fix: session encoding used per-response IDs, not stable session-global IDs

encodeWithSession assigned per-response local IDs instead of stable session-global
IDs, so cross-call dedup references (@n # previously transmitted) pointed at the
wrong symbols; the header also emitted zero-valued budget/tokens/edges. Both fixed
to match the Go reference and the shared graph-session fixtures - graph session
output is now byte-identical across all six SDKs. Undetected because the conformance
runner skipped the graph-session fixtures.

Runner hardened: unhandled operations now hard-fail instead of silently skipping;
session, delta-encode, roundtrip, and pack-root fixtures now run; delta-verify is
the only explicit allow-list (pending a graph delta wire decoder).

Author: blackwell-systems

CHANGELOG.md

@@ -4,6 +4,8 @@
 
 ### Fixes
 
+- The conformance runner now hard-fails on any unhandled operation (instead of silently skipping it) and exercises session, delta-encode, roundtrip, and pack-root fixtures; only `delta-verify` is explicitly allow-listed, pending a graph delta wire decoder.
+- **Session encoding correctness fix.** `encode_with_session` assigned per-response local IDs instead of stable session-global IDs, so the cross-call dedup references (`@N  # previously transmitted`) pointed at the wrong symbols, and the header emitted zero-valued `budget`/`tokens`/`edges`. Both are fixed to match the reference; graph session output is now byte-identical across all six SDKs. This had gone undetected because the conformance runner skipped the shared graph-session fixtures (now wired).
 - Added the graph-profile PackRoot (`pack_root(symbols, edges)`, gcf-pack-root-v1, SPEC 10.2): the content-addressed sha256 over canonical, independently-sorted symbol/edge records, byte-identical to gcf-go/rust/typescript/swift/kotlin. The conformance runner now exercises the shared `graph-pack-root` fixtures, which it had been skipping (so this primitive was previously unimplemented and untested).
 - Buffered graph encoder now matches the reference byte-for-byte: symbols are ordered by distance then descending score with local IDs assigned in output order, and the header omits `budget`/`tokens`/`edges` when zero (previously symbols kept input order and zero-valued header fields were always emitted). The conformance runner now exercises the shared `graph-encode` fixtures (001-003), which it had been skipping - which is how this divergence went uncaught.
 - Buffered graph encoder: order edges by source ID, then target ID, then edge type (SPEC 16.1), instead of emitting them in input order. Decode-invariant (edges are a set) and does not affect `pack_root` (which sorts edge records independently), so no content addresses change. Pinned by shared fixture `graph-encode/003`. Streaming edges remain in producer-arrival order.

src/gcf/session.py

@@ -77,22 +77,32 @@ def encode_with_session(p: Payload, sess: Session | None = None) -> str:
 
     parts: list[str] = []
 
-    # Build local ID mapping for this response.
+    # Build session-stable ID mapping (matching the reference encoder):
+    # previously transmitted symbols keep their existing session-global ID;
+    # new symbols get the next available session IDs in payload order. These
+    # are NOT per-call local indices, so IDs stay stable across calls within a
+    # session (see graph-session conformance fixtures).
     local_index: dict[str, int] = {}
-    for i, s in enumerate(p.symbols):
-        local_index[s.qualified_name] = i
-
-    # Count valid edges.
-    valid_edges = sum(
-        1 for e in p.edges
-        if e.source in local_index and e.target in local_index
-    )
-
-    # Header with session=true marker.
-    header = (
-        f"GCF profile=graph tool={p.tool} budget={p.token_budget} tokens={p.tokens_used} "
-        f"symbols={len(p.symbols)} edges={valid_edges} session=true"
-    )
+    for s in p.symbols:
+        if sess.transmitted(s.qualified_name):
+            local_index[s.qualified_name] = sess.get_id(s.qualified_name)
+    next_new = sess.size()
+    for s in p.symbols:
+        if not sess.transmitted(s.qualified_name):
+            local_index[s.qualified_name] = next_new
+            next_new += 1
+
+    # Header with session=true marker. Omit budget/tokens/edges when zero,
+    # matching the reference encoder.
+    header = f"GCF profile=graph tool={p.tool}"
+    if p.token_budget > 0:
+        header += f" budget={p.token_budget}"
+    if p.tokens_used > 0:
+        header += f" tokens={p.tokens_used}"
+    header += f" symbols={len(p.symbols)}"
+    if p.edges:
+        header += f" edges={len(p.edges)}"
+    header += " session=true"
     if p.pack_root:
         header += f" pack_root={p.pack_root}"
     parts.append(header)
@@ -128,7 +138,7 @@ def encode_with_session(p: Payload, sess: Session | None = None) -> str:
 
     # Edges section.
     if p.edges:
-        parts.append(f"## edges [{valid_edges}]")
+        parts.append(f"## edges [{len(p.edges)}]")
         for e in p.edges:
             src_idx = local_index.get(e.source)
             tgt_idx = local_index.get(e.target)

tests/test_conformance_v2.py

@@ -83,9 +83,6 @@ def _subset_match(expected, got):
 def test_conformance(rel_path, data):
     op = data.get("operation")
 
-    if op in ("session", "delta"):
-        pytest.skip(f"{op} not implemented")
-
     if data.get("inputBase64"):
         pytest.skip("binary input")
 
@@ -309,5 +306,87 @@ def _set(s):
             f"graph pack-root mismatch:\n  got: {got}\n  exp: {data['expected']}"
         )
 
+    elif op == "session":
+        # Graph session dedup (SPEC 6.x). A single Session persists across all
+        # calls in the fixture; symbol IDs must stay session-stable, and already
+        # transmitted symbols collapse to bare `@N  # previously transmitted`
+        # references. Byte-compare every call against its expected wire.
+        from gcf.session import Session, encode_with_session
+        from gcf.types import Edge, Payload, Symbol
+
+        sess = Session()
+        for i, call in enumerate(data["calls"]):
+            inp = call["input"]
+            payload = Payload(
+                tool=inp.get("tool", ""),
+                token_budget=inp.get("tokenBudget", 0),
+                tokens_used=inp.get("tokensUsed", 0),
+                pack_root=inp.get("packRoot", ""),
+                symbols=[
+                    Symbol(
+                        qualified_name=s["qualifiedName"],
+                        kind=s["kind"],
+                        score=s["score"],
+                        provenance=s["provenance"],
+                        distance=s.get("distance", 0),
+                    )
+                    for s in inp.get("symbols", [])
+                ],
+                edges=[
+                    Edge(source=e["source"], target=e["target"], edge_type=e["edgeType"])
+                    for e in inp.get("edges", [])
+                ],
+            )
+            got = encode_with_session(payload, sess)
+            assert got == call["expected"], (
+                f"session call {i + 1} wire mismatch:\n"
+                f"  got: {got!r}\n  exp: {call['expected']!r}"
+            )
+
+    elif op == "delta":
+        # graph-delta fixtures share the `delta` operation but come in two shapes:
+        #   - encode: `input` is a structured object -> byte-compare encode_delta.
+        #   - verify: `input` is a WIRE STRING (with a base_snapshot) -> the wire
+        #     decoder + verifier is not yet implemented, so skip like delta-verify.
+        inp = data["input"]
+        if isinstance(inp, str) or "base_snapshot" in data:
+            pytest.skip("graph delta wire decoder not yet implemented")
+
+        from gcf.delta import encode_delta
+        from gcf.types import DeltaPayload, Edge, Symbol
+
+        def _sym(s):
+            return Symbol(
+                qualified_name=s["qualifiedName"],
+                kind=s["kind"],
+                score=s.get("score", 0.0),
+                provenance=s.get("provenance", ""),
+                distance=s.get("distance", 0),
+            )
+
+        def _edge(e):
+            return Edge(source=e["source"], target=e["target"], edge_type=e["edgeType"])
+
+        d = DeltaPayload(
+            tool=inp.get("tool", ""),
+            base_root=inp["baseRoot"],
+            new_root=inp["newRoot"],
+            removed=[_sym(s) for s in inp.get("removed", [])],
+            added=[_sym(s) for s in inp.get("added", [])],
+            removed_edges=[_edge(e) for e in inp.get("removedEdges", [])],
+            added_edges=[_edge(e) for e in inp.get("addedEdges", [])],
+            delta_tokens=inp.get("deltaTokens", 0),
+            full_tokens=inp.get("fullTokens", 0),
+        )
+        got = encode_delta(d)
+        assert got == data["expected"], (
+            f"delta encode mismatch:\n  got: {got!r}\n  exp: {data['expected']!r}"
+        )
+
+    elif op == "delta-verify":
+        pytest.skip("graph delta wire decoder not yet implemented")
+
     else:
-        pytest.skip(f"unknown operation: {op}")
+        pytest.fail(
+            f"unhandled operation: {op}; must be handled or explicitly allow-listed"
+        )