## Summary

V1-launch readiness sweep: cherry-picks three known-good upstream bug
fixes from the post-filter testbed, closes two residual smoke gaps, and
deeply refreshes the v1 docs against current reality.

### Bug fixes (5 of 7 from UPSTREAM_BUGS.md)

| Severity | Bug | Fix |
|---|---|---|
| HIGH (data corruption) | #2 — `codehub scan <path>` ingested SARIF
into operator's CWD instead of the scanned repo | `c43c5aa fix(cli):
scan ingests SARIF into the scanned repo, not CWD` |
| HIGH (CI gate) | #3 — `scripts/smoke-mcp.sh` asserted
EXPECTED_TOOLS=19; server registers 29 | `433f684 fix(repo): smoke-mcp
asserts 29 tools, matching the v1.0 server` |
| HIGH (CI dashboard) | #4 — `codehub bench` surfaced 9 of 17 acceptance
gates (some titles also stale) | `c5f9047 fix(cli): bench dashboard
surfaces all 17 acceptance gates` |
| MEDIUM | #1 + #6 — `codehub doctor` false-WARN on tree-sitter /
@duckdb / @LadybugDB under pnpm strict isolation; `duckdb close()`
undefined on `@duckdb/node-api@1.x` | `c218c31 fix(cli): doctor resolves
native bindings from owner workspaces` |
| LOW (test hygiene) | #7 — `http-embedder.test.ts` cases failed when
`CODEHUB_EMBEDDING_*` env was set in operator's shell | `317bdf1
fix(embedder): isolate http-embedder tests from operator env` |

Bug #5 (testbed-only pytest-timeout) does not apply upstream. Bug fixes
#1+#6, #2, #3 are direct cherry-picks of `def988b`, `6924b1b`, `ec66d4a`
from the post-filter sibling — every changed file:line coordinate
verified to match upstream HEAD before pick.

### Spec-coordinate hygiene
- `fad766f` — scrub `AC-A-7` / `AC-A-10` from
`scripts/m7-parity-audit.sh` header (per the durable lesson; scripts are
not ADRs).
- `e186aea` — restore ADR-permanent spec coordinates in
`docs/adr/0013-m7-default-flip-and-abstraction.md` and
`docs/adr/0014-scip-references-and-embedder-fingerprint.md` after an
earlier docs-sweep commit over-scrubbed them. Per PR #74's carve-out,
ADR text is the explicit place where coordinates ARE allowed.

Final sweep: `rg -n 'AC-[A-Z]-[0-9]' packages/ scripts/` returns zero
hits.

### Docs refresh
- `898192e` — README: status flipped from "v0.1.0 initial public
release" to "v1 — feature-complete on M1–M7" (the prerelease caveat
stays since `package.json` is still `0.1.x`); 28 → 29 MCP tools across
the mermaid diagram, table heading, and mcp-package row; new "Parse
runtime — WASM default" section cross-linking ADR
`0013-parse-runtime-wasm-default.md`; Repository Layout regenerated
against `ls packages/` (now 17 packages — adds `cobol-proleap`,
`frameworks`, `pack`, `policy`, `wiki`; drops `eval` and `gym` with a
sibling-testbed note); 14 → 15 GA languages (COBOL via regex provider);
requirements bumped to Node 22-or-24; tool table expanded to enumerate
the cross-repo federation tools and `pack_codebase`.
- `69eac8f` — ADR 0011 `Proposed → Accepted`; ADR 0013-m7 `Proposed →
Accepted`; sibling-ADR cross-link banner on the duplicate-0013 collision
(`0013-parse-runtime-wasm-default.md` and
`0013-m7-default-flip-and-abstraction.md` both landed concurrently); ADR
0014 References block swapped from `.erpaval/specs/...` (gitignored,
will rot once packet graduates) to durable code-path citations.
- `edb362e` — CHANGELOG `[Unreleased]` entry summarizing this PR;
AGENTS.md 28 → 29 tools and a divergence banner where it intentionally
drops session-local coordinates that CLAUDE.md still carries;
OBJECTIVES.md tool count + language count + sibling-testbed note.

## Validation

- `pnpm install --frozen-lockfile` ✅
- `mise run check` (lint + typecheck + test + banned-strings + verdict)
✅
- `pnpm -F @opencodehub/cli test` — **236/236** pass (was 235; +1 from
the new `[SKIP]` parsing case in `bench.test.ts`)
- `pnpm -F @opencodehub/embedder test` — 79 pass / 0 fail / 1 skipped
- `bash scripts/smoke-mcp.sh` — **PASS (29 tools listed)**
- `node packages/cli/dist/index.js doctor` — `tree-sitter native
binding: OK`, `duckdb native binding: OK`, `graph-db native binding:
FAIL` (real opt-in build status — the `@ladybugdb/core` binding is not
installed on this dev box, which is what `doctor` is supposed to
surface; the false-WARN this PR fixes is gone)
- `rg -n 'AC-[A-Z]-[0-9]' packages/ scripts/` — zero hits

## Test plan

- [ ] CI green on `chore/v1-upstream-bug-sweep`
- [ ] `codehub doctor` reports OK on tree-sitter + duckdb in CI matrix
(Node 22 + Node 24)
- [ ] `codehub scan /tmp/<fixture>` ingests into `<fixture>` not CWD
(manual verification on a downstream repo)
- [ ] `codehub bench` table now renders all 17 rows, none stuck on
"skipped — script crashed"
- [ ] License audit / banned-strings / commitlint stay green

## Out of scope

- Bug #5 (testbed-only pytest-timeout). Listed for reference in
UPSTREAM_BUGS.md; does not affect upstream.

## Summary

V1-launch readiness sweep: cherry-picks three known-good upstream bug
fixes from the post-filter testbed, closes two residual smoke gaps, and
deeply refreshes the v1 docs against current reality.

### Bug fixes (5 of 7 from UPSTREAM_BUGS.md)

| Severity | Bug | Fix |
|---|---|---|
| HIGH (data corruption) | #2 — `codehub scan <path>` ingested SARIF
into operator's CWD instead of the scanned repo | `c43c5aa fix(cli):
scan ingests SARIF into the scanned repo, not CWD` |
| HIGH (CI gate) | #3 — `scripts/smoke-mcp.sh` asserted
EXPECTED_TOOLS=19; server registers 29 | `433f684 fix(repo): smoke-mcp
asserts 29 tools, matching the v1.0 server` |
| HIGH (CI dashboard) | #4 — `codehub bench` surfaced 9 of 17 acceptance
gates (some titles also stale) | `c5f9047 fix(cli): bench dashboard
surfaces all 17 acceptance gates` |
| MEDIUM | #1 + #6 — `codehub doctor` false-WARN on tree-sitter /
@duckdb / @LadybugDB under pnpm strict isolation; `duckdb close()`
undefined on `@duckdb/node-api@1.x` | `c218c31 fix(cli): doctor resolves
native bindings from owner workspaces` |
| LOW (test hygiene) | #7 — `http-embedder.test.ts` cases failed when
`CODEHUB_EMBEDDING_*` env was set in operator's shell | `317bdf1
fix(embedder): isolate http-embedder tests from operator env` |

Bug #5 (testbed-only pytest-timeout) does not apply upstream. Bug fixes
#1+#6, #2, #3 are direct cherry-picks of `def988b`, `6924b1b`, `ec66d4a`
from the post-filter sibling — every changed file:line coordinate
verified to match upstream HEAD before pick.

### Spec-coordinate hygiene
- `fad766f` — scrub `AC-A-7` / `AC-A-10` from
`scripts/m7-parity-audit.sh` header (per the durable lesson; scripts are
not ADRs).
- `e186aea` — restore ADR-permanent spec coordinates in
`docs/adr/0013-m7-default-flip-and-abstraction.md` and
`docs/adr/0014-scip-references-and-embedder-fingerprint.md` after an
earlier docs-sweep commit over-scrubbed them. Per PR #74's carve-out,
ADR text is the explicit place where coordinates ARE allowed.

Final sweep: `rg -n 'AC-[A-Z]-[0-9]' packages/ scripts/` returns zero
hits.

### Docs refresh
- `898192e` — README: status flipped from "v0.1.0 initial public
release" to "v1 — feature-complete on M1–M7" (the prerelease caveat
stays since `package.json` is still `0.1.x`); 28 → 29 MCP tools across
the mermaid diagram, table heading, and mcp-package row; new "Parse
runtime — WASM default" section cross-linking ADR
`0013-parse-runtime-wasm-default.md`; Repository Layout regenerated
against `ls packages/` (now 17 packages — adds `cobol-proleap`,
`frameworks`, `pack`, `policy`, `wiki`; drops `eval` and `gym` with a
sibling-testbed note); 14 → 15 GA languages (COBOL via regex provider);
requirements bumped to Node 22-or-24; tool table expanded to enumerate
the cross-repo federation tools and `pack_codebase`.
- `69eac8f` — ADR 0011 `Proposed → Accepted`; ADR 0013-m7 `Proposed →
Accepted`; sibling-ADR cross-link banner on the duplicate-0013 collision
(`0013-parse-runtime-wasm-default.md` and
`0013-m7-default-flip-and-abstraction.md` both landed concurrently); ADR
0014 References block swapped from `.erpaval/specs/...` (gitignored,
will rot once packet graduates) to durable code-path citations.
- `edb362e` — CHANGELOG `[Unreleased]` entry summarizing this PR;
AGENTS.md 28 → 29 tools and a divergence banner where it intentionally
drops session-local coordinates that CLAUDE.md still carries;
OBJECTIVES.md tool count + language count + sibling-testbed note.

## Validation

- `pnpm install --frozen-lockfile` ✅
- `mise run check` (lint + typecheck + test + banned-strings + verdict)
✅
- `pnpm -F @opencodehub/cli test` — **236/236** pass (was 235; +1 from
the new `[SKIP]` parsing case in `bench.test.ts`)
- `pnpm -F @opencodehub/embedder test` — 79 pass / 0 fail / 1 skipped
- `bash scripts/smoke-mcp.sh` — **PASS (29 tools listed)**
- `node packages/cli/dist/index.js doctor` — `tree-sitter native
binding: OK`, `duckdb native binding: OK`, `graph-db native binding:
FAIL` (real opt-in build status — the `@ladybugdb/core` binding is not
installed on this dev box, which is what `doctor` is supposed to
surface; the false-WARN this PR fixes is gone)
- `rg -n 'AC-[A-Z]-[0-9]' packages/ scripts/` — zero hits

## Test plan

- [ ] CI green on `chore/v1-upstream-bug-sweep`
- [ ] `codehub doctor` reports OK on tree-sitter + duckdb in CI matrix
(Node 22 + Node 24)
- [ ] `codehub scan /tmp/<fixture>` ingests into `<fixture>` not CWD
(manual verification on a downstream repo)
- [ ] `codehub bench` table now renders all 17 rows, none stuck on
"skipped — script crashed"
- [ ] License audit / banned-strings / commitlint stay green

## Out of scope

- Bug #5 (testbed-only pytest-timeout). Listed for reference in
UPSTREAM_BUGS.md; does not affect upstream.

…skip logs (#156)

## Summary

Fixes a cluster of scanner/indexer robustness bugs surfaced by running
`codehub analyze` on an external Python/uv project. Each was
misreporting a ran-but-nonzero scanner as a hard skip, or emitting
misleading/duplicate diagnostics. Grounded against osv-scanner v2 and
bandit exit-code semantics.

## Issues fixed

**1. osv-scanner "exit code 127" despite running fine** — osv v2
reserves exit `1–126` = vulns found, `127` = general error, `128` = no
packages (per osv docs). The shared invoker treated only 0/1 as clean,
so 127 surfaced as a bare error. Root trigger: the wrapper passed
`--offline-vulnerabilities` by default, which on a repo with no synced
DB makes osv walk the tree, then fail to load the offline DB → exit 127.
→ Added an osv-specific exit-code interpreter (127 → "general error, try
`codehub db-sync`"; 128 → "no packages discovered"). Dropped
offline-by-default; use the canonical `scan source --recursive .` form
(matches `ci.yml`). **The `root: /` line is osv's own internal log — the
adapter correctly roots at the repo dir (`cwd=projectPath`, arg `.`).**

**2. bandit "exit code 2 + usage:"** — bandit exits 2 on argparse
errors; `-f sarif` is invalid without the `bandit[sarif]` extra
installed → usage banner. (The old "falls back to text" assumption was
false.)
→ Detect exit-2 + `usage: bandit` and emit an actionable "install
`bandit[sarif]`" advisory; suppress the misleading "stdout was not valid
JSON" note.

**3. Duplicate skip messages** — the runner routed `onWarn` to status
`"skipped"` AND re-emitted the terminal note, so lines printed twice and
ran-but-nonzero advisories were mislabeled "skipped".
→ Added a distinct `"warn"` status (scan ran, here's a note) and
coalesced the terminal event so each note prints once.

**4. scip-python "mise ERROR No version is set for shim"** —
`runIndexer` threw on any non-zero exit; a mise/asdf shim with no pinned
version resolves on PATH but exits non-zero before the real indexer
runs, producing an alarming "indexer failed".
→ Detect the version-manager-shim failure pattern and return a graceful
`skipped` (logged as the calmer "python skipped — …") with an actionable
hint. A genuine traceback still throws.

## Out of scope (user-env, not codehub bugs)
pip-audit "binary not found" is a graceful skip already (only bug was
the duplicate print, fixed in #3). The dead-code ghost-community warning
is correctly guarded and informational.

## Verification
- `@opencodehub/scanners` — **88 tests pass** (+7: osv exit 1/127/128 +
argv, bandit exit-2, runner de-dup + warn)
- `@opencodehub/scip-ingest` — **66 tests pass** (+4: mise/asdf shim
detection + genuine-crash still throws)

## Note for reviewer
Dropping `--offline-vulnerabilities` is a deliberate posture change (osv
does online lookups by default now) — flagging for sign-off.

…uce a symbol-free graph (#204)

## Why

The WASM-resolver bug fixed in #201 shipped **invisibly for ~5 days**.
Root cause of the *invisibility* (separate from the resolver itself): a
globally-broken parser degrades silently — every file returns empty
captures, `analyze` builds a File/Directory-only skeleton graph, prints
a node count, and **exits 0**. Nothing distinguished "the parser is
dead" from "this repo has no symbols." This PR closes that failure class
and the adjacent gaps the investigation surfaced.

## The five fixes

**#1 — Zero-symbol guard (run-level backstop).** `ParseOutput` now
carries `treeSitterFileCount` + `treeSitterSymbolCount`; the
orchestrator trips a `zeroSymbolGuardTripped` flag via the exported pure
predicate `shouldTripZeroSymbolGuard` (≥5 tree-sitter files **and** 0
symbols), pushes a loud warning, and `analyze` maps it to a distinct
**advisory exit code 3**. Configs-only / cobol-only /
unsupported-language repos report 0 tree-sitter files and never trip;
external `CodeElement` import stubs are excluded so an import-only repo
can't mask a break.

**#2 — Distinguish global parser death from per-file failure.** New
`WasmRuntimeUnavailableError` (with `name` set so it survives Piscina's
structured-clone across the worker boundary). `ensureWasmRuntime` now
**throws** it when the vendored grammar dir is missing /
`web-tree-sitter.wasm` won't init — a deployment breakage — instead of
the old ambiguous soft `undefined` that collapsed into N identical
per-file warnings. `openWasmParser` + `parseOne` rethrow; the parse
phase aborts the run with an actionable message. Per-file errors
(syntax, timeout, one missing grammar) still warn-and-skip. The
"web-tree-sitter package genuinely absent" path stays a no-throw
hand-off to #1.

**#3 — Resolver drift-guard test.** Extended the `asset-resolver` drift
guard to cover **all 5 shipped asset trees** (added `vendor/wasms` +
`java` to plugin-assets / ci-templates / config). A future fixed-offset
regression in any resolver now fails a test instead of shipping silently
— codifies the audit that this session ran by hand.

**#4 — tsup rm-before-copy.** `copyTree` now `rm`s each leaf dest before
`cp`, so an incremental/watch rebuild can't accumulate renamed/deleted
asset dirs in `dist/` (the stale `opencodehub-*` skill dirs from the
rename PR). Safe against the nested-dest hazard — each `onSuccess` dest
is a distinct leaf.

**#5 — Verifier asserts a real symbol.** `verify-global-install.sh` now
requires `codehub query 'Greet'` to return a `Function/Class/Method` row
from `greeter.go` (a uniquely-cased Go func), replacing the weak "any
hit on `export default`" gate — which **passed on the 0-symbol
skeleton** because the stderr header alone satisfied "non-empty".

## Verification

Against the built bundle:
- **Happy path** → exit 0, 16 nodes / 24 edges, symbols extracted.
- **`vendor/wasms` hidden** → run **ABORTS (exit 1)** with `Phase
'parse' failed: web-tree-sitter runtime failed to initialize; vendored
grammar directory not found at <dir> (reinstall … or re-vendor …)`. **No
skeleton graph persisted.** (Before this PR: silent exit 0 with a 5-node
skeleton — the exact bug that hid #201.)

The two parser fixes compose: #2 hard-aborts the runtime-death case
before anything is written; #1's exit-3 guard is the backstop for the
residual soft case (package genuinely absent → no throw but 0 symbols).

Tests: ingestion **594/594**, cli **316 pass / 0 fail / 11
platform-skip**; typecheck + repo lint + banned-strings clean. New
tests: `wasm-runtime.test.ts` (global-probe), `parse-worker.test.ts`
(sentinel rethrow vs per-file warning), `orchestrator.test.ts`
(predicate table + healthy-run no-trip), extended
`asset-resolver.test.ts` drift guard.

## Notes

- Adds advisory **exit code 3** to `analyze` (graph built, but zero code
symbols). Documented in an `index.ts` comment; the happy path stays exit
0.
- Pushing a warning does not affect `graphHash` (hash is over graph
nodes/edges only) — the byte-identical-hash determinism test stays
green.
- Stacks cleanly on the merged resolver fix (#201) and the prefix rename
(#203); no overlap.

---------

Co-authored-by: T <t@example.com>