merge: resolve conflicts with upstream/main (dependabot CI updates)

Upstream changes: dependabot CI action version bumps (checkout, cache,
upload-artifact, attest-build-provenance, codeql-action).

Conflict resolutions:
- mcp.c (3 regions): Kept our fuzzy fallback + added upstream's new
  'mode' and 'param_name' free() calls. Kept our matched_file/candidates/
  zero-edge check + integrated upstream's mode-based edge_types parsing.
  Kept our strcpy comment.
- pass_parallel.c (1 region): Removed dead prescan functions (extract_lines,
  prescan_http_sites, prescan_routes, prescan_config_refs, prescan_add_route,
  is_route_source_lang) — these were added by our branch but upstream removed
  the calling code and type definitions. They're now unused dead code.

Author: Your Name

CONTRIBUTING.md

@@ -118,8 +118,32 @@ Examples: `fix(store): set busy_timeout before WAL`, `feat(cli): add --progress
 
 ## Pull Request Guidelines
 
-- **One issue per PR.** Each PR must address exactly one bug, one feature, or one refactor. Do not bundle multiple fixes or feature additions into a single PR. If your change touches multiple areas, split it into separate PRs.
-- **Open an issue first.** Every PR should reference a tracking issue (`Fixes #N` or `Closes #N`). This ensures the change is discussed before code is written.
+### Before You Write Code
+
+- **Open an issue first — always.** Every PR must reference a tracking issue (`Fixes #N` or `Closes #N`). Describe what you want to change and why. Wait for maintainer feedback before implementing. PRs without a prior issue discussion will be closed.
+- **Bug fixes and test additions** are the exception — these are welcome without prior discussion, as long as they're focused.
+
+### What Requires Explicit Maintainer Approval
+
+The following changes will not be merged without prior design discussion in an issue:
+
+- **API surface changes** — adding, removing, renaming, or changing defaults of MCP tools
+- **New pipeline passes or indexing algorithms** — anything that changes what gets extracted or how
+- **Build system / Makefile changes** — beyond trivial fixes
+- **Project configuration** — CLAUDE.md, skill files, .mcp.json, CI workflows
+- **New dependencies** — vendored or otherwise
+- **Breaking changes** of any kind
+
+If in doubt, open an issue and ask.
+
+### PR Scope and Size
+
+- **One issue per PR.** Each PR must address exactly one bug, one feature, or one refactor. Do not bundle multiple fixes or feature additions into a single PR. Kitchen-sink PRs will be closed with a request to split.
+- **Keep PRs small.** A good PR is under 500 lines. If your change is larger, split it into reviewable increments that each stand on their own.
+- **Don't mix features with fixes.** If you find a bug while implementing a feature, submit the bug fix as a separate PR.
+
+### Code Requirements
+
 - **C code only** — this project was rewritten from Go to pure C in v0.5.0. Go PRs will be acknowledged and potentially ported, but cannot be merged directly.
 - Include tests for new functionality
 - Run `scripts/test.sh` and `scripts/lint.sh` before submitting

Makefile.cbm

@@ -118,7 +118,8 @@ EXTRACTION_SRCS = \
     $(CBM_DIR)/extract_env_accesses.c \
     $(CBM_DIR)/extract_k8s.c \
     $(CBM_DIR)/helpers.c \
-    $(CBM_DIR)/lang_specs.c
+    $(CBM_DIR)/lang_specs.c \
+    $(CBM_DIR)/service_patterns.c
 
 # LSP resolvers (compiled as one unit via lsp_all.c)
 LSP_SRCS = $(CBM_DIR)/lsp_all.c
@@ -175,6 +176,7 @@ PIPELINE_SRCS = \
     src/pipeline/pass_gitdiff.c \
     src/pipeline/pass_configures.c \
     src/pipeline/pass_configlink.c \
+    src/pipeline/pass_route_nodes.c \
     src/pipeline/pass_enrichment.c \
     src/pipeline/pass_envscan.c \
     src/pipeline/pass_compile_commands.c \
@@ -282,7 +284,7 @@ TEST_GO_LSP_SRCS = tests/test_go_lsp.c
 
 TEST_C_LSP_SRCS = tests/test_c_lsp.c
 
-TEST_INTEGRATION_SRCS = tests/test_integration.c
+TEST_INTEGRATION_SRCS = tests/test_integration.c tests/test_incremental.c
 
 TEST_TRACES_SRCS = tests/test_traces.c
 

internal/cbm/cbm.c

@@ -124,6 +124,16 @@ void cbm_typeassign_push(CBMTypeAssignArray *arr, CBMArena *a, CBMTypeAssign ta)
     arr->items[arr->count++] = ta;
 }
 
+void cbm_stringref_push(CBMStringRefArray *arr, CBMArena *a, CBMStringRef sr) {
+    GROW_ARRAY(arr, a);
+    arr->items[arr->count++] = sr;
+}
+
+void cbm_infrabinding_push(CBMInfraBindingArray *arr, CBMArena *a, CBMInfraBinding ib) {
+    GROW_ARRAY(arr, a);
+    arr->items[arr->count++] = ib;
+}
+
 void cbm_impltrait_push(CBMImplTraitArray *arr, CBMArena *a, CBMImplTrait it) {
     GROW_ARRAY(arr, a);
     arr->items[arr->count++] = it;

internal/cbm/cbm.h

@@ -107,9 +107,23 @@ typedef struct {
     bool is_entry_point;
 } CBMDefinition;
 
+/* Argument captured from a call expression */
 typedef struct {
-    const char *callee_name;       // raw callee text ("pkg.Func", "foo")
-    const char *enclosing_func_qn; // QN of enclosing function (or module QN)
+    const char *expr;    // raw expression text ("payload.info", "MY_URL", "'hello'")
+    const char *value;   // resolved string value or NULL (constant propagation)
+    const char *keyword; // keyword name if keyword arg ("url", "topic_id"), NULL if positional
+    int index;           // positional index (0-based)
+} CBMCallArg;
+
+#define CBM_MAX_CALL_ARGS 8
+
+typedef struct {
+    const char *callee_name;            // raw callee text ("pkg.Func", "foo")
+    const char *enclosing_func_qn;      // QN of enclosing function (or module QN)
+    const char *first_string_arg;       // first string literal argument (URL, topic, key) or NULL
+    const char *second_arg_name;        // second argument identifier (handler ref) or NULL
+    CBMCallArg args[CBM_MAX_CALL_ARGS]; // first N arguments with expressions
+    int arg_count;                      // number of captured arguments
 } CBMCall;
 
 typedef struct {
@@ -149,6 +163,29 @@ typedef struct {
     const char *enclosing_func_qn; // QN of enclosing function
 } CBMTypeAssign;
 
+// String reference: URL, config key, or async target found in source.
+// Extracted from string literals during AST walk.
+typedef enum {
+    CBM_STRREF_URL = 0,    // REST path or full URL
+    CBM_STRREF_CONFIG = 1, // config file path or env var key
+} CBMStringRefKind;
+
+typedef struct {
+    const char *value;             // the string literal content
+    const char *enclosing_func_qn; // QN of enclosing function
+    const char *key_path;          // dotted key path from YAML/JSON nesting (NULL if flat)
+    CBMStringRefKind kind;         // URL, CONFIG
+} CBMStringRef;
+
+/* Infrastructure binding: topic/queue → endpoint URL.
+ * Extracted from YAML/HCL/JSON subscription/scheduler configs.
+ * Used by pass_route_nodes to connect async Route nodes to handler services. */
+typedef struct {
+    const char *source_name; // topic, queue, or schedule name
+    const char *target_url;  // push_endpoint, uri, or http_target URL
+    const char *broker;      // "pubsub", "cloud_tasks", "cloud_scheduler", "sqs", "kafka"
+} CBMInfraBinding;
+
 // Rust: impl Trait for Struct
 typedef struct {
     const char *trait_name;  // trait name (raw text)
@@ -225,6 +262,18 @@ typedef struct {
     int cap;
 } CBMTypeAssignArray;
 
+typedef struct {
+    CBMStringRef *items;
+    int count;
+    int cap;
+} CBMStringRefArray;
+
+typedef struct {
+    CBMInfraBinding *items;
+    int count;
+    int cap;
+} CBMInfraBindingArray;
+
 typedef struct {
     CBMImplTrait *items;
     int count;
@@ -246,6 +295,8 @@ typedef struct {
     CBMTypeAssignArray type_assigns;
     CBMImplTraitArray impl_traits;       // Rust: impl Trait for Struct pairs
     CBMResolvedCallArray resolved_calls; // LSP-resolved calls (high confidence)
+    CBMStringRefArray string_refs;       // URL/config string literals from AST
+    CBMInfraBindingArray infra_bindings; // topic→URL pairs from IaC configs
 
     const char *module_qn;    // module qualified name
     const char **exports;     // NULL-terminated (NULL if none)
@@ -279,6 +330,14 @@ typedef struct {
 
 // --- Extraction context passed to sub-extractors ---
 
+// Module-level string constant map (for constant propagation)
+#define CBM_MAX_STRING_CONSTANTS 256
+typedef struct {
+    const char *names[CBM_MAX_STRING_CONSTANTS];
+    const char *values[CBM_MAX_STRING_CONSTANTS];
+    int count;
+} CBMStringConstantMap;
+
 typedef struct {
     CBMArena *arena;
     CBMFileResult *result;
@@ -289,8 +348,9 @@ typedef struct {
     const char *rel_path;
     const char *module_qn;
     TSNode root;
-    EFCache ef_cache;               // enclosing function cache
-    const char *enclosing_class_qn; // for nested class QN computation
+    EFCache ef_cache;                      // enclosing function cache
+    const char *enclosing_class_qn;        // for nested class QN computation
+    CBMStringConstantMap string_constants; // module-level NAME = "value" pairs
 } CBMExtractCtx;
 
 // --- Public API ---
@@ -346,6 +406,8 @@ void cbm_rw_push(CBMRWArray *arr, CBMArena *a, CBMReadWrite rw);
 void cbm_typerefs_push(CBMTypeRefArray *arr, CBMArena *a, CBMTypeRef tr);
 void cbm_envaccess_push(CBMEnvAccessArray *arr, CBMArena *a, CBMEnvAccess ea);
 void cbm_typeassign_push(CBMTypeAssignArray *arr, CBMArena *a, CBMTypeAssign ta);
+void cbm_stringref_push(CBMStringRefArray *arr, CBMArena *a, CBMStringRef sr);
+void cbm_infrabinding_push(CBMInfraBindingArray *arr, CBMArena *a, CBMInfraBinding ib);
 void cbm_impltrait_push(CBMImplTraitArray *arr, CBMArena *a, CBMImplTrait it);
 void cbm_resolvedcall_push(CBMResolvedCallArray *arr, CBMArena *a, CBMResolvedCall rc);