Integrate CP89 and upstream CLI fixes

Author: ngallodev

.github/workflows/promote-qualified-release.yml

@@ -18,6 +18,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.version }}
       - name: Validate version input
         env:
           VERSION: ${{ inputs.version }}
@@ -39,12 +41,14 @@ jobs:
         env:
           VERSION: ${{ inputs.version }}
         run: |
+          SOURCE_COMMIT="$(git rev-parse HEAD)"
           python3 scripts/ci/verify-external-qualification.py \
             --manifest release/qualification-manifest.json \
             --summary release/qualification-summary.md \
             --archive release/codebase-memory-cli-windows-amd64.zip \
             --checksums release/checksums.txt \
-            --expected-tag "$VERSION"
+            --expected-tag "$VERSION" \
+            --expected-source-commit "$SOURCE_COMMIT"
 
   publish-registries:
     needs: [verify-external-qualification]
@@ -54,6 +58,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.version }}
       - name: Sync packaging versions
         env:
           RELEASE_VERSION: ${{ inputs.version }}

BACKLOG.md

@@ -10,6 +10,25 @@
 
 ## Open
 
+- [ ] Selectively evaluate remaining upstream fixes from
+  `../codebase-memory-mcp` before merging into the CLI fork. Do not
+  cherry-pick MCP-only changes or overwrite CP89/release-tooling work; apply
+  compatible patches into a temporary worktree, run focused suites, then
+  review the resulting diff before integration.
+  - `77a0c7d9` pipeline empty-graph function-sort guard.
+  - `04ba2fa3` Cypher variable-limit validation; `98899ba5` is the related
+    unnamed-head-node follow-up.
+  - `9846c3f1` and `c1b9c451` Windows daemon/session-root separator
+    handling; port daemon-only hunks and omit MCP hunks.
+  - `92725a5e` Windows stdio parent-death cleanup; verify relevance to the
+    CLI-only process model before porting.
+  - `e5c17de6` and `b04f5450` coverage correctness/performance; manually
+    reconcile against the fork's changed coverage implementation.
+  - `1770d68a` Razor Pages/MVC extraction and `24f54c0e` inline
+    Svelte/HTML/Astro extraction; assess grammar and fixture scope separately.
+  - MCP-only output/search/pagination/compact-output commits are intentionally
+    excluded from this backlog item.
+
 - [ ] Retire or migrate legacy MCP-dependent test sources. The production
   Makefile now leaves `MCP_SRCS` empty, but the monolithic test runner still
   compiles MCP tests and repro harnesses; focused daemon tests therefore stop

docs/CLI_MIGRATION_STATUS.md

@@ -416,3 +416,13 @@ Status: **IMPLEMENTED / REQUIRES EXTERNAL RERUN**
 - **FIXED (evidence isolation):** corpus initialization writes the frozen manifest into the qualification evidence tree rather than dirtying the exact RC source checkout.
 - **RECONCILED:** the last two known Claude-hook tests now enforce exact current CLI command ownership while preserving MCP-era hook identities as foreign, matching the CP78 side-by-side contract.
 - **PENDING EXTERNAL EVIDENCE:** run the external CLI/full suite after CP88 and then execute the Windows RC orchestrator on `luigi.home.arpa` against the immutable draft artifact. No compile or test execution was performed locally for CP88.
+
+### CP89 — Windows RC qualification provenance closeout
+
+Static/source audit only; no local compilation or test execution was performed.
+
+- external Windows qualification evidence now binds the exact release tag to its immutable source commit in addition to the Windows archive/executable SHA-256 values;
+- `run-windows-rc-qualification.ps1` requires PowerShell 7+ for deterministic BOM-free UTF-8 JSON evidence and refuses cross-checkout `SourceRoot` execution;
+- `run-windows-benchmark-corpus.ps1` resolves moving initialization branches from `origin/<branch>` and freezes the resulting commit before benchmarking;
+- the promotion workflow checks out the exact qualified tag both when verifying evidence and when publishing npm/PyPI wrappers, preventing registry publication from a later default-branch revision;
+- the Windows benchmark runbook now accurately describes the external frozen-manifest evidence flow and the deliberate post-qualification commit that establishes the durable corpus generation for later releases.

docs/RELEASE_QUALIFICATION_PLAN.md

@@ -199,3 +199,8 @@ If qualification finds a defect and the candidate changes:
 RC dispatch is now a distinct evidence-bearing step. Use `scripts/ci/prepare-rc-dispatch.py` and `docs/agents/GITHUB_RC_DISPATCH_AGENT.md` rather than hand-assembling workflow inputs.
 
 The dispatch record binds the clean source commit, explicit RC tag, release workflow hash, corpus-generation manifest hash, and external-qualification hold. The first CLI-first candidate should normally use the next deliberate prerelease in the current release line (recommended `v0.11.0-rc.1` after public `v0.10.8`), but the operator must select the tag explicitly and verify it is unused before dispatch. Because `v0.10.8` predates the comparable CLI-first workflow surface, the first qualified CLI release must explicitly use `BASELINE_ZERO`; the next release uses that qualified CLI release as its immutable comparative baseline.
+
+
+### Qualified source identity
+
+External qualification evidence must bind the exact release tag to its immutable source commit (`release.source_commit`) in addition to the Windows archive and executable SHA-256 values. The promotion workflow checks out the exact tag and rejects evidence whose source commit differs.

docs/WINDOWS_BENCHMARK_RUNBOOK.md

@@ -18,7 +18,7 @@ The two moving `master` references above are **initialization references only**.
 
 ## Prerequisites on Luigi
 
-Use native 64-bit PowerShell 7 if available. Required commands: `git`, `python`, and the candidate `codebase-memory-cli.exe`. Use a local SSD directory, not a network share. Keep AC power connected, disable sleep for the run, close large background workloads, and keep the same Windows power mode for all trials.
+Use native 64-bit **PowerShell 7 or newer**. The qualification orchestrator intentionally rejects Windows PowerShell 5.1 so JSON/evidence UTF-8 encoding is deterministic. Required commands: `git`, `python`, and the candidate `codebase-memory-cli.exe`. Use a local SSD directory, not a network share. Keep AC power connected, disable sleep for the run, close large background workloads, and keep the same Windows power mode for all trials.
 
 Suggested layout:
 
@@ -89,15 +89,15 @@ Run the corpus orchestrator in initialization mode. `-CodebaseMemoryRef` must be
 2. fetches tags/refs;
 3. checks out each declared initialization ref (and the supplied exact RC ref for self-hosting);
 4. hard-resets/cleans each benchmark checkout;
-5. writes each local path and exact `HEAD` SHA into `docs/qualification/BENCHMARK_CORPUS.json`;
-6. runs `scripts/qualification/validate-corpus-checkouts.py` against the frozen manifest;
+5. writes each local path and exact `HEAD` SHA into a separate frozen manifest (`BENCHMARK_CORPUS.frozen.json`);
+6. runs `scripts/qualification/validate-corpus-checkouts.py` against that frozen manifest;
 7. executes the benchmark corpus using the exact candidate executable.
 
-After this first successful freeze, **commit the populated corpus manifest**. Any later repository SHA change requires a new corpus generation rather than silently editing `windows-corpus-1`.
+The top-level RC orchestrator stores the frozen manifest under its `evidence` directory so the exact RC source checkout remains clean throughout qualification. After the first successful BASELINE_ZERO run, review that evidence manifest and deliberately copy its frozen repository entries into `docs/qualification/BENCHMARK_CORPUS.json` on the development branch for subsequent releases, then commit that change. Do not modify the already-qualified RC tag. Any later repository SHA change requires a new corpus generation rather than silently editing `windows-corpus-1`.
 
 ## Subsequent runs
 
-Once the manifest is pinned, omit `-Initialize` and do not supply a moving branch as a substitute for a pinned commit:
+Once a later source revision contains the committed frozen manifest, omit `-Initialize` and do not supply a moving branch as a substitute for a pinned commit:
 
 ```powershell
 .\scripts\qualification\run-windows-benchmark-corpus.ps1 `

docs/WINDOWS_RELEASE_VALIDATION.md

@@ -189,3 +189,8 @@ Native Windows qualification is complete only when:
 - recovery/lifecycle checks complete;
 - evidence bundle is complete;
 - all non-pass results have explicit disposition.
+
+
+### Qualified source identity
+
+External qualification evidence must bind the exact release tag to its immutable source commit (`release.source_commit`) in addition to the Windows archive and executable SHA-256 values. The promotion workflow checks out the exact tag and rejects evidence whose source commit differs.

docs/agents/WINDOWS_RELEASE_QUALIFICATION_AGENT.md

@@ -230,3 +230,8 @@ Required manifest shape:
 ```
 
 If any required gate is not releasable, do not upload a PASS manifest. Keep the evidence bundle locally and report the blocker.
+
+
+### Qualified source identity
+
+External qualification evidence must bind the exact release tag to its immutable source commit (`release.source_commit`) in addition to the Windows archive and executable SHA-256 values. The promotion workflow checks out the exact tag and rejects evidence whose source commit differs.

scripts/ci/verify-external-qualification.py

@@ -24,6 +24,7 @@ def main() -> None:
     ap.add_argument('--archive', required=True, type=pathlib.Path)
     ap.add_argument('--checksums', required=True, type=pathlib.Path)
     ap.add_argument('--expected-tag', required=True)
+    ap.add_argument('--expected-source-commit', required=True)
     ap.add_argument('--expected-host', default='luigi.home.arpa')
     ap.add_argument('--expected-corpus', default='windows-corpus-1')
     args = ap.parse_args()
@@ -35,6 +36,8 @@ def main() -> None:
     if data.get('corpus_generation') != args.expected_corpus: fail('corpus generation mismatch')
     rel = data.get('release') or {}
     if rel.get('tag') != args.expected_tag: fail('release tag mismatch')
+    if rel.get('source_commit') != args.expected_source_commit:
+        fail('release source commit mismatch')
 
     for key in ('portable_result','installed_result','windows_guards_result','recovery_result'):
         if data.get(key) != 'PASS': fail(f'{key} is not PASS')
@@ -63,7 +66,7 @@ def main() -> None:
     if rel.get('windows_executable_sha256','').lower() != h:
         fail('Windows executable SHA-256 mismatch')
 
-    print(f'External qualification verified: {args.expected_tag} on {args.expected_host} ({args.expected_corpus})')
+    print(f'External qualification verified: {args.expected_tag} @ {args.expected_source_commit} on {args.expected_host} ({args.expected_corpus})')
 
 if __name__ == '__main__':
     main()

scripts/qualification/run-windows-benchmark-corpus.ps1

@@ -31,8 +31,14 @@ foreach($r in $doc.repositories){
     elseif($r.initialization_ref){$ref=[string]$r.initialization_ref}
     else { throw "No initialization ref for $($r.id)" }
   }
-  git -C $path checkout --detach $ref; if($LASTEXITCODE){throw "checkout failed: $($r.id) ref=$ref"}
-  git -C $path reset --hard HEAD | Out-Null
+  # Freeze moving branch refs from origin, not from a potentially stale local branch.
+  $checkoutRef=$ref
+  & git -C $path show-ref --verify --quiet "refs/remotes/origin/$ref"
+  if($LASTEXITCODE -eq 0){$checkoutRef="refs/remotes/origin/$ref"}
+  $resolvedCommit=(& git -C $path rev-parse "$checkoutRef^{commit}" 2>$null).Trim()
+  if($LASTEXITCODE -ne 0 -or -not $resolvedCommit){throw "cannot resolve checkout ref: $($r.id) ref=$checkoutRef"}
+  git -C $path checkout --detach $resolvedCommit; if($LASTEXITCODE){throw "checkout failed: $($r.id) ref=$checkoutRef commit=$resolvedCommit"}
+  git -C $path reset --hard $resolvedCommit | Out-Null
   git -C $path clean -ffd | Out-Null
   $dirty=@(& git -C $path status --porcelain)
   if($dirty.Count -ne 0){throw "checkout is dirty after reset/clean: $($r.id)"}

scripts/qualification/run-windows-rc-qualification.ps1

@@ -16,8 +16,12 @@ param(
   [string]$ExpectedHost = 'luigi.home.arpa'
 )
 $ErrorActionPreference='Stop'
+if($PSVersionTable.PSVersion.Major -lt 7){throw 'Windows RC qualification requires PowerShell 7 or newer for deterministic UTF-8 evidence output'}
 $repoRoot=(Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
 if(-not $SourceRoot){$SourceRoot=$repoRoot}else{$SourceRoot=(Resolve-Path -LiteralPath $SourceRoot).Path}
+if([IO.Path]::GetFullPath($SourceRoot).TrimEnd('\') -ne [IO.Path]::GetFullPath($repoRoot).TrimEnd('\')){
+  throw 'SourceRoot must be the same exact checkout that contains this qualification script; cross-checkout qualification is not allowed'
+}
 $stamp=[DateTime]::UtcNow.ToString('yyyyMMddTHHmmssZ')
 $runRoot=Join-Path $QualificationRoot (($ReleaseTag -replace '[^A-Za-z0-9._-]','_') + '-' + $stamp)
 $artifactDir=Join-Path $runRoot 'artifact'
@@ -224,11 +228,11 @@ $manifestPath=Join-Path $evidenceDir 'qualification-manifest.json'
   recovery_result=$recoveryResult
   benchmark_result=$BenchmarkResult
   summary_sha256=$summaryHash
-  release=[ordered]@{tag=$ReleaseTag;windows_archive_sha256=$archiveHash;windows_executable_sha256=$exeHash}
+  release=[ordered]@{tag=$ReleaseTag;source_commit=$ExpectedSourceCommit;windows_archive_sha256=$archiveHash;windows_executable_sha256=$exeHash}
 } | ConvertTo-Json -Depth 5 | Set-Content -Encoding utf8 -LiteralPath $manifestPath
 
 # Verify the evidence with the same verifier used by promotion before optional upload.
-& python (Join-Path $repoRoot 'scripts\ci\verify-external-qualification.py') --manifest $manifestPath --summary $summary --archive $CandidateArchive --checksums $Checksums --expected-tag $ReleaseTag --expected-host $ExpectedHost --expected-corpus 'windows-corpus-1'
+& python (Join-Path $repoRoot 'scripts\ci\verify-external-qualification.py') --manifest $manifestPath --summary $summary --archive $CandidateArchive --checksums $Checksums --expected-tag $ReleaseTag --expected-source-commit $ExpectedSourceCommit --expected-host $ExpectedHost --expected-corpus 'windows-corpus-1'
 Require-Exit $LASTEXITCODE 'external qualification evidence verification'
 if($UploadEvidence){
   $gh=(Get-Command gh -ErrorAction SilentlyContinue); if(-not $gh){throw 'gh is required for -UploadEvidence'}