![PyPI version](https://img.shields.io/pypi/v/roam-code?style=flat-square&color=blue)](https://pypi.org/project/roam-code/)
 [![GitHub stars](https://img.shields.io/github/stars/Cranot/roam-code?style=flat-square)](https://github.com/Cranot/roam-code/stargazers)
@@ -81,7 +81,7 @@ $ roam diff                    # blast radius of uncommitted changes
 - **`personalized_pagerank()`** in `graph/pagerank.py`: NetworkX `personalization=` wrapper with empty-seed fallback to global PR; biases ranking toward query-relevant nodes for the retrieve reranker.
 - **`.roam/config.toml`** (new): zero-dep TOML loader (stdlib `tomllib` → `tomli` → in-tree subset parser). Tunable retrieve weights (`alpha`/`beta`/`gamma`/`delta`/`epsilon`), `tokens_per_line`, `lexical_baseline`, `first_stage_token_cap`, `default_budget`, `default_k`, `default_rerank`.
 - **DX corrections from dogfood pass**: `roam --detail <cmd>` is the canonical group-level flag; misleading "use --detail" hints in 7 commands rewritten to point users at `roam --detail <cmd>`. `--top N` aliased on `complexity`/`algo`/`rules` (`--top 0` means unlimited on `rules`). `roam fingerprint` no longer refuses graphs ≥5,000 symbols (new soft-warn threshold 20k, hard cap 100k).
-- **150 CLI commands, 112 MCP tools** (`fleet`, `ask`, `taint`, `cga`, `eval-retrieve` remain CLI-only; v12 exposes `roam_retrieve`, `roam_critique`, `roam_fleet_plan`, plus 5 v12.1 boolean oracles (`roam_oracle_*`) and `roam_taint_classify` as MCP tools). 33-tool `core` preset is the default for token-budget-conscious clients.
+- **150 CLI commands, 116 MCP tools** (`fleet`, `ask`, `taint`, `cga`, `eval-retrieve` remain CLI-only; v12 exposes `roam_retrieve`, `roam_critique`, `roam_fleet_plan`, plus 5 v12.1 boolean oracles (`roam_oracle_*`) and `roam_taint_classify` as MCP tools). 33-tool `core` preset is the default for token-budget-conscious clients.
 
 ## What's New in v11
 
@@ -112,7 +112,7 @@ $ roam diff                    # blast radius of uncommitted changes
 - MCP token overhead for default core context dropped from ~36K to <3K tokens (about 92% reduction).
 
 ### Performance and Retrieval
-- Symbol search moved to SQLite FTS5/BM25: typical search moved from seconds to milliseconds (about 1000x on benchmarked paths).
+- Symbol search moved to SQLite FTS5/BM25: typical search moved from seconds to tens of milliseconds on the indexed cohort (mileage varies by repo size and query selectivity — see `bench/retrieve/` for the methodology).
 - Incremental indexing shifted from O(N) full-edge rebuild behavior to O(changed) updates.
 - DB/runtime optimizations (`mmap_size`, safer large-graph guards, batched writes) reduce first-run and reindex friction on larger repos.
 
@@ -252,7 +252,7 @@ roam health
 
 ## Commands
 
-The [5 core commands](#core-commands) shown above cover ~80% of agent workflows. All 150 commands are organized into 7 categories.
+**Lead with the 5 verbs.** The [5 core commands](#core-commands) cover ~80% of agent workflows: `understand`, `context`, `retrieve`, `preflight`, `critique`. The remaining 145 commands are detail surface for specialised workflows (taint, fleet, cga, oracle, eval, …) — they're called by agents on demand, not memorised. This is intentional design; under the hood the canonical surface is **150 commands organised into 7 categories**, but you don't need to know that to start.
 
 <details>
 <summary><strong>Full command reference</strong></summary>
@@ -890,7 +890,7 @@ ROAM_MCP_LITE=0 roam mcp
 Core preset tools: `roam_affected_tests`, `roam_batch_get`, `roam_batch_search`, `roam_complete`, `roam_complexity_report`, `roam_context`, `roam_dead_code`, `roam_deps`, `roam_diagnose`, `roam_diagnose_issue`, `roam_diff`, `roam_expand_toolset`, `roam_explore`, `roam_file_info`, `roam_health`, `roam_impact`, `roam_pr_risk`, `roam_preflight`, `roam_prepare_change`, `roam_review_change`, `roam_search_symbol`, `roam_syntax_check`, `roam_trace`, `roam_understand`, `roam_uses`.
 
 <details>
-<summary><strong>MCP tool list (all 112)</strong></summary>
+<summary><strong>MCP tool list (all 116)</strong></summary>
 
 | Tool | Description |
 |------|-------------|
@@ -910,6 +910,10 @@ Core preset tools: `roam_affected_tests`, `roam_batch_get`, `roam_batch_search`,
 | `roam_oracle_is_reachable_from_entry` | Boolean oracle: can BFS reach this symbol from any entry-point? |
 | `roam_oracle_is_clone_of` | Boolean oracle: does this symbol participate in a persisted clone cluster? |
 | `roam_taint_classify` | LLM-augmented taint classification (IDOR/AUTHZ/SQLI/...) via MCP sampling |
+| `roam_taint` | Static taint analysis — graph-reach BFS with OpenVEX-correct findings |
+| `roam_sbom` | CycloneDX 1.7 / SPDX 2.3 SBOM emit with optional AIBOM extension (EU AI Act) |
+| `roam_cga_emit` | Emit a Code Graph Attestation (in-toto v1) with optional cosign signing |
+| `roam_cga_verify` | Verify a CGA statement — re-derives Merkle + edge digest, checks cosign signature |
 | `roam_trace` | Dependency path between two symbols |
 | `roam_impact` | Blast radius of changing a symbol |
 | `roam_file_info` | File skeleton with all definitions |
@@ -1521,7 +1525,7 @@ roam-code/
 ├── src/roam/
 │   ├── __init__.py                    # Version (from pyproject.toml)
 │   ├── cli.py                         # Click CLI (150 commands)
-│   ├── mcp_server.py                  # MCP server (112 tools, 10 resources, 5 prompts)
+│   ├── mcp_server.py                  # MCP server (116 tools, 10 resources, 5 prompts)
 │   ├── db/
 │   │   ├── connection.py              # SQLite (WAL, pragmas, batched IN)
 │   │   ├── schema.py                  # Tables, indexes, migrations
@@ -1615,7 +1619,7 @@ Optional: Local semantic ONNX stack (`numpy`, `onnxruntime`, `tokenizers`) via `
 ### Shipped
 
 - [x] MCP v2 agent surface: in-process execution, compound operations, presets, schemas, annotations, and compatibility profiles.
-- [x] Full command and MCP inventory parity in docs: 150 CLI commands and 112 MCP tools.
+- [x] Full command and MCP inventory parity in docs: 150 CLI commands and 116 MCP tools.
 - [x] CI hardening: composite action, changed-only mode, trend-aware gates, sticky PR updater, and SARIF guardrails.
 - [x] Performance foundation: FTS5/BM25 search, O(changed) incremental indexing, DB/index optimizations.
 - [x] Agent governance suite: `vibe-check`, `ai-readiness`, `verify`, `ai-ratio`, `duplicates`, advanced `algo` scoring/SARIF.

{roam_code-12.1.0 → roam_code-12.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "roam-code"
-version = "12.1.0"
+version = "12.3.0"
 description = "Instant codebase comprehension for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -32,7 +32,11 @@ classifiers = [
 dependencies = [
     "click>=8.0",
     "tree-sitter>=0.23",
-    "tree-sitter-language-pack>=0.6",
+    # Pinned upper bound: 1.6.3's cp312 wheel ships a manylinux_2_34
+    # tarball that fails to register the ``tree_sitter_language_pack``
+    # module post-install (CI run 25217131296). 1.6.2 (cp310-abi3) works
+    # cleanly across 3.9–3.13.
+    "tree-sitter-language-pack>=0.6,<1.6.3",
     "networkx>=3.0",
 ]
 
@@ -55,9 +59,42 @@ semantic = [
     "onnxruntime>=1.16",
     "tokenizers>=0.15",
 ]
+leiden = [
+    # Strictly better community detection than Louvain (no badly-connected
+    # communities). Auto-detected at runtime; falls back to seeded Louvain
+    # when these aren't installed.
+    "igraph>=0.11",
+    "leidenalg>=0.10",
+]
+graph-fast = [
+    # rustworkx is a Rust-backed drop-in for many NetworkX algorithms;
+    # 3-100× speedup at >250k nodes per the v12.2 architecture review.
+    # Auto-detected via ``ROAM_GRAPH_BACKEND=rustworkx``.
+    "rustworkx>=0.14",
+]
+sbom = [
+    # CycloneDX 1.7 SBOM emit (with AIBOM extension) for `roam sbom`.
+    # Falls back to in-tree minimal emitter when not installed.
+    "cyclonedx-python-lib>=8.0",
+]
+learned = [
+    # LightGBM LambdaMART distillation for `roam retrieve --rerank learned`.
+    # Optional — current `--rerank fast` blend stays the default.
+    "lightgbm>=4.0",
+]
 dev = [
     "pytest>=7.0",
     "pytest-xdist>=3.0",
+    # pytest-asyncio is required by tests/test_taint_classifier.py — those
+    # tests use ``@pytest.mark.asyncio`` to verify the MCP-sampling-based
+    # taint classifier under a controlled async loop.
+    "pytest-asyncio>=0.23",
+    # scipy is required by ``nx.pagerank`` on networkx 3.x; without it,
+    # the personalized-pagerank tests exercise the degree-based fallback
+    # which doesn't honour ``alpha`` and trivially fails the
+    # alpha-override / chain-propagation invariants. Production users
+    # without scipy still get the (less accurate but correct) fallback.
+    "scipy>=1.11",
     "ruff>=0.4",
     "build>=1.0",
     "twine>=5.0",
@@ -69,10 +106,17 @@ where = ["src"]
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 addopts = "-q --tb=short"
+# v12.2: pytest-asyncio strict-mode + auto fixture loop scope. Avoids the
+# 11 PytestUnknownMarkWarning warnings on `@pytest.mark.asyncio` in
+# test_taint_classifier.py when pytest-asyncio is installed (it ships
+# under the `[dev]` extra).
+asyncio_mode = "strict"
+asyncio_default_fixture_loop_scope = "function"
 markers = [
     "smoke: fast, high-signal tests for local iteration",
     "core: broader local suite for pre-push checks",
     "slow: marks tests as slow (deselect with '-m \"not slow\"')",
+    "asyncio: marks async tests requiring pytest-asyncio (skip when missing)",
 ]
 
 [tool.ruff]

{roam_code-12.1.0 → roam_code-12.3.0}/src/roam/attest/cga.py

@@ -31,6 +31,11 @@ from typing import Any
 from roam.security.taint_engine import OPENVEX_JUSTIFICATIONS, OPENVEX_STATUSES
 
 PREDICATE_TYPE = "https://roam-code.dev/CodeGraph/v1"
+# v12.2: fused CodeGraph + AIBOM predicate. Owns the "structurally bound
+# AI authorship for tamper-evident codebases" lane that SLSA + SPDX +
+# CycloneDX 1.7 + OpenVEX leave gapped. Reference impl candidate for
+# the in-toto attestation registry.
+PREDICATE_TYPE_AIBOM = "https://roam-code.dev/CodeGraph-AIBOM/v1"
 STATEMENT_TYPE = "https://in-toto.io/Statement/v1"
 SCHEMA_VERSION = "1"
 
@@ -218,6 +223,7 @@ def build_cga_statement(
     project_root: Path,
     tool_version: str | None = None,
     taint_findings: list | None = None,
+    include_aibom: bool = False,
 ) -> dict[str, Any]:
     """Build the full in-toto v1 Statement wrapping the CGA predicate.
 
@@ -225,9 +231,15 @@ def build_cga_statement(
         {
           "_type": "https://in-toto.io/Statement/v1",
           "predicateType": "https://roam-code.dev/CodeGraph/v1",
+                              # → CodeGraph-AIBOM/v1 when include_aibom=True
           "subject": [{"name": "...", "digest": {...}}],
           "predicate": {...}
         }
+
+    With ``include_aibom=True``, the predicate type promotes to
+    ``CodeGraph-AIBOM/v1`` and embeds an ``aibom`` block binding
+    AI-authored commits to the indexed symbols they touched. Required
+    for EU AI Act Art. 50 disclosure (effective 2026-08-02).
     """
     sha = _git_commit_sha(project_root) or "unknown"
     remote = _git_remote_url(project_root)
@@ -236,16 +248,26 @@ def build_cga_statement(
         "name": subject_name,
         "digest": {"git_commit_sha1": sha},
     }
+    predicate = build_cga_predicate(
+        conn,
+        project_root=project_root,
+        tool_version=tool_version,
+        taint_findings=taint_findings,
+    )
+    predicate_type = PREDICATE_TYPE
+    if include_aibom:
+        try:
+            from roam.security.aibom_extension import build_aibom_block
+
+            predicate["aibom"] = build_aibom_block(project_root, conn)
+            predicate_type = PREDICATE_TYPE_AIBOM
+        except Exception as exc:
+            predicate["aibom_error"] = str(exc)
     return {
         "_type": STATEMENT_TYPE,
-        "predicateType": PREDICATE_TYPE,
+        "predicateType": predicate_type,
         "subject": [subject],
-        "predicate": build_cga_predicate(
-            conn,
-            project_root=project_root,
-            tool_version=tool_version,
-            taint_findings=taint_findings,
-        ),
+        "predicate": predicate,
     }
 
 
@@ -270,8 +292,11 @@ def verify_cga_statement(
     errors: list[str] = []
     if statement.get("_type") != STATEMENT_TYPE:
         errors.append(f"_type mismatch: got {statement.get('_type')!r}, expected {STATEMENT_TYPE!r}")
-    if statement.get("predicateType") != PREDICATE_TYPE:
-        errors.append(f"predicateType mismatch: got {statement.get('predicateType')!r}, expected {PREDICATE_TYPE!r}")
+    accepted_types = (PREDICATE_TYPE, PREDICATE_TYPE_AIBOM)
+    if statement.get("predicateType") not in accepted_types:
+        errors.append(
+            f"predicateType mismatch: got {statement.get('predicateType')!r}, expected one of {accepted_types!r}"
+        )
     predicate = statement.get("predicate") or {}
     if not isinstance(predicate, dict):
         return False, errors + ["predicate is not a JSON object"]

{roam_code-12.1.0 → roam_code-12.3.0}/src/roam/commands/cmd_cga.py

@@ -110,9 +110,25 @@ def _default_output_path(project_root: Path, statement: dict) -> Path:
         "browser flow."
     ),
 )
+@click.option(
+    "--aibom",
+    is_flag=True,
+    help=(
+        "Promote the predicate to ``CodeGraph-AIBOM/v1`` and embed an "
+        "AIBOM block binding AI-authored commits to the indexed symbols "
+        "they touched. Required for EU AI Act Art. 50 disclosure (effective "
+        "2026-08-02) and the GPAI Code of Practice provenance mandate. "
+        "Reference impl candidate for the in-toto attestation registry."
+    ),
+)
 @click.pass_context
-def cga_emit(ctx, output_path, no_write, include_taint, taint_rules_dir, sign, key_path, keyless):
-    """Emit a Code Graph Attestation (in-toto v1, optionally cosign-signed)."""
+def cga_emit(ctx, output_path, no_write, include_taint, taint_rules_dir, sign, key_path, keyless, aibom):
+    """Emit a Code Graph Attestation (in-toto v1, optionally cosign-signed).
+
+    With ``--aibom`` the predicate type promotes to
+    ``roam-code.dev/CodeGraph-AIBOM/v1`` and the predicate gains an
+    ``aibom`` block binding AI-authored commits to indexed symbols.
+    """
     json_mode = ctx.obj.get("json") if ctx.obj else False
     token_budget = ctx.obj.get("budget", 0) if ctx.obj else 0
 
@@ -137,6 +153,7 @@ def cga_emit(ctx, output_path, no_write, include_taint, taint_rules_dir, sign, k
             conn,
             project_root=project_root,
             taint_findings=taint_findings,
+            include_aibom=aibom,
         )
 
     canonical = serialize_statement(statement)
@@ -198,7 +215,7 @@ def cga_emit(ctx, output_path, no_write, include_taint, taint_rules_dir, sign, k
                         "edge_bundle_digest": pred["edge_bundle_digest"],
                         "symbol_count": pred["symbol_count"],
                         "edge_count": pred["edge_count"],
-                        "predicate_type": PREDICATE_TYPE,
+                        "predicate_type": statement.get("predicateType", PREDICATE_TYPE),
                         "statement_type": STATEMENT_TYPE,
                         "written_to": written_to,
                         "signed": bool(sign_result and sign_result.get("signed")),
@@ -212,7 +229,7 @@ def cga_emit(ctx, output_path, no_write, include_taint, taint_rules_dir, sign, k
         return
 
     click.echo(f"VERDICT: {verdict}")
-    click.echo(f"Predicate type: {PREDICATE_TYPE}")
+    click.echo(f"Predicate type: {statement.get('predicateType', PREDICATE_TYPE)}")
     click.echo(f"Statement type: {STATEMENT_TYPE}")
     click.echo(f"Languages:      {', '.join(pred['languages']) or '(none)'}")
     if written_to:

{roam_code-12.1.0 → roam_code-12.3.0}/src/roam/commands/cmd_critique.py

@@ -31,6 +31,57 @@ from roam.critique.checks import (
 from roam.db.connection import open_db
 from roam.output.formatter import json_envelope, to_json
 
+# Hot-path → bench command. When a diff touches any of these path
+# prefixes, the default critique rules can pass while the change
+# materially alters retrieval/scoring/graph algorithms. The hint
+# names the bench so the user includes it in their verification
+# loop. Order matters: first match wins (most specific first).
+_BENCH_RELEVANCE_RULES = [
+    (
+        ("src/roam/retrieve/", "src/roam/eval/"),
+        "pytest tests/test_retrieve_cross_repo.py + roam eval-retrieve --tasks bench/retrieve/roam_self.jsonl",
+    ),
+    (
+        ("src/roam/graph/pagerank.py", "src/roam/graph/clusters.py"),
+        "pytest tests/test_personalized_pagerank.py tests/test_fallback_contracts.py",
+    ),
+    (("src/roam/graph/",), "pytest tests/ -k graph_ -m 'not slow'"),
+    (
+        ("src/roam/languages/", "src/roam/index/parser.py"),
+        "pytest tests/test_languages.py tests/test_extractor_grammar_drift.py",
+    ),
+    (("src/roam/security/taint",), "pytest tests/test_taint_analysis.py tests/test_taint_classifier.py"),
+    (("src/roam/critique/",), "pytest tests/test_critique.py"),
+    (
+        ("src/roam/commands/cmd_oracle.py", "src/roam/commands/cmd_health.py"),
+        "pytest tests/test_oracle.py tests/test_commands_health.py",
+    ),
+]
+
+
+def _bench_relevance_hint(regions) -> str:
+    """Return a one-line bench/test suggestion when the diff touches a
+    structurally-significant path. ``regions`` is the
+    ``critique.checks.ChangedRegion`` list from the diff parser; we
+    look at each region's file path and pick the first matching rule.
+    """
+    paths = []
+    for r in regions:
+        path = getattr(r, "file_path", None) or getattr(r, "file", None) or ""
+        if path:
+            paths.append(path.replace("\\", "/"))
+    if not paths:
+        return ""
+    seen: set[str] = set()
+    for path in paths:
+        for prefixes, hint in _BENCH_RELEVANCE_RULES:
+            if any(path.startswith(p) or p in path for p in prefixes):
+                if hint in seen:
+                    return hint
+                seen.add(hint)
+                return hint
+    return ""
+
 
 @click.command()
 @click.option(
@@ -163,5 +214,17 @@ def critique(ctx, input_path, high_callers, intent_text):
                     click.echo(f"    {line}")
                 click.echo()
 
+        # Bench-relevance hint (dogfood notes 2026-05-01): when the diff
+        # touches files in the retrieve / graph / catalog hot path, the
+        # default rule set ("clones not edited", "blast radius") can
+        # legitimately say "no concerns" while the change quietly
+        # alters the structural-rerank scoring formula. Surfacing the
+        # bench command makes the verifier conversation include the
+        # one validation that actually exercises the modified code.
+        bench_hint = _bench_relevance_hint(regions)
+        if bench_hint:
+            click.echo()
+            click.echo(f"BENCH HINT: {bench_hint}")
+
     if result["severity_breakdown"].get("high", 0) > 0:
         ctx.exit(5)

{roam_code-12.1.0 → roam_code-12.3.0}/src/roam/commands/cmd_dead.py

@@ -358,6 +358,19 @@ def _group_dead(dead_items, by):
 # ---------------------------------------------------------------------------
 
 
+_TOOLING_PATH_HINTS = ("/dev/", "/benchmarks/", "/.github/", "\\dev\\", "\\benchmarks\\", "\\.github\\")
+
+
+def _is_tooling_path(path: str) -> bool:
+    """Same hint set as cmd_fan / cmd_smells. Excluded from dead-code
+    headline by default (dogfood notes 2026-05-01) — CI scripts are
+    expected to have unreferenced helper functions."""
+    if not path:
+        return False
+    p = "/" + path.replace("\\", "/")
+    return any(hint.replace("\\", "/") in p for hint in _TOOLING_PATH_HINTS)
+
+
 def _analyze_dead(conn):
     """Run the full dead code analysis.
 
@@ -366,6 +379,9 @@ def _analyze_dead(conn):
     rows = conn.execute(UNREFERENCED_EXPORTS).fetchall()
     # Exclude test files — their symbols are discovered by pytest, not imported
     rows = [r for r in rows if not _is_test_path(r["file_path"])]
+    # Exclude tooling/CI/benchmarks/dev — same default-exclusion that
+    # ``cmd_smells`` and ``cmd_fan`` apply.
+    rows = [r for r in rows if not _is_tooling_path(r["file_path"])]
     if not rows:
         return [], [], set()
 

{roam_code-12.1.0 → roam_code-12.3.0}/src/roam/commands/cmd_diagnose.py

@@ -315,6 +315,15 @@ def diagnose(ctx, name, depth):
 
         # Text output
         click.echo(f"VERDICT: {verdict}")
+        # Index-staleness hint (dogfood notes 2026-05-01): when index
+        # is older than HEAD, commit_count / churn columns are
+        # unreliable — surface this so the user knows whether to trust
+        # the numbers or re-index.
+        from roam.commands.resolve import index_staleness_hint as _stale_hint
+
+        _stale = _stale_hint()
+        if _stale:
+            click.echo(f"NOTE: {_stale}")
         sym_name = sym["qualified_name"] or sym["name"]
         click.echo(f"Diagnose: {sym_name}")
         click.echo(f"  {loc(target_metrics['file_path'], sym['line_start'])}")

{roam_code-12.1.0 → roam_code-12.3.0}/src/roam/commands/cmd_entry_points.py

@@ -103,7 +103,13 @@ _NAME_PATTERNS = [
     ("Scheduled", re.compile(r"cron|schedule|periodic|tick", re.IGNORECASE)),
     ("Message", re.compile(r"consume|subscriber|on_message|process_message", re.IGNORECASE)),
     ("CLI", re.compile(r"^cmd_|_command$|_cmd$", re.IGNORECASE)),
-    ("HTTP", re.compile(r"_view$|_endpoint$|_controller$|_handler$", re.IGNORECASE)),
+    # HTTP name patterns: only the strong endpoint/controller suffixes.
+    # ``_view$`` and ``_handler$`` matched too broadly — dogfood notes
+    # 2026-05-01 caught ``_extract_create_view`` (a SQL parser method)
+    # and ``error_handler`` (signal handler) being classified as HTTP
+    # routes. The decorator pattern above already catches genuine
+    # ``@app.route`` etc. — name fallback can be conservative.
+    ("HTTP", re.compile(r"_endpoint$|_controller$", re.IGNORECASE)),
 ]
 
 

{roam_code-12.1.0 → roam_code-12.3.0}/src/roam/commands/cmd_fan.py

@@ -107,12 +107,43 @@ _FRAMEWORK_NAMES = frozenset(
 )
 
 
+_TOOLING_PATH_HINTS = ("/dev/", "/benchmarks/", "/.github/", "\\dev\\", "\\benchmarks\\", "\\.github\\")
+
+
+def _is_tooling_path(path: str) -> bool:
+    """Return True for paths that belong to tooling/CI/benchmarks/dev.
+
+    Default-excluded from headline metrics so first-time users aren't
+    dominated by ``pr-comment.js`` and ``roam-bench.py`` rows.
+    Matches the hint set used by ``cmd_smells._file_role_lookup``.
+    """
+    if not path:
+        return False
+    p = "/" + path.replace("\\", "/")
+    return any(hint.replace("\\", "/") in p for hint in _TOOLING_PATH_HINTS)
+
+
+def _filter_tooling_rows(rows):
+    """Filter out rows whose ``file_path`` is in a tooling location."""
+    return [r for r in rows if not _is_tooling_path(r["file_path"] or "")]
+
+
 @click.command()
 @click.argument("mode", default="symbol", type=click.Choice(["symbol", "file"]))
 @click.option("-n", "count", default=20, help="Number of items to show")
 @click.option("--no-framework", is_flag=True, help="Filter out framework/boilerplate symbols")
+@click.option(
+    "--include-tooling",
+    is_flag=True,
+    default=False,
+    help=(
+        "Include CI scripts, dev tooling, build, and generated files. "
+        "Excluded by default — high fan-in in dev/.github/benchmarks "
+        "is expected and dominates the headline (dogfood notes 2026-05-01)."
+    ),
+)
 @click.pass_context
-def fan(ctx, mode, count, no_framework):
+def fan(ctx, mode, count, no_framework, include_tooling):
     """Show fan-in/fan-out: most connected symbols or files.
 
     Unlike ``coupling`` (which measures temporal co-change frequency), this
@@ -124,6 +155,10 @@ def fan(ctx, mode, count, no_framework):
     ensure_index()
 
     with open_db(readonly=True) as conn:
+        # Pull more rows than ``count`` when filtering, so the displayed
+        # top-N still has ``count`` entries after exclusions. 5x is a
+        # comfortable safety factor for typical tooling shares.
+        fetch_limit = count * 5 if not include_tooling else count
         if mode == "symbol":
             rows = conn.execute(
                 """
@@ -138,9 +173,13 @@ def fan(ctx, mode, count, no_framework):
                 ORDER BY total DESC
                 LIMIT ?
             """,
-                (count,),
+                (fetch_limit,),
             ).fetchall()
 
+            if not include_tooling:
+                rows = _filter_tooling_rows(rows)
+            rows = rows[:count]
+
             if no_framework:
                 rows = [r for r in rows if r["name"] not in _FRAMEWORK_NAMES]