Sync ctx a4e14d3

GitHub commit: a4e14d3ac2e5af5324d58ff178ce1a9da78cda63

.gitattributes

@@ -1,4 +1,2 @@
-graph/wiki-graph.tar.gz filter=lfs diff=lfs merge=lfs -text
-graph/wiki-graph-runtime.tar.gz filter=lfs diff=lfs merge=lfs -text
-.hypothesis/unicode_data/14.0.0/charmap.json.gz filter=lfs diff=lfs merge=lfs -text
-graph/skills-sh-catalog.json.gz filter=lfs diff=lfs merge=lfs -text
+graph/wiki-graph.tar.gz filter=lfs diff=lfs merge=lfs -text
+graph/wiki-graph-runtime.tar.gz filter=lfs diff=lfs merge=lfs -text

.githooks/pre-commit

@@ -1,44 +1,47 @@
-#!/usr/bin/env bash
-# pre-commit -- refresh cheap repo stats without leaking local wiki state.
-#
-# Enable with:   git config core.hooksPath .githooks
-# Disable with:  git config --unset core.hooksPath
-#
-# This hook intentionally does not rebuild graph/wiki artifacts from
-# ~/.claude/skill-wiki. That directory can contain private local entities.
-# Release graph artifacts must be created by explicit, reproducible commands
-# and staged by the user or CI.
-
-set -u
-
-REPO_ROOT="$(git rev-parse --show-toplevel)"
-UPDATER="$REPO_ROOT/src/update_repo_stats.py"
-
-PYTHON="${PYTHON:-python3}"
-command -v "$PYTHON" >/dev/null 2>&1 || PYTHON="python"
-STATS_TIMEOUT="${CTX_REPO_STATS_TIMEOUT:-240s}"
-
-STAGED_CHANGES=$(git diff --cached --name-only)
-log() { echo "[pre-commit] $*" >&2; }
-
-if echo "$STAGED_CHANGES" | grep -qE '^(README\.md|docs/index\.md|graph/(wiki-graph\.tar\.gz|communities\.json|skills-sh-catalog\.json\.gz)|src/update_repo_stats\.py)$' ; then
-  if [[ -f "$UPDATER" ]]; then
-    STATS_CMD=("$PYTHON" "$UPDATER")
-    if command -v timeout >/dev/null 2>&1; then
-      STATS_CMD=(timeout "$STATS_TIMEOUT" "${STATS_CMD[@]}")
-    fi
-    if ! "${STATS_CMD[@]}" 2> >(sed 's/^/[pre-commit stats] /' >&2); then
-      log "stats updater failed or timed out; continuing without README refresh"
-    elif ! git diff --quiet -- README.md docs/index.md; then
-      git add README.md docs/index.md
-      log "README.md and docs/index.md refreshed and re-staged"
-    fi
-  fi
-fi
-
-if echo "$STAGED_CHANGES" | grep -qE '^(skills|agents|harnesses|imported-skills|graph/skills-sh-catalog\.json\.gz)' ; then
-  log "entity source changed; graph/wiki tarball not rebuilt by pre-commit"
-  log "run the explicit graph release command and stage graph/wiki-graph.tar.gz if needed"
-fi
-
-exit 0
+#!/usr/bin/env bash
+# pre-commit -- refresh cheap repo stats without leaking local wiki state.
+#
+# Enable with:   git config core.hooksPath .githooks
+# Disable with:  git config --unset core.hooksPath
+#
+# This hook intentionally does not rebuild graph/wiki artifacts from
+# ~/.claude/skill-wiki. That directory can contain private local entities.
+# Release graph artifacts must be created by explicit, reproducible commands
+# and staged by the user or CI.
+
+set -u
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+UPDATER="$REPO_ROOT/src/update_repo_stats.py"
+
+PYTHON="${PYTHON:-python3}"
+command -v "$PYTHON" >/dev/null 2>&1 || PYTHON="python"
+STATS_TIMEOUT="${CTX_REPO_STATS_TIMEOUT:-240s}"
+
+STAGED_CHANGES=$(git diff --cached --name-only)
+log() { echo "[pre-commit] $*" >&2; }
+
+if echo "$STAGED_CHANGES" | grep -qE '^(README\.md|docs/(index|knowledge-graph|catalog)\.md|graph/(wiki-graph\.tar\.gz|communities\.json|skills-sh-catalog\.json\.gz)|src/update_repo_stats\.py|src/tests/.*\.py)$' ; then
+  if [[ -f "$UPDATER" ]]; then
+    STATS_CMD=("$PYTHON" "$UPDATER")
+    if echo "$STAGED_CHANGES" | grep -qE '^src/tests/.*\.py$' ; then
+      STATS_CMD=(env CTX_UPDATE_REPO_STATS_LIVE_TESTS=1 "${STATS_CMD[@]}")
+    fi
+    if command -v timeout >/dev/null 2>&1; then
+      STATS_CMD=(timeout "$STATS_TIMEOUT" "${STATS_CMD[@]}")
+    fi
+    if ! "${STATS_CMD[@]}" 2> >(sed 's/^/[pre-commit stats] /' >&2); then
+      log "stats updater failed or timed out; continuing without README refresh"
+    elif ! git diff --quiet -- README.md docs/index.md docs/knowledge-graph.md docs/catalog.md; then
+      git add README.md docs/index.md docs/knowledge-graph.md docs/catalog.md
+      log "README.md, docs/index.md, docs/knowledge-graph.md, and docs/catalog.md refreshed and re-staged"
+    fi
+  fi
+fi
+
+if echo "$STAGED_CHANGES" | grep -qE '^(skills|agents|harnesses|imported-skills|graph/skills-sh-catalog\.json\.gz)' ; then
+  log "entity source changed; graph/wiki tarball not rebuilt by pre-commit"
+  log "run the explicit graph release command and stage graph/wiki-graph.tar.gz if needed"
+fi
+
+exit 0

.github/workflows/clean-host-contract.yml

@@ -1,35 +1,35 @@
-name: Clean Host Contract
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "17 3 * * 1"
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
-permissions:
-  contents: read
-
-jobs:
-  clean-host-contract:
-    name: Clean wheel install and A-Z contract
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Set up Python 3.12
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-          cache: pip
-          cache-dependency-path: pyproject.toml
-
-      - name: Upgrade pip
-        run: python -m pip install --upgrade pip
-
-      - name: Run clean-host contract
-        run: python scripts/clean_host_contract.py --fast
+name: Clean Host Contract
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 3 * * 1"
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+permissions:
+  contents: read
+
+jobs:
+  clean-host-contract:
+    name: Clean wheel install and A-Z contract
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Upgrade pip
+        run: python -m pip install --upgrade pip
+
+      - name: Run clean-host contract
+        run: python scripts/clean_host_contract.py --fast

.github/workflows/docs.yml

@@ -1,73 +1,88 @@
-name: Deploy docs to GitHub Pages
-
-# Build the MkDocs Material site and publish to GitHub Pages on every push
-# to main. Also deployable on demand via the workflow_dispatch trigger.
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - "docs/**"
-      - "mkdocs.yml"
-      - "requirements-docs.txt"
-      - ".github/workflows/docs.yml"
-  workflow_dispatch:
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
-permissions:
-  contents: read
-
-# Allow only one concurrent deploy; cancel in-progress runs on a new push.
-concurrency:
-  group: "pages"
-  cancel-in-progress: true
-
-jobs:
-  build:
-    name: Build site
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0   # Required by mkdocs git-revision plugins if added.
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-          cache: "pip"
-          cache-dependency-path: requirements-docs.txt
-
-      - name: Install docs dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install -r requirements-docs.txt
-
-      - name: Build site (strict)
-        run: |
-          python -m mkdocs build --strict
-
-      - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v5
-        with:
-          path: site
-
-  deploy:
-    name: Deploy to GitHub Pages
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pages: write
-      id-token: write
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - name: Deploy
-        id: deployment
-        uses: actions/deploy-pages@v5
+name: Deploy docs to GitHub Pages
+
+# Build the MkDocs Material site and publish to GitHub Pages on every push
+# to main. Also deployable on demand via the workflow_dispatch trigger.
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "docs/**"
+      - "mkdocs.yml"
+      - "requirements-docs.txt"
+      - ".github/workflows/docs.yml"
+  workflow_dispatch:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+permissions:
+  contents: read
+
+# Allow only one concurrent deploy; cancel in-progress runs on a new push.
+concurrency:
+  group: "pages"
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build site
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0   # Required by mkdocs git-revision plugins if added.
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: requirements-docs.txt
+
+      - name: Install docs dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements-docs.txt
+
+      - name: Build site (strict)
+        run: |
+          python -m mkdocs build --strict
+
+      - name: Archive Pages artifact
+        run: |
+          tar \
+            --dereference --hard-dereference \
+            --directory site \
+            -cvf "$RUNNER_TEMP/artifact.tar" \
+            --exclude=.git \
+            --exclude=.github \
+            --exclude=.[^/]* \
+            .
+
+      - name: Upload Pages artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: github-pages
+          path: ${{ runner.temp }}/artifact.tar
+          retention-days: 1
+          if-no-files-found: error
+          overwrite: true
+
+  deploy:
+    name: Deploy to GitHub Pages
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy
+        id: deployment
+        uses: actions/deploy-pages@v5

.github/workflows/huggingface-sync.yml

@@ -0,0 +1,108 @@
+name: Sync Hugging Face
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  HF_TOKEN: ${{ secrets.HF_TOKEN }}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: "huggingface-sync-main"
+  cancel-in-progress: true
+
+jobs:
+  sync:
+    name: Sync model repo
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          lfs: false
+
+      - name: Skip when HF_TOKEN is not configured
+        if: ${{ env.HF_TOKEN == '' }}
+        run: |
+          echo "::notice title=Hugging Face sync skipped::Set the HF_TOKEN repository secret to publish Stevesolun/ctx automatically."
+
+      - name: Classify sync scope
+        id: scope
+        if: ${{ env.HF_TOKEN != '' }}
+        shell: bash
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+          EVENT_NAME: ${{ github.event_name }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
+            echo "sync_mode=full" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          BASE="$BEFORE_SHA"
+          if [[ -z "$BASE" || "$BASE" =~ ^0+$ ]] || ! git cat-file -e "$BASE^{commit}" 2>/dev/null; then
+            BASE="$(git rev-parse "$HEAD_SHA^")"
+          fi
+          git diff --name-only "$BASE" "$HEAD_SHA" > changed-files.txt
+          python - <<'PY' >> "$GITHUB_OUTPUT"
+          from pathlib import Path
+
+          files = [
+              line.strip().replace("\\", "/")
+              for line in Path("changed-files.txt").read_text(encoding="utf-8").splitlines()
+              if line.strip()
+          ]
+          card_only_prefixes = (".github/", "docs/", "src/tests/")
+          card_only_files = {"README.md", "CHANGELOG.md"}
+          card_only = bool(files) and all(
+              path in card_only_files or path.startswith(card_only_prefixes)
+              for path in files
+          )
+          print(f"sync_mode={'card' if card_only else 'full'}")
+          PY
+
+      - name: Hydrate required graph artifacts from release assets
+        if: ${{ env.HF_TOKEN != '' && steps.scope.outputs.sync_mode == 'full' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          latest_tag="$(gh release view --repo "$GITHUB_REPOSITORY" --json tagName --jq .tagName)"
+          echo "Hydrating graph artifacts from release ${latest_tag}"
+          rm -f graph/wiki-graph.tar.gz graph/wiki-graph-runtime.tar.gz graph/skills-sh-catalog.json.gz
+          gh release download "$latest_tag" --repo "$GITHUB_REPOSITORY" --dir graph --pattern wiki-graph.tar.gz
+          gh release download "$latest_tag" --repo "$GITHUB_REPOSITORY" --dir graph --pattern wiki-graph-runtime.tar.gz
+          gh release download "$latest_tag" --repo "$GITHUB_REPOSITORY" --dir graph --pattern skills-sh-catalog.json.gz
+
+      - name: Set up Python
+        if: ${{ env.HF_TOKEN != '' }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: pyproject.toml
+
+      - name: Install sync dependencies
+        if: ${{ env.HF_TOKEN != '' }}
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]" huggingface_hub
+
+      - name: Sync Hugging Face model repo
+        if: ${{ env.HF_TOKEN != '' }}
+        env:
+          SYNC_MODE: ${{ steps.scope.outputs.sync_mode }}
+        run: |
+          if [[ "$SYNC_MODE" == "card" ]]; then
+            python scripts/sync_huggingface.py --repo . --repo-id Stevesolun/ctx --repo-type model --card-only
+          else
+            python scripts/sync_huggingface.py --repo . --repo-id Stevesolun/ctx --repo-type model
+          fi

.github/workflows/publish.yml

@@ -1,475 +1,481 @@
-name: Publish to PyPI
-
-# Publish claude-ctx to PyPI on every tag that looks like a version
-# (v0.5.0, v0.5.0-rc1, v1.0.0, …). Uses PyPI Trusted Publishing —
-# no API token needed once the pending publisher is configured at
-# https://pypi.org/manage/account/publishing/.
-#
-# Also deployable on demand to TestPyPI via workflow_dispatch. Production
-# PyPI publishes must use a version tag push so graph release assets are
-# uploaded before the wheel is published.
-
-on:
-  push:
-    tags:
-      - "v*"
-  workflow_dispatch:
-    inputs:
-      repository:
-        description: "PyPI repository (pypi or testpypi)"
-        required: true
-        default: "pypi"
-        type: choice
-        options:
-          - pypi
-          - testpypi
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Build sdist + wheel
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    outputs:
-      graph_assets_available: ${{ steps.resolve_graph_lfs.outcome == 'success' }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-
-      - name: Install release tooling
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install ".[dev]" build packaging twine
-
-      - name: Validate release target
-        run: |
-          python - <<'PY'
-          import os
-          import tomllib
-          from packaging.version import Version
-
-          event = os.environ["GITHUB_EVENT_NAME"]
-          target_repository = os.environ.get("INPUT_REPOSITORY", "pypi")
-          ref_type = os.environ.get("GITHUB_REF_TYPE", "")
-          ref_name = os.environ["GITHUB_REF_NAME"]
-
-          if event == "workflow_dispatch" and target_repository == "pypi":
-              raise SystemExit(
-                  "Manual PyPI publish is disabled; push a version tag so "
-                  "graph release assets are uploaded before publishing"
-              )
-          if event == "workflow_dispatch" and target_repository == "testpypi":
-              print(f"manual TestPyPI publish allowed from {ref_type}:{ref_name}")
-              raise SystemExit(0)
-
-          if ref_type != "tag":
-              raise SystemExit(
-                  "PyPI release must run from a version tag; "
-                  f"got {ref_type}:{ref_name}"
-              )
-          tag = ref_name
-          if not tag.startswith("v"):
-              raise SystemExit(f"release tag must start with v: {tag}")
-
-          with open("pyproject.toml", "rb") as fh:
-              package_version = tomllib.load(fh)["project"]["version"]
-
-          tag_version = str(Version(tag[1:]))
-          normalized_package_version = str(Version(package_version))
-          if tag_version != normalized_package_version:
-              raise SystemExit(
-                  f"tag {tag!r} does not match pyproject version {package_version!r}"
-              )
-          print(f"release version {package_version} matches tag {tag}")
-          PY
-        env:
-          INPUT_REPOSITORY: ${{ github.event.inputs.repository || 'pypi' }}
-
-      - name: Reject already published PyPI version
-        run: |
-          python - <<'PY'
-          import os
-          import tomllib
-          import urllib.error
-          import urllib.request
-
-          target_repository = os.environ.get("INPUT_REPOSITORY", "pypi")
-          if target_repository != "pypi":
-              print(f"skipping PyPI reuse check for {target_repository}")
-              raise SystemExit(0)
-
-          with open("pyproject.toml", "rb") as fh:
-              project = tomllib.load(fh)["project"]
-
-          name = project["name"]
-          package_version = project["version"]
-          url = f"https://pypi.org/pypi/{name}/{package_version}/json"
-          try:
-              with urllib.request.urlopen(url, timeout=15):
-                  raise SystemExit(
-                      f"{name} {package_version} already exists on PyPI; "
-                      "bump the version before publishing"
-                  )
-          except urllib.error.HTTPError as exc:
-              if exc.code == 404:
-                  print(f"{name} {package_version} is not present on PyPI")
-                  raise SystemExit(0)
-              raise
-          PY
-        env:
-          INPUT_REPOSITORY: ${{ github.event.inputs.repository || 'pypi' }}
-
-      - name: Resolve release graph LFS artifacts
-        id: resolve_graph_lfs
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG_NAME: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          git lfs install --local
-          if git lfs pull --include="graph/wiki-graph.tar.gz,graph/wiki-graph-runtime.tar.gz" --exclude=""; then
-            exit 0
-          fi
-          echo "Git LFS download failed; trying matching prior release asset."
-          python - <<'PY'
-          import hashlib
-          import json
-          import os
-          from pathlib import Path
-          import subprocess
-          import time
-          import urllib.request
-
-          repo = os.environ["GITHUB_REPOSITORY"]
-          current_tag = os.environ.get("TAG_NAME", "")
-          release_asset_wait_seconds = 300
-          release_asset_poll_seconds = 10
-
-          def load_releases() -> list[dict]:
-              return json.loads(subprocess.check_output(
-                  ["gh", "api", f"repos/{repo}/releases?per_page=50"],
-                  text=True,
-              ))
-
-          def hydrate_from_release(path_name: str, hydrated_min_size: int) -> None:
-              graph_tar = Path(path_name)
-              pointer = graph_tar.read_text(encoding="utf-8", errors="replace")
-              expected_oid = ""
-              expected_size = 0
-              for line in pointer.splitlines():
-                  if line.startswith("oid sha256:"):
-                      expected_oid = line.split(":", 1)[1].strip()
-                  elif line.startswith("size "):
-                      expected_size = int(line.split(" ", 1)[1].strip())
-              if not expected_oid:
-                  if graph_tar.stat().st_size > hydrated_min_size:
-                      print(f"{graph_tar} is already hydrated")
-                      return
-                  raise SystemExit(f"{path_name} is neither hydrated nor an LFS pointer")
-
-              deadline = time.monotonic() + release_asset_wait_seconds
-              while True:
-                  candidates = []
-                  for release in load_releases():
-                      tag_name = str(release.get("tag_name") or "")
-                      is_graph_cache = tag_name.startswith("graph-artifacts-")
-                      if release.get("draft") or (
-                          release.get("prerelease") and not is_graph_cache
-                      ):
-                          continue
-                      if tag_name == current_tag:
-                          continue
-                      for asset in release.get("assets", []):
-                          if asset.get("name") != graph_tar.name:
-                              continue
-                          digest = str(asset.get("digest") or "")
-                          size = int(asset.get("size") or 0)
-                          if size != expected_size:
-                              continue
-                          if digest and digest != f"sha256:{expected_oid}":
-                              continue
-                          candidates.append((tag_name, asset))
-
-                  if candidates:
-                      break
-                  if time.monotonic() >= deadline:
-                      raise SystemExit(
-                          f"No previous release asset matches {path_name} "
-                          f"sha256:{expected_oid} size:{expected_size}"
-                      )
-                  print(
-                      f"Waiting for matching release asset {graph_tar.name} "
-                      f"sha256:{expected_oid} size:{expected_size}"
-                  )
-                  time.sleep(release_asset_poll_seconds)
-
-              source_tag, asset = candidates[0]
-              tmp = graph_tar.with_name(f"{graph_tar.name}.download")
-              sha = hashlib.sha256()
-              total = 0
-              with urllib.request.urlopen(asset["browser_download_url"], timeout=300) as resp:  # noqa: S310
-                  with tmp.open("wb") as fh:
-                      while True:
-                          chunk = resp.read(1024 * 1024)
-                          if not chunk:
-                              break
-                          sha.update(chunk)
-                          total += len(chunk)
-                          fh.write(chunk)
-              actual_oid = sha.hexdigest()
-              if actual_oid != expected_oid or total != expected_size:
-                  tmp.unlink(missing_ok=True)
-                  raise SystemExit(
-                      f"Downloaded {path_name} does not match LFS pointer: "
-                      f"sha256:{actual_oid} size:{total}"
-                  )
-              tmp.replace(graph_tar)
-              print(
-                  f"Hydrated {path_name} from {source_tag} release asset "
-                  f"sha256:{actual_oid} size:{total}"
-              )
-
-          hydrate_from_release("graph/wiki-graph.tar.gz", 100_000_000)
-          hydrate_from_release("graph/wiki-graph-runtime.tar.gz", 10_000_000)
-          PY
-
-      - name: Validate release graph artifacts
-        if: steps.resolve_graph_lfs.outcome == 'success'
-        run: |
-          python src/validate_graph_artifacts.py \
-            --graph-dir graph \
-            --deep \
-            --min-nodes 100000 \
-            --min-edges 2000000 \
-            --min-skills-sh-nodes 89000 \
-            --min-semantic-edges 1000000 \
-            --expected-nodes 102928 \
-            --expected-edges 2913960 \
-            --expected-semantic-edges 1683193 \
-            --expected-harness-nodes 207 \
-            --expected-skills-sh-nodes 89471 \
-            --expected-skills-sh-catalog-entries 89465 \
-            --expected-skills-sh-converted 89465 \
-            --expected-skill-pages 91464 \
-            --expected-agent-pages 467 \
-            --expected-mcp-pages 10790 \
-            --expected-harness-pages 207 \
-            --line-threshold 180 \
-            --max-stage-lines 40
-
-      - name: Validate README and docs stats
-        if: steps.resolve_graph_lfs.outcome == 'success'
-        run: python src/update_repo_stats.py --check
-
-      - name: Static gates
-        run: |
-          python -m ruff check src hooks scripts
-          python -m mypy src
-
-      - name: Clean-host contract
-        run: python scripts/clean_host_contract.py --fast
-
-      - name: Release canary tests
-        run: |
-          python -m pytest -q --no-cov \
-            src/tests/test_ci_classifier.py \
-            src/tests/test_package_scaffold.py \
-            src/tests/test_clean_host_contract.py \
-            src/tests/test_alive_loop_e2e.py
-
-      - name: Build distributions
-        run: python -m build
-
-      - name: Check distributions
-        run: python -m twine check dist/*
-
-      - name: Check distribution contents
-        run: |
-          python - <<'PY'
-          import tarfile
-          import zipfile
-          from pathlib import Path
-
-          wheel = next(Path("dist").glob("*.whl"))
-          sdist = next(Path("dist").glob("*.tar.gz"))
-
-          with zipfile.ZipFile(wheel) as zf:
-              wheel_names = set(zf.namelist())
-          required = {"ctx/config.json", "ctx/skill-registry.json"}
-          missing = sorted(required - wheel_names)
-          if missing:
-              raise SystemExit(f"wheel missing packaged defaults: {missing}")
-
-          with tarfile.open(sdist, "r:gz") as tf:
-              names = set(tf.getnames())
-          forbidden = ("/src/tests/", "/.claude/", "/.a5c/")
-          leaked = sorted(name for name in names if any(part in name for part in forbidden))
-          if leaked:
-              raise SystemExit("sdist contains local/test artifacts:\n" + "\n".join(leaked[:20]))
-          print(f"checked distribution contents: {wheel.name}, {sdist.name}")
-          PY
-
-      - name: Smoke install wheel
-        run: |
-          python -m venv .venv-smoke
-          . .venv-smoke/bin/activate
-          python -m pip install --upgrade pip
-          wheel="$(python - <<'PY'
-          from pathlib import Path
-          print(next(Path("dist").glob("*.whl")))
-          PY
-          )"
-          python -m pip install "$wheel"
-          python -m pip check
-          python - <<'PY'
-          import tomllib
-          from importlib.metadata import entry_points, version
-
-          import ctx
-          import ctx_config
-
-          with open("pyproject.toml", "rb") as fh:
-              expected_scripts = set(tomllib.load(fh)["project"]["scripts"])
-
-          dist_version = version("claude-ctx")
-          if ctx.__version__ != dist_version:
-              raise SystemExit(
-                  f"ctx.__version__={ctx.__version__!r} != metadata {dist_version!r}"
-              )
-          if ctx_config.cfg.recommendation_top_k != 5:
-              raise SystemExit("packaged default config was not loaded")
-          scripts = {
-              ep.name: ep for ep in entry_points(group="console_scripts")
-              if ep.name == "ctx" or ep.name.startswith("ctx-")
-          }
-          missing = sorted(expected_scripts - set(scripts))
-          extra = sorted(set(scripts) - expected_scripts)
-          if missing or extra:
-              raise SystemExit(
-                  "wheel console-script surface mismatch\n"
-                  f"missing: {missing}\n"
-                  f"extra: {extra}"
-              )
-          failures = []
-          for ep in scripts.values():
-              try:
-                  ep.load()
-              except Exception as exc:
-                  failures.append(f"{ep.name}: {exc!r}")
-          if failures:
-              raise SystemExit("console script load failures:\n" + "\n".join(failures))
-          unsafe_help = {"ctx-mcp-server"}
-          safe_help = sorted(expected_scripts - unsafe_help)
-          with open("ctx-console-help.txt", "w", encoding="utf-8", newline="\n") as fh:
-              fh.write("\n".join(safe_help) + "\n")
-          print(
-              f"loaded {len(scripts)} ctx console scripts from wheel "
-              f"{dist_version}; help-smoke={len(safe_help)}"
-          )
-          PY
-          while IFS= read -r cmd; do
-            cmd="${cmd%$'\r'}"
-            [[ -z "$cmd" ]] && continue
-            echo "help smoke: $cmd"
-            "$cmd" --help >/dev/null
-          done < ctx-console-help.txt
-          python -m pip install "${wheel}[harness]"
-          python - <<'PY'
-          import litellm
-
-          print(f"harness extra import ok: litellm {getattr(litellm, '__version__', 'unknown')}")
-          PY
-
-      - name: Upload dist artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: dist
-          path: dist/
-
-      - name: Upload graph artifact bundle
-        if: steps.resolve_graph_lfs.outcome == 'success'
-        uses: actions/upload-artifact@v7
-        with:
-          name: graph-release-assets
-          path: |
-            graph/wiki-graph.tar.gz
-            graph/wiki-graph-runtime.tar.gz
-            graph/skills-sh-catalog.json.gz
-            graph/communities.json
-            graph/entity-overlays.jsonl
-
-  release-assets:
-    name: Upload graph release assets
-    needs: build
-    if: github.event_name == 'push' && needs.build.outputs.graph_assets_available == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Download graph artifact bundle
-        uses: actions/download-artifact@v7
-        with:
-          name: graph-release-assets
-          path: graph-release-assets
-
-      - name: Upload graph assets to GitHub release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG_NAME: ${{ github.ref_name }}
-        run: |
-          gh release view "$TAG_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1 \
-            || gh release create "$TAG_NAME" \
-              --repo "$GITHUB_REPOSITORY" \
-              --title "$TAG_NAME" \
-              --notes "ctx $TAG_NAME"
-          gh release upload "$TAG_NAME" \
-            --repo "$GITHUB_REPOSITORY" \
-            graph-release-assets/wiki-graph.tar.gz \
-            graph-release-assets/wiki-graph-runtime.tar.gz \
-            graph-release-assets/skills-sh-catalog.json.gz \
-            graph-release-assets/communities.json \
-            graph-release-assets/entity-overlays.jsonl \
-            --clobber
-
-  publish:
-    name: Publish to PyPI
-    needs:
-      - build
-      - release-assets
-    if: ${{ always() && needs.build.result == 'success' && (needs.release-assets.result == 'success' || (github.event_name == 'workflow_dispatch' && github.event.inputs.repository == 'testpypi')) }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write   # required for Trusted Publishing
-    environment:
-      name: pypi
-      url: https://pypi.org/project/claude-ctx/
-    steps:
-      - name: Download dist artifact
-        uses: actions/download-artifact@v7
-        with:
-          name: dist
-          path: dist/
-
-      - name: Publish to PyPI
-        if: github.event_name == 'push'
-        uses: pypa/gh-action-pypi-publish@release/v1
-
-      - name: Publish to TestPyPI
-        if: github.event_name == 'workflow_dispatch' && github.event.inputs.repository == 'testpypi'
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          repository-url: https://test.pypi.org/legacy/
+name: Publish to PyPI
+
+# Publish claude-ctx to PyPI on every tag that looks like a version
+# (v0.5.0, v0.5.0-rc1, v1.0.0, …). Uses PyPI Trusted Publishing —
+# no API token needed once the pending publisher is configured at
+# https://pypi.org/manage/account/publishing/.
+#
+# Also deployable on demand to TestPyPI via workflow_dispatch. Production
+# PyPI publishes must use a version tag push so graph release assets are
+# uploaded before the wheel is published.
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      repository:
+        description: "PyPI repository (pypi or testpypi)"
+        required: true
+        default: "pypi"
+        type: choice
+        options:
+          - pypi
+          - testpypi
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build sdist + wheel
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      graph_assets_available: ${{ steps.resolve_graph_assets.outcome == 'success' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install release tooling
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev]" build packaging twine
+
+      - name: Validate release target
+        run: |
+          python - <<'PY'
+          import os
+          import tomllib
+          from packaging.version import Version
+
+          event = os.environ["GITHUB_EVENT_NAME"]
+          target_repository = os.environ.get("INPUT_REPOSITORY", "pypi")
+          ref_type = os.environ.get("GITHUB_REF_TYPE", "")
+          ref_name = os.environ["GITHUB_REF_NAME"]
+
+          if event == "workflow_dispatch" and target_repository == "pypi":
+              raise SystemExit(
+                  "Manual PyPI publish is disabled; push a version tag so "
+                  "graph release assets are uploaded before publishing"
+              )
+          if event == "workflow_dispatch" and target_repository == "testpypi":
+              print(f"manual TestPyPI publish allowed from {ref_type}:{ref_name}")
+              raise SystemExit(0)
+
+          if ref_type != "tag":
+              raise SystemExit(
+                  "PyPI release must run from a version tag; "
+                  f"got {ref_type}:{ref_name}"
+              )
+          tag = ref_name
+          if not tag.startswith("v"):
+              raise SystemExit(f"release tag must start with v: {tag}")
+
+          with open("pyproject.toml", "rb") as fh:
+              package_version = tomllib.load(fh)["project"]["version"]
+
+          tag_version = str(Version(tag[1:]))
+          normalized_package_version = str(Version(package_version))
+          if tag_version != normalized_package_version:
+              raise SystemExit(
+                  f"tag {tag!r} does not match pyproject version {package_version!r}"
+              )
+          print(f"release version {package_version} matches tag {tag}")
+          PY
+        env:
+          INPUT_REPOSITORY: ${{ github.event.inputs.repository || 'pypi' }}
+
+      - name: Reject already published PyPI version
+        run: |
+          python - <<'PY'
+          import os
+          import tomllib
+          import urllib.error
+          import urllib.request
+
+          target_repository = os.environ.get("INPUT_REPOSITORY", "pypi")
+          if target_repository != "pypi":
+              print(f"skipping PyPI reuse check for {target_repository}")
+              raise SystemExit(0)
+
+          with open("pyproject.toml", "rb") as fh:
+              project = tomllib.load(fh)["project"]
+
+          name = project["name"]
+          package_version = project["version"]
+          url = f"https://pypi.org/pypi/{name}/{package_version}/json"
+          try:
+              with urllib.request.urlopen(url, timeout=15):
+                  raise SystemExit(
+                      f"{name} {package_version} already exists on PyPI; "
+                      "bump the version before publishing"
+                  )
+          except urllib.error.HTTPError as exc:
+              if exc.code == 404:
+                  print(f"{name} {package_version} is not present on PyPI")
+                  raise SystemExit(0)
+              raise
+          PY
+        env:
+          INPUT_REPOSITORY: ${{ github.event.inputs.repository || 'pypi' }}
+
+      - name: Resolve release graph artifacts from release assets
+        id: resolve_graph_assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          echo "Resolving graph artifacts from matching release assets to avoid Git LFS bandwidth."
+          python - <<'PY'
+          import hashlib
+          import json
+          import os
+          from pathlib import Path
+          import subprocess
+          import time
+          import urllib.request
+
+          repo = os.environ["GITHUB_REPOSITORY"]
+          current_tag = os.environ.get("TAG_NAME", "")
+          release_asset_wait_seconds = 300
+          release_asset_poll_seconds = 10
+          expected_graph_assets = {
+              "graph/wiki-graph.tar.gz": {
+                  "sha256": "91b30795e7d200cf31a62a8749969d12658f5f74636d2de06d6b2b24b393c12f",
+                  "size": 457545675,
+              },
+              "graph/wiki-graph-runtime.tar.gz": {
+                  "sha256": "334fb19bace3fd6e4b92087850f17297fb248032957d123f3f1432dfde2e36c0",
+                  "size": 175773376,
+              },
+          }
+
+          def load_releases() -> list[dict]:
+              return json.loads(subprocess.check_output(
+                  ["gh", "api", f"repos/{repo}/releases?per_page=50"],
+                  text=True,
+              ))
+
+          def hydrate_from_release(path_name: str, hydrated_min_size: int) -> None:
+              graph_tar = Path(path_name)
+              fallback = expected_graph_assets[path_name]
+              expected_oid = fallback["sha256"]
+              expected_size = int(fallback["size"])
+              if graph_tar.exists():
+                  pointer = graph_tar.read_text(encoding="utf-8", errors="replace")
+                  for line in pointer.splitlines():
+                      if line.startswith("oid sha256:"):
+                          expected_oid = line.split(":", 1)[1].strip()
+                      elif line.startswith("size "):
+                          expected_size = int(line.split(" ", 1)[1].strip())
+                  if not pointer.startswith("version https://git-lfs.github.com/spec/v1") and graph_tar.stat().st_size > hydrated_min_size:
+                      print(f"{graph_tar} is already hydrated")
+                      return
+
+              deadline = time.monotonic() + release_asset_wait_seconds
+              while True:
+                  candidates = []
+                  for release in load_releases():
+                      tag_name = str(release.get("tag_name") or "")
+                      is_graph_cache = tag_name.startswith("graph-artifacts-")
+                      if release.get("draft") or (
+                          release.get("prerelease") and not is_graph_cache
+                      ):
+                          continue
+                      if tag_name == current_tag:
+                          continue
+                      for asset in release.get("assets", []):
+                          if asset.get("name") != graph_tar.name:
+                              continue
+                          digest = str(asset.get("digest") or "")
+                          size = int(asset.get("size") or 0)
+                          if size != expected_size:
+                              continue
+                          if digest and digest != f"sha256:{expected_oid}":
+                              continue
+                          candidates.append((tag_name, asset))
+
+                  if candidates:
+                      break
+                  if time.monotonic() >= deadline:
+                      raise SystemExit(
+                          f"No previous release asset matches {path_name} "
+                          f"sha256:{expected_oid} size:{expected_size}"
+                      )
+                  print(
+                      f"Waiting for matching release asset {graph_tar.name} "
+                      f"sha256:{expected_oid} size:{expected_size}"
+                  )
+                  time.sleep(release_asset_poll_seconds)
+
+              source_tag, asset = candidates[0]
+              tmp = graph_tar.with_name(f"{graph_tar.name}.download")
+              sha = hashlib.sha256()
+              total = 0
+              with urllib.request.urlopen(asset["browser_download_url"], timeout=300) as resp:  # noqa: S310
+                  with tmp.open("wb") as fh:
+                      while True:
+                          chunk = resp.read(1024 * 1024)
+                          if not chunk:
+                              break
+                          sha.update(chunk)
+                          total += len(chunk)
+                          fh.write(chunk)
+              actual_oid = sha.hexdigest()
+              if actual_oid != expected_oid or total != expected_size:
+                  tmp.unlink(missing_ok=True)
+                  raise SystemExit(
+                      f"Downloaded {path_name} does not match LFS pointer: "
+                      f"sha256:{actual_oid} size:{total}"
+                  )
+              tmp.replace(graph_tar)
+              print(
+                  f"Hydrated {path_name} from {source_tag} release asset "
+                  f"sha256:{actual_oid} size:{total}"
+              )
+
+          hydrate_from_release("graph/wiki-graph.tar.gz", 100_000_000)
+          hydrate_from_release("graph/wiki-graph-runtime.tar.gz", 10_000_000)
+          PY
+
+      - name: Validate release graph artifacts
+        if: steps.resolve_graph_assets.outcome == 'success'
+        run: |
+          python src/validate_graph_artifacts.py \
+            --graph-dir graph \
+            --deep \
+            --min-nodes 100000 \
+            --min-edges 2000000 \
+            --min-skills-sh-nodes 89000 \
+            --min-semantic-edges 1000000 \
+            --expected-nodes 102928 \
+            --expected-edges 2913960 \
+            --expected-semantic-edges 1683193 \
+            --expected-harness-nodes 207 \
+            --expected-skills-sh-nodes 89471 \
+            --expected-skills-sh-catalog-entries 89465 \
+            --expected-skills-sh-converted 89465 \
+            --expected-skill-pages 91464 \
+            --expected-agent-pages 467 \
+            --expected-mcp-pages 10790 \
+            --expected-harness-pages 207 \
+            --line-threshold 180 \
+            --max-stage-lines 40
+
+      - name: Validate README and docs stats
+        if: steps.resolve_graph_assets.outcome == 'success'
+        run: python src/update_repo_stats.py --check
+
+      - name: Static gates
+        run: |
+          python -m ruff check src hooks scripts
+          python -m mypy src
+
+      - name: Clean-host contract
+        run: python scripts/clean_host_contract.py --fast
+
+      - name: Release canary tests
+        run: |
+          python -m pytest -q --no-cov \
+            src/tests/test_ci_classifier.py \
+            src/tests/test_package_scaffold.py \
+            src/tests/test_clean_host_contract.py \
+            src/tests/test_alive_loop_e2e.py
+
+      - name: Build distributions
+        run: python -m build
+
+      - name: Check distributions
+        run: python -m twine check dist/*
+
+      - name: Check distribution contents
+        run: |
+          python - <<'PY'
+          import tarfile
+          import zipfile
+          from pathlib import Path
+
+          wheel = next(Path("dist").glob("*.whl"))
+          sdist = next(Path("dist").glob("*.tar.gz"))
+
+          with zipfile.ZipFile(wheel) as zf:
+              wheel_names = set(zf.namelist())
+          required = {"ctx/config.json", "ctx/skill-registry.json"}
+          missing = sorted(required - wheel_names)
+          if missing:
+              raise SystemExit(f"wheel missing packaged defaults: {missing}")
+
+          with tarfile.open(sdist, "r:gz") as tf:
+              names = set(tf.getnames())
+          forbidden = ("/src/tests/", "/.claude/", "/.a5c/")
+          leaked = sorted(name for name in names if any(part in name for part in forbidden))
+          if leaked:
+              raise SystemExit("sdist contains local/test artifacts:\n" + "\n".join(leaked[:20]))
+          print(f"checked distribution contents: {wheel.name}, {sdist.name}")
+          PY
+
+      - name: Smoke install wheel
+        run: |
+          python -m venv .venv-smoke
+          . .venv-smoke/bin/activate
+          python -m pip install --upgrade pip
+          wheel="$(python - <<'PY'
+          from pathlib import Path
+          print(next(Path("dist").glob("*.whl")))
+          PY
+          )"
+          python -m pip install "$wheel"
+          python -m pip check
+          python - <<'PY'
+          import tomllib
+          from importlib.metadata import entry_points, version
+
+          import ctx
+          import ctx_config
+
+          with open("pyproject.toml", "rb") as fh:
+              expected_scripts = set(tomllib.load(fh)["project"]["scripts"])
+
+          dist_version = version("claude-ctx")
+          if ctx.__version__ != dist_version:
+              raise SystemExit(
+                  f"ctx.__version__={ctx.__version__!r} != metadata {dist_version!r}"
+              )
+          if ctx_config.cfg.recommendation_top_k != 5:
+              raise SystemExit("packaged default config was not loaded")
+          scripts = {
+              ep.name: ep for ep in entry_points(group="console_scripts")
+              if ep.name == "ctx" or ep.name.startswith("ctx-")
+          }
+          missing = sorted(expected_scripts - set(scripts))
+          extra = sorted(set(scripts) - expected_scripts)
+          if missing or extra:
+              raise SystemExit(
+                  "wheel console-script surface mismatch\n"
+                  f"missing: {missing}\n"
+                  f"extra: {extra}"
+              )
+          failures = []
+          for ep in scripts.values():
+              try:
+                  ep.load()
+              except Exception as exc:
+                  failures.append(f"{ep.name}: {exc!r}")
+          if failures:
+              raise SystemExit("console script load failures:\n" + "\n".join(failures))
+          unsafe_help = {"ctx-mcp-server"}
+          safe_help = sorted(expected_scripts - unsafe_help)
+          with open("ctx-console-help.txt", "w", encoding="utf-8", newline="\n") as fh:
+              fh.write("\n".join(safe_help) + "\n")
+          print(
+              f"loaded {len(scripts)} ctx console scripts from wheel "
+              f"{dist_version}; help-smoke={len(safe_help)}"
+          )
+          PY
+          while IFS= read -r cmd; do
+            cmd="${cmd%$'\r'}"
+            [[ -z "$cmd" ]] && continue
+            echo "help smoke: $cmd"
+            "$cmd" --help >/dev/null
+          done < ctx-console-help.txt
+          python -m pip install "${wheel}[harness]"
+          python - <<'PY'
+          import litellm
+
+          print(f"harness extra import ok: litellm {getattr(litellm, '__version__', 'unknown')}")
+          PY
+
+      - name: Upload dist artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+      - name: Upload graph artifact bundle
+        if: steps.resolve_graph_assets.outcome == 'success'
+        uses: actions/upload-artifact@v7
+        with:
+          name: graph-release-assets
+          path: |
+            graph/wiki-graph.tar.gz
+            graph/wiki-graph-runtime.tar.gz
+            graph/skills-sh-catalog.json.gz
+            graph/communities.json
+            graph/entity-overlays.jsonl
+
+  release-assets:
+    name: Upload graph release assets
+    needs: build
+    if: github.event_name == 'push' && needs.build.outputs.graph_assets_available == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download graph artifact bundle
+        uses: actions/download-artifact@v7
+        with:
+          name: graph-release-assets
+          path: graph-release-assets
+
+      - name: Upload graph assets to GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          gh release view "$TAG_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1 \
+            || gh release create "$TAG_NAME" \
+              --repo "$GITHUB_REPOSITORY" \
+              --title "$TAG_NAME" \
+              --notes "ctx $TAG_NAME"
+          gh release upload "$TAG_NAME" \
+            --repo "$GITHUB_REPOSITORY" \
+            graph-release-assets/wiki-graph.tar.gz \
+            graph-release-assets/wiki-graph-runtime.tar.gz \
+            graph-release-assets/skills-sh-catalog.json.gz \
+            graph-release-assets/communities.json \
+            graph-release-assets/entity-overlays.jsonl \
+            --clobber
+
+  publish:
+    name: Publish to PyPI
+    needs:
+      - build
+      - release-assets
+    if: ${{ always() && needs.build.result == 'success' && (needs.release-assets.result == 'success' || (github.event_name == 'workflow_dispatch' && github.event.inputs.repository == 'testpypi')) }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write   # required for Trusted Publishing
+    environment:
+      name: pypi
+      url: https://pypi.org/project/claude-ctx/
+    steps:
+      - name: Download dist artifact
+        uses: actions/download-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        if: github.event_name == 'push'
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+      - name: Publish to TestPyPI
+        if: github.event_name == 'workflow_dispatch' && github.event.inputs.repository == 'testpypi'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/

.github/workflows/test.yml

@@ -1,704 +1,750 @@
-name: Tests
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: tests-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  classify:
-    name: "Change classifier"
-    runs-on: ubuntu-latest
-    outputs:
-      browser_changed: ${{ steps.classify.outputs.browser_changed }}
-      ci_changed: ${{ steps.classify.outputs.ci_changed }}
-      docs_changed: ${{ steps.classify.outputs.docs_changed }}
-      docs_only: ${{ steps.classify.outputs.docs_only }}
-      graph_artifact_changed: ${{ steps.classify.outputs.graph_artifact_changed }}
-      graph_changed: ${{ steps.classify.outputs.graph_changed }}
-      graph_only: ${{ steps.classify.outputs.graph_only }}
-      package_changed: ${{ steps.classify.outputs.package_changed }}
-      similarity_changed: ${{ steps.classify.outputs.similarity_changed }}
-      source_changed: ${{ steps.classify.outputs.source_changed }}
-    steps:
-      - name: Checkout with full history
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-          lfs: false
-
-      - name: Classify changed paths
-        id: classify
-        shell: bash
-        env:
-          BEFORE_SHA: ${{ github.event.before }}
-          EVENT_NAME: ${{ github.event_name }}
-          HEAD_SHA: ${{ github.sha }}
-          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          set -euo pipefail
-          BASE="$BEFORE_SHA"
-          if [[ "$EVENT_NAME" == "pull_request" && -n "$PR_BASE_SHA" ]]; then
-            BASE="$PR_BASE_SHA"
-          fi
-          if [[ -z "$BASE" || "$BASE" =~ ^0+$ ]]; then
-            BASE="$(git rev-list --max-parents=0 "$HEAD_SHA")"
-          fi
-          if git cat-file -e "$BASE^{commit}" 2>/dev/null; then
-            git diff --name-only "$BASE" "$HEAD_SHA" > changed-files.txt
-          elif git cat-file -e "$HEAD_SHA^" 2>/dev/null; then
-            git diff --name-only "$HEAD_SHA^" "$HEAD_SHA" > changed-files.txt
-          else
-            git diff-tree --no-commit-id --name-only -r "$HEAD_SHA" > changed-files.txt
-          fi
-
-          python scripts/ci_classifier.py changed-files.txt
-
-  static:
-    name: "Static quality gates"
-    needs: classify
-    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-          cache: pip
-          cache-dependency-path: pyproject.toml
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install ".[dev]"
-
-      - name: Run static quality gates
-        run: python -m ruff check src hooks scripts && python -m mypy src && python -m pip check
-
-  unit-linux:
-    name: "unit-linux"
-    needs: classify
-    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-          cache: pip
-          cache-dependency-path: pyproject.toml
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install ".[dev]"
-
-      - name: Run tests with coverage gate
-        # Bump this number as the coverage sprint ships - never lower it.
-        run: pytest -q -m "not browser and not integration" --cov=src --cov-report=term-missing --cov-fail-under=40
-
-      - name: Upload coverage artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: coverage
-          path: .coverage
-          include-hidden-files: true
-          retention-days: 7
-
-  similarity-integration:
-    name: "Similarity precision/recall"
-    needs: classify
-    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.similarity_changed == 'true') }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-          cache: pip
-          cache-dependency-path: pyproject.toml
-
-      - name: Install embedding dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install ".[dev,embeddings]"
-
-      - name: Run similarity precision/recall gate
-        env:
-          CTX_REQUIRE_SIMILARITY_EVAL: "1"
-        run: pytest -q --no-cov -m integration src/tests/test_similarity_precision_recall.py
-
-  test:
-    name: pytest (${{ matrix.os }} / py${{ matrix.python-version }})
-    if: ${{ github.event_name != 'pull_request' }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            python-version: "3.12"
-          - os: windows-latest
-            python-version: "3.11"
-          - os: windows-latest
-            python-version: "3.12"
-          - os: macos-latest
-            python-version: "3.11"
-          - os: macos-latest
-            python-version: "3.12"
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ matrix.python-version }}
-          cache: pip
-          cache-dependency-path: pyproject.toml
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install ".[dev]"
-
-      - name: Run tests without coverage
-        run: pytest -q -m "not browser and not integration" --no-cov
-
-  contract-compat:
-    name: "Contract compatibility (${{ matrix.os }})"
-    needs: classify
-    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [windows-latest, macos-latest]
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python 3.12
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install ".[dev]"
-
-      - name: Run cross-OS contract tests
-        run: python -m pytest -q --no-cov src/tests/test_clean_host_contract.py src/tests/test_package_scaffold.py
-
-  e2e-canary:
-    name: "A-Z alive-loop E2E canary"
-    needs: classify
-    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-          cache: pip
-          cache-dependency-path: pyproject.toml
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install ".[dev]"
-
-      - name: Run E2E + fuzz canary suite
-        # These two files pin the critical-path invariants:
-        #   test_alive_loop_e2e.py: A-Z user journey (signals → bundle →
-        #     install → unload → purge) — any handoff regression trips it.
-        #   test_fuzz_yaml_rendering.py: property-based YAML injection
-        #     coverage on install/enrich render_scalar.
-        # They live in the main matrix job already, but pulling them
-        # forward as a separate fail-fast canary surfaces the regression
-        # in seconds instead of waiting for the full test run.
-        run: |
-          pytest -q --no-cov \
-            src/tests/test_alive_loop_e2e.py \
-            src/tests/test_fuzz_yaml_rendering.py
-
-  docs-check:
-    name: "Docs strict build"
-    needs: classify
-    if: ${{ github.event_name == 'pull_request' && needs.classify.outputs.docs_changed == 'true' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-          cache: pip
-          cache-dependency-path: requirements-docs.txt
-
-      - name: Build docs strictly
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install -r requirements-docs.txt
-          python -m mkdocs build --strict
-
-  graph-check:
-    name: "Graph artifact check"
-    needs: classify
-    if: ${{ github.event_name == 'pull_request' && needs.classify.outputs.graph_artifact_changed == 'true' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout graph artifacts
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Resolve graph LFS artifacts
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          git lfs install --local
-          if git lfs pull --include="graph/wiki-graph.tar.gz,graph/wiki-graph-runtime.tar.gz" --exclude=""; then
-            exit 0
-          fi
-          echo "Git LFS download failed; trying matching prior release asset."
-          python - <<'PY'
-          import hashlib
-          import json
-          import os
-          from pathlib import Path
-          import subprocess
-          import time
-          import urllib.request
-
-          repo = os.environ["GITHUB_REPOSITORY"]
-          release_asset_wait_seconds = 300
-          release_asset_poll_seconds = 10
-
-          def load_releases() -> list[dict]:
-              return json.loads(subprocess.check_output(
-                  ["gh", "api", f"repos/{repo}/releases?per_page=50"],
-                  text=True,
-              ))
-
-          def hydrate_from_release(path_name: str, hydrated_min_size: int) -> None:
-              graph_tar = Path(path_name)
-              pointer = graph_tar.read_text(encoding="utf-8", errors="replace")
-              expected_oid = ""
-              expected_size = 0
-              for line in pointer.splitlines():
-                  if line.startswith("oid sha256:"):
-                      expected_oid = line.split(":", 1)[1].strip()
-                  elif line.startswith("size "):
-                      expected_size = int(line.split(" ", 1)[1].strip())
-              if not expected_oid:
-                  if graph_tar.stat().st_size > hydrated_min_size:
-                      print(f"{graph_tar} is already hydrated")
-                      return
-                  raise SystemExit(f"{path_name} is neither hydrated nor an LFS pointer")
-
-              deadline = time.monotonic() + release_asset_wait_seconds
-              while True:
-                  candidates = []
-                  for release in load_releases():
-                      tag_name = str(release.get("tag_name") or "")
-                      is_graph_cache = tag_name.startswith("graph-artifacts-")
-                      if release.get("draft") or (
-                          release.get("prerelease") and not is_graph_cache
-                      ):
-                          continue
-                      for asset in release.get("assets", []):
-                          if asset.get("name") != graph_tar.name:
-                              continue
-                          digest = str(asset.get("digest") or "")
-                          size = int(asset.get("size") or 0)
-                          if size != expected_size:
-                              continue
-                          if digest and digest != f"sha256:{expected_oid}":
-                              continue
-                          candidates.append((tag_name, asset))
-
-                  if candidates:
-                      break
-                  if time.monotonic() >= deadline:
-                      raise SystemExit(
-                          f"No previous release asset matches {path_name} "
-                          f"sha256:{expected_oid} size:{expected_size}"
-                      )
-                  print(
-                      f"Waiting for matching release asset {graph_tar.name} "
-                      f"sha256:{expected_oid} size:{expected_size}"
-                  )
-                  time.sleep(release_asset_poll_seconds)
-
-              source_tag, asset = candidates[0]
-              tmp = graph_tar.with_name(f"{graph_tar.name}.download")
-              sha = hashlib.sha256()
-              total = 0
-              with urllib.request.urlopen(asset["browser_download_url"], timeout=300) as resp:  # noqa: S310
-                  with tmp.open("wb") as fh:
-                      while True:
-                          chunk = resp.read(1024 * 1024)
-                          if not chunk:
-                              break
-                          sha.update(chunk)
-                          total += len(chunk)
-                          fh.write(chunk)
-              actual_oid = sha.hexdigest()
-              if actual_oid != expected_oid or total != expected_size:
-                  tmp.unlink(missing_ok=True)
-                  raise SystemExit(
-                      f"Downloaded {path_name} does not match LFS pointer: "
-                      f"sha256:{actual_oid} size:{total}"
-                  )
-              tmp.replace(graph_tar)
-              print(
-                  f"Hydrated {path_name} from {source_tag} release asset "
-                  f"sha256:{actual_oid} size:{total}"
-              )
-
-          hydrate_from_release("graph/wiki-graph.tar.gz", 100_000_000)
-          hydrate_from_release("graph/wiki-graph-runtime.tar.gz", 10_000_000)
-          PY
-
-      - name: Validate shipped graph artifacts
-        run: |
-          python src/validate_graph_artifacts.py \
-            --graph-dir graph \
-            --deep \
-            --min-nodes 100000 \
-            --min-edges 2000000 \
-            --min-skills-sh-nodes 89000 \
-            --min-semantic-edges 1000000 \
-            --expected-nodes 102928 \
-            --expected-edges 2913960 \
-            --expected-semantic-edges 1683193 \
-            --expected-harness-nodes 207 \
-            --expected-skills-sh-nodes 89471 \
-            --expected-skills-sh-catalog-entries 89465 \
-            --expected-skills-sh-converted 89465 \
-            --expected-skill-pages 91464 \
-            --expected-agent-pages 467 \
-            --expected-mcp-pages 10790 \
-            --expected-harness-pages 207 \
-            --line-threshold 180 \
-            --max-stage-lines 40
-
-  browser-security:
-    name: "Browser monitor security"
-    needs: classify
-    if: ${{ github.event_name == 'push' || needs.classify.outputs.browser_changed == 'true' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python 3.12
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-          cache: pip
-          cache-dependency-path: pyproject.toml
-
-      - name: Install browser Python dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install ".[dev,browser]"
-
-      - name: Detect Playwright version
-        id: playwright
-        run: |
-          python - <<'PY' >> "$GITHUB_OUTPUT"
-          from importlib.metadata import version
-
-          print(f"version={version('playwright')}")
-          PY
-
-      - name: Cache Playwright browsers
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/ms-playwright
-          key: playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}
-
-      - name: Install browser runtime
-        run: |
-          python -m playwright install-deps chromium
-          python -m playwright install chromium
-
-      - name: Run browser security tests
-        run: pytest -q --no-cov -m browser src/tests/test_ctx_monitor_browser.py
-
-  package-build:
-    name: "Build wheel package"
-    needs: classify
-    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python 3.12
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-          cache: pip
-          cache-dependency-path: pyproject.toml
-
-      - name: Build and inspect wheel
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install build twine
-          python -m build
-          python -m twine check dist/*
-          python - <<'PY'
-          from pathlib import Path
-
-          wheels = sorted(Path("dist").glob("*.whl"))
-          if len(wheels) != 1:
-              raise SystemExit(f"expected exactly one wheel, found {len(wheels)}")
-          wheel = wheels[0]
-          if not wheel.name.endswith("-py3-none-any.whl"):
-              message = f"expected a universal pure-Python wheel, got {wheel.name}"
-              raise SystemExit(message)
-          print(f"built package-smoke wheel: {wheel.name}")
-          PY
-
-      - name: Upload wheel artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: package-smoke-wheel
-          path: dist/*.whl
-          retention-days: 7
-
-  package-smoke:
-    name: "Wheel package smoke (${{ matrix.os }})"
-    needs:
-      - classify
-      - package-build
-    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python 3.12
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-          cache: pip
-          cache-dependency-path: pyproject.toml
-
-      - name: Download wheel artifact
-        uses: actions/download-artifact@v7
-        with:
-          name: package-smoke-wheel
-          path: dist
-
-      - name: Install wheel in clean venv
-        run: |
-          python -m venv .venv-smoke
-          if [[ "$RUNNER_OS" == "Windows" ]]; then
-            . .venv-smoke/Scripts/activate
-          else
-            . .venv-smoke/bin/activate
-          fi
-          python -m pip install --upgrade pip
-          python -m pip install dist/*.whl
-          python -m pip check
-          python - <<'PY'
-          import tomllib
-          from importlib.metadata import entry_points, version
-
-          import ctx
-
-          with open("pyproject.toml", "rb") as fh:
-              expected_scripts = set(tomllib.load(fh)["project"]["scripts"])
-
-          dist_version = version("claude-ctx")
-          if ctx.__version__ != dist_version:
-              raise SystemExit(
-                  f"ctx.__version__={ctx.__version__!r} != metadata {dist_version!r}"
-              )
-
-          script_eps = {
-              ep.name: ep
-              for ep in entry_points(group="console_scripts")
-              if ep.name == "ctx" or ep.name.startswith("ctx-")
-          }
-          missing = sorted(expected_scripts - set(script_eps))
-          extra = sorted(set(script_eps) - expected_scripts)
-          if missing or extra:
-              raise SystemExit(
-                  "wheel console-script surface mismatch\n"
-                  f"missing: {missing}\n"
-                  f"extra: {extra}"
-              )
-          failures = []
-          for ep in script_eps.values():
-              try:
-                  ep.load()
-              except Exception as exc:
-                  failures.append(f"{ep.name}: {exc!r}")
-          if failures:
-              raise SystemExit("console script load failures:\n" + "\n".join(failures))
-
-          unsafe_help = {"ctx-mcp-server"}
-          safe_help = sorted(expected_scripts - unsafe_help)
-          with open(
-              "ctx-console-help.txt", "w", encoding="utf-8", newline="\n"
-          ) as fh:
-              fh.write("\n".join(safe_help) + "\n")
-          print(
-              f"loaded {len(script_eps)} ctx console scripts from wheel "
-              f"{dist_version}; help-smoke={len(safe_help)}"
-          )
-          PY
-          while IFS= read -r cmd; do
-            cmd="${cmd%$'\r'}"
-            [[ -z "$cmd" ]] && continue
-            echo "help smoke: $cmd"
-            "$cmd" --help >/dev/null
-          done < ctx-console-help.txt
-
-  clean-host-contract:
-    name: "Clean host contract"
-    needs: classify
-    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python 3.12
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-          cache: pip
-          cache-dependency-path: pyproject.toml
-
-      - name: Upgrade pip
-        run: python -m pip install --upgrade pip
-
-      - name: Run clean-host contract
-        run: python scripts/clean_host_contract.py --fast
-
-  no-test-no-merge:
-    name: "Contract changes must touch tests"
-    needs: classify
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'pull_request' && needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true' }}
-    steps:
-      - name: Checkout with full history
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-          lfs: false
-
-      - name: Enforce test-coverage-per-PR policy
-        # Policy: any product or CI/package contract change
-        # must be accompanied by at least one test file change in the
-        # same PR. Exemptions:
-        #   - Pure docs / comment changes (matched by a trivial heuristic)
-        #   - Config JSON (src/config.json) — schema changes get tests
-        #     for the accessor, not the JSON itself.
-        #   - Changes ONLY inside __pycache__, .pyc files, etc.
-        run: |
-          set -euo pipefail
-          BASE="${{ github.event.pull_request.base.sha }}"
-          HEAD="${{ github.event.pull_request.head.sha }}"
-          LABELS='${{ toJson(github.event.pull_request.labels.*.name) }}'
-          python scripts/ci_no_test_policy.py \
-            --base "$BASE" \
-            --head "$HEAD" \
-            --labels-json "$LABELS"
-
-  ci-required:
-    name: "CI required"
-    runs-on: ubuntu-latest
-    needs:
-      - classify
-      - static
-      - unit-linux
-      - similarity-integration
-      - test
-      - contract-compat
-      - e2e-canary
-      - docs-check
-      - graph-check
-      - browser-security
-      - package-smoke
-      - package-build
-      - clean-host-contract
-      - no-test-no-merge
-    if: ${{ always() }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Check required job results
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          NEEDS_JSON: ${{ toJson(needs) }}
-        run: python scripts/ci_required.py
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: tests-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  classify:
+    name: "Change classifier"
+    runs-on: ubuntu-latest
+    outputs:
+      browser_changed: ${{ steps.classify.outputs.browser_changed }}
+      ci_changed: ${{ steps.classify.outputs.ci_changed }}
+      docs_changed: ${{ steps.classify.outputs.docs_changed }}
+      docs_only: ${{ steps.classify.outputs.docs_only }}
+      graph_artifact_changed: ${{ steps.classify.outputs.graph_artifact_changed }}
+      graph_changed: ${{ steps.classify.outputs.graph_changed }}
+      graph_only: ${{ steps.classify.outputs.graph_only }}
+      package_changed: ${{ steps.classify.outputs.package_changed }}
+      similarity_changed: ${{ steps.classify.outputs.similarity_changed }}
+      source_changed: ${{ steps.classify.outputs.source_changed }}
+    steps:
+      - name: Checkout with full history
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          lfs: false
+
+      - name: Classify changed paths
+        id: classify
+        shell: bash
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+          EVENT_NAME: ${{ github.event_name }}
+          HEAD_SHA: ${{ github.sha }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+          BASE="$BEFORE_SHA"
+          if [[ "$EVENT_NAME" == "pull_request" && -n "$PR_BASE_SHA" ]]; then
+            BASE="$PR_BASE_SHA"
+          fi
+          if [[ -z "$BASE" || "$BASE" =~ ^0+$ ]]; then
+            BASE="$(git rev-list --max-parents=0 "$HEAD_SHA")"
+          fi
+          if git cat-file -e "$BASE^{commit}" 2>/dev/null; then
+            git diff --name-only "$BASE" "$HEAD_SHA" > changed-files.txt
+          elif git cat-file -e "$HEAD_SHA^" 2>/dev/null; then
+            git diff --name-only "$HEAD_SHA^" "$HEAD_SHA" > changed-files.txt
+          else
+            git diff-tree --no-commit-id --name-only -r "$HEAD_SHA" > changed-files.txt
+          fi
+
+          python scripts/ci_classifier.py changed-files.txt
+
+  static:
+    name: "Static quality gates"
+    needs: classify
+    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev]"
+
+      - name: Run static quality gates
+        run: python -m ruff check src hooks scripts && python -m mypy src && python -m pip check
+
+  unit-linux:
+    name: "unit-linux"
+    needs: classify
+    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev]"
+
+      - name: Run tests with coverage gate
+        # Bump this number as the coverage sprint ships - never lower it.
+        run: pytest -q -m "not browser and not integration" --cov=src --cov-report=term-missing --cov-fail-under=40
+
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage
+          path: .coverage
+          include-hidden-files: true
+          retention-days: 7
+
+  similarity-integration:
+    name: "Similarity precision/recall"
+    needs: classify
+    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.similarity_changed == 'true') }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install embedding dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev,embeddings]"
+
+      - name: Cache MiniLM model
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/huggingface
+          key: hf-sentence-transformers-all-MiniLM-L6-v2-v1
+
+      - name: Pre-download MiniLM model
+        env:
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+        run: |
+          python - <<'PY'
+          import time
+          from sentence_transformers import SentenceTransformer
+
+          model = "sentence-transformers/all-MiniLM-L6-v2"
+          for attempt in range(1, 5):
+              try:
+                  SentenceTransformer(model)
+                  print(f"ready: {model}")
+                  break
+              except Exception as exc:
+                  print(f"attempt {attempt} failed: {exc}", flush=True)
+                  if attempt == 4:
+                      raise
+                  time.sleep(15 * attempt)
+          PY
+
+      - name: Run similarity precision/recall gate
+        env:
+          CTX_REQUIRE_SIMILARITY_EVAL: "1"
+        run: pytest -q --no-cov -m integration src/tests/test_similarity_precision_recall.py
+
+  test:
+    name: pytest (${{ matrix.os }} / py${{ matrix.python-version }})
+    if: ${{ github.event_name != 'pull_request' }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            python-version: "3.12"
+          - os: windows-latest
+            python-version: "3.11"
+          - os: windows-latest
+            python-version: "3.12"
+          - os: macos-latest
+            python-version: "3.11"
+          - os: macos-latest
+            python-version: "3.12"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev]"
+
+      - name: Run tests without coverage
+        run: pytest -q -m "not browser and not integration" --no-cov
+
+  contract-compat:
+    name: "Contract compatibility (${{ matrix.os }})"
+    needs: classify
+    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev]"
+
+      - name: Run cross-OS contract tests
+        run: python -m pytest -q --no-cov src/tests/test_clean_host_contract.py src/tests/test_package_scaffold.py
+
+  e2e-canary:
+    name: "A-Z alive-loop E2E canary"
+    needs: classify
+    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev]"
+
+      - name: Run E2E + fuzz canary suite
+        # These two files pin the critical-path invariants:
+        #   test_alive_loop_e2e.py: A-Z user journey (signals → bundle →
+        #     install → unload → purge) — any handoff regression trips it.
+        #   test_fuzz_yaml_rendering.py: property-based YAML injection
+        #     coverage on install/enrich render_scalar.
+        # They live in the main matrix job already, but pulling them
+        # forward as a separate fail-fast canary surfaces the regression
+        # in seconds instead of waiting for the full test run.
+        run: |
+          pytest -q --no-cov \
+            src/tests/test_alive_loop_e2e.py \
+            src/tests/test_fuzz_yaml_rendering.py
+
+  docs-check:
+    name: "Docs strict build"
+    needs: classify
+    if: ${{ github.event_name == 'pull_request' && needs.classify.outputs.docs_changed == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: requirements-docs.txt
+
+      - name: Build docs strictly
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements-docs.txt
+          python -m mkdocs build --strict
+
+  graph-check:
+    name: "Graph artifact check"
+    needs: classify
+    if: ${{ github.event_name == 'pull_request' && needs.classify.outputs.graph_artifact_changed == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout graph artifacts
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install graph check dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev]"
+
+      - name: Resolve graph artifacts from release assets
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          echo "Resolving graph artifacts from matching release assets to avoid Git LFS bandwidth."
+          python - <<'PY'
+          import hashlib
+          import json
+          import os
+          from pathlib import Path
+          import subprocess
+          import time
+          import urllib.request
+
+          repo = os.environ["GITHUB_REPOSITORY"]
+          release_asset_wait_seconds = 300
+          release_asset_poll_seconds = 10
+          expected_graph_assets = {
+              "graph/wiki-graph.tar.gz": {
+                  "sha256": "91b30795e7d200cf31a62a8749969d12658f5f74636d2de06d6b2b24b393c12f",
+                  "size": 457545675,
+              },
+              "graph/wiki-graph-runtime.tar.gz": {
+                  "sha256": "334fb19bace3fd6e4b92087850f17297fb248032957d123f3f1432dfde2e36c0",
+                  "size": 175773376,
+              },
+          }
+
+          def load_releases() -> list[dict]:
+              return json.loads(subprocess.check_output(
+                  ["gh", "api", f"repos/{repo}/releases?per_page=50"],
+                  text=True,
+              ))
+
+          def hydrate_from_release(path_name: str, hydrated_min_size: int) -> None:
+              graph_tar = Path(path_name)
+              fallback = expected_graph_assets[path_name]
+              expected_oid = fallback["sha256"]
+              expected_size = int(fallback["size"])
+              if graph_tar.exists():
+                  pointer = graph_tar.read_text(encoding="utf-8", errors="replace")
+                  for line in pointer.splitlines():
+                      if line.startswith("oid sha256:"):
+                          expected_oid = line.split(":", 1)[1].strip()
+                      elif line.startswith("size "):
+                          expected_size = int(line.split(" ", 1)[1].strip())
+                  if not pointer.startswith("version https://git-lfs.github.com/spec/v1") and graph_tar.stat().st_size > hydrated_min_size:
+                      print(f"{graph_tar} is already hydrated")
+                      return
+
+              deadline = time.monotonic() + release_asset_wait_seconds
+              while True:
+                  candidates = []
+                  for release in load_releases():
+                      tag_name = str(release.get("tag_name") or "")
+                      is_graph_cache = tag_name.startswith("graph-artifacts-")
+                      if release.get("draft") or (
+                          release.get("prerelease") and not is_graph_cache
+                      ):
+                          continue
+                      for asset in release.get("assets", []):
+                          if asset.get("name") != graph_tar.name:
+                              continue
+                          digest = str(asset.get("digest") or "")
+                          size = int(asset.get("size") or 0)
+                          if size != expected_size:
+                              continue
+                          if digest and digest != f"sha256:{expected_oid}":
+                              continue
+                          candidates.append((tag_name, asset))
+
+                  if candidates:
+                      break
+                  if time.monotonic() >= deadline:
+                      raise SystemExit(
+                          f"No previous release asset matches {path_name} "
+                          f"sha256:{expected_oid} size:{expected_size}"
+                      )
+                  print(
+                      f"Waiting for matching release asset {graph_tar.name} "
+                      f"sha256:{expected_oid} size:{expected_size}"
+                  )
+                  time.sleep(release_asset_poll_seconds)
+
+              source_tag, asset = candidates[0]
+              tmp = graph_tar.with_name(f"{graph_tar.name}.download")
+              sha = hashlib.sha256()
+              total = 0
+              with urllib.request.urlopen(asset["browser_download_url"], timeout=300) as resp:  # noqa: S310
+                  with tmp.open("wb") as fh:
+                      while True:
+                          chunk = resp.read(1024 * 1024)
+                          if not chunk:
+                              break
+                          sha.update(chunk)
+                          total += len(chunk)
+                          fh.write(chunk)
+              actual_oid = sha.hexdigest()
+              if actual_oid != expected_oid or total != expected_size:
+                  tmp.unlink(missing_ok=True)
+                  raise SystemExit(
+                      f"Downloaded {path_name} does not match LFS pointer: "
+                      f"sha256:{actual_oid} size:{total}"
+                  )
+              tmp.replace(graph_tar)
+              print(
+                  f"Hydrated {path_name} from {source_tag} release asset "
+                  f"sha256:{actual_oid} size:{total}"
+              )
+
+          hydrate_from_release("graph/wiki-graph.tar.gz", 100_000_000)
+          hydrate_from_release("graph/wiki-graph-runtime.tar.gz", 10_000_000)
+          PY
+
+      - name: Validate shipped graph artifacts
+        run: |
+          python src/validate_graph_artifacts.py \
+            --graph-dir graph \
+            --deep \
+            --min-nodes 100000 \
+            --min-edges 2000000 \
+            --min-skills-sh-nodes 89000 \
+            --min-semantic-edges 1000000 \
+            --expected-nodes 102928 \
+            --expected-edges 2913960 \
+            --expected-semantic-edges 1683193 \
+            --expected-harness-nodes 207 \
+            --expected-skills-sh-nodes 89471 \
+            --expected-skills-sh-catalog-entries 89465 \
+            --expected-skills-sh-converted 89465 \
+            --expected-skill-pages 91464 \
+            --expected-agent-pages 467 \
+            --expected-mcp-pages 10790 \
+            --expected-harness-pages 207 \
+            --line-threshold 180 \
+            --max-stage-lines 40
+
+      - name: Validate README and docs stats
+        run: python src/update_repo_stats.py --check
+
+  browser-security:
+    name: "Browser monitor security"
+    needs: classify
+    if: ${{ github.event_name == 'push' || needs.classify.outputs.browser_changed == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install browser Python dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev,browser]"
+
+      - name: Detect Playwright version
+        id: playwright
+        run: |
+          python - <<'PY' >> "$GITHUB_OUTPUT"
+          from importlib.metadata import version
+
+          print(f"version={version('playwright')}")
+          PY
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}
+
+      - name: Install browser runtime
+        run: |
+          python -m playwright install-deps chromium
+          python -m playwright install chromium
+
+      - name: Run browser security tests
+        run: pytest -q --no-cov -m browser src/tests/test_ctx_monitor_browser.py
+
+  package-build:
+    name: "Build wheel package"
+    needs: classify
+    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Build and inspect wheel
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build twine
+          python -m build
+          python -m twine check dist/*
+          python - <<'PY'
+          from pathlib import Path
+
+          wheels = sorted(Path("dist").glob("*.whl"))
+          if len(wheels) != 1:
+              raise SystemExit(f"expected exactly one wheel, found {len(wheels)}")
+          wheel = wheels[0]
+          if not wheel.name.endswith("-py3-none-any.whl"):
+              message = f"expected a universal pure-Python wheel, got {wheel.name}"
+              raise SystemExit(message)
+          print(f"built package-smoke wheel: {wheel.name}")
+          PY
+
+      - name: Upload wheel artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: package-smoke-wheel
+          path: dist/*.whl
+          retention-days: 7
+
+  package-smoke:
+    name: "Wheel package smoke (${{ matrix.os }})"
+    needs:
+      - classify
+      - package-build
+    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Download wheel artifact
+        uses: actions/download-artifact@v7
+        with:
+          name: package-smoke-wheel
+          path: dist
+
+      - name: Install wheel in clean venv
+        run: |
+          python -m venv .venv-smoke
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            . .venv-smoke/Scripts/activate
+          else
+            . .venv-smoke/bin/activate
+          fi
+          python -m pip install --upgrade pip
+          python -m pip install dist/*.whl
+          python -m pip check
+          python - <<'PY'
+          import tomllib
+          from importlib.metadata import entry_points, version
+
+          import ctx
+
+          with open("pyproject.toml", "rb") as fh:
+              expected_scripts = set(tomllib.load(fh)["project"]["scripts"])
+
+          dist_version = version("claude-ctx")
+          if ctx.__version__ != dist_version:
+              raise SystemExit(
+                  f"ctx.__version__={ctx.__version__!r} != metadata {dist_version!r}"
+              )
+
+          script_eps = {
+              ep.name: ep
+              for ep in entry_points(group="console_scripts")
+              if ep.name == "ctx" or ep.name.startswith("ctx-")
+          }
+          missing = sorted(expected_scripts - set(script_eps))
+          extra = sorted(set(script_eps) - expected_scripts)
+          if missing or extra:
+              raise SystemExit(
+                  "wheel console-script surface mismatch\n"
+                  f"missing: {missing}\n"
+                  f"extra: {extra}"
+              )
+          failures = []
+          for ep in script_eps.values():
+              try:
+                  ep.load()
+              except Exception as exc:
+                  failures.append(f"{ep.name}: {exc!r}")
+          if failures:
+              raise SystemExit("console script load failures:\n" + "\n".join(failures))
+
+          unsafe_help = {"ctx-mcp-server"}
+          safe_help = sorted(expected_scripts - unsafe_help)
+          with open(
+              "ctx-console-help.txt", "w", encoding="utf-8", newline="\n"
+          ) as fh:
+              fh.write("\n".join(safe_help) + "\n")
+          print(
+              f"loaded {len(script_eps)} ctx console scripts from wheel "
+              f"{dist_version}; help-smoke={len(safe_help)}"
+          )
+          PY
+          while IFS= read -r cmd; do
+            cmd="${cmd%$'\r'}"
+            [[ -z "$cmd" ]] && continue
+            echo "help smoke: $cmd"
+            "$cmd" --help >/dev/null
+          done < ctx-console-help.txt
+
+  clean-host-contract:
+    name: "Clean host contract"
+    needs: classify
+    if: ${{ github.event_name != 'pull_request' || (needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Upgrade pip
+        run: python -m pip install --upgrade pip
+
+      - name: Run clean-host contract
+        run: python scripts/clean_host_contract.py --fast
+
+  no-test-no-merge:
+    name: "Contract changes must touch tests"
+    needs: classify
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' && needs.classify.outputs.docs_only != 'true' && needs.classify.outputs.graph_only != 'true' }}
+    steps:
+      - name: Checkout with full history
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          lfs: false
+
+      - name: Enforce test-coverage-per-PR policy
+        # Policy: any product or CI/package contract change
+        # must be accompanied by at least one test file change in the
+        # same PR. Exemptions:
+        #   - Pure docs / comment changes (matched by a trivial heuristic)
+        #   - Config JSON (src/config.json) — schema changes get tests
+        #     for the accessor, not the JSON itself.
+        #   - Changes ONLY inside __pycache__, .pyc files, etc.
+        run: |
+          set -euo pipefail
+          BASE="${{ github.event.pull_request.base.sha }}"
+          HEAD="${{ github.event.pull_request.head.sha }}"
+          LABELS='${{ toJson(github.event.pull_request.labels.*.name) }}'
+          python scripts/ci_no_test_policy.py \
+            --base "$BASE" \
+            --head "$HEAD" \
+            --labels-json "$LABELS"
+
+  ci-required:
+    name: "CI required"
+    runs-on: ubuntu-latest
+    needs:
+      - classify
+      - static
+      - unit-linux
+      - similarity-integration
+      - test
+      - contract-compat
+      - e2e-canary
+      - docs-check
+      - graph-check
+      - browser-security
+      - package-smoke
+      - package-build
+      - clean-host-contract
+      - no-test-no-merge
+    if: ${{ always() }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Check required job results
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          NEEDS_JSON: ${{ toJson(needs) }}
+        run: python scripts/ci_required.py

.github/workflows/xdist-experiment.yml

@@ -1,90 +1,90 @@
-name: Xdist experiment
-
-on:
-  workflow_dispatch:
-  pull_request:
-    branches: [main]
-    paths:
-      - ".github/workflows/xdist-experiment.yml"
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
-concurrency:
-  group: xdist-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  xdist:
-    name: xdist (${{ matrix.os }} / py${{ matrix.python-version }})
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-        python-version: ["3.12"]
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          lfs: false
-
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ matrix.python-version }}
-          cache: pip
-          cache-dependency-path: pyproject.toml
-
-      - name: Install experiment dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install ".[dev]" pytest-xdist
-
-      - name: Run xdist experiment
-        run: |
-          set +e
-          start="$(python - <<'PY'
-          import time
-          print(time.monotonic())
-          PY
-          )"
-          python -m pytest -q -m "not browser" --no-cov \
-            -n 2 \
-            --dist=loadfile \
-            --max-worker-restart=0 \
-            --durations=25
-          status="$?"
-          end="$(python - <<'PY'
-          import time
-          print(time.monotonic())
-          PY
-          )"
-          elapsed="$(python - "$start" "$end" <<'PY'
-          import sys
-          start = float(sys.argv[1])
-          end = float(sys.argv[2])
-          print(f"{end - start:.1f}")
-          PY
-          )"
-
-          {
-            echo "## pytest-xdist experiment"
-            echo ""
-            echo "- OS: $RUNNER_OS"
-            echo "- Python: ${{ matrix.python-version }}"
-            echo "- Command: \`python -m pytest -q -m \"not browser\" --no-cov -n 2 --dist=loadfile --max-worker-restart=0 --durations=25\`"
-            echo "- Exit code: $status"
-            echo "- Elapsed seconds: $elapsed"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          if [ "$status" -ne 0 ]; then
-            echo "::warning::xdist experiment failed on $RUNNER_OS with exit code $status"
-          fi
-          exit "$status"
+name: Xdist experiment
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [main]
+    paths:
+      - ".github/workflows/xdist-experiment.yml"
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+concurrency:
+  group: xdist-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  xdist:
+    name: xdist (${{ matrix.os }} / py${{ matrix.python-version }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python-version: ["3.12"]
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          lfs: false
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install experiment dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev]" pytest-xdist
+
+      - name: Run xdist experiment
+        run: |
+          set +e
+          start="$(python - <<'PY'
+          import time
+          print(time.monotonic())
+          PY
+          )"
+          python -m pytest -q -m "not browser" --no-cov \
+            -n 2 \
+            --dist=loadfile \
+            --max-worker-restart=0 \
+            --durations=25
+          status="$?"
+          end="$(python - <<'PY'
+          import time
+          print(time.monotonic())
+          PY
+          )"
+          elapsed="$(python - "$start" "$end" <<'PY'
+          import sys
+          start = float(sys.argv[1])
+          end = float(sys.argv[2])
+          print(f"{end - start:.1f}")
+          PY
+          )"
+
+          {
+            echo "## pytest-xdist experiment"
+            echo ""
+            echo "- OS: $RUNNER_OS"
+            echo "- Python: ${{ matrix.python-version }}"
+            echo "- Command: \`python -m pytest -q -m \"not browser\" --no-cov -n 2 --dist=loadfile --max-worker-restart=0 --durations=25\`"
+            echo "- Exit code: $status"
+            echo "- Elapsed seconds: $elapsed"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          if [ "$status" -ne 0 ]; then
+            echo "::warning::xdist experiment failed on $RUNNER_OS with exit code $status"
+          fi
+          exit "$status"

.gitignore

@@ -1,103 +1,103 @@
-# Babysitter orchestration — runs, state, and local SDK install
-.a5c/
-
-# Python
-__pycache__/
-*.py[cod]
-*.pyo
-*.pyd
-.Python
-*.egg-info/
-dist/
-build/
-*.egg
-.eggs/
-.venv/
-.venv-release/
-.venv-smoke/
-venv/
-env/
-.env
-
-# Node / npm
-node_modules/
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-package-lock.json
-
-# Temp / runtime outputs
-/tmp/
-*.tmp
-*.bak
-*.swp
-*.swo
-.DS_Store
-Thumbs.db
-
-# Skill system runtime files (generated, not source)
-/skills/skill-router/check-gates.md
-/skills/skill-router/failure-log.md
-
-# Agent directives (cloned from global ~/.claude/CLAUDE.md — personal, not for sharing)
-CLAUDE.md
-
-# Per-workspace Claude Code settings (local permissions, user-specific)
-.claude/
-
-# Wiki (runtime knowledge store, not source)
-# Uncomment to exclude the wiki from the repo:
-# ~/.claude/skill-wiki/
-
-# Intent log and pending signals (session runtime)
-# These live in ~/.claude/ so already outside the repo
-
-# Internal review artifacts and working notes (not public docs)
-/docs/reports/
-/docs/plans/20[0-9][0-9]-*/
-/docs/plans/20[0-9][0-9]-*.md
-/internal/reviews/
-
-# Generated graph review artifacts (regenerate locally when needed)
-/graph/*-report.md
-/graph/*-report.json
-/graph/*-report.json.gz
-/graph/*.staged
-/graph/*.partial
-/graph/*.lock
-*.promotion.json
-/graph/tag-backfill.md
-/graph/tag-backfill.json
-
-# Secrets / config overrides
-skill-system-config.json
-.env.local
-.env.development
-.env.production
-.envrc
-
-# Strix security scanner (local venv, instructions, output)
-.strix-venv/
-.strix-instructions.txt
-.strix-output/
-.strix-out/
-.strix-run.log
-.strix-preview-wiki/
-.imported-deployed/
-strix_runs/
-
-# Test coverage
-.coverage
-.ci-preflight-dist/
-htmlcov/
-.pytest_cache/
-.mypy_cache/
-.mypy_cache*/
-.ruff_cache/
-.hypothesis/
-
-# Local code-review graph experiments
-.code-review-graph/
-
-# MkDocs build output
-/site/
+# Babysitter orchestration — runs, state, and local SDK install
+.a5c/
+
+# Python
+__pycache__/
+*.py[cod]
+*.pyo
+*.pyd
+.Python
+*.egg-info/
+dist/
+build/
+*.egg
+.eggs/
+.venv/
+.venv-release/
+.venv-smoke/
+venv/
+env/
+.env
+
+# Node / npm
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+package-lock.json
+
+# Temp / runtime outputs
+/tmp/
+*.tmp
+*.bak
+*.swp
+*.swo
+.DS_Store
+Thumbs.db
+
+# Skill system runtime files (generated, not source)
+/skills/skill-router/check-gates.md
+/skills/skill-router/failure-log.md
+
+# Agent directives (cloned from global ~/.claude/CLAUDE.md — personal, not for sharing)
+CLAUDE.md
+
+# Per-workspace Claude Code settings (local permissions, user-specific)
+.claude/
+
+# Wiki (runtime knowledge store, not source)
+# Uncomment to exclude the wiki from the repo:
+# ~/.claude/skill-wiki/
+
+# Intent log and pending signals (session runtime)
+# These live in ~/.claude/ so already outside the repo
+
+# Internal review artifacts and working notes (not public docs)
+/docs/reports/
+/docs/plans/20[0-9][0-9]-*/
+/docs/plans/20[0-9][0-9]-*.md
+/internal/reviews/
+
+# Generated graph review artifacts (regenerate locally when needed)
+/graph/*-report.md
+/graph/*-report.json
+/graph/*-report.json.gz
+/graph/*.staged
+/graph/*.partial
+/graph/*.lock
+*.promotion.json
+/graph/tag-backfill.md
+/graph/tag-backfill.json
+
+# Secrets / config overrides
+skill-system-config.json
+.env.local
+.env.development
+.env.production
+.envrc
+
+# Strix security scanner (local venv, instructions, output)
+.strix-venv/
+.strix-instructions.txt
+.strix-output/
+.strix-out/
+.strix-run.log
+.strix-preview-wiki/
+.imported-deployed/
+strix_runs/
+
+# Test coverage
+.coverage
+.ci-preflight-dist/
+htmlcov/
+.pytest_cache/
+.mypy_cache/
+.mypy_cache*/
+.ruff_cache/
+.hypothesis/
+
+# Local code-review graph experiments
+.code-review-graph/
+
+# MkDocs build output
+/site/

.hypothesis/.gitignore

@@ -1,9 +0,0 @@
-# This .gitignore file was automatically created by Hypothesis. Hypothesis gitignores
-# .hypothesis by default, because we generally recommend that .hypothesis not be checked
-# into version control.
-#
-# If you *would* like to check .hypothesis into version control, you should delete this
-# file. Hypothesis will not re-create this .gitignore unless .hypothesis is deleted (and
-# if it does, that's a bug - please report it!)
-
-*

.hypothesis/constants/0019c6a267d025e1

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\utils\__init__.py
-# hypothesis_version: 6.152.1
-
-[]

.hypothesis/constants/004e722d2b39195a

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\_pytest\freeze_support.py
-# hypothesis_version: 6.152.1
-
-['.']

.hypothesis/constants/009298dc5190c8bd

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\algorithms\polynomials.py
-# hypothesis_version: 6.152.1
-
-['chromatic_polynomial', 'contraction_idx', 'directed', 'tutte_polynomial', 'x', 'y']

.hypothesis/constants/010258c38047fd64

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\coverage\lcovreport.py
-# hypothesis_version: 6.152.1
-
-[',', '-', '0', '1', '=', 'LCOV report', 'ascii', 'end_of_record\n', 'function', 'utf-8']

.hypothesis/constants/017531f0e829ce4f

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\algorithms\summarization.py
-# hypothesis_version: 6.152.1
-
-['Supernode-', '[edge_attributes]', '[node_attributes]', 'dedensify', 'group', 'not copy', 'snap_aggregation', 'types']

.hypothesis/constants/0197b3c42bd36715

@@ -1,4 +0,0 @@
-# file: C:\Steves_Files\Work\Research_and_Papers\ctx\src\ctx\core\graph\resolve_graph.py
-# hypothesis_version: 6.152.1
-
-[0.0, 1.0, ',', ', ', '--hops', '--json', '--matched', '--tags', '--top', '1', ':', 'Output as JSON', '__main__', 'agent:', 'ann:v1:', 'ann_attach', 'artifacts', 'attach_key', 'communities', 'ctx_graph_path', 'delta', 'edges', 'export_id', 'graph', 'graph-walk', 'graph.json', 'graphify-out', 'harness:', 'id', 'kind', 'label', 'links', 'matching_tags', 'mcp-server:', 'mode', 'name', 'never_load', 'node_id', 'nodes', 'normalized_score', 'on', 'replace_scope', 'report', 'results', 'score', 'semantic_build_floor', 'semantic_sim', 'shared_tags', 'skill', 'skill:', 'source', 'store_true', 'tag-search', 'tag_sim', 'tags', 'target', 'token_sim', 'true', 'type', 'utf-8', 'via', 'weight', 'y', 'yes', '~/.claude/skill-wiki']

.hypothesis/constants/0199ac9602548c81

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\algorithms\connectivity\edge_augmentation.py
-# hypothesis_version: 6.152.1
-
-['MetaEdge', 'directed', 'generator', 'is_k_edge_connected', 'k_edge_augmentation', 'mapping', 'members', 'meta_uv', 'multigraph', 'no available edges', 'uv', 'w', 'weight']

.hypothesis/constants/01e01103d68a3193

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\algorithms\centrality\katz.py
-# hypothesis_version: 6.152.1
-
-[1e-06, 0.1, 1.0, 1000, 'katz_centrality', 'multigraph', 'weight']

.hypothesis/constants/0213343f1393a3fa

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\algorithms\components\connected.py
-# hypothesis_version: 6.152.1
-
-['connected_components', 'directed', 'is_connected']

.hypothesis/constants/031f85f1c11bb00b

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\numpy\_typing\_nbit_base.py
-# hypothesis_version: 6.152.1
-
-['NBitBase', '_128Bit', '_16Bit', '_32Bit', '_64Bit', '_8Bit', '_96Bit', 'numpy._typing', 'numpy.typing']

.hypothesis/constants/03a0bc33c3be41ac

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\_pytest\config\findpaths.py
-# hypothesis_version: 6.152.1
-
-['-', '.cfg', '.ini', '.pytest.ini', '.pytest.toml', '.toml', '::', '=', 'file', 'ini', 'ini_options', 'override', 'pyproject.toml', 'pytest', 'pytest.ini', 'pytest.toml', 'setup.cfg', 'setup.py', 'toml', 'tool', 'tool:pytest', 'tox.ini', 'utf-8']

.hypothesis/constants/03d65cf548ce3b23

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\numpy\_core\memmap.py
-# hypothesis_version: 6.152.1
-
-[b'\x00', -100.0, 'C', '_mmap', 'b', 'c', 'copyonwrite', 'flush', 'memmap', 'name', 'numpy', 'r', 'r+', 'read', 'readonly', 'readwrite', 'w+', 'write']

.hypothesis/constants/041b82baf95116f0

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\_pytest\stash.py
-# hypothesis_version: 6.152.1
-
-['D', 'Stash', 'StashKey', 'T', '_storage']

.hypothesis/constants/044c9664c732c0e2

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\algorithms\community\label_propagation.py
-# hypothesis_version: 6.152.1
-
-['asyn_lpa_communities', 'directed', 'seed', 'weight']

.hypothesis/constants/0570a7c52cd987f9

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\yaml\resolver.py
-# hypothesis_version: 6.152.1
-
-['!&*', '-+0123456789', '-+0123456789.', '0123456789', '<', '=', 'BaseResolver', 'N', 'Resolver', '^(?:!|&|\\*)$', '^(?:<<)$', '^(?:=)$', 'n', 'yYnNtTfFoO', 'yaml_path_resolvers', '~']

.hypothesis/constants/0628f2618034526e

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\anyio\abc\_resources.py
-# hypothesis_version: 6.152.1
-
-['T']

.hypothesis/constants/068c9e16d4886008

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\_pytest\terminalprogress.py
-# hypothesis_version: 6.152.1
-
-['TERM', 'dumb', 'terminalreporter']

.hypothesis/constants/06a795a0e79c102f

@@ -1,4 +0,0 @@
-# file: C:\Steves_Files\Work\Research_and_Papers\ctx\scripts\build_dashboard_graph_index.py
-# hypothesis_version: 6.152.1
-
-[0.0, 1.0, 10000, ',', '--graph-json', '--output', '--top-k', ':', 'VACUUM', '__main__', 'degree', 'description', 'edge_reasons', 'edges', 'edges_count', 'export_id', 'graph', 'id', 'label', 'links', 'max_degree', 'nodes', 'nodes_count', 'quality_score', 'reasons', 'semantic', 'shared_tags', 'slug_token_sim', 'source', 'source_overlap', 'tag_sim', 'tags', 'target', 'top_k', 'type', 'usage_score', 'utf-8', 'version', 'weight']

.hypothesis/constants/072d43d60d40fd51

@@ -1,4 +0,0 @@
-# file: C:\Steves_Files\Work\Research_and_Papers\ctx\src\backup_config.py
-# hypothesis_version: 6.152.1
-
-[1024, '%Y%m%dT%H%M%SZ', '..', '.claude.json', '.credentials.json', '/', ':', 'AGENTS.md', 'CLAUDE.md', '\\', '\\\\', 'agents', 'backup', 'claude.json', 'dest', 'excludes', 'full', 'hybrid', 'incremental', 'keep_daily', 'keep_latest', 'max_file_bytes', 'memory_glob', 'name_format', 'pending-skills.json', 'retention', 'scope', 'settings.json', 'skill-manifest.json', 'skill-registry.json', 'skills', 'snapshot_dir', 'src', 'stats-cache.json', 'timestamp_format', 'top_files', 'trees', 'trees[].dest', 'trees[].src', 'user-profile.json', 'utf-8', '{timestamp}', '~/.claude/backups']

.hypothesis/constants/0736e2d4acddd01a

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\yaml\error.py
-# hypothesis_version: 6.152.1
-
-['\x00\r\n\x85\u2028\u2029', ' ... ', ':\n', 'Mark', 'MarkedYAMLError', 'YAMLError', '^']

.hypothesis/constants/07475514dc0bbadb

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\pytest\__main__.py
-# hypothesis_version: 6.152.1
-
-['__main__']

.hypothesis/constants/075aa0dd31e12c03

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\xdist\_version.py
-# hypothesis_version: 6.152.1
-
-['3.8.0', '__version__', '__version_tuple__', 'version', 'version_tuple']

.hypothesis/constants/084c48810f649441

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\readwrite\text.py
-# hypothesis_version: 6.152.1
-
-[' ...', '!', '+', '+-- ', ', ', '-', '...', ':   ', '<-', 'L-- ', 'L-> ', '_', 'as_dict', 'backedge', 'collapse', 'empty', 'label', 'mapping', 'vertical_edge', 'w', 'write', 'write_network_text', '|', '|   ', '|-- ', '|-> ', '─', '│', '│   ', '└── ', '└─╼ ', '├── ', '├─╼ ', '╎   ', '╙', '╙── ', '╟── ', '╽', '╾']

.hypothesis/constants/08a45b14b7a1aa82

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\xdist\_path.py
-# hypothesis_version: 6.152.1
-
-[]

.hypothesis/constants/0964dd49257e9b00

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\markdown\treeprocessors.py
-# hypothesis_version: 6.152.1
-
-['\n%s', '%04d', 'br', 'code', 'd', 'inline', 'pre', 'prettify', 'unescape', '{}(\\d+){}', '{}{}{}', '{}{}{}{}']

.hypothesis/constants/0967afddd3cfffcc

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\algorithms\centrality\eigenvector.py
-# hypothesis_version: 6.152.1
-
-[1e-06, 100, 'LR', 'multigraph', 'weight']

.hypothesis/constants/09a20f6b52e6dcc7

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\algorithms\minors\__init__.py
-# hypothesis_version: 6.152.1
-
-['contracted_edge', 'contracted_nodes', 'equivalence_classes', 'identified_nodes', 'quotient_graph']

.hypothesis/constants/09ae28b390a241d0

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\sortedcontainers\sorteddict.py
-# hypothesis_version: 6.152.1
-
-[50331648, ', ', '<not-given>', 'items', 'iteritems', 'iterkeys', 'itervalues', 'keys', 'values', 'viewitems', 'viewkeys', 'viewvalues', '{0!r}, ', '{0!r}: {1!r}', '{0}({1}{{{2}}})']

.hypothesis/constants/09bba2fe6bc8792d

@@ -1,4 +0,0 @@
-# file: C:\Steves_Files\Work\Research_and_Papers\ctx\src\ctx\core\source_registry.py
-# hypothesis_version: 6.152.1
-
-['-', '--json', '--registry', '-nc', 'Apache-2.0', 'CC BY-NC 4.0', 'ExternalSourceRecord', 'MIT', '_', '__main__', 'agents-md', 'agpl', 'apache-2.0', 'bsd-2-clause', 'bsd-3-clause', 'cc-by-4.0', 'cc0-1.0', 'copyleft license', 'explicit-permission', 'external-link', 'full', 'full-body', 'gpl', 'harness', 'import_mode', 'isc', 'julius-caveman', 'knowledge-protocol', 'lat-md', 'lgpl', 'license', 'mattpocock-skills', 'metadata-only', 'mit', 'mpl-2.0', 'name', 'no-explicit', 'noncommercial', 'notes', 'optillm', 'owner-permission', 'permission_reference', 'permission_status', 'revision', 'skill-suite', 'source_kind', 'sources', 'store_true', 'unknown', 'unknown license', 'unlicense', 'url', 'utf-8']

.hypothesis/constants/09e51e4d7e8d7e87

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\algorithms\connectivity\disjoint_paths.py
-# hypothesis_version: 6.152.1
-
-['G', 'auxiliary', 'auxiliary?', 'capacity', 'cutoff', 'edge_disjoint_paths', 'flow', 'flow_func', 'flow_value', 'id', 'inf', 'mapping', 'node_disjoint_paths', 'residual', 'two_phase', 'value_only']

.hypothesis/constants/0a6403dce3b6e280

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\coverage\env.py
-# hypothesis_version: 6.152.1
-
-['+', 'COVERAGE_COVERAGE', 'COVERAGE_TESTING', 'CPython', 'PYBEHAVIOR', 'PyPy', 'True', '_', '_is_gil_enabled', 'alpha', 'darwin', 'debug_info', 'linux', 'monitoring', 'win32']

.hypothesis/constants/0ac765fb060691b5

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\algorithms\isolate.py
-# hypothesis_version: 6.152.1
-
-['is_isolate', 'isolates', 'number_of_isolates']

.hypothesis/constants/0b1d2411e5eaa76a

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\algorithms\__init__.py
-# hypothesis_version: 6.152.1
-
-[]

.hypothesis/constants/0bb70d1826311e40

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\execnet\gateway_bootstrap.py
-# hypothesis_version: 6.152.1
-
-[b'1', 255, 'except NameError:', 'import socket', 'import sys', 'remoteaddress', 'sys.stdout.flush()', 'try: execmodel', 'utf-8']

.hypothesis/constants/0bc3b2f77e74ecd9

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\pytest_mock\__init__.py
-# hypothesis_version: 6.152.1
-
-['AsyncMockType', 'MockFixture', 'MockType', 'MockerFixture', 'PytestMockWarning', 'class_mocker', 'mocker', 'module_mocker', 'package_mocker', 'pytest_addoption', 'pytest_configure', 'session_mocker']

.hypothesis/constants/0c23327e39eaa492

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\networkx\algorithms\components\__init__.py
-# hypothesis_version: 6.152.1
-
-[]

.hypothesis/constants/0c347c1a609186cf

@@ -1,4 +0,0 @@
-# file: C:\Steves_Files\Work\Research_and_Papers\ctx\src\ctx\adapters\generic\compaction.py
-# hypothesis_version: 6.152.1
-
-[0.3, 600, 60000, ')', ', ', 'CompactionResult', '[Compacted', '[summary was empty]', '] ', 'assistant', 'system', 'tool', 'user']

.hypothesis/constants/0c7b341cd0f9acb2

@@ -1,4 +0,0 @@
-# file: C:\Steves_Files\Work\Research_and_Papers\ctx\src\mcp_fetch.py
-# hypothesis_version: 6.152.1
-
-[',', '--limit', '--list-sources', '--refresh', '--source', '--verbose', '-v', ':', 'NAME', '__main__', 'all', 'count', 'ctx-mcp-fetch', 'reconfigure', 'replace', 'store_true', 'utf-8']

.hypothesis/constants/0cfa12dfbf9e9abb

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\colorama\initialise.py
-# hypothesis_version: 6.152.1
-
-['win32']

.hypothesis/constants/0d65a410db824952

@@ -1,4 +0,0 @@
-# file: C:\Users\solun\AppData\Roaming\Python\Python311\site-packages\yaml\representer.py
-# hypothesis_version: 6.152.1
-
-[0.0, 1.0, 1e+300, '%r', '%r%rj', '%r+%rj', '%rj', '%s.%s', '-.inf', '.', '.0e', '.inf', '.nan', 'BaseRepresenter', 'Representer', 'RepresenterError', 'SafeRepresenter', '__getstate__', '__newobj__', '__reduce__', '__reduce_ex__', 'args', 'ascii', 'dictitems', 'e', 'encodebytes', 'false', 'items', 'listitems', 'null', 'state', 'true', 'yaml_representers', '|']