witan-code 0.15.0__tar.gz → 0.16.0__tar.gz

{witan_code-0.15.0 → witan_code-0.16.0}/.gitignore

@@ -36,3 +36,6 @@ mcp-server.log
 
 # agent-config-kit remote skill/hook fetch cache
 .agent-config-kit-cache/
+
+# Zensical build output for the witan-context docs site.
+site/

{witan_code-0.15.0 → witan_code-0.16.0}/CHANGELOG.md

@@ -6,6 +6,150 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/) (pre-1.0:
 a MINOR bump may include breaking changes).
 
+## [Unreleased]
+
+### Fixed
+
+- **A failed cross-repo bridge write is reported instead of swallowed.** The
+  production bridge wedged for ~15 hours on 2026-08-25 and nothing said so:
+  every CI cycle logged the failure, printed `bindings=0 errors=0`, exited 0,
+  and raised no Sentry issue. Two independent causes.
+
+  The site logged at `warning`. `configure_sentry` installs
+  `LoggingIntegration(event_level=ERROR)` so a call site needs no
+  `capture_exception`, which makes the level the entire mechanism — and by that
+  contract a warning declares the failure "expected and already handled". A
+  throwing bridge write is neither. It logs at `error` now; verified end to end
+  against a recording transport (warning → 0 events, error → 1 issue with the
+  exception attached).
+
+  Sentry was also never initialised on that path: `configure_observability()`
+  ran only in `serve`, and the CI indexer runs `witan code index`. It now runs
+  in the CLI's meta launcher for every command, with `instrument=False` to keep
+  the OTel auto-instrumentors out of a short-lived CLI. Everything there no-ops
+  without its env var, so a developer with no `SENTRY_DSN` pays nothing.
+
+  The failure is now counted (`errors`) and flagged (`bridge=FAILED` in the
+  summary). `bindings=0` previously meant both "nothing to write" and "the
+  write threw". Deliberately still non-fatal — the per-repo index succeeds and
+  is worth keeping — but "non-fatal" and "unreported" are different claims.
+
+
+- **The test suite no longer asserts an environment.** Four tests
+  (`test_branches.py`'s three branch-view assertions and
+  `test_graph.py::test_a_shared_branch_view_needs_an_identity_to_own_it`)
+  failed on any machine whose `witan login` had resolved an actor, and passed
+  in CI, where a GitHub runner has none. They asserted un-namespaced view
+  names and the logged-out refusal prose — the shape identity resolution
+  happens to take when there is no identity — because nothing stopped
+  `identity.actor_id()` from reading the real `~/.config/witan/config.toml`
+  and OIDC token cache.
+
+  The `_fresh_identity` fixture now points `WITAN_CONFIG` and
+  `WITAN_TOKEN_CACHE` at `tmp_path` and clears the four env vars that
+  short-circuit ahead of them, so logged-out is deterministic everywhere. A
+  new `logged_in_actor` fixture opts back in through `WITAN_ACTOR`, and
+  `test_a_logged_in_writer_owns_the_views_it_indexes` uses it to cover the
+  half of `witan_code.views` a CI runner cannot reach: on a logged-in machine
+  the views carry their owner, on the local store too.
+
+### Changed
+
+- **`graph.check_writable` requires `actor`; `None` now means "no identity",
+  full stop.** It used to fall back to `identity.actor_id()`, which gave the
+  parameter two meanings depending on the caller. Every call site
+  (`indexer`, `bridge`, `ingest`) already resolves an actor — it needs one to
+  *name* the view it is about to write — so nothing relied on the fallback,
+  and for `ingest` it was wrong: a request arriving with no actor was judged
+  against the serving process's identity rather than being refused for having
+  none.
+
+## [0.16.0] - 2026-08-25
+
+### Added
+
+- **`witan-code doctor` and the `code_store_health` tool — a readiness check
+  that covers the bridge store.** Every per-repo graph *and* the shared
+  `_bridge.omni`, probed with the cheapest query that has to open a store to
+  answer. The bridge is the point: it belongs to no repo, so it appears in no
+  repo listing, and `code_interface_search` / `code_interface_providers` /
+  `code_interface_consumers` / `code_cross_repo_impact` all read it and
+  nothing else does. A bridge that cannot be opened breaks all of them while
+  `code_indexed_repos` still lists every repo happily.
+
+  That is not hypothetical. On the machine this was written on, all 54 local
+  stores had been unreadable since an omnigraph upgrade — the bridge for six
+  weeks — and nothing reported it: the failure surfaced only as an identical
+  Rust backtrace per tool call, and the prompt hook went on asserting
+  "N other repos indexed, so cross-repo `code_interface_*` resolve" on every
+  single prompt while none of them could run.
+
+- **`witan-code reindex --rebuild`.** Deletes this repo's store, and the
+  bridge store if it is also unreadable, then indexes from scratch. Only the
+  stores that actually fail to open: `--rebuild` on a healthy store would
+  throw away a working index, and dropping a healthy bridge would take every
+  other repo's cross-repo bindings with it.
+
+  Deliberately not witan's `migrate storage` shape (export with the
+  pre-upgrade binary, reload with the new one, keep a `.pre-migrate` copy). A
+  memory graph holds the only copy of what it knows; a code graph holds a
+  derivation of a checkout that is still on disk. So this needs no old binary
+  and keeps no backup — a copy no installed binary can open is just disk, and
+  one of these stores is 27 GB.
+
+  Refuses a path that is not the repo root, since it deletes the whole store:
+  `reindex src/ --rebuild` would empty the store and refill only `src/`,
+  leaving the rest of the repo unindexed with nothing afterwards reporting it.
+  The root is resolved from the parent directory when the path is a FILE —
+  `index`/`reindex` accept one, and `git -C <file>` exits 128, which read as
+  "not a repo" and skipped the guard on the argument shape most likely to be
+  typed by accident.
+
+  A failed deletion raises instead of being swallowed. `ignore_errors=True`
+  left an unreadable store in place while the sidecars went anyway and the CLI
+  printed "Deleted … (N freed)", announcing a recovery that had not happened.
+
+### Changed
+
+- **A stale on-disk format now fails with a remedy instead of a Rust
+  backtrace.** witan-code's `OmnigraphClient` sets the `_STORAGE_MISMATCH_HINT`
+  that witan-core has always supported and witan has always set; without it
+  the client re-raised omnigraph's raw error — ANSI escapes, `Location:`,
+  backtrace boilerplate — once per tool call, advising an export path that
+  needs a binary the upgrade replaced.
+
+- **`code_indexed_repos` distinguishes "unreadable" from "empty".** New
+  `unreadable` field carrying the reason; `files` stays `null`. The two used
+  to render identically, so a code graph that had been dead for weeks read as
+  a repo nobody had indexed much.
+
+- **The `UserPromptSubmit` block no longer claims cross-repo resolution works
+  without checking.** It probes the bridge and says plainly when
+  `code_interface_*` will fail. A store the current repo cannot read replaces
+  the size/freshness line with a warning rather than rendering "? files" —
+  unless an index is in flight, which is the one benign way to see a store
+  that will not open yet.
+
+  The verdict is cached on disk, not in the process: `witan-code
+  inject-context` is a fresh process per prompt, so a module-level memo would
+  cache nothing and the block would cost a second store query on every prompt.
+
+  The bridge is probed with `bridge.gq/count_bindings`, not the per-repo
+  `code_read.gq/count_files` — the bridge schema has no `CodeFile` node, so
+  the per-repo probe condemns a perfectly healthy bridge. That is not a
+  cosmetic misreport, because `--rebuild` keys off the same verdict: it was
+  caught deleting each freshly-rebuilt bridge on the very next repo of a
+  rebuild sweep, taking every other repo's bindings with it each time.
+
+  A REMOTE bridge is always probed rather than gated on `StoreRef.exists`,
+  which degrades every failed remote probe to `False` by design. Gating on it
+  dropped an unreachable cluster bridge out of the report entirely and let
+  `code_store_health` answer `ok: true` while every `code_interface_*` tool
+  was failing — the exact condition the check exists to detect. A missing
+  LOCAL bridge is still absence, not failure: a repo with no contracts yet has
+  none, and reporting that as red would fail a healthy fresh install. The
+  prompt hook's own bridge probe carried the same defect and is fixed with it.
+
 ## [0.15.0] - 2026-08-21
 
 ### Changed

{witan_code-0.15.0 → witan_code-0.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: witan-code
-Version: 0.15.0
+Version: 0.16.0
 Summary: witan-code — tree-sitter code graph + cross-repo bridge (mounts under `witan code`)
 Project-URL: Homepage, https://github.com/mitodl/agent-kit/tree/main/mcp/servers/witan-code
 Project-URL: Repository, https://github.com/mitodl/agent-kit
@@ -41,13 +41,13 @@ repository's symbols (functions, methods, classes, modules) and their
 relationships, then exposes definition / reference / caller / impact queries to
 the agent.
 
-It is a self-contained sibling of `witan` (Layer 1) and shares its
-subprocess/CLI conventions, but stores a **separate, per-repo, local-only**
-graph.
+It is a sibling of `witan` (Layer 1) — it never imports it, though both build on
+`witan-core` — and shares its subprocess/CLI conventions, but stores a
+**separate, per-repo** graph rather than writing into Layer 1's.
 
 > **Wiring it into your agents locally** (MCP server, the `PostToolUse` reindex
 > hook, and the indexer CLI, run straight from your checkout): see
-> [Local Development Setup](../../../docs/agent-memory.md#local-development-setup).
+> [Local Development Setup](../../../docs/internals/agent-memory.md#local-development-setup).
 
 ## When to use this vs. grep / the `Explore` agent
 
@@ -70,7 +70,14 @@ resolution, not a true call graph) — see
 | Layer | Server | Stores | Scope | Synced |
 |------|--------|--------|-------|--------|
 | 1 | `witan` | patterns, project facts, lessons, workflow traces | team-wide | yes (S3) |
-| 2 | `witan-code` | code symbols + edges | per-repo | **no — local only** |
+| 2 | `witan-code` | code symbols + edges | per-repo | local by default; shareable |
+
+Layer 2 was local-only originally and is no longer. A code graph can live on a
+shared `omnigraph-server` (`WITAN_CODE_SERVER` in-cluster, or through the
+deployed witan MCP tier from outside it), where a CI indexer owns each repo's
+default `main` view and every other writer gets its own per-actor branch view.
+On a local store there is one user, who is its writer, and none of that
+arbitration applies. See [`docs/BRANCH_INDEXING.md`](docs/BRANCH_INDEXING.md).
 
 The two layers compose through **soft symbol-ID references**. A Layer-1 node
 (e.g. a `lesson` or `agent_context`) can record symbol ids of the form:
@@ -115,7 +122,7 @@ The per-repo graph stops at a repo boundary, but service-oriented architectures
 couple repos through **shared contracts**: an env var that infra sets and an app
 reads, an HTTP endpoint one service serves and another calls, a package one repo
 publishes and others import. The bridge records these as **interface bindings**
-in a single shared, local-only store (`_bridge.omni`, a sibling of the per-repo
+in a single shared store (`_bridge.omni` locally, a sibling of the per-repo
 stores) so linkages can be queried across every indexed repo.
 
 It is **zero-config**: every `index`/reindex of a repo also extracts that repo's
@@ -519,8 +526,9 @@ graph):
 
 | Tool | Returns |
 |------|---------|
-| `code_indexed_repos()` | every indexed repo with file count, size, and last-indexed timestamp |
+| `code_indexed_repos()` | every indexed repo with file count, size, and last-indexed timestamp; `files: null` + `unreadable: <why>` for a store no `code_*` tool can query |
 | `code_indexed_branches(branch=None)` | the in-flight branch views each repo's store carries, and who owns each; pass a git branch to see every writer's view of it |
+| `code_store_health()` | whether every code graph opens — per-repo **and the bridge**; the readiness check to run before reading an empty result as "nothing found" (see [Rebuilding an unreadable store](#rebuilding-an-unreadable-store)) |
 
 ## CLI
 
@@ -529,7 +537,12 @@ graph):
 - `setup [--dry-run]` — fetch the pinned omnigraph binary to `~/.local/bin/`
   for standalone use (see [Install](#install)).
 - `index [PATH]` — incremental; skips files whose content hash is unchanged.
-- `reindex [PATH]` — force rebuild a path.
+- `reindex [PATH] [--rebuild] [--yes]` — force rebuild a path. `--rebuild`
+  first deletes this repo's store, and the bridge store, *if they cannot be
+  read* — see [Rebuilding an unreadable store](#rebuilding-an-unreadable-store).
+- `doctor` — check that every code graph opens: each per-repo store **and the
+  shared bridge store**, which belongs to no repo and so appears in no other
+  listing. Exits non-zero if any is unreadable, so it works as a check.
 - `repos` — list all indexed repos with file count, symbol count, and store size.
 - `branches [--branch B] [--prune]` — list the in-flight branch views per
   store; `--branch` shows every writer's view of one git branch (how you find
@@ -628,6 +641,38 @@ mechanisms keep this in check, mirroring that module (deliberately duplicated
   `cleanup` GCs old Lance versions to reclaim disk and is destructive, so it
   requires `--yes`.
 
+## Rebuilding an unreadable store
+
+omnigraph uses strict single-version storage: a release that bumps the
+on-disk format refuses to open a graph an older binary wrote (`__manifest is
+stamped at internal schema vN, but this omnigraph reads only vM`). Every
+`code_*` read against such a store errors, permanently, until it is rebuilt.
+
+`witan-code doctor` is how you find out. It probes every per-repo store **and
+the bridge store**, which is the one that goes unwatched: it belongs to no
+repo, so it is in no repo listing, and `code_interface_search` /
+`code_interface_providers` / `code_interface_consumers` /
+`code_cross_repo_impact` all read it and nothing else does. A bridge that
+cannot be opened breaks all of those while every per-repo listing still looks
+healthy.
+
+The fix is **not** witan's `witan migrate storage` (export with the
+pre-upgrade binary, reload with the new one). A code graph is *derived* from a
+checkout that is still on disk, so reindexing rebuilds it from source and
+needs no old binary:
+
+```console
+witan-code doctor                    # which stores, and why
+witan-code reindex --rebuild         # from each affected checkout
+```
+
+`--rebuild` deletes only the stores it could not read — this repo's, and the
+bridge if it is unreadable too — then indexes from scratch. Nothing is kept
+aside: a copy no installed binary can open is just disk. Dropping the bridge
+does cost every *other* repo's cross-repo bindings, and each restores its own
+on its next index, so a machine with many indexed repos wants a
+`witan-code reindex --rebuild` pass over each checkout it cares about.
+
 ## Skill
 
 [`witan_code/skills/witan-code/SKILL.md`](witan_code/skills/witan-code/SKILL.md)

{witan_code-0.15.0 → witan_code-0.16.0}/README.md

@@ -8,13 +8,13 @@ repository's symbols (functions, methods, classes, modules) and their
 relationships, then exposes definition / reference / caller / impact queries to
 the agent.
 
-It is a self-contained sibling of `witan` (Layer 1) and shares its
-subprocess/CLI conventions, but stores a **separate, per-repo, local-only**
-graph.
+It is a sibling of `witan` (Layer 1) — it never imports it, though both build on
+`witan-core` — and shares its subprocess/CLI conventions, but stores a
+**separate, per-repo** graph rather than writing into Layer 1's.
 
 > **Wiring it into your agents locally** (MCP server, the `PostToolUse` reindex
 > hook, and the indexer CLI, run straight from your checkout): see
-> [Local Development Setup](../../../docs/agent-memory.md#local-development-setup).
+> [Local Development Setup](../../../docs/internals/agent-memory.md#local-development-setup).
 
 ## When to use this vs. grep / the `Explore` agent
 
@@ -37,7 +37,14 @@ resolution, not a true call graph) — see
 | Layer | Server | Stores | Scope | Synced |
 |------|--------|--------|-------|--------|
 | 1 | `witan` | patterns, project facts, lessons, workflow traces | team-wide | yes (S3) |
-| 2 | `witan-code` | code symbols + edges | per-repo | **no — local only** |
+| 2 | `witan-code` | code symbols + edges | per-repo | local by default; shareable |
+
+Layer 2 was local-only originally and is no longer. A code graph can live on a
+shared `omnigraph-server` (`WITAN_CODE_SERVER` in-cluster, or through the
+deployed witan MCP tier from outside it), where a CI indexer owns each repo's
+default `main` view and every other writer gets its own per-actor branch view.
+On a local store there is one user, who is its writer, and none of that
+arbitration applies. See [`docs/BRANCH_INDEXING.md`](docs/BRANCH_INDEXING.md).
 
 The two layers compose through **soft symbol-ID references**. A Layer-1 node
 (e.g. a `lesson` or `agent_context`) can record symbol ids of the form:
@@ -82,7 +89,7 @@ The per-repo graph stops at a repo boundary, but service-oriented architectures
 couple repos through **shared contracts**: an env var that infra sets and an app
 reads, an HTTP endpoint one service serves and another calls, a package one repo
 publishes and others import. The bridge records these as **interface bindings**
-in a single shared, local-only store (`_bridge.omni`, a sibling of the per-repo
+in a single shared store (`_bridge.omni` locally, a sibling of the per-repo
 stores) so linkages can be queried across every indexed repo.
 
 It is **zero-config**: every `index`/reindex of a repo also extracts that repo's
@@ -486,8 +493,9 @@ graph):
 
 | Tool | Returns |
 |------|---------|
-| `code_indexed_repos()` | every indexed repo with file count, size, and last-indexed timestamp |
+| `code_indexed_repos()` | every indexed repo with file count, size, and last-indexed timestamp; `files: null` + `unreadable: <why>` for a store no `code_*` tool can query |
 | `code_indexed_branches(branch=None)` | the in-flight branch views each repo's store carries, and who owns each; pass a git branch to see every writer's view of it |
+| `code_store_health()` | whether every code graph opens — per-repo **and the bridge**; the readiness check to run before reading an empty result as "nothing found" (see [Rebuilding an unreadable store](#rebuilding-an-unreadable-store)) |
 
 ## CLI
 
@@ -496,7 +504,12 @@ graph):
 - `setup [--dry-run]` — fetch the pinned omnigraph binary to `~/.local/bin/`
   for standalone use (see [Install](#install)).
 - `index [PATH]` — incremental; skips files whose content hash is unchanged.
-- `reindex [PATH]` — force rebuild a path.
+- `reindex [PATH] [--rebuild] [--yes]` — force rebuild a path. `--rebuild`
+  first deletes this repo's store, and the bridge store, *if they cannot be
+  read* — see [Rebuilding an unreadable store](#rebuilding-an-unreadable-store).
+- `doctor` — check that every code graph opens: each per-repo store **and the
+  shared bridge store**, which belongs to no repo and so appears in no other
+  listing. Exits non-zero if any is unreadable, so it works as a check.
 - `repos` — list all indexed repos with file count, symbol count, and store size.
 - `branches [--branch B] [--prune]` — list the in-flight branch views per
   store; `--branch` shows every writer's view of one git branch (how you find
@@ -595,6 +608,38 @@ mechanisms keep this in check, mirroring that module (deliberately duplicated
   `cleanup` GCs old Lance versions to reclaim disk and is destructive, so it
   requires `--yes`.
 
+## Rebuilding an unreadable store
+
+omnigraph uses strict single-version storage: a release that bumps the
+on-disk format refuses to open a graph an older binary wrote (`__manifest is
+stamped at internal schema vN, but this omnigraph reads only vM`). Every
+`code_*` read against such a store errors, permanently, until it is rebuilt.
+
+`witan-code doctor` is how you find out. It probes every per-repo store **and
+the bridge store**, which is the one that goes unwatched: it belongs to no
+repo, so it is in no repo listing, and `code_interface_search` /
+`code_interface_providers` / `code_interface_consumers` /
+`code_cross_repo_impact` all read it and nothing else does. A bridge that
+cannot be opened breaks all of those while every per-repo listing still looks
+healthy.
+
+The fix is **not** witan's `witan migrate storage` (export with the
+pre-upgrade binary, reload with the new one). A code graph is *derived* from a
+checkout that is still on disk, so reindexing rebuilds it from source and
+needs no old binary:
+
+```console
+witan-code doctor                    # which stores, and why
+witan-code reindex --rebuild         # from each affected checkout
+```
+
+`--rebuild` deletes only the stores it could not read — this repo's, and the
+bridge if it is unreadable too — then indexes from scratch. Nothing is kept
+aside: a copy no installed binary can open is just disk. Dropping the bridge
+does cost every *other* repo's cross-repo bindings, and each restores its own
+on its next index, so a machine with many indexed repos wants a
+`witan-code reindex --rebuild` pass over each checkout it cares about.
+
 ## Skill
 
 [`witan_code/skills/witan-code/SKILL.md`](witan_code/skills/witan-code/SKILL.md)

witan_code-0.16.0/conftest.py

@@ -0,0 +1,26 @@
+"""Load the workspace's shared test-environment guard.
+
+This file exists to be imported EARLY. ``testsupport.hermetic`` redirects every
+ambient input — HOME, the XDG dirs, the witan state files and graph stores, the
+terminal width — at import time rather than in a fixture, because the leak it
+exists to stop can happen while pytest is still collecting (importing
+``witan.server`` creates a graph). A rootdir ``conftest.py`` is the earliest
+hook that runs for every invocation.
+
+★ IMPORTED, not named in ``pytest_plugins``. That setting is only honoured in
+whichever conftest is TOP-LEVEL for the rootdir pytest picked, and the rootdir
+depends on the arguments: run ``pytest`` from the repo root and all five of
+these become non-top-level, aborting collection outright with "Defining
+'pytest_plugins' in a non-top-level conftest is no longer supported". A plain
+import carries no such rule, does the same redirection (it happens at module
+import), and re-exporting the hook below makes this conftest its own plugin.
+"""
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[3]))
+
+# The import is the point: `testsupport.hermetic` redirects the environment at
+# module scope. The hook re-export is what lets this conftest report a leak.
+from testsupport.hermetic import pytest_sessionfinish  # noqa: E402,F401

{witan_code-0.15.0 → witan_code-0.16.0}/docs/USER_GUIDE.md

@@ -171,10 +171,12 @@ not indexed yet (HCL/Terraform is the leading candidate).
 ## Cross-repo bridge in brief
 
 Per-repo indexing stops at the repo boundary; the bridge is a separate,
-shared, local-only store (`_bridge.omni`) that links repos through contracts
-they share — an env var one repo's infra sets and another reads, an HTTP
-endpoint one serves and another calls, a package one publishes and others
-import, a service one repo deploys. It is **zero-config**: every `index` /
+shared store that links repos through contracts they share — an env var one
+repo's infra sets and another reads, an HTTP endpoint one serves and another
+calls, a package one publishes and others import, a service one repo deploys.
+It follows the same store resolution as the per-repo graphs: `_bridge.omni`
+beside them locally, and the deployment's bridge graph when one is configured
+(`witan_code.store.bridge_store`). It is **zero-config**: every `index` /
 `reindex` of any repo also extracts that repo's bindings into the bridge
 store automatically — there's no registry of repos to maintain.
 

{witan_code-0.15.0 → witan_code-0.16.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "witan-code"
-version = "0.15.0"
+version = "0.16.0"
 description = "witan-code — tree-sitter code graph + cross-repo bridge (mounts under `witan code`)"
 readme = "README.md"
 license = "BSD-3-Clause"
@@ -205,7 +205,7 @@ testpaths = ["tests"]
 packages = ["witan_code"]
 
 [tool.bumpversion]
-current_version = "0.15.0"
+current_version = "0.16.0"
 allow_dirty = true
 
 [[tool.bumpversion.files]]

{witan_code-0.15.0 → witan_code-0.16.0}/tests/conftest.py

@@ -41,21 +41,63 @@ def main():
 """
 
 
+# Every input `identity._resolve` reads. Isolating the file paths is not
+# enough on its own: each of these env vars short-circuits ahead of them.
+_IDENTITY_ENV = (
+    "WITAN_ACTOR",
+    "WITAN_REMOTE_URL",
+    "WITAN_OIDC_ISSUER",
+    "WITAN_TARGET",
+)
+
+
 @pytest.fixture(autouse=True)
-def _fresh_identity():
-    """Forget the process-lifetime actor between tests.
+def _fresh_identity(tmp_path, monkeypatch):
+    """Pin the identity these tests run under: nobody, unless one is asked for.
 
+    Two jobs. The first is to forget the process-lifetime actor between tests —
     ``identity.actor_id`` memoizes deliberately (a witan-code process writes as
     exactly one identity), which without this would let the first test that
     resolves one decide the branch-view names for every test after it.
+
+    The second is to stop that resolution reaching the machine. It reads the
+    real ``~/.config/witan/config.toml`` and the real OIDC token cache, so on a
+    developer's box — logged in, unlike a CI runner — ``actor_id()`` returns an
+    ``act-…`` and the branch views get namespaced under it. Four tests asserted
+    un-namespaced names and failed for everyone who had run ``witan login``,
+    green in CI the whole time. Pointing both at ``tmp_path`` makes logged-out
+    the deterministic default everywhere; ``logged_in_actor`` opts back in.
     """
     from witan_code import identity
 
+    monkeypatch.setenv("WITAN_CONFIG", str(tmp_path / "witan-config.toml"))
+    monkeypatch.setenv("WITAN_TOKEN_CACHE", str(tmp_path / "witan-tokens.json"))
+    for var in _IDENTITY_ENV:
+        monkeypatch.delenv(var, raising=False)
+
     identity.reset_cache()
     yield
     identity.reset_cache()
 
 
+@pytest.fixture
+def logged_in_actor(monkeypatch):
+    """Run the test as a specific actor — the half of the guard CI never sees.
+
+    Set through ``WITAN_ACTOR`` rather than by stubbing ``actor_id``, so the
+    resolution path a non-interactive writer (the CI indexer, a maintenance
+    job) actually takes is the one under test.
+    """
+    from witan_code import identity
+
+    def _login(actor: str = "act-alice") -> str:
+        monkeypatch.setenv(identity.ACTOR_ENV_VAR, actor)
+        identity.reset_cache()
+        return actor
+
+    return _login
+
+
 @pytest.fixture(autouse=True)
 def _fresh_git_context():
     """Forget the memoized git context between tests.

{witan_code-0.15.0 → witan_code-0.16.0}/tests/test_branches.py

@@ -155,6 +155,51 @@ def test_feature_branch_indexes_to_own_branch(tmp_path, monkeypatch):
     assert not on_main, "main view must not see in-flight branch symbols"
 
 
+@requires_stack
+def test_a_logged_in_writer_owns_the_views_it_indexes(
+    tmp_path, monkeypatch, logged_in_actor
+):
+    """The other half of `witan_code.views`, which CI never reaches.
+
+    A GitHub runner has no witan identity, so every branch-view assertion above
+    is of the un-namespaced name. On a logged-in machine — every real user —
+    the views carry their owner, on the local store too (there is no second
+    naming rule for local stores). Asserting it here is what keeps the two
+    halves from drifting.
+    """
+    from witan_code import config as cfg_module
+    from witan_code import indexer
+    from witan_code.graph import OmnigraphClient
+    from witan_code.views import owner
+
+    actor = logged_in_actor("act-alice")
+    monkeypatch.setenv("WITAN_REPO", REPO)
+    monkeypatch.setenv("WITAN_CODE_DIR", str(tmp_path / "code"))
+    cfg = cfg_module.load()
+
+    base = _git_repo(tmp_path / "r")
+    (base / "svc.py").write_text(SAMPLE)
+    indexer.index_path(base, config=cfg)
+
+    _git(base, "checkout", "-q", "-b", "feature/new-api")
+    (base / "extra.py").write_text("def branch_only_symbol():\n    return 2\n")
+    indexer.index_path(base, config=cfg)
+
+    view = f"{actor}/feature_new-api"
+    store = str(cfg_module.store_path(REPO, cfg.code_dir))
+    main_client = OmnigraphClient(store, cfg.queries_dir)
+    assert view in main_client.list_branches()
+    assert "feature_new-api" not in main_client.list_branches(), (
+        "the un-namespaced name is the collision this scheme replaced"
+    )
+    assert owner(view) == actor
+
+    branch_client = OmnigraphClient(store, cfg.queries_dir, branch=view)
+    assert branch_client.read(
+        "code_read.gq", "find_by_name", {"name": "branch_only_symbol"}
+    )
+
+
 @requires_stack
 def test_branch_index_writes_to_bridge_overlay_not_main(tmp_path, monkeypatch):
     """A non-default branch's bridge writes land on its repo-qualified

{witan_code-0.15.0 → witan_code-0.16.0}/tests/test_cli_dispatch.py

@@ -295,3 +295,63 @@ def test_branches_prune_is_refused_against_a_shared_store(monkeypatch, capsys):
     cli_module.branches(prune=True)
 
     assert "refusing to prune a shared graph" in capsys.readouterr().out
+
+
+def test_rebuild_refuses_a_path_that_is_not_the_repo_root(
+    tmp_path, monkeypatch, capsys
+):
+    """A rebuild deletes the whole store, so it must reindex the whole repo.
+
+    `reindex src/ --rebuild` would empty the store and refill only `src/`,
+    leaving the rest of the repo unindexed with nothing afterwards reporting
+    it — a worse state than the unreadable store it started from.
+    """
+    from witan_code import repo as repo_module
+    from witan_code import store as store_module
+
+    root = tmp_path / "checkout"
+    sub = root / "src"
+    sub.mkdir(parents=True)
+    monkeypatch.setattr(repo_module, "git_toplevel", lambda _p: root)
+
+    def _boom(*_args, **_kwargs):
+        raise AssertionError("deleted a store for a partial-path rebuild")
+
+    monkeypatch.setattr(store_module, "discard_store", _boom)
+
+    with pytest.raises(SystemExit):
+        cli_module._rebuild_stores(sub, yes=True)
+
+    out = capsys.readouterr().out
+    assert "not the repo root" in out
+    assert str(root) in out
+
+
+def test_rebuild_refuses_a_file_path_with_real_git(tmp_path, monkeypatch, capsys):
+    """`index`/`reindex` accept a FILE, and `git -C <file>` exits 128.
+
+    Deliberately runs the real `git_toplevel` rather than stubbing it: the
+    stub in the test above returns a root for anything, so it cannot see this.
+    Reading "Not a directory" as "no repo" skipped the guard entirely and left
+    `reindex some_file.py --rebuild` deleting the whole store and refilling it
+    with one file — the exact outcome the guard exists to prevent.
+    """
+    import subprocess
+
+    from witan_code import store as store_module
+
+    root = tmp_path / "checkout"
+    root.mkdir()
+    subprocess.run(["git", "init", "-q", str(root)], check=True)
+    target = root / "a.py"
+    target.write_text("x = 1\n")
+
+    def _boom(*_args, **_kwargs):
+        raise AssertionError("deleted a store for a single-file rebuild")
+
+    monkeypatch.setattr(store_module, "discard_store", _boom)
+
+    with pytest.raises(SystemExit):
+        cli_module._rebuild_stores(target, yes=True)
+
+    assert "not the repo root" in capsys.readouterr().out