[Ancienttwo]

Refs #574

S1 of ADR-0058: one in-process, read-only CodeGraph read session, with the repository readiness check rebuilt on it. Base: main 60f2968 (0.14.1, #593 and Bun 1.4.4 from #595).

Goal

inspectRepositoryCodeFacts (doctor, complete debt, the private snapshot) and assertRepositoryCodeFactsReady (the checkpoint, debt, projection and CLI-provider gate) read the index only through CodeGraph.openSync(root, { readOnly: true }). They start no CodeGraph process and run no git status or git diff.

Changes

Read session (codegraph-adapter/src/read-session.ts, new)

• openCodeGraphReadSession / withCodeGraphReadSession open one handle per operation and close it in finally.
• The session offers version(), compatibility(), freshness() (memoized per session), revision(), unchangedSinceOpen(), graph and close().
• Open states, checked in this order:
  • lstat(.codegraph) fails with ENOENT or ENOTDIR: index-missing. Any other lstat error: index-open-failed.
  • .codegraph is a link, dangling or not: index-open-failed.
  • stat(codegraph.db) fails with ENOENT or ENOTDIR: index-missing. Any other stat error: index-open-failed. This is the same rule as for .codegraph.
  • A live writer lock (codegraph init fails with 'database is locked' and the index stays in indexing when archctx reads code facts during the build #426): build-in-progress, and the index is never opened.
  • The read-only open or the first revision read throws: index-open-failed.
  • Otherwise open.
• Coherent read (design G4): unchangedSinceOpen() re-checks the writer lock and compares the revision taken at open with the revision after the reads. When anything moved, readiness answers not-ready (index-incomplete, every index field null), and the gate refuses with code-facts-not-ready and retryable: true. It never passes.
• freshness() is CodeGraph's own change test: the provider's enumeration, plus its change hash (readBoundedSourceSync, oversizeStamp, hashContent).
  • An indexed file that left the enumeration or the disk counts as removed.
  • A file that exists but cannot be read counts as modified, because it cannot be attested.
• pinnedCodeGraphProvider() takes its version from the manifest of the loaded platform bundle, so REQUIRED_CODEGRAPH_VERSION stays the only pin.
• CODEGRAPH_PROVIDER_INTERNAL_EXPORTS is the Decision 7 table of provider-internal modules and exports.

Readiness (codegraph-adapter/src/index.ts)

• One reader. inspectRepositoryCodeFacts reads both tiers, compatibility and freshness. assertRepositoryCodeFactsReady reads compatibility only and reads no source file.
• withExistingCodeGraphSnapshot calls the same inspectRepositoryCodeFacts(snapshotRoot). The CLI probe and CodeGraphSnapshotOptions are deleted. S4 removes the snapshot itself.
• RepositoryCodeFactsV1 keeps its shape. C2: unavailable.reasonCode gains "index-open-failed".
• binary removed from the read options. RepositoryCodeFactsInspectionOptions is now { provider? }. CodeGraphCliProvider takes an optional third argument, readProvider; its binary now only builds the index (sync). prepareArchitectureDocumentationProjectionSnapshot accepts readProvider for its gate. runtime-daemon/src/flow-selector-check.ts no longer passes binary to the snapshot.

A .codegraph without codegraph.db is index-missing (round-2 item 1). The design table maps an absent database to AC_CODE_FACTS_UNAVAILABLE / index-missing, and the surviving snapshot path (index.ts:1225 on main) already refused it that way. Round 1 had returned not-initialized (AC_CODE_FACTS_NOT_READY); that state is gone. Doctor reports index-missing with indexPresent: false, and the checkpoint gate refuses with index-missing. A 0-byte or schema-less codegraph.db now gives index-open-failed instead of not-initialized.

Contracts

• C2: the failure.ts policy table gains index-open-failed (AC_CODE_FACTS_UNAVAILABLE, inspect-diagnostics, retryable: false).

Agreed scope widening

• runtime-daemon/src/architecture-debt-code-facts.ts: the two inspect calls drop binary and take the injected provider.
• 1a: surfaces/cli/src/main.ts passes process.execArgv to the daemon it starts, only when process.versions.bun is set. Under Node nothing new is passed.
• 2a was removed under Bun 1.4.4. The read session, selector index and symbol reader close exactly as on main, with no GC (see "Bun 1.4.4").
• 1b: the bun.lock hand-edit is dropped. Main's lock was regenerated by Bun 1.4.4 (chore: pin Bun 1.4.4 (#594) #595) and already points the workspace archctx bin at ./cli/bin/archctx. This PR changes no byte of bun.lock. bun install --frozen-lockfile under 1.4.4 is accepted, and readlink node_modules/.bin/archctx → ../@archcontext/surfaces/cli/bin/archctx.
• Dev runtime on darwin: packages/surfaces/cli/bin/bun-darwin-sqlite.ts runs only under Bun on darwin. It calls bun:sqlite Database.setCustomSQLite with a library from a closed list (/opt/homebrew/opt/sqlite/lib/libsqlite3.dylib, /usr/local/opt/sqlite/lib/libsqlite3.dylib), and throws with a brew install sqlite hint when neither exists.
  • The bunfig.toml test preload imports it. Dev bin/archctx imports it and preloads it into the CLI process it starts.
  • The probe's CI stderr line is removed.
  • Still needed under Bun 1.4.4 (see below).
  • It never reaches the npm tarball: the package boundary audit passes, and a release-style bundle has no setCustomSQLite, no bun-darwin-sqlite and no libsqlite3.dylib.

Refactors

• SDK loading, the platform-bundle lookup and the writer-lock check move from index.ts into read-session.ts. REQUIRED_CODEGRAPH_PACKAGE and REQUIRED_CODEGRAPH_VERSION are re-exported unchanged.
• codeGraphSnapshotRuntime and the snapshot's source scanner use the shared bundle lookup.
• repositoryCodeFactsFromStatus is the one evaluator of an index state.
• The gate's unreachable pending-source-changes branch is removed, because the compatibility tier never measures pending changes.

Paths not yet moved, each with the slice that moves it. These are sequencing, not fallbacks.

• The projection handshake (prepareProjectionCodeFacts) and the import population still use the CLI status and query. S2+S3 move them.
• The snapshot copy and its Node query child stay until S4.

Round 4

• R3-1: the database check is a stat, with the same rule as the .codegraph lstat: only ENOENT and ENOTDIR mean index-missing, and any other error is index-open-failed.
  • Test: an unreadable .codegraph (chmod 000, so codegraph.db cannot be stat'ed) and an unsearchable project directory (chmod 000, so .codegraph cannot be lstat'ed) are both index-open-failed, and neither opens the index.
  • The test is skipped on win32 and when running as root.
• Opus F1: the open-state list above now states the lstat rule exactly.
• Opus F3: the snapshot comment now says readiness opens the copied index in-process through the read session, while the queries still run in the provider's Node child until S4. The snapshot's rmSync is unchanged.

Bun 1.4.4 (rebased onto 60f2968)

Both checks were run locally with Bun 1.4.4 on macOS.

• macOS sidecar: still needed. After codegraph sync removed the sidecar files, Bun 1.4.4 with the system SQLite (3.51.0) still fails the read-only open with "unable to open database file". The darwin module stays unchanged.
• Windows EBUSY guard: removed.
  • Measured with lsof: after close(), Bun 1.4.4 holds 0 of the 5 database files it had open. Bun 1.4.3 held 6 of 6 until a GC after the handle was released.
  • In all 22 protocol fixtures, the test process held 0 files under the fixture root after daemon.stop() without any GC, against 8 under 1.4.3, and had no child process.
  • So collectReleasedCodeGraphHandles and its three call sites are deleted, and so is the test-side Bun.gc(true).
  • The protocol fixture keeps only rmSync's maxRetries: 5, retryDelay: 100 on win32, for a transient hold outside the process.
  • This is a macOS measurement. The Windows shards confirm it on this head; if EBUSY returns there, the drop commit (9db4488) is the one to revert.

Round 3

• R2-1: the snapshot keeps C2. When the session inspector answers unavailable / index-open-failed, withExistingCodeGraphSnapshot throws index-open-failed; every other unavailable answer stays code-facts-unavailable. Test: a non-SQLite codegraph.db through the snapshot gives AC_CODE_FACTS_UNAVAILABLE / index-open-failed.
• R2-2: lstat(.codegraph) failing with ENOENT or ENOTDIR is index-missing. Any other failure (permission, I/O) is index-open-failed, because it does not prove the index is absent.
• Opus R1: the fake gains readFailsAfterOpen, which throws only from the build info that compatibility() reads after the open. That test asserts index-open-failed with open = close = 1. The former readFails test is renamed to say it covers a read during the open.
• Opus R2: a moving index refuses with retryable: true only when the loaded provider has the pinned version. With a version mismatch it refuses retryable: false with install-compatible-codegraph, asserted in the G4 test.

Windows EBUSY (round-2 item 5, superseded by Bun 1.4.4)

Under Bun 1.4.3, an instrumented local run (not committed) of all 23 protocol tests showed:

• 8 files held under the fixture root before Bun.gc(true), and 0 after it;
• no child process, with the daemon running in-process.

The remaining Windows hold was therefore outside the test process; the rmSync retries cover it. Under 1.4.4 no GC is needed (above), and the retries stay.

Changed or removed assertions, and their coverage

codegraph-adapter/test/projection-codegraph-status.test.ts (inspect section, rewritten against an injected provider). The projectionCodeGraphStatusIssues describe is kept unchanged, because S2+S3 still evaluate CLI status -j with it.

• "unavailable CodeGraph" (nonexistent binary) → "a provider that cannot load". The fake is a Proxy whose version getter throws CodeGraphProviderUnavailableError. That is the error pinnedCodeGraphProvider() throws when the SDK, the platform bundle, its manifest or a Decision 7 export is missing. The real loader cannot be made to fail in a running process. The Decision 7 bump guard (read-session.test.ts) asserts that every listed module path and export exists in the pinned bundle.
• "missing index from --version alone, never status or sync" → "missing index from the provider version alone and opens nothing" (open count 0).
• "ready index calls only --version and status" → "ready index from one read-only session and closes it" (open = close = 1). In addition, read-session.test.ts reads a real index with no holder process, and its git spy proves no git status or git diff runs.
• Per-issue test.each:
  • not-initialized, index-incomplete, extraction, project-path, worktree-mismatch and pending → incompatible-index test.each (bundle version, build version, unknown build version, partial, pending refs, stale extraction, other project root), plus the pending-changes test.
  • not-initialized → index-missing (item 1).
  • worktree-mismatch is dropped for the session. openSync(root) never walks up to another worktree's index (ADR-0058 table), so the session sets worktreeMismatch: null. The evaluator's worktree-mismatch branch stays covered by the kept projectionCodeGraphStatusIssues tests.
• "binary version diagnostics do not copy raw output" → "issue messages are the closed vocabulary, never provider output". The open-failure test also asserts the raw provider error never reaches the facts.
• "stale extraction and pending as issues" → the stale-extraction case of the test.each plus the pending-changes test.
• "binary of another version" → the bundle-version case.
• "failing or invalid status is unavailable" and "status JSON not an object" → no status JSON is parsed any more. Replaced by "an open that fails" and "a read that fails after the open", both index-open-failed.
• "always passes CODEGRAPH_NO_DOWNLOAD to --version and status" → removed, because readiness starts no process at all: no environment to pass. code-facts-not-ready.test.ts asserts an empty process log for every readiness path. The remaining CLI read, the import query until S2, still passes CODEGRAPH_NO_DOWNLOAD=1, and architecture-debt-code-facts.test.ts still asserts it (query=1).
• "packaged shim with no platform bundle does not download" → removed, because readiness no longer runs the npm shim. The SDK loader (npm-sdk.js) never downloads ("we never trigger a network download from inside require()"); it only reuses an installed or cached bundle. A missing bundle surfaces as CodeGraphProviderUnavailableError → codegraph-unavailable, which the Proxy test covers. The shim still builds the index (init, sync), and that is unchanged.

codegraph-adapter/test/build-lock.test.ts. Live, stale and malformed lock, ported from the CLI call log to provider open counts: a live lock never opens the index, a stale or malformed one opens and closes it once.

codegraph-adapter/test/codegraph-adapter.test.ts. The two shim tests inject readProvider; their sync and query assertions are unchanged.

surfaces/cli/test/code-facts-not-ready.test.ts

• Process-log expectations change from --version\nstatus\n to empty: no readiness process.
• The checkpoint and debt gate's issues are compatibility-only.
• "present uninitialized index" → ".codegraph without a database is index-missing" (item 1).
• The projection-snapshot gate injects readProvider.
• The real incomplete index (initSync) still yields version-mismatch plus index-incomplete.

surfaces/cli/test/doctor-code-facts.test.ts. An empty .codegraph is now index-missing with indexPresent: false (item 1). Doctor ok is unchanged.

runtime-daemon/test/architecture-debt-code-facts.test.ts. Readiness comes from the injected provider, which opens and closes twice around the reads. The process log keeps only query=1 (S2), and a missing or stale index starts nothing.

runtime-daemon/test/flow-selector-check.test.ts, surfaces/cli/test/ref-impact.test.ts. Their subprocess runs the dev launcher bin/archctx instead of src/main.ts. The snapshot's readiness now reads in-process (item 3), so on darwin the CLI process needs the same SQLite library as the test process. The assertions are unchanged.

surfaces/cli/test/projection-protocol-lifecycle.test.ts. Cleanup uses rmSync retries on win32; no assertion changed.

New tests

• read-session.test.ts:
  • each open state, the dangling link, and the coherent-read case (an injected revision change between reads gives not-ready and a retryable refusal);
  • compatibility/revision, freshness counts and memoization, an unreadable source, and close-on-return/throw with refusal after close;
  • a real index read in-process with no holder: ready; edit, add and delete counted; an oversize file fresh; .git/index mtime and the database sha256 unchanged; the git spy;
  • the Decision 7 bump guard.
• scripts/codegraph-selector-node-integration.mjs (verify:pre, all three OSes) runs the read session under Node with no holder: compatibility and freshness, pending counts, the compatibility-only gate, the git spy, and .git/index and the database unchanged. A live-writer case did not fit this script cheaply and is not added; the injected revision test covers G4.

Test budget (git diff --numstat origin/main, head 8649579)

• Product (src, bin, main.ts, contracts): +556 / −144.
• Config: bunfig.toml +1 / −1. bun.lock unchanged.
• Tests: +656 / −302, including the 109-line fixture.
• Script: +74 / −2.

Verification (Bun 1.4.4)

• bun install --frozen-lockfile: accepted.
• bun run typecheck: exit 0.
• Head 9db4488: bun test --timeout 120000 over codegraph-adapter, code-facts-not-ready, doctor-code-facts, architecture-debt-code-facts, flow-selector-check, ref-impact, complete-architecture-debt, projection-protocol-lifecycle, docs-anchors, local-product-e2e and the contracts tests: 699 pass, 0 fail.
• Head 8649579: bun run typecheck exit 0. codegraph-adapter, code-facts-not-ready, doctor-code-facts, architecture-debt-code-facts, flow-selector-check, ref-impact and complete-architecture-debt: 162 pass, 0 fail.
• bun run test:codegraph-selector-node: verified.
• node scripts/packaged-cli-smoke.mjs: OK.
• node scripts/package-boundary-audit.mjs: passed.

Risk

• On macOS, the Bun dev and test runtime needs a Homebrew SQLite (the error says how to install it). The product runtime, Node, is unchanged.
• The pinned provider-internal modules break loudly on a provider bump, through the bump guard.
• A .codegraph without a database moves from not-ready to index-missing, the same refusal as no index at all.

Rollback

Revert this PR. There is no data migration; the WAL sidecar files are managed by SQLite.

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-13T15:04:32.829961Z We couldn’t complete this review. Comment @codex review to try again.	4cc2537	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 1
Subject: 35795ac
Tier: high
Agent: codex (gpt-6.1-terra), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 1
Subject: 35795ac
Tier: high
Verdict: FAIL
Reviewer: codex (gpt-6.1-terra)
Model relation: different-family

Cross-family review (Codex CLI, read-only) of S1 at 35795ac against 0983ae9. The read session uses the in-process read-only handle, the lockfile diff changes only the agreed bin entry, and the package boundary audit passes. Two P1 findings and one P2.

NITs

None.

Findings outside the diff

• P2 F3 at PR #589 body:53: Changed and removed assertions are not justified item by item; the missing-platform-bundle/no-download assertion was removed and its replacement tests a different behavior. -> Document each changed or removed assertion with its retained or replacement coverage, including the missing-provider behavior.

[Ancienttwo]

repo-harness acceptance record
Claim: #589 (comment)

Round	Role	Subject	Verdict
1	codex (gpt-6.1-terra), read-only	35795ac7546e3f5ae250a092b22bff1d97c7421a	FAIL: 2 P1, 1 P2

Model relation: different-family

Findings:

• P1 F1 at packages/local-runtime/codegraph-adapter/src/read-session.ts:207: A .codegraph directory without codegraph.db returns not-initialized, so the gate reports AC_CODE_FACTS_NOT_READY; the S1 design requires AC_CODE_FACTS_UNAVAILABLE / index-missing whenever the database is absent, and the new test asserts the conflicting behavior. -> Map an absent database to index-missing and update the behavior tests.
• P1 F2 at packages/local-runtime/codegraph-adapter/src/read-session.ts:208: The writer lock is checked only before opening; a sync can start afterwards, and compatibility and freshness are read in separate calls with no transaction or post-read validation. -> Establish a coherent read boundary against a sync that starts or finishes during the session, test it, and fail closed when consistency cannot be established.
• P2 F3 at PR feat(codegraph-adapter): one in-process read-only read session (#574 S1) #589 body:53: Changed and removed assertions are not justified item by item; the missing-platform-bundle/no-download assertion was removed and its replacement tests a different behavior. -> Document each changed or removed assertion with its retained or replacement coverage, including the missing-provider behavior.

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 1
Subject: 35795ac
Tier: high
Agent: pi (claude-opus-5-5), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 1
Subject: 35795ac
Tier: high
Verdict: FAIL
Reviewer: pi (claude-opus-5-5)
Model relation: same-family

Fresh same-family review (Pi, Opus 5.5) of S1 at 35795ac. The reviewer returned PASS with one P2. A P2 blocks under the fix-loop rule, so the orchestrator records the round as FAIL. One read path, failure codes, handle lifetime, 1a/1b/darwin module and the release bundle all verified, including a fresh frozen install and a bundle build.

NITs

• F2: index.ts:1686 the gate reads the compatibility tier, which never adds pending-source-changes, so the issues.every(pending-source-changes) branch is dead; remove it.
• F3: read-session.ts:204-207 a missing codegraph.db maps to not-initialized against the design table's index-missing, undeclared in the PR body; a dangling .codegraph symlink returns index-missing because existsSync runs before lstat.
• F4: read-session.ts:208 the build lock is checked once before the open; a sync that starts afterwards can tear compatibility() and getFiles(). Re-check after the reads and cover a live writer in the Node integration script.
• F5: index.ts:1925 loadCapabilityCodeGraphProjectionInputs runs Bun.gc(true) on win32 even when no selector index was opened; guard it.
• F6: cli/bin/bun-darwin-sqlite.ts:22,41 the CI stderr diagnostic line from the probe is still present; the exists seam and 1a have no test.
• F7: projection-codegraph-status.test.ts removed cases (packaged shim with no platform bundle, CODEGRAPH_NO_DOWNLOAD, worktree-mismatch) are not listed in the PR body.
• F8: PR body test budget counts are slightly off: product +575/-136 and tests +556/-289 by numstat.
• F9: The SDK's validateDirectory rewrites .codegraph/.gitignore on a readOnly openSync when it is missing or an old default, outside ADR-0058 Decision 4; provider behavior to record on #574 or amend in S6.

[Ancienttwo]

repo-harness acceptance record
Claim: #589 (comment)

Round	Role	Subject	Verdict
1	pi (claude-opus-5-5), read-only	35795ac7546e3f5ae250a092b22bff1d97c7421a	FAIL: 1 P2, 8 P3

Model relation: same-family

Findings:

• P2 F1 at packages/local-runtime/codegraph-adapter/src/index.ts:1199: S1 split the shared inspectRepositoryCodeFacts into a CLI-only copy, inspectSnapshotCodeFactsByCli (--version + status -j), so the same readiness facts can still be read two ways; its CodeGraphSnapshotOptions {binary, timeouts} parameter is never passed by any caller. -> Have withExistingCodeGraphSnapshot call the session-based inspectRepositoryCodeFacts(snapshotRoot) and delete the CLI probe and CodeGraphSnapshotOptions.
• P3 F2: index.ts:1686 the gate reads the compatibility tier, which never adds pending-source-changes, so the issues.every(pending-source-changes) branch is dead; remove it.
• P3 F3: read-session.ts:204-207 a missing codegraph.db maps to not-initialized against the design table's index-missing, undeclared in the PR body; a dangling .codegraph symlink returns index-missing because existsSync runs before lstat.
• P3 F4: read-session.ts:208 the build lock is checked once before the open; a sync that starts afterwards can tear compatibility() and getFiles(). Re-check after the reads and cover a live writer in the Node integration script.
• P3 F5: index.ts:1925 loadCapabilityCodeGraphProjectionInputs runs Bun.gc(true) on win32 even when no selector index was opened; guard it.
• P3 F6: cli/bin/bun-darwin-sqlite.ts:22,41 the CI stderr diagnostic line from the probe is still present; the exists seam and 1a have no test.
• P3 F7: projection-codegraph-status.test.ts removed cases (packaged shim with no platform bundle, CODEGRAPH_NO_DOWNLOAD, worktree-mismatch) are not listed in the PR body.
• P3 F8: PR body test budget counts are slightly off: product +575/-136 and tests +556/-289 by numstat.
• P3 F9: The SDK's validateDirectory rewrites .codegraph/.gitignore on a readOnly openSync when it is missing or an old default, outside ADR-0058 Decision 4; provider behavior to record on codegraph-adapter: read the index only through the in-process read-only handle #574 or amend in S6.

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 2
Subject: f2a38df
Tier: high
Agent: codex (gpt-6.1-terra), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 2
Subject: f2a38df
Tier: high
Verdict: FAIL
Reviewer: codex (gpt-6.1-terra)
Model relation: different-family

Round-2 delta review. All three round-1 findings are resolved: a missing database maps to index-missing, the G4 lock and revision checks are in, and the PR body justifies the changed assertions. The launcher change keeps its assertions. Two failure-classification defects remain on the new paths.

NITs

None.

[Ancienttwo]

repo-harness acceptance record
Claim: #589 (comment)

Round	Role	Subject	Verdict
2	codex (gpt-6.1-terra), read-only	f2a38dfb27f5e7894a63aaa6ac31f1e86a615f41	FAIL: 2 P2

Model relation: different-family

Findings:

• P2 R2-1 at packages/local-runtime/codegraph-adapter/src/index.ts:1260: The snapshot uses the session inspector but converts every unavailable result to code-facts-unavailable, so a real index-open-failed loses its C2 reason on the flows check --no-sync path. -> Preserve index-open-failed when propagating the inspector result, and cover the mapping.
• P2 R2-2 at packages/local-runtime/codegraph-adapter/src/read-session.ts:208: Every lstatSync error maps to index-missing, including permission and I/O errors, which do not establish that the index is absent. -> Map absence errors (ENOENT) to index-missing and other access failures to index-open-failed.

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 2
Subject: f2a38df
Tier: high
Agent: pi (claude-opus-5-5), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 2
Subject: f2a38df
Tier: high
Verdict: PASS
Reviewer: pi (claude-opus-5-5)
Model relation: same-family

Round-2 review by a fresh same-family context (Pi, Opus 5.5). Round-1 F1 to F3 are resolved. Re-verified: frozen install, tsc clean, 165 pass across the adapter, not-ready, doctor, debt and protocol suites, 17 pass for flow-selector-check plus ref-impact, and test:codegraph-selector-node under Node 24. P3 notes only.

NITs

• R1: projection-codegraph-status.test.ts:181: with readFails the fake's getIndexRevision throws at open, so the 'read fails after the open' test exercises the open path; no test reaches the inspect-level catch after a good open.
• R2: index.ts:1662: when moving is true and the bundle version is not the pin, the refusal carries install-compatible-codegraph with retryable true; retrying cannot fix a version mismatch.
• R3: read-session.ts:212-219: a 0-byte or schema-less codegraph.db now gives index-open-failed where it gave not-initialized; the PR body does not mention it.
• R4: bun-darwin-sqlite.ts:22 and main.ts:3454: selectDarwinSqliteLibrary and the Bun-only execArgv forwarding have no unit test.
• R5: No live-writer or live-WAL case; the SDK open can rewrite .codegraph/.gitignore outside ADR-0058 Decision 4. Record both for S6.

[Ancienttwo]

repo-harness acceptance record
Claim: #589 (comment)

Round	Role	Subject	Verdict
2	pi (claude-opus-5-5), read-only	f2a38dfb27f5e7894a63aaa6ac31f1e86a615f41	PASS: 5 P3

Model relation: same-family

Findings:

• P3 R1: projection-codegraph-status.test.ts:181: with readFails the fake's getIndexRevision throws at open, so the 'read fails after the open' test exercises the open path; no test reaches the inspect-level catch after a good open.
• P3 R2: index.ts:1662: when moving is true and the bundle version is not the pin, the refusal carries install-compatible-codegraph with retryable true; retrying cannot fix a version mismatch.
• P3 R3: read-session.ts:212-219: a 0-byte or schema-less codegraph.db now gives index-open-failed where it gave not-initialized; the PR body does not mention it.
• P3 R4: bun-darwin-sqlite.ts:22 and main.ts:3454: selectDarwinSqliteLibrary and the Bun-only execArgv forwarding have no unit test.
• P3 R5: No live-writer or live-WAL case; the SDK open can rewrite .codegraph/.gitignore outside ADR-0058 Decision 4. Record both for S6.

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 3
Subject: 9db4488
Tier: high
Agent: codex (gpt-6.1-terra), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 3
Subject: 9db4488
Tier: high
Verdict: FAIL
Reviewer: codex (gpt-6.1-terra)
Model relation: different-family

Round-3 delta review against the clean merge of f2a38df with 60f2968. R2-1 is resolved (the snapshot keeps index-open-failed). R2-2 is resolved for lstat(.codegraph), but the following database existence check still collapses access errors into index-missing. The changed handle paths close explicitly, including when the initial revision read fails; Windows CI on this head decides the GC removal.

NITs

None.

[Ancienttwo]

repo-harness acceptance record
Claim: #589 (comment)

Round	Role	Subject	Verdict
3	codex (gpt-6.1-terra), read-only	9db4488bb936bc17d090dc7d868fba9729081750	FAIL: 1 P2

Model relation: different-family

Findings:

• P2 R3-1 at packages/local-runtime/codegraph-adapter/src/read-session.ts:206: existsSync(codegraph.db) returns false for access failures as well as absence; if .codegraph can be lstated but not traversed, an existing database is reported as index-missing rather than index-open-failed. -> Use a database check that distinguishes ENOENT/ENOTDIR from permission and I/O failures, and cover the classification.

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 3
Subject: 9db4488
Tier: high
Agent: pi (claude-opus-5-5), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 3
Subject: 9db4488
Tier: high
Verdict: PASS
Reviewer: pi (claude-opus-5-5)
Model relation: same-family

Round-3 review (Pi, Opus 5.5) with Bun 1.4.4 on a git archive copy of 9db4488: tsc clean; 184 pass across the adapter, not-ready, doctor, debt, protocol, flow-selector-check and ref-impact suites; test:codegraph-selector-node verified under Node 24. Round-2 notes resolved, no handle references collectReleasedCodeGraphHandles, the darwin module is still needed and fails closed without it, and the PR changes no byte of bun.lock. P3 notes only.

NITs

• F1: The PR body still says lstat(.codegraph) failure gives index-missing; the code maps only ENOENT/ENOTDIR there, and no test covers the non-ENOENT branch.
• F2: Carried over: selectDarwinSqliteLibrary and 1a have no unit test, and there is no live-writer case.
• F3: index.ts:1263-1264 the comment saying Node owns all SDK/SQLite handles is stale now that snapshot readiness opens in-process under Bun, and the snapshot's rmSync(temporaryRoot) has no retries; Windows CI on this head decides it.
• F4: Dropping 2a and the 1b lock edit departs from the recorded #574 decisions; the reasons are only in the PR body.

[Ancienttwo]

repo-harness acceptance record
Claim: #589 (comment)

Round	Role	Subject	Verdict
3	pi (claude-opus-5-5), read-only	9db4488bb936bc17d090dc7d868fba9729081750	PASS: 4 P3

Model relation: same-family

Findings:

• P3 F1: The PR body still says lstat(.codegraph) failure gives index-missing; the code maps only ENOENT/ENOTDIR there, and no test covers the non-ENOENT branch.
• P3 F2: Carried over: selectDarwinSqliteLibrary and 1a have no unit test, and there is no live-writer case.
• P3 F3: index.ts:1263-1264 the comment saying Node owns all SDK/SQLite handles is stale now that snapshot readiness opens in-process under Bun, and the snapshot's rmSync(temporaryRoot) has no retries; Windows CI on this head decides it.
• P3 F4: Dropping 2a and the 1b lock edit departs from the recorded codegraph-adapter: read the index only through the in-process read-only handle #574 decisions; the reasons are only in the PR body.

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 4
Subject: 8649579
Tier: high
Agent: codex (gpt-6.1-terra), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 4
Subject: 8649579
Tier: high
Verdict: PASS
Reviewer: codex (gpt-6.1-terra)
Model relation: different-family

Round-4 delta review (9db4488..8649579). R3-1 is resolved: the database check distinguishes absence (ENOENT/ENOTDIR) from access and I/O failures, which map to index-open-failed. The new permission test would fail on 9db4488 for a non-root POSIX process and skips on win32 and under root. No new defect.

NITs

None.

[Ancienttwo]

repo-harness acceptance record
Claim: #589 (comment)

Round	Role	Subject	Verdict
4	codex (gpt-6.1-terra), read-only	86495797f4e86d4002fb9242b99ce429ceae72f7	PASS: none

Model relation: different-family

Findings:

• none

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 4
Subject: 8649579
Tier: high
Agent: pi (claude-opus-5-5), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 4
Subject: 8649579
Tier: high
Verdict: PASS
Reviewer: pi (claude-opus-5-5)
Model relation: same-family

Round-4 review (Pi, Opus 5.5) with Bun 1.4.4 on a git archive copy of 8649579: tsc clean; 137 pass across codegraph-adapter, code-facts-not-ready, doctor-code-facts and flow-selector-check. Round-3 notes resolved. P3 notes only.

NITs

• G1: index.ts:1232 the private snapshot still pre-checks existsSync(.codegraph/codegraph.db), so an unreadable .codegraph refuses there as index-missing; it fails closed and S4 deletes this path.
• G2: Carried over: darwin module and 1a lack unit tests, no live-writer case, and the #574 record should note the 2a/1b supersession and the S6 follow-ups.

[Ancienttwo]

repo-harness acceptance record
Claim: #589 (comment)

Round	Role	Subject	Verdict
4	pi (claude-opus-5-5), read-only	86495797f4e86d4002fb9242b99ce429ceae72f7	PASS: 2 P3

Model relation: same-family

Findings:

• P3 G1: index.ts:1232 the private snapshot still pre-checks existsSync(.codegraph/codegraph.db), so an unreadable .codegraph refuses there as index-missing; it fails closed and S4 deletes this path.
• P3 G2: Carried over: darwin module and 1a lack unit tests, no live-writer case, and the codegraph-adapter: read the index only through the in-process read-only handle #574 record should note the 2a/1b supersession and the S6 follow-ups.

[Ancienttwo]

The chatgpt-codex-connector summary is for the earlier commit 4cc2537. Its follow-up reports the Codex usage limit, and it left no inline finding. The required High-tier reviews are the GPT and Opus receipts; both are PASS on 8649579 in round 4.

Seat: orchestrator t7

[Ancienttwo]

Joint decision (orchestrator + advisor), 2026-11-14: merge #589 (#574 S1) at 8649579 onto main 60f2968.

• Required CI is green, including the Windows shards. That run shows the GC removal holds under Bun 1.4.4.
• Round 4: GPT PASS with no findings, and Opus PASS with P3 notes only.
• Blocking findings went 4, 2, 1, 0 across the rounds.
• The receipt threads and the bot comment are answered.
• P3 G1 goes away in S4. The S6 scope names the follow-ups: unit tests for the darwin module and 1a, a live-writer test for the read session, and the provider's .gitignore write on open.

Seat: orchestrator t7