fix(intelligence): bound architecture endpoint SQL parameters

[SHAURYAKSHARMA24]

Summary

Use a snapshot-scoped SQL UNION subquery for relationship endpoints instead of one bind parameter per key. Preserve every relationship and the existing API/schema. Add SQL-bound and evidence parity regression.

Linked issue

Related to #508.

Scope

Audit F11; baseline dev df0e82be3d7b2b7d846eefc1bcf82bde834936f2. This corrects independently verified existing behavior and advances the linked issue without adding product scope.

What changed

Use a snapshot-scoped SQL UNION subquery for relationship endpoints instead of one bind parameter per key. Preserve every relationship and the existing API/schema. Add SQL-bound and evidence parity regression.

Acceptance criteria completed

Implementation and targeted regression coverage below. See remaining work for conditions not verified.

Testing performed

28 architecture/authentication explanation tests passed, including 500-method top-level membership and SQL parameter-bound regressions; Ruff passed. Five real HTTP samples: median 75.96ms baseline versus 66.19ms changed; both 399311 bytes and full response JSON equal. Small noisy sample is not a performance guarantee.

Current head: 69dcc1e638792e41e12682bc7eb8a63e68547950; check snapshot appears below.

Screenshots

Local screenshots and browser measurements are recorded in the remediation delivery report where applicable. Backend-only changes use contract/regression evidence.

Security and data considerations

Preserves owner scoping, source provenance, sealed graph contracts and historical data. No security gate weakened. Rollback: revert this scoped commit; see issue for migration/deployment implications.

Dependencies and blocked work

Independent dev-based PR unless explicitly stated in the issue. No unmerged changes included.

Scope changes or remaining work

This fixes parameter growth only. Full payload pagination, symbol inventory memory bounds and browser measurements remain in #506–#508.

Please review @parthrohit22.

Contributor checklist

• Targets dev; dedicated fork branch from latest dev; issue claimed.

• Scope/evidence recorded; unrelated changes and secrets excluded.

• Targeted validation results reported accurately.

• Required current-head CI and maintainer review complete.

Current-head remediation validation

Head: 69dcc1e638792e41e12682bc7eb8a63e68547950.

28 architecture/authentication explanation tests passed, including 500-method top-level membership and SQL parameter-bound regressions; Ruff passed. Five real HTTP samples: median 75.96ms baseline versus 66.19ms changed; both 399311 bytes and full response JSON equal. Small noisy sample is not a performance guarantee.

This fixes parameter growth only. Full payload pagination, symbol inventory memory bounds and browser measurements remain in #506–#508.

Checks at delivery: Repository Hygiene: SUCCESS; Analyze (javascript-typescript): SUCCESS; Analyze (python): SUCCESS; API Contract Drift: SUCCESS; Frontend: FAILURE; Backend: SUCCESS; Docker Build: SUCCESS; Marketing Site: SUCCESS; Prototype Browser Acceptance: SKIPPED; Vercel: FAILURE; CodeQL: SUCCESS. Required checks/reviews must pass before merge; deployment authorization was not granted.

[vercel]

@SHAURYAKSHARMA24 is attempting to deploy a commit to the parthrohit60-3117's projects Team on Vercel.

A member of the Team first needs to authorize it.

[SHAURYAKSHARMA24]

Additional validation

28 architecture/authentication-explanation tests passed after top-level symbol filtering. A 500-method fixture loads one inventory key instead of 501. Five HTTP measurements of 88 nodes/640 edges: baseline median 75.96ms; changed median 66.19ms; both 399311 bytes, complete JSON equal. Small sample; no speedup guarantee.
No merge or public deployment performed.