docs: identify the CLI fork and refresh documentation [skip ci]

Author: ngallodev

CONTRIBUTING.md

@@ -1,4 +1,4 @@
-# Contributing to codebase-memory-mcp
+# Contributing to Codebase Memory CLI
 
 Contributions are welcome. This guide covers setup, testing, and PR guidelines.
 
@@ -9,16 +9,16 @@ Contributions are welcome. This guide covers setup, testing, and PR guidelines.
 **Prerequisites**: C compiler (gcc or clang), make, zlib, Git. Optional: Node.js 22+ (for graph UI).
 
 ```bash
-git clone https://github.com/DeusData/codebase-memory-mcp.git
-cd codebase-memory-mcp
+git clone https://github.com/ngallodev/codebase-memory-cli.git
+cd codebase-memory-cli
 git config core.hooksPath scripts/hooks  # activates pre-commit security checks
 scripts/build.sh
 ```
 
 macOS: `xcode-select --install` provides clang.
 Linux: `sudo apt install build-essential zlib1g-dev` (Debian/Ubuntu) or `sudo dnf install gcc zlib-devel` (Fedora).
 
-The binary is output to `build/c/codebase-memory-mcp`.
+The binary is output to `build/c/codebase-memory-cli`.
 
 ## Run Tests
 
@@ -29,7 +29,7 @@ scripts/test.sh
 This builds with ASan + UBSan and runs the full C test suite. Key test files:
 - `tests/test_pipeline.c` — pipeline integration tests
 - `tests/test_httplink.c` — HTTP route extraction and linking
-- `tests/test_mcp.c` — MCP protocol and tool handler tests
+- `tests/test_cli.c` — CLI command and lifecycle tests
 - `tests/test_store_*.c` — SQLite graph store tests
 
 ## Run Linter
@@ -46,7 +46,7 @@ Runs clang-tidy, cppcheck, and clang-format. All must pass before committing (al
 make -f Makefile.cbm security
 ```
 
-Runs 8 security layers: static allow-list audit, binary string scan, UI audit, install audit, network egress test, MCP robustness (fuzz), vendored dependency integrity, and frontend integrity.
+Runs the repository's security layers: static allow-list audit, binary string scan, UI audit, install audit, network egress test, parser robustness, vendored dependency integrity, and frontend integrity.
 
 ## Project Structure
 
@@ -55,7 +55,7 @@ src/
   foundation/       Arena allocator, hash table, string utils, platform compat
   store/            SQLite graph storage (WAL mode, FTS5)
   cypher/           Cypher query → SQL translation
-  mcp/              MCP server (JSON-RPC 2.0 over stdio, 14 tools)
+  operations/       Protocol-neutral CLI operations
   pipeline/         Multi-pass indexing pipeline
     pass_*.c        Individual pipeline passes (definitions, calls, usages, etc.)
     httplink.c      HTTP route extraction (Go/Express/Laravel/Ktor/Python)
@@ -127,7 +127,7 @@ Examples: `fix(store): set busy_timeout before WAL`, `feat(cli): add --progress
 
 The following changes will not be merged without prior design discussion in an issue:
 
-- **API surface changes** — adding, removing, renaming, or changing defaults of MCP tools
+- **CLI operation changes** — adding, removing, renaming, or changing defaults of supported operations
 - **New pipeline passes or indexing algorithms** — anything that changes what gets extracted or how
 - **Build system / Makefile changes** — beyond trivial fixes
 - **Project configuration** — CLAUDE.md, skill files, .mcp.json, CI workflows
@@ -160,7 +160,7 @@ If you add a new `system()`, `popen()`, `fork()`, or network call, it must be ju
 
 ## Good First Issues
 
-Check [issues labeled `good first issue`](https://github.com/DeusData/codebase-memory-mcp/labels/good%20first%20issue) for beginner-friendly tasks with clear scope and guidance.
+Check [issues labeled `good first issue`](https://github.com/ngallodev/codebase-memory-cli/labels/good%20first%20issue) for beginner-friendly tasks with clear scope and guidance.
 
 ## License and sign-off (DCO) — required on every commit
 

MAINTAINERS.md

@@ -3,7 +3,8 @@
 This document defines how maintainer responsibility, review routing, and
 operational authority work in this project.
 
-codebase-memory-mcp is currently a user-owned repository. Because GitHub teams
+codebase-memory-cli is currently a user-owned repository and a CLI-only fork of
+Codebase Memory MCP. Because GitHub teams
 are not available here, all delegated ownership is expressed with individual
 GitHub handles.
 
@@ -131,7 +132,7 @@ recorded in `.github/CODEOWNERS` and repository settings.
 These changes always require project-owner review, even if an area reviewer
 approves:
 
-- MCP tool behavior, tool outputs, or protocol capabilities.
+- CLI operation behavior, output formats, or protocol-facing compatibility.
 - New process execution, shell invocation, network access, or file access.
 - CI, release, package publishing, installer, or updater changes.
 - Vendored dependency changes, generated grammar changes, or license policy.

README.md

@@ -1,12 +1,23 @@
-# Codebase Memory
+# Codebase Memory CLI
 
-Codebase Memory builds a persistent structural knowledge graph of a source repository and exposes it through a local command-line interface designed for coding agents and humans.
+Codebase Memory CLI builds a persistent structural knowledge graph of a source
+repository and exposes it through a local command-line interface for coding
+agents and humans.
+
+This repository is a fork and C port of
+[Codebase Memory MCP](https://github.com/DeusData/codebase-memory-mcp). The
+fork keeps the code-intelligence engine, but removes the MCP server and its
+third-party MCP integration surface. It exists for workplace environments
+where policy prohibits using third-party MCP servers while still allowing a
+local, auditable developer tool.
 
 The product executable is `codebase-memory-cli`. Running it with no command shows CLI help; there is no supported MCP stdio server entry point.
 
-> Migration status: application operations, daemon execution, supervised workers, UI dispatch, and store hosting are protocol-neutral. The physical MCP subsystem has been removed. Remaining MCP-era names are limited to compatibility-sensitive persisted paths/package history that are being retired deliberately. See [`docs/CLI_MIGRATION_STATUS.md`](docs/CLI_MIGRATION_STATUS.md).
+> The CLI is the supported product surface. Some cache and package paths retain
+> the historical `codebase-memory-mcp` name for compatibility; they do not
+> enable or start an MCP server.
 
-## What it does
+## Features
 
 Codebase Memory parses source with tree-sitter and optional language-server enrichment, then stores functions, classes, methods, call relationships, imports, routes, cross-service links, and other structural facts in a local graph-backed index.
 
@@ -22,6 +33,17 @@ Use it when you need to answer questions such as:
 
 The graph is a discovery and structural-evidence layer, not a substitute for source verification. For material claims, especially negative or exhaustive claims, verify exact source and index coverage.
 
+It includes:
+
+- tree-sitter parsing for 162 languages;
+- hybrid LSP-style semantic enrichment for supported languages;
+- definitions, calls, imports, usages, routes, channels, and cross-service links;
+- architecture summaries, change-impact analysis, dead-code queries, ADRs, and Cypher queries;
+- BM25, semantic, structural, and graph-augmented source search;
+- cross-repository graph intelligence and optional 3D graph visualization;
+- a persistent local index with incremental updates and optional shared graph artifacts;
+- a coordination daemon, supervised workers, and filesystem watcher for reliable background indexing.
+
 ## Quick start
 
 Build or install the binary, then from a repository:
@@ -42,7 +64,8 @@ codebase-memory-cli search "ClaimValidator" --json
 codebase-memory-cli trace ClaimValidator.validate --direction inbound --json
 ```
 
-Canonical machine output does not expose the historical MCP `content:[{type:"text"}]` envelope. Operational failures return a non-zero exit status.
+Canonical machine output is ordinary CLI output or stable JSON. Operational
+failures return a non-zero exit status.
 
 ## Core commands
 
@@ -68,13 +91,14 @@ When the working directory does not identify the intended index unambiguously, p
 
 ### Compatibility interface
 
-The historical generic form remains temporarily available as a parity/migration surface:
+The generic operation form remains available for scripts that need the complete
+operation catalog:
 
 ```sh
 codebase-memory-cli cli search_graph --project my-project --name-pattern '.*Handler.*'
 ```
 
-It is not the canonical interface and will be retired after the protocol-neutral operation layer replaces the remaining private dispatcher dependency.
+The named commands above are preferred for normal use.
 
 ## Agent workflow
 
@@ -118,8 +142,8 @@ Use `install --plan` to inspect asset writes and `install-hooks --plan` to inspe
 ### From source
 
 ```sh
-git clone https://github.com/DeusData/codebase-memory-mcp.git
-cd codebase-memory-mcp
+git clone https://github.com/ngallodev/codebase-memory-cli.git
+cd codebase-memory-cli
 scripts/build.sh
 ./build/c/codebase-memory-cli --help
 ```
@@ -129,16 +153,20 @@ scripts/build.sh
 macOS/Linux:
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/scripts/setup.sh | bash
+curl -fsSL https://raw.githubusercontent.com/ngallodev/codebase-memory-cli/main/scripts/setup.sh | bash
 ```
 
 Windows PowerShell:
 
 ```powershell
-irm https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/scripts/setup-windows.ps1 | iex
+irm https://raw.githubusercontent.com/ngallodev/codebase-memory-cli/main/scripts/setup-windows.ps1 | iex
 ```
 
-The setup scripts install the executable. They do not install hooks or write MCP client configuration. Afterward, run `codebase-memory-cli install --skip-binary` for CLI-first skills/instructions. Run `codebase-memory-cli install-hooks` separately only if you explicitly want CLI-owned agent hooks.
+The setup scripts install the executable. They do not install hooks or write
+MCP client configuration. Afterward, run `codebase-memory-cli install
+--skip-binary` for CLI skills and instructions. Run
+`codebase-memory-cli install-hooks` separately only if you explicitly want
+CLI-owned agent hooks.
 
 ## Human and machine output
 
@@ -170,7 +198,7 @@ The existing indexing engine is intentionally unchanged by the CLI-first migrati
 - hybrid LSP semantic enrichment for selected languages;
 - persistent local indexes;
 - call/import/definition and selected cross-service relationships;
-- change detection, architecture, Cypher, ADR, trace-ingestion, and other operations still available through the temporary compatibility interface while canonical named commands are expanded.
+- change detection, architecture, Cypher, ADR, trace ingestion, and other operations exposed through the canonical CLI and its compatibility form.
 
 The first vertical slice does **not** rewrite the graph schema, parser pipeline, store format, or existing indexes.
 
@@ -198,7 +226,7 @@ Important environment variables include:
 
 See [`docs/CONFIGURATION.md`](docs/CONFIGURATION.md) for the full reference.
 
-## Architecture during the CLI-first migration
+## Architecture
 
 The intended direction is:
 
@@ -208,7 +236,10 @@ agent skill ─┼──> CLI / hooks ──> protocol-neutral operations ──
 agent hooks ─┘
 ```
 
-The CLI, hooks, daemon, supervised workers, and UI now dispatch through the neutral operation/runtime layers. Index supervision, project mutation locks, version-cohort checks, process containment, memory limits, cancellation, store recovery, and secure local coordination remain part of the correctness kernel rather than protocol adapters.
+The CLI, hooks, daemon, supervised workers, watcher, and UI dispatch through
+the operation and runtime layers. Index supervision, project mutation locks,
+version-cohort checks, process containment, memory limits, cancellation, store
+recovery, and secure local coordination are part of the application itself.
 
 ## Build
 
@@ -244,8 +275,9 @@ See [`SECURITY.md`](SECURITY.md) and [`docs/SECURITY-DISCLOSURE.md`](docs/SECURI
 
 ## Migration documents
 
-- [`docs/CLI_FIRST_VERTICAL_SLICE_IMPLEMENTATION_PLAN.md`](docs/CLI_FIRST_VERTICAL_SLICE_IMPLEMENTATION_PLAN.md) — implementation-grade first-slice plan, critical review, checkpoints, and definition of done.
-- [`docs/CLI_ONLY_MIGRATION_PLAN.md`](docs/CLI_ONLY_MIGRATION_PLAN.md) — original high-level CLI-only direction retained as historical input.
+- [`docs/CLI_MIGRATION_STATUS.md`](docs/CLI_MIGRATION_STATUS.md) — current port and qualification status.
+- [`docs/RELEASE_QUALIFICATION_PLAN.md`](docs/RELEASE_QUALIFICATION_PLAN.md) — build, platform, benchmark, and release gates.
+- [`docs/CLI_ONLY_MIGRATION_PLAN.md`](docs/CLI_ONLY_MIGRATION_PLAN.md) — historical rationale and scope of the MCP removal.
 
 ## License
 

SECURITY.md

@@ -1,37 +1,30 @@
-# Security Policy
+# Security Policy — Codebase Memory CLI
 
 ## Transparency & Disclaimer
 
-codebase-memory-mcp interacts deeply with your filesystem. It reads source files across your entire codebase, writes to agent configuration files, and spawns background processes. This is inherent to what it does — not a bug.
+Codebase Memory CLI interacts deeply with your filesystem. It reads source
+files across your codebase, writes to agent configuration files when explicitly
+requested, and may spawn local background processes for indexing. This is
+inherent to what it does — not a bug. It is a CLI-only fork and C port of
+Codebase Memory MCP, created for workplaces that prohibit third-party MCP
+servers.
 
 **If you are uncomfortable with these access patterns**, please audit the source code before running. The full source is available in this repository. Release archives produced by the current release pipeline are verifiably built from this source and can be independently verified via SLSA Build Level 3 provenance, Sigstore signatures, and SHA-256 checksums (see [Verification](#verification) below). Each archive contains a native executable and its authenticated release-owned runtime assets.
 
 We are humans and can make mistakes. We take security seriously — it is Priority #1 for this project — but we cannot guarantee perfection. By using this software you accept responsibility for evaluating whether it meets your own security requirements.
 
 ## Runtime Network Behavior
 
-Indexing, graph queries, semantic search, and MCP tool handling run locally. The
-MCP server does not upload source code, repository paths, graph indexes, query
+Indexing, graph queries, semantic search, and CLI operation handling run locally.
+The CLI does not upload source code, repository paths, graph indexes, query
 contents, environment variables, usage metrics, or telemetry.
 
-The MCP server has one best-effort external runtime check: after MCP
-`initialize`, it starts a background update-check thread that requests release
-metadata from
-`https://api.github.com/repos/DeusData/codebase-memory-mcp/releases/latest`.
-That request is used only to show an update notice when a newer release exists.
-It sends no project data; only standard HTTPS metadata, such as the destination
-host and the normal `curl` request headers, are visible to GitHub and the
-network path.
-
-The update check is non-blocking for MCP startup and tool calls. If the machine
-is offline, DNS fails, GitHub is unreachable, or `curl` exits with an error, the
-check is ignored. The request is also bounded with `curl --max-time 5`; a
-process shutting down immediately while the check is still running may wait for
-that bounded background thread to finish.
-
-Explicit install, package-manager, and `codebase-memory-mcp update` flows are
-separate user-initiated network operations that download release assets and
-checksums from GitHub.
+The CLI has no MCP runtime or MCP startup path. Explicit install and update
+commands may request release metadata from GitHub to locate or verify release
+assets. No project data is sent.
+
+Network access is limited to explicit installation and update workflows that
+download release assets and checksums from GitHub.
 
 ## Help Us Stay Secure
 
@@ -56,7 +49,7 @@ can fix it before public disclosure:
 
 1. **Do NOT open a public issue, PR, or social-media post** for security
    vulnerabilities.
-2. **Preferred:** use GitHub's [private vulnerability reporting](https://github.com/DeusData/codebase-memory-mcp/security/advisories/new)
+2. **Preferred:** use GitHub's [private vulnerability reporting](https://github.com/ngallodev/codebase-memory-cli/security/advisories/new)
    (the repository's **Security → Report a vulnerability** button). This keeps
    everything in one place and starts a private advisory automatically.
 3. **Alternative:** email martin.vogel.tech@gmail.com.
@@ -81,7 +74,7 @@ can fix it before public disclosure:
 
 We follow **coordinated disclosure**: fixes are developed privately, validated
 across all supported platforms, released, and only then disclosed publicly via a
-[GitHub Security Advisory](https://github.com/DeusData/codebase-memory-mcp/security/advisories)
+[GitHub Security Advisory](https://github.com/ngallodev/codebase-memory-cli/security/advisories)
 with a **CVE** and credit to you. The full handling process — including how you
 can verify the fix before release — is documented in
 [`docs/SECURITY-DISCLOSURE.md`](docs/SECURITY-DISCLOSURE.md).
@@ -106,13 +99,12 @@ This project implements multiple layers of security verification. Every release
   - Layer 4: Install output path + content validation
   - Layer 5: Smoke test hardening (clean shutdown, residual processes, version integrity)
   - Layer 6: Graph UI audit (external domains, CORS, server binding, eval/iframe)
-  - Layer 7: MCP robustness (23 adversarial JSON-RPC payloads)
+  - Layer 7: parser and CLI robustness tests
   - Layer 8: Vendored dependency integrity (SHA-256 checksums, dangerous call scan)
 - **All dangerous function calls** require a reviewed entry in `scripts/security-allowlist.txt`
 - **Time-bomb pattern detection** — scans for `time()`/`sleep()` near dangerous calls (could indicate delayed activation)
-- **MCP tool handler file read audit** — tracks file read count in `mcp.c` against an expected maximum (detects added file reads that could exfiltrate data through tool responses)
 - **CodeQL SAST** — static application security testing on every push (taint analysis, CWE detection, data flow tracking). Any open alert blocks the release.
-- **Fuzz testing** — random/mutated inputs to MCP server and Cypher parser (60 seconds per build). Catches crashes, segfaults, and memory errors that structured tests miss.
+- **Fuzz testing** — random/mutated inputs to the CLI parser and Cypher parser (60 seconds per build). Catches crashes, segfaults, and memory errors that structured tests miss.
 - **Native antivirus scanning** on every platform (any detection fails the build):
   - **Windows**: Windows Defender with ML heuristics — the same engine end users run
   - **Linux**: ClamAV with daily signature updates
@@ -159,8 +151,8 @@ Users can independently verify any release archive and the runtime set it contai
 ```bash
 # SLSA Build Level 3 provenance for release archives
 gh attestation verify <downloaded-file> \
-  --repo DeusData/codebase-memory-mcp \
-  --signer-workflow DeusData/codebase-memory-mcp/.github/workflows/_build.yml
+  --repo ngallodev/codebase-memory-cli \
+  --signer-workflow ngallodev/codebase-memory-cli/.github/workflows/_build.yml
 
 # Sigstore cosign (keyless signature)
 cosign verify-blob --bundle <file>.bundle <file>
@@ -289,7 +281,7 @@ Any other verdict, an incomplete scan, a missing sibling, or a provenance/hash
 mismatch blocks the complete release. The selected bytes are then packaged
 without stripping, signing, relinking, or any other content mutation, and the
 resulting archives—not rejected candidates—are what smoke and soak testing execute.
-After packaging, every archive and MCPB executable is extracted and its SHA-256
+After packaging, every archive and executable is extracted and its SHA-256
 must still equal the selected candidate. This identity check makes a second
 VirusTotal submission of the same bytes unnecessary.