Merge branch 'main' into fix/2433-server-discover-probe-log

Author: DeusData

.codebase-memory.json

@@ -0,0 +1,95 @@
+{
+  "test_impact": {
+    "version": 1,
+    "tests": {
+      "presets": {
+        "c-cbm": true
+      }
+    },
+    "rules": [
+      {
+        "id": "harness",
+        "paths": ["tests/test_framework.h", "tests/test_helpers.*", "tests/test_main.c"],
+        "action": "run_all"
+      },
+      {
+        "id": "engine",
+        "paths": [
+          ".codebase-memory.json",
+          "src/mcp/test_impact*",
+          "src/store/store_impact.*",
+          "scripts/test-impact/**",
+          "scripts/ci/test-impact-*"
+        ],
+        "action": "run_all"
+      },
+      {
+        "id": "build",
+        "paths": [
+          "scripts/build.sh",
+          "scripts/env.sh",
+          "scripts/test.sh",
+          "scripts/run-tests-parallel.sh",
+          "scripts/run-test-wave.py",
+          "scripts/path-safety.sh",
+          "scripts/clean.sh",
+          "scripts/suite-failure-report.sh",
+          "scripts/ci/verify-shard-union.sh",
+          "scripts/embed-frontend.sh",
+          "/.gitattributes"
+        ],
+        "action": "run_all"
+      },
+      {
+        "id": "grammars",
+        "paths": ["internal/cbm/vendored/**"],
+        "action": "run_all"
+      },
+      {
+        "id": "fixtures",
+        "paths": ["tests/fixtures/*/**"],
+        "action": "referencing_tests",
+        "key": "path_segment:2"
+      },
+      {
+        "id": "contracts",
+        "paths": ["tests/**/*.{sh,py,json,txt,ps1}"],
+        "action": "ignore"
+      },
+      {
+        "id": "notices",
+        "paths": ["NOTICE*", "CHANGELOG*", "THIRD_PARTY*"],
+        "action": "ignore"
+      },
+      {
+        "id": "repo-data",
+        "paths": [
+          "scripts/**",
+          "pkg/**",
+          "test-infrastructure/**",
+          "docs/**",
+          "**/*.md",
+          "graph-ui/**",
+          "tools/**",
+          "tests/fuzz/corpus/**",
+          "/{.clang-format,.clang-tidy,.cppcheck,.gitignore,.gitleaksignore,DCO,Formula}",
+          "/{flake.lock,flake.nix,glama.json,install.ps1,install.sh,server.json}"
+        ],
+        "action": "referencing_tests",
+        "key": "path",
+        "unreferenced": "ignore"
+      }
+    ],
+    "unmapped_files": "run_all",
+    "coverage": {
+      "compatibility_paths": [
+        "tests/test_framework.h",
+        "tests/test_main.c",
+        "tests/test_helpers.h",
+        "Makefile.cbm",
+        "scripts/test-impact/coverage-map.py",
+        "scripts/test-impact/coverage-merge.py"
+      ]
+    }
+  }
+}

.gitattributes

@@ -15,3 +15,10 @@ scripts/hooks/pre-commit       text eol=lf
 # Chialisp grammar corpus: one case asserts CRLF comment termination, so this
 # file must keep its exact bytes on every platform (no eol conversion). (#919)
 tools/tree-sitter-chialisp/test/corpus/comments.txt -text
+
+# llvm-profdata text captures: tests/test_profile_text_parser.py checks their
+# SHA-256, so they keep their exact bytes on every platform (no eol conversion).
+tests/fixtures/profile_text/*.proftext -text
+# Golden profile-map outputs: tests/test_profile_map_v2.py compares the
+# producer's LF bytes against them, so they keep their exact bytes too.
+tests/fixtures/profile_map_v2/*.tsv -text

.github/scancode-constraints.txt

@@ -0,0 +1,5 @@
+# Constraints for the ScanCode install of the license gate (PIP_CONSTRAINT).
+# pluggy 1.7.0 (2026-10-15) no longer finds plugincode 32.0.0's class-level
+# hookspecs: scancode then crashes at import with "did not find any
+# 'pre_scan' hooks" and the gate fails on every run.
+pluggy==1.6.0

.github/workflows/_lint.yml

@@ -3,22 +3,31 @@
 name: Lint & Security
 
 on:
-  workflow_call: {}
+  workflow_call:
+    inputs:
+      lanes:
+        description: 'PR lane selection (scripts/ci/select-lanes.sh JSON list); "all" = every job (dry run, release)'
+        type: string
+        default: all
 
 permissions:
   contents: read
 
 jobs:
   lint:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'lint') }}
     # Pinned, not ubuntu-latest: the LLVM install below adds an
     # apt.llvm.org llvm-toolchain-NOBLE repo, which is 24.04 by name. When
     # GitHub moves ubuntu-latest to the next LTS this job breaks on a day
     # nobody chose. Pin the runner to the release the repo line already names.
     runs-on: ubuntu-24.04
     # 15 min proved too tight on a slow runner day and a timed-out lint reads
     # as "cancelled", which the release graph must treat as a hard stop; keep
-    # a bound, but one only a genuine hang can hit (normal runtime ~5 min).
-    timeout-minutes: 30
+    # a bound, but one only a genuine hang can hit. 30 min stopped being that
+    # in 2026-10: single-process cppcheck over a src tree that grew ~60 % in
+    # files took the lint step from ~8 to 22-29 min, and three runs on
+    # 2026-10-13 were cancelled at 30 min with cppcheck still alive.
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -64,6 +73,7 @@ jobs:
   # provability (never suppressed — the NOLINT ban applies here too).
   # Vendored-tree diagnostics are path-filtered, mirroring .cppcheck.
   lint-mem:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'lint-mem') }}
     # Pinned for the same reason as `lint`: llvm-toolchain-noble-21 below.
     runs-on: ubuntu-24.04
     timeout-minutes: 60

.github/workflows/_security.yml

@@ -4,7 +4,12 @@
 name: Security Gate
 
 on:
-  workflow_call: {}
+  workflow_call:
+    inputs:
+      lanes:
+        description: 'PR lane selection (scripts/ci/select-lanes.sh JSON list); "all" = every job (dry run, release)'
+        type: string
+        default: all
 
 permissions:
   contents: read
@@ -16,19 +21,28 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: "Layer 1: Static allow-list audit"
-        run: scripts/security-audit.sh
+        run: |
+          bash tests/test_security_audit_subprocess_calls.sh
+          scripts/security-audit.sh
       - name: "Layer 6: UI security audit"
-        run: scripts/security-ui.sh
+        run: |
+          bash tests/test_security_ui_urls.sh
+          scripts/security-ui.sh
       - name: "Layer 8: Vendored dependency integrity"
         run: scripts/security-vendored.sh
 
   license-gate:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'license-gate') }}
     runs-on: ubuntu-latest
     timeout-minutes: 240
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install ScanCode Toolkit
-        run: pipx install scancode-toolkit
+        # Pinned: an unpinned install picked up pluggy 1.7.0, which breaks
+        # scancode at import (see .github/scancode-constraints.txt).
+        env:
+          PIP_CONSTRAINT: ${{ github.workspace }}/.github/scancode-constraints.txt
+        run: pipx install scancode-toolkit==32.5.0
       - name: "Gate self-test (a planted violation must be detected)"
         run: scripts/license-gate.sh --selftest
       - name: "License compliance gate (one finding fails)"
@@ -39,6 +53,7 @@ jobs:
         run: scripts/audit-license-provenance.py
 
   codeql-gate:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'codeql-gate') }}
     runs-on: ubuntu-latest
     timeout-minutes: 240
     # Without security-events:read this job inherits the workflow's

.github/workflows/_smoke.yml

@@ -95,6 +95,13 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # SMOKE_REQUIRE_WRAPPERS=1 needs a Go toolchain for the Go wrapper; the
+      # macOS runner images have none on PATH.
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: pkg/go/go.mod
+          cache: false
+
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
@@ -118,6 +125,7 @@ jobs:
         env:
           CBM_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/cbm-artifact
           SMOKE_REQUIRE_UI: "1"
+          SMOKE_REQUIRE_WRAPPERS: "1"
 
       - name: Security audits
         run: |
@@ -175,6 +183,13 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # SMOKE_REQUIRE_WRAPPERS=1 needs a Go toolchain for the Go wrapper; the
+      # MSYS2 shell below inherits it (path-type: inherit).
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: pkg/go/go.mod
+          cache: false
+
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
         with:
           msystem: ${{ matrix.arch == 'arm64' && 'CLANGARM64' || 'CLANG64' }}
@@ -224,6 +239,7 @@ jobs:
         env:
           SMOKE_ARCH: ${{ matrix.arch }}
           SMOKE_REQUIRE_UI: "1"
+          SMOKE_REQUIRE_WRAPPERS: "1"
         run: |
           export CBM_SMOKE_ARTIFACT_DIR="$(cygpath -u "$RUNNER_TEMP")/cbm-artifact"
           bash test-infrastructure/vm/vm-smoke.sh
@@ -279,6 +295,12 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # SMOKE_REQUIRE_WRAPPERS=1 needs a Go toolchain for the Go wrapper.
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: pkg/go/go.mod
+          cache: false
+
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binaries-linux-${{ matrix.arch }}-portable
@@ -301,6 +323,7 @@ jobs:
         env:
           CBM_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/cbm-artifact
           SMOKE_REQUIRE_UI: "1"
+          SMOKE_REQUIRE_WRAPPERS: "1"
 
       # The -portable binary is what all linux install/update paths now deliver;
       # it MUST start on old glibc (Debian 11 / RHEL 8 / Ubuntu 20.04). Runs it