swarph-cli 0.62.0__tar.gz → 0.64.0__tar.gz

{swarph_cli-0.62.0/src/swarph_cli.egg-info → swarph_cli-0.64.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.62.0
+Version: 0.64.0
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT
@@ -148,6 +148,7 @@ swarph guide                      # the whole guide
 swarph guide channels             # one topic
 swarph guide --list               # every topic, with the commands it teaches
 swarph guide --search subscribe   # find a topic by INTENT, not by its name
+swarph guide doctrine             # the standard of evidence a cell is held to (v0.63.0)
 ```
 
 Three ways in, because a new cell does not know which word it has:
@@ -291,9 +292,12 @@ Between-sessions memory pass: **VERIFY · ORGANIZE · ENRICH** against a **CLONE
 ```
 $ swarph dreaming run --corpus ~/.claude/projects/.../memory --out /tmp/dreaming-out
 $ swarph dreaming run --corpus <dir> --out <dir> --verify-only
-$ echo $?   # 0 clean-and-adjudicated | 1 findings | 2 refused | 3 ran-but-adjudicated-nothing
+$ swarph dreaming run --corpus <dir> --out <dir> --notify <cell>
+$ echo $?   # 0 clean-and-adjudicated | 1 findings | 2 refused | 3 ran-but-adjudicated-nothing | 4 notify send failed
 ```
 
+`--notify <cell>` (#937) sends one mesh DM to `<cell>` **only when the finding set changes** (new and cleared findings named, with counts); an unchanged set sends nothing. State lives in `.last-findings.json` beside the `--out` dir and advances only after a successful send, so a failed send (exit 4) retries on the next run.
+
 **Scope is single-cell:** your corpus and your local transcripts. This is not the cross-agent multi-transcript dreaming from the Anthropic talk — that needs a shared transcript surface this release does not claim.
 
 #### The AI Router (why a tool, not a hook)

{swarph_cli-0.62.0 → swarph_cli-0.64.0}/README.md

@@ -100,6 +100,7 @@ swarph guide                      # the whole guide
 swarph guide channels             # one topic
 swarph guide --list               # every topic, with the commands it teaches
 swarph guide --search subscribe   # find a topic by INTENT, not by its name
+swarph guide doctrine             # the standard of evidence a cell is held to (v0.63.0)
 ```
 
 Three ways in, because a new cell does not know which word it has:
@@ -243,9 +244,12 @@ Between-sessions memory pass: **VERIFY · ORGANIZE · ENRICH** against a **CLONE
 ```
 $ swarph dreaming run --corpus ~/.claude/projects/.../memory --out /tmp/dreaming-out
 $ swarph dreaming run --corpus <dir> --out <dir> --verify-only
-$ echo $?   # 0 clean-and-adjudicated | 1 findings | 2 refused | 3 ran-but-adjudicated-nothing
+$ swarph dreaming run --corpus <dir> --out <dir> --notify <cell>
+$ echo $?   # 0 clean-and-adjudicated | 1 findings | 2 refused | 3 ran-but-adjudicated-nothing | 4 notify send failed
 ```
 
+`--notify <cell>` (#937) sends one mesh DM to `<cell>` **only when the finding set changes** (new and cleared findings named, with counts); an unchanged set sends nothing. State lives in `.last-findings.json` beside the `--out` dir and advances only after a successful send, so a failed send (exit 4) retries on the next run.
+
 **Scope is single-cell:** your corpus and your local transcripts. This is not the cross-agent multi-transcript dreaming from the Anthropic talk — that needs a shared transcript surface this release does not claim.
 
 #### The AI Router (why a tool, not a hook)

{swarph_cli-0.62.0 → swarph_cli-0.64.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.62.0"
+version = "0.64.0"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }

{swarph_cli-0.62.0 → swarph_cli-0.64.0}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.62.0"
+__version__ = "0.64.0"
 
 __all__ = ["__version__"]

{swarph_cli-0.62.0 → swarph_cli-0.64.0}/src/swarph_cli/commands/board.py

@@ -390,8 +390,38 @@ def _thread_url(gateway: str, card_id: int, *, limit: Optional[int] = None) -> s
     return f"{base}?limit={limit}" if limit else base
 
 
-def _thread_recipient(card: dict, explicit_to: Optional[str]) -> str:
-    """Who a card-thread post is addressed to. `--to` wins, else the assignee.
+def _project_owner_orchestrator(gw: str, token: str, project_id) -> Optional[str]:
+    """Resolve ``projects.owner_orchestrator`` for a card's project_id.
+
+    >>> THE CARD PAYLOAD DOES NOT CARRY THE OWNER (#864). <<< Measured
+    2026-09-17: GET /board/cards/{id} has assignee/project_id and no owner
+    field; GET /board/projects rows carry ``owner_orchestrator`` (NOT NULL on
+    the server). A second call is required — inventing a sentinel peer is the
+    #259 failure mode this helper exists to avoid.
+    """
+    if project_id is None:
+        return None
+    st, data = _http_get_json(f"{gw.rstrip('/')}/board/projects", token)
+    if st != 200:
+        return None
+    rows = data if isinstance(data, list) else (data or {}).get("projects", [])
+    for row in rows or []:
+        if row.get("id") == project_id or str(row.get("id")) == str(project_id):
+            owner = (row.get("owner_orchestrator") or "").strip()
+            return owner or None
+    return None
+
+
+def _thread_recipient(
+    card: dict,
+    explicit_to: Optional[str],
+    *,
+    owner_orchestrator: Optional[str] = None,
+) -> "tuple[str, str]":
+    """Who a card-thread post is addressed to, and why.
+
+    Order: ``--to`` > card assignee > project ``owner_orchestrator`` (#864).
+    Returns ``(to_node, reason)`` so the confirmation line can name the choice.
 
     >>> RAISES RATHER THAN INVENTING A SENTINEL. <<< POST /messages requires
     exactly one of {to_node, channel}, so a card post needs a real recipient. The
@@ -401,18 +431,21 @@ def _thread_recipient(card: dict, explicit_to: Optional[str]) -> str:
     A placeholder here would manufacture that defect once per card post.
     """
     if explicit_to:
-        return explicit_to
+        return explicit_to, "--to"
     assignee = card.get("assignee")
     if assignee:
-        return assignee
+        return assignee, "card assignee"
+    if owner_orchestrator:
+        return owner_orchestrator, "project owner_orchestrator"
     raise RuntimeError(
-        f"card #{card.get('id')} has no assignee, so there is no default recipient "
-        f"for a thread post — pass --to <peer>. (A card post is still a DM on the "
-        f"wire; it needs someone to be addressed to.)"
+        f"card #{card.get('id')} has no assignee and project owner_orchestrator "
+        f"is unresolvable, so there is no default recipient for a thread post — "
+        f"pass --to <peer>. (A card post is still a DM on the wire; it needs "
+        f"someone to be addressed to.)"
     )
 
 
-def _say_line(resp: dict, card_id, to_node: str) -> str:
+def _say_line(resp: dict, card_id, to_node: str, *, reason: Optional[str] = None) -> str:
     """The post confirmation — AND any obligation the post just DISCHARGED.
 
     >>> THE GATEWAY ALREADY SAID SO AND THIS CLI THREW IT AWAY. <<< POST
@@ -435,7 +468,11 @@ def _say_line(resp: dict, card_id, to_node: str) -> str:
     POLICY (that is #562's own question) -- it is the fix for the holder not
     being told, which is what made six hours of divergence possible.
     """
-    line = f"posted id={resp.get('id')} onto card #{card_id} (to {to_node})"
+    if reason:
+        line = (f"posted id={resp.get('id')} onto card #{card_id} "
+                f"(to {to_node}; {reason})")
+    else:
+        line = f"posted id={resp.get('id')} onto card #{card_id} (to {to_node})"
     closed = resp.get("closed_obligations") or []
     if closed:
         ids = ", ".join(f"#{i}" for i in closed)
@@ -855,7 +892,8 @@ def _build_parser() -> argparse.ArgumentParser:
     add_content_args(cy)
     cy.add_argument("--kind", default="fyi", help="status|question|answer|unblock|fyi")
     cy.add_argument("--to", dest="to_node", default=None,
-                    help="recipient peer (default: the card's assignee)")
+                    help="recipient peer (default: card assignee, else project "
+                         "owner_orchestrator; refused if neither resolves)")
     _add_common(cy)
 
     ck = cards.add_parser(
@@ -1278,8 +1316,15 @@ def run_board(argv: list[str]) -> int:
                       f"(it predates #181a). Run scripts/migrate_card_threads.py on "
                       f"the gateway host.", file=sys.stderr)
                 return 1
+            # #864: card GET has no owner field — only fetch projects when the
+            # cheaper defaults (explicit --to, card assignee) are absent.
+            owner = None
+            if not args.to_node and not card.get("assignee"):
+                owner = _project_owner_orchestrator(gw, token, card.get("project_id"))
             try:
-                to_node = _thread_recipient(card, args.to_node)
+                to_node, reason = _thread_recipient(
+                    card, args.to_node, owner_orchestrator=owner,
+                )
             except RuntimeError as exc:
                 print(f"swarph board cards say: {exc}", file=sys.stderr)
                 return 1
@@ -1293,7 +1338,9 @@ def run_board(argv: list[str]) -> int:
             # explicit `propose` grant. `_out` passes `detail` through whole; it does
             # not need help, and a second copy of that logic is a second thing to
             # keep in sync.
-            return _out(st, d, lambda x: _say_line(x, args.id, to_node), aj)
+            return _out(
+                st, d, lambda x: _say_line(x, args.id, to_node, reason=reason), aj,
+            )
         if args.command == "ready":
             st, d = _patch_json(f"{gw}/board/cards/{args.id}", {"actor": self_name, "move_ready": not args.clear}, token)
             return _out(st, d, lambda x: f"card #{x.get('id')} move_ready -> {x.get('move_ready')}", aj)

{swarph_cli-0.62.0 → swarph_cli-0.64.0}/src/swarph_cli/commands/codegraph.py

@@ -37,12 +37,65 @@ import sys
 from swarph_cli.commands.codegraph_hook import _match_quality
 
 DEFAULT_INDEX = os.path.expanduser("~/.swarph/codegraph/index.db")
-# NOTE: named DEFAULT_CALLER_CELL, not "*_CALLER" — this is an A8 caller-CELL
-# identity (sensitivity-gate scoping), not a SwarphCall `role.subrole.specific`
-# caller tag, and must NOT trip the repo-wide caller-convention meta-guard
-# (tests/test_caller_meta_guard.py) which validates every `*_CALLER` constant
-# against that unrelated dotted-slug convention.
-DEFAULT_CALLER_CELL = "lab-ovh"
+# >>> THERE IS NO DEFAULT IDENTITY ANY MORE. THIS CONSTANT IS GONE ON PURPOSE. <<<
+#
+# It used to read `DEFAULT_CALLER_CELL = "lab-ovh"`, and that one line meant every
+# unconfigured caller on lab-ovh queried with the ORCHESTRATOR'S READ AUTHORITY.
+#
+# MEASURED 2026-09-18 (science-claude, mesh 43183/43186/43188). The gateway was never
+# bypassed and nothing was ever spoofed: `_query_via_gateway` sends NO caller field, so
+# the server binds identity from the bearer token, correctly. What the default did was
+# pick WHICH REAL TOKEN got presented — `_resolve_token(self_name, ...)` reads the file
+# that name points at. A cell asking a question on this box authenticated AS lab-ovh,
+# with lab-ovh's genuine credential, and got a full, plausible, correctly-authorised
+# answer belonging to somebody else.
+#
+# >>> A WRONG-IDENTITY WRITE ANNOUNCES ITSELF — a DM arrives signed by the wrong cell
+# and someone notices. A WRONG-IDENTITY READ ANNOUNCES NOTHING. <<< It was found only
+# because a repo its owner KNEW they owned was missing from their own results.
+#
+# WHY REFUSE RATHER THAN WARN (commander, 2026-09-18 04:44Z): a warning on a read that
+# returns a correct-looking answer is a line of text above a result the caller already
+# believes. And the cost of refusing was measured first, not assumed — of 8 executable
+# `swarph` invocations in systemd + cron on lab-ovh, 7 already pass `--as` or
+# `--token-file`, and the 8th (`monitor reexec-on-change`) cannot authenticate at all:
+# no --gateway, no --token-file, no --as exists on that verb. SCHEDULED WORK BREAKS IN
+# ZERO PLACES. The population that pays is interactive use, which is the population
+# that was silently mis-attributed.
+#
+# $SWARPH_SELF STILL WORKS AND IS THE INTENDED PATH. It is a DECLARED identity. What is
+# refused is the *undeclared* case, where a package-level guess stood in for one.
+IDENTITY_UNSET = object()  # sentinel: argparse default when --caller-cell is omitted
+
+
+class IdentityNotDeclared(RuntimeError):
+    """No caller identity was declared and there is no default to fall back to."""
+
+
+def require_caller_cell(explicit=None, *, verb: str) -> str:
+    """Resolve the caller cell, or REFUSE.
+
+    Order: explicit flag -> $SWARPH_SELF -> $SWARPH_CELL -> refuse.
+
+    The refusal names the verb and every way to satisfy it, because an error that
+    says only "identity unset" moves the work to the reader.
+    """
+    if explicit not in (None, IDENTITY_UNSET) and str(explicit).strip():
+        return str(explicit).strip()
+    for var in ("SWARPH_SELF", "SWARPH_CELL"):
+        v = (os.environ.get(var) or "").strip()
+        if v:
+            return v
+    raise IdentityNotDeclared(
+        f"swarph {verb}: NO CALLER IDENTITY DECLARED, and there is no default.\n"
+        f"  This used to fall back to 'lab-ovh', which meant an undeclared caller\n"
+        f"  queried with that cell's read authority and got somebody else's answer.\n"
+        f"  Declare one of:\n"
+        f"    --caller-cell <cell>      for this invocation\n"
+        f"    SWARPH_SELF=<cell>        for this shell or unit\n"
+        f"    SWARPH_CELL=<cell>        (MCP hosts)\n"
+        f"  It is NOT guessable: this box hosts several cells under one uid."
+    )
 
 # NOT 1 and NOT 2. A distinct code so "nothing was searched" can never be confused
 # with a crash or a usage error, and so a caller can branch on it specifically.
@@ -332,7 +385,7 @@ def _query_via_gateway(gateway: str, query: str, limit: int, token_file):
     from swarph_cli.commands.mesh import _post_json, _resolve_token  # local import: keeps
     # the local-only path free of any mesh dependency, so an offline cell still works.
 
-    self_name = os.environ.get("SWARPH_SELF") or DEFAULT_CALLER_CELL
+    self_name = require_caller_cell(verb="codegraph")
     token = _resolve_token(self_name, token_file)
     body = {"query": query, "limit": max(1, min(int(limit), 25))}
     status, payload = _post_json(gateway.rstrip("/") + "/codegraph", body, token)
@@ -352,7 +405,9 @@ def run_codegraph(argv) -> int:
                     "is configured (the server searches and returns the answer); falls back to a local index.")
     ap.add_argument("query", help="natural-language query, e.g. 'which function escapes HTML'")
     ap.add_argument("--index", default=DEFAULT_INDEX, help=f"index db (default {DEFAULT_INDEX})")
-    ap.add_argument("--caller-cell", default=DEFAULT_CALLER_CELL, help="A8 caller identity (default lab-ovh)")
+    ap.add_argument("--caller-cell", default=IDENTITY_UNSET,
+                    help="A8 caller identity. NO DEFAULT — else $SWARPH_SELF / $SWARPH_CELL, "
+                         "else the command REFUSES rather than guessing (it used to guess lab-ovh).")
     ap.add_argument("--limit", type=int, default=8)
     ap.add_argument("--json", action="store_true", help="machine-readable JSON output")
     ap.add_argument("--gateway", default=None,

{swarph_cli-0.62.0 → swarph_cli-0.64.0}/src/swarph_cli/commands/codegraph_hook.py

@@ -37,6 +37,10 @@ from swarph_cli.gateway_default import env_gateway
 
 TIMEOUT_S = 6
 MAX_ROWS = 6
+# Probe one past the display cap so audit can tell "exactly 6" from "hit the
+# clamp" (#825 / lab 48145: 90.5% of rows sat on match_count==6 because the
+# query limit WAS the count).
+_PROBE_LIMIT = MAX_ROWS + 1
 
 # Identifier token — used for prompt terms and for the Bash shred skip (no
 # useful symbol-shaped token left after cleaning).
@@ -89,6 +93,12 @@ def extract_raw_and_cleaned(cmd: str) -> Optional[tuple[str, str]]:
         if tok.startswith("-"):
             continue
         raw = tok.strip("'\"")
+        # Prefer the longest identifier STILL VISIBLE in the raw pattern
+        # before the shredding re.sub (#825). `foo_bar.*[0-9]+` must yield
+        # `foo_bar`, not skip-as-shredded or query regex debris.
+        idents = [t for t in _IDENT_TOKEN.findall(raw) if len(t) >= 3]
+        if idents:
+            return (raw, max(idents, key=len))
         cleaned = re.sub(r"[^\w\s.]", " ", raw).strip()
         if not cleaned:
             return None
@@ -308,7 +318,8 @@ def resolve_pending_outcome(self_name: str, subsequent: str,
 
 # ── gateway query ─────────────────────────────────────────────────────────
 
-def query_gateway(term: str, gateway: str, token: str, limit: int = MAX_ROWS) -> dict:
+def query_gateway(term: str, gateway: str, token: str,
+                   limit: int = _PROBE_LIMIT) -> dict:
     if not (gateway or "").strip():
         return {"error": "MESH_GATEWAY_URL is not set and swarph ships no default "
                          "gateway host (#578) — the graph was never asked"}
@@ -411,6 +422,9 @@ def _query_and_emit(self_name: str, gateway: str, term: str, *,
         return
     env = query_gateway(term, gateway, token)
     rows = env.get("results") or [] if "error" not in env else []
+    capped = len(rows) > MAX_ROWS
+    # Audit sees the probe length (MAX_ROWS+1 ⇒ at-least / capped). Display
+    # still truncates via render()'s rows[:MAX_ROWS].
     name_hit = any_symbol_name_contains_term(term, rows) if rows else False
     fid = firing_id or str(uuid.uuid4())
     write_audit(self_name, {
@@ -424,13 +438,22 @@ def _query_and_emit(self_name: str, gateway: str, term: str, *,
         "raw_term": raw_term or term,
         "skipped": False,
         "match_count": len(rows),
+        "match_count_capped": capped,
         "any_name_contains_term": name_hit,
         "error": env.get("error"),
     })
     if trigger == "prompt":
         register_pending_firing(self_name, fid, session_id)
+    # Render only the display window so the prompt is not flooded.
+    if capped and "error" not in env:
+        env = {**env, "results": rows[:MAX_ROWS], "match_count_capped": True}
     text = render(term, env)
     if text:
+        if capped:
+            text = text.rstrip() + (
+                f"\n  (display capped at {MAX_ROWS}; audit match_count="
+                f"{len(rows)} match_count_capped=true)"
+            )
         _emit(text, event_name)
 
 

{swarph_cli-0.62.0 → swarph_cli-0.64.0}/src/swarph_cli/commands/dreaming.py

@@ -67,6 +67,12 @@ def _build_parser() -> argparse.ArgumentParser:
         help="require enrich; refuse (rc=2) if SLM client unavailable (#734)",
     )
     run.add_argument("--verify-only", action="store_true", help="verify only; skip organize/enrich")
+    run.add_argument(
+        "--notify",
+        default=None,
+        metavar="CELL",
+        help="DM CELL when the finding set changes; no DM when it is unchanged (#937)",
+    )
     return p
 
 
@@ -95,4 +101,6 @@ def run_dreaming(argv: list[str] | None = None) -> int:
         forwarded.append("--enrich")
     if args.verify_only:
         forwarded.append("--verify-only")
+    if getattr(args, "notify", None):
+        forwarded.extend(["--notify", args.notify])
     return dreaming_run.main(forwarded)

{swarph_cli-0.62.0 → swarph_cli-0.64.0}/src/swarph_cli/commands/guide.py

@@ -130,6 +130,38 @@ def _commands_in(section: str) -> "list[str]":
     return out
 
 
+def verbs_in_guide(topics: "dict[str, str] | None" = None) -> "set[str]":
+    """#547: the verbs the guide TEACHES, counted PER VERB (a topic count said 11 and
+    meant nothing). A verb is covered when some section's commands include it."""
+    topics = topics if topics is not None else _split_topics(_load_guide())
+    out: set[str] = set()
+    for body in topics.values():
+        for cmd in _commands_in(body):
+            parts = cmd.split()
+            if len(parts) >= 2:
+                out.add(parts[1])
+    return out
+
+
+def _registry() -> "list[str]":
+    # Lazy: main dispatches handlers by dotted path and does not import this module,
+    # but keep the direction one-way anyway.
+    from swarph_cli.main import registered_verbs
+    return registered_verbs()
+
+
+def _verb_entry(topics: "dict[str, str]", verb: str) -> "list[tuple[str, str]]":
+    """The line in each topic that teaches `swarph <verb>` -- one per topic, first hit."""
+    pat = re.compile(r"`swarph " + re.escape(verb) + r"(?:[ `])")
+    hits: list[tuple[str, str]] = []
+    for name, body in topics.items():
+        for raw in body.splitlines():
+            if pat.search(raw):
+                hits.append((name, raw.strip()))
+                break
+    return hits
+
+
 _TERM_RE = re.compile(r"\*\*(.+?)\*\*")
 
 
@@ -262,13 +294,21 @@ def run_guide(argv: "list[str]") -> int:
         # `apropos`: an LLM arrives with an INTENT ("subscribe to updates"), not the
         # topic's name ("channels"). Requiring the name is the #520 discovery defect
         # reproduced inside its own fix.
+        term = args.search.strip().lower()
+        # #547: a VERB name resolves to the verb's own entry first -- `--search highlight`
+        # used to answer with a topic list that did not contain it.
+        verb_hits = _verb_entry(topics, term) if term in _registry() else []
         hits = _search(topics, args.search)
-        if not hits:
+        if not hits and not verb_hits:
             print_safe(f"swarph guide: nothing matches {args.search!r}. "
                        f"Topics: {', '.join(topics)}", stream=sys.stderr)
             return 2
-        for name, line in hits:
+        for name, line in verb_hits:
             print_safe(f"{name:<22} {line}")
+        shown = {name for name, _ in verb_hits}
+        for name, line in hits:
+            if name not in shown:
+                print_safe(f"{name:<22} {line}")
         return 0
 
     if not args.topic:
@@ -279,6 +319,19 @@ def run_guide(argv: "list[str]") -> int:
     if key in topics:
         print_safe(topics[key])
         return 0
+    if key in _registry():
+        # #547: every registered verb resolves, per verb (tests/test_547 pins the set):
+        # the lines that teach it, then -- when the name is also a topic's substring
+        # (`channel` -> channels) -- that one topic, as before.
+        for name, line in _verb_entry(topics, key):
+            print_safe(f"{name:<22} {line}")
+        near = [k for k in topics if key in k]
+        if len(near) == 1:
+            print_safe("")
+            print_safe(topics[near[0]])
+        else:
+            print_safe(f"\n  more:  swarph {key} --help")
+        return 0
 
     # Substring fallback before failing: `swarph guide channel` should find `channels`.
     hits = [k for k in topics if key in k]

{swarph_cli-0.62.0 → swarph_cli-0.64.0}/src/swarph_cli/commands/hooks.py

@@ -1005,36 +1005,47 @@ def uninstall_hook(
     return 0
 
 
-def _is_installed(settings: dict, command: str, bundle: HookBundle) -> bool:
-    """True when ALL of ``bundle``'s bindings' commands are present in settings."""
+def _event_binding_present(
+    settings: dict, command: str, binding: HookBinding,
+) -> bool:
+    """True when one specific event/matcher carries our command."""
     hooks = settings.get("hooks")
     if not isinstance(hooks, dict):
         return False
+    event_list = hooks.get(binding.event)
+    if not isinstance(event_list, list):
+        return False
+    _known = _command_variants_for(command)
+    for entry in event_list:
+        if entry.get("matcher", "") != binding.matcher:
+            continue
+        return any(a.get("command") in _known for a in entry.get("hooks", []))
+    return False
+
+
+def binding_coverage(
+    settings: dict, command: str, bundle: HookBundle,
+) -> tuple[list[str], list[str]]:
+    """Return (present_events, missing_events) for ``bundle``'s bindings (#825).
+
+    A PostToolUse-only install of codegraph-on-grep used to report as plain
+    ``available`` (not installed) while still firing 400 times — the steering
+    half unbound and invisible. Coverage makes PARTIAL legible.
+    """
+    present, missing = [], []
     for b in bundle.bindings:
-        event_list = hooks.get(b.event)
-        if not isinstance(event_list, list):
-            return False
-        found = False
-        for entry in event_list:
-            if entry.get("matcher", "") == b.matcher:
-                # #216 review (Copilot, 2nd pass): THE THIRD SITE. Exact
-                # matching here makes a LEGACY backslash binding read as NOT
-                # INSTALLED, so a Windows cell's real, working hooks list as
-                # "unavailable" — the operator is told nothing is installed
-                # while the bindings sit right there in settings.json.
-                # The previous commit said "one helper, BOTH callers". There
-                # were THREE. A rule applied at N-1 sites is the defect this
-                # class keeps producing, and it produced it again inside the
-                # fix for it.
-                _known = _command_variants_for(command)
-                if any(
-                    a.get("command") in _known for a in entry.get("hooks", [])
-                ):
-                    found = True
-                break
-        if not found:
-            return False
-    return True
+        label = b.event if not b.matcher else f"{b.event}:{b.matcher}"
+        if _event_binding_present(settings, command, b):
+            present.append(label)
+        else:
+            missing.append(label)
+    return present, missing
+
+
+def _is_installed(settings: dict, command: str, bundle: HookBundle) -> bool:
+    """True when ALL of ``bundle``'s bindings' commands are present in settings."""
+    present, missing = binding_coverage(settings, command, bundle)
+    return bool(present) and not missing
 
 
 def list_hooks(
@@ -1045,8 +1056,10 @@ def list_hooks(
 ) -> int:
     """List builtin hooks with install status. One greppable line per builtin::
 
-        name  [installed|available]  trust=builtin  — description
+        name  [installed|partial|available]  trust=builtin  — description
 
+    ``partial`` (#825): at least one binding present but not the full set —
+    the lab-ovh codegraph case (PostToolUse only, UserPromptSubmit/Stop absent).
     When installed and the script carries a ``swarph-cli-bundle-version`` stamp
     (#830), a second line reports match / mismatch vs the running package.
     """
@@ -1054,14 +1067,26 @@ def list_hooks(
     hooks_home_p = Path(hooks_home).expanduser()
     for name in sorted(BUILTIN_HOOKS):
         bundle = BUILTIN_HOOKS[name]
-        command = _installed_command(bundle, hooks_home)
-        # Read side of the same ladder: a legacy install reported as "available"
-        # invites the reinstall that produces a DUPLICATE binding.
-        status = ("installed"
-                  if any(_is_installed(settings, c, bundle)
-                         for c in _installed_command_variants(bundle, hooks_home))
-                  else "available")
+        variants = _installed_command_variants(bundle, hooks_home)
+        # Pick the first variant that has ANY binding coverage for reporting.
+        present: list[str] = []
+        missing: list[str] = [b.event for b in bundle.bindings]
+        for c in variants:
+            p, m = binding_coverage(settings, c, bundle)
+            if len(p) > len(present):
+                present, missing = p, m
+        if present and not missing:
+            status = "installed"
+        elif present and missing:
+            status = "partial"
+        else:
+            status = "available"
         out(f"{name}  [{status}]  trust=builtin  — {bundle.description}")
+        if status == "partial":
+            out(f"  bindings present: {', '.join(present) or '(none)'}")
+            out(f"  bindings MISSING: {', '.join(missing)}  "
+                f"— re-run: swarph hooks add {name}  (#825 fleet bind)")
+            continue
         if status != "installed":
             continue
         script = (hooks_home_p / bundle.script_name).expanduser()

{swarph_cli-0.62.0 → swarph_cli-0.64.0}/src/swarph_cli/commands/mcp_server.py

@@ -151,7 +151,8 @@ def _codegraph_query(query: str, *, limit: int = 8) -> list[dict]:
 
     Delegates to :func:`codegraph.structural_query` against the module-level
     ``_CODEGRAPH_INDEX`` path, using ``SWARPH_CELL`` (else
-    ``codegraph.DEFAULT_CALLER_CELL``) as the A8 caller identity and the
+    ``codegraph.require_caller_cell``, which REFUSES rather than defaulting) as
+    the A8 caller identity and the
     default operate-what-you-own allowlist (``allowlist=None``).
 
     NEVER raises — any exception (missing index, corrupt db, bad query, or
@@ -162,7 +163,13 @@ def _codegraph_query(query: str, *, limit: int = 8) -> list[dict]:
     to keep the tool output tight for the calling agent.
     """
     try:
-        caller_cell = os.environ.get("SWARPH_CELL", codegraph.DEFAULT_CALLER_CELL)
+        # NO DEFAULT IDENTITY (2026-09-18). `codegraph.DEFAULT_CALLER_CELL` is gone;
+        # an undeclared caller used to become lab-ovh and receive that cell's read
+        # authority. require_caller_cell raises IdentityNotDeclared, which the
+        # NEVER-RAISES contract below turns into an empty result — FAIL-CLOSED: the
+        # MCP host gets nothing rather than somebody else's answer.
+        caller_cell = codegraph.require_caller_cell(
+            os.environ.get("SWARPH_CELL"), verb="mcp codegraph_query")
         rows = codegraph.structural_query(
             query,
             index_path=_CODEGRAPH_INDEX,