CI-only: fix/study-cross-repo-bridges at b7aca1a4, small layout (do not merge)

cmd/gortex/daemon_state.go

@@ -367,18 +367,20 @@ func (frontier *warmupDeltaFrontier) invalidate() {
 func (frontier *warmupDeltaFrontier) record(result *indexer.IndexResult) {
 	frontier.mu.Lock()
 	defer frontier.mu.Unlock()
+	if result != nil {
+		for _, file := range result.CrossRepoResolveFiles {
+			if file != "" {
+				frontier.crossRepoFiles[file] = struct{}{}
+			}
+		}
+	}
 	if result == nil || result.RepoPrefix == "" || result.FullRetrack || len(result.FailedFiles) > 0 {
 		frontier.exact = false
 		return
 	}
 	plan := frontier.plans[result.RepoPrefix]
 	plan.Merge(result.DerivedInvalidation)
 	frontier.plans[result.RepoPrefix] = plan
-	for _, file := range result.CrossRepoResolveFiles {
-		if file != "" {
-			frontier.crossRepoFiles[file] = struct{}{}
-		}
-	}
 }
 
 func (frontier *warmupDeltaFrontier) snapshot(changedRepos int, scopeUnknown bool) (map[string]indexer.DerivedInvalidationPlan, []string, bool) {

cmd/gortex/daemon_warm_cargo_frontier_test.go

@@ -0,0 +1,25 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"github.com/zzet/gortex/internal/indexer"
+)
+
+func TestWarmupCargoConsumersStayOutsideDerivedPlan(t *testing.T) {
+	for _, full := range []bool{false, true} {
+		frontier := newWarmupDeltaFrontier()
+		frontier.record(&indexer.IndexResult{
+			RepoPrefix: "provider", FullRetrack: full,
+			DerivedInvalidation:   indexer.DerivedInvalidationPlan{Files: []string{"provider/src/lib.rs"}},
+			CrossRepoResolveFiles: []string{"consumer/src/lib.rs"},
+		})
+		plans, files, exact := frontier.snapshot(1, false)
+		require.Contains(t, files, "consumer/src/lib.rs")
+		require.Equal(t, !full, exact)
+		for _, plan := range plans {
+			require.NotContains(t, plan.Files, "consumer/src/lib.rs")
+		}
+	}
+}

cmd/gortex/daemon_warm_python_frontier_test.go

@@ -0,0 +1,25 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"github.com/zzet/gortex/internal/indexer"
+)
+
+func TestWarmupPythonConsumersStayOutsideDerivedPlan(t *testing.T) {
+	for _, full := range []bool{false, true} {
+		frontier := newWarmupDeltaFrontier()
+		frontier.record(&indexer.IndexResult{
+			RepoPrefix: "provider", FullRetrack: full,
+			DerivedInvalidation:   indexer.DerivedInvalidationPlan{Files: []string{"provider/src/PIL/image.py"}},
+			CrossRepoResolveFiles: []string{"consumer/app.py"},
+		})
+		plans, files, exact := frontier.snapshot(1, false)
+		require.Contains(t, files, "consumer/app.py")
+		require.Equal(t, !full, exact)
+		for _, plan := range plans {
+			require.NotContains(t, plan.Files, "consumer/app.py")
+		}
+	}
+}

docs/multi-repo.md

@@ -126,6 +126,32 @@ the participating repositories' allow-lists. This keeps a repository from
 silently losing framework edges requested by a sibling while allowing a
 workspace where every repository opts out to avoid the scans entirely.
 
+### Tracked module imports
+
+- Go imports can link to a representative source file in a tracked module.
+  The longest matching root `go.mod` path selects the package. Ambiguous providers
+  stay unlinked. Local `replace` paths must point to indexed source files.
+- Rust `use` imports can link to a tracked library declared in `Cargo.toml`.
+  Dependency aliases, workspace dependencies, explicit workspace members and
+  `[lib]` names and paths are supported. Undeclared crates, ambiguous providers
+  and reserved names such as `std`, `core` and `crate` stay unlinked.
+- Python imports can link to a tracked distribution declared in `pyproject.toml`
+  or `requirements*.txt`. Root and `src/` layouts support modules and regular
+  packages. A local top-level package blocks a foreign link. Ambiguous providers,
+  undeclared distributions and Python stdlib imports stay unlinked.
+
+These import-file links do not make every symbol in the provider reachable.
+Calls still need an imported path or type. Versions and build configurations
+are not verified.
+
+### Python package re-exports
+
+Calls through a declared, tracked Python distribution can follow one level of
+relative `from .module import Name` or `from .module import Name as Alias` in its
+package `__init__.py`. The bridge requires an exact imported binding and a unique
+function or class in the provider. It does not follow wildcard imports,
+conditional or function-local imports, or multi-level re-export chains.
+
 ## Daemon tuning (optional)
 
 The background daemon writes JSON lines to `daemon.log` and rotates it while
@@ -494,9 +520,14 @@ Scoped tool responses carry a `scope_applied` meta field plus a one-line widen h
   - Entry lookup respects `exports` keys, wildcard subpaths and `null` blocks. It probes the selected `import`/`default` target first, then a `types` condition when that file is not indexed. Without `exports`, it tries `types`, `main` and directory indexes. Unsupported-condition subpaths never guess a directory target.
   - Bare calls use the caller file's named import binding, including its local alias, not another same-named function anywhere in the provider. A per-binding import links to a symbol marked public by the extractor; otherwise it stays at `external::<specifier>::<name>` with its `npm_import` marker and creates no call binding. Linked imports retain their specifier, survive provider eviction as external imports, and are rechecked by whole-graph resolution.
   - **Limits:** Build-output-only entries, such as `main` and `types` pointing into excluded `dist/`, stay external unless an indexed target is declared. Gortex does not infer `src/` from `dist/`. The importing repository's own packages, `npm:` aliases and workspace paths that escape the repository are not linked by this pass. Sibling dependencies declared with `file:`, `link:` or `portal:` are not supported. Default-import bare calls have no exact binding evidence yet and stay unresolved. After an upgrade, JavaScript and TypeScript files are re-extracted once (extractor version 2), so existing imports acquire the specifier and alias metadata; their links appear after that pass. Namespace member calls, CommonJS `require` calls and package re-exports are not linked by this npm import pass. Export targets without `./` are accepted leniently, as in workspace resolution, even though Node rejects them. Call binding is file-scoped: a parameter or local callable with the imported name can bind to the import.
+  - Go source imports can link to a representative indexed package file. The `go.mod` dependency contract remains separate. Linked imports retain their package identity across provider saves.
   - Go package-selector calls such as `library.Hello()` use tracked roots' `go.mod` module paths, not checkout names. An import of `example.org/library/sub` can bind to `<provider>/sub/file.go::Hello` even when the provider prefix is `b`.
   - Precise own-module, vendor and staging paths take priority. Otherwise the longest matching module path wins. A primary/non-worktree checkout wins a tie with dedicated worktree copies; ties between independent primary checkouts are refused. Cross-workspace calls still require the caller's `cross_workspace_deps` declaration.
   - A cross-repo module binding carries confidence `0.6` and origin `ast_inferred`. It is a source hint, not proof that the tracked checkout matches the required version. The edge retains its symbol-bearing import identity so provider edits and full reindexes can rebind it without editing the caller. Module-map changes re-check existing bindings.
-  - **Limits:** Only root `go.mod` identities are used; nested modules and `go.work` selection are not resolved. Required versions and module/version replacements are not verified. A local `replace` whose destination is untracked prevents module-path binding instead of selecting another checkout with the same module name. Tracked local replacements remain source hints, not full Go build-list resolution. Calls on values typed from another module, such as `client.Do()` for a `library.Client`, can remain `unresolved::*.Do`; receiver-type linking is not implemented here.
+  - **Limits:** Only each tracked root's `go.mod` identity is used. Separately tracked nested modules can win by longest path; nested manifests within one tracked root and `go.work` selection are not resolved. Required versions and module/version replacements are not verified. A local `replace` whose destination is untracked prevents module-path binding instead of selecting another checkout with the same module name. Tracked local replacements remain source hints, not full Go build-list resolution. Calls on values typed from another module, such as `client.Do()` for a `library.Client`, stay unresolved unless another pass has precise evidence. Importing the module alone does not enable name-only receiver binding.
+  - Rust `use` imports link to the declared provider's library root or module file. Dependency, dev-dependency, build-dependency and target tables are read. Calls bind only to a unique imported item or receiver in that file.
+  - **Cargo limits:** This is not Cargo build resolution. Versions, features and target conditions are not evaluated. Absolute or escaping library paths, conflicting aliases and multiple eligible providers are refused. Re-exports and untyped receivers are not inferred. Module-qualified calls such as `use lib::util; util::action()` are not linked by this bridge. Only direct members of a single group bind, such as `use lib::util::{a, b}`. Nested members inside braces are not linked. Grouped and ungrouped member calls require an indexed file for the exact parent module; an import that falls back to an ancestor file does not authorize those calls. Existing links are not always revisited after declaration or provider-set changes; reindex the provider to refresh them.
+  - Python distribution imports link only after a consumer declaration and a unique eligible provider match. Qualified calls use the linked module file. Typed methods require a receiver name bound by `from X import Name [as Alias]` and a matching provider method in that file. Plain `import pkg.mod` and wildcard imports never link typed methods. A same-named type defined in the caller file refuses the link. Package calls can follow the one-level re-exports described above.
+  - **Python limits:** Distribution versions and arbitrary source layouts are not verified. Providers must expose indexed root or `src/` modules or regular packages. Namespace-only providers and dynamic imports are not linked. Local top-level names take priority, including namespace directories. A working link is not reconsidered when a second provider appears, its dependency declaration is dropped, or a new local top-level package shadows it. Reindex the consumer to refresh it.
 - **Impact analysis** — `explain_change_impact`, `verify_change`, and `get_test_targets` follow cross-repo edges automatically, grouping results by repository.
 - **Shared repos** — the same repo can appear in multiple projects with different reference tags. It's indexed once and shared across projects.

internal/indexer/added_file_declaration_gate_test.go

@@ -0,0 +1,156 @@
+package indexer
+
+import (
+	"github.com/stretchr/testify/require"
+	"github.com/zzet/gortex/internal/config"
+	"github.com/zzet/gortex/internal/graph"
+	"github.com/zzet/gortex/internal/parser/languages"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestPythonAddedFileDeclarationGate(t *testing.T) {
+	provider, consumer := t.TempDir(), t.TempDir()
+	writeWorkspaceFile(t, provider, "pyproject.toml", "[project]\nname = 'library'\n")
+	writeWorkspaceFile(t, consumer, "pyproject.toml", "[project]\nname = 'app'\n")
+	g := &pythonLookupScanStore{Store: graph.New()}
+	g.AddEdge(&graph.Edge{From: "consumer/app.py", FilePath: "consumer/app.py", To: "external::pkg.extra", Kind: graph.EdgeImports})
+	mi := &MultiIndexer{graph: g, repos: map[string]*RepoMetadata{"provider": {RootPath: provider}, "consumer": {RootPath: consumer}}}
+	for range 2 {
+		require.Empty(t, mi.pythonAddedFileConsumers([]string{"provider/pkg/extra.py"}))
+	}
+	require.Zero(t, g.importScans, "no declaration means no import scan")
+	writeWorkspaceFile(t, consumer, "pyproject.toml", "[project]\ndependencies = ['library']\n")
+	require.Equal(t, []string{"consumer/app.py"}, mi.pythonAddedFileConsumers([]string{"provider/pkg/extra.py"}))
+	require.Equal(t, 1, g.importScans)
+	require.Zero(t, g.nodeReads, "admission must not build the provider lookup")
+	writeWorkspaceFile(t, consumer, "pyproject.toml", "[project]\nname = 'app'\n")
+	g.importScans = 0
+	require.Empty(t, mi.pythonAddedFileConsumers([]string{"provider/pkg/next.py"}))
+	require.Zero(t, g.importScans)
+	// Existing but unreadable snapshot evidence must open admission.
+	prior := readDiskFile
+	readDiskFile = func(file string) ([]byte, bool) { return nil, false }
+	t.Cleanup(func() { readDiskFile = prior })
+	require.Equal(t, []string{"consumer/app.py"}, mi.pythonAddedFileConsumers([]string{"provider/pkg/extra.py"}))
+	require.Equal(t, 1, g.importScans)
+}
+
+func TestCargoAddedFileDeclarationGate(t *testing.T) {
+	provider, consumer := t.TempDir(), t.TempDir()
+	writeWorkspaceFile(t, provider, "Cargo.toml", "[package]\nname = 'library'\n")
+	writeWorkspaceFile(t, consumer, "Cargo.toml", "[package]\nname = 'app'\n")
+	g := &cargoWarmScanStore{Store: graph.New()}
+	g.AddEdge(&graph.Edge{From: "consumer/src/lib.rs", FilePath: "consumer/src/lib.rs", To: "external::library/extra", Kind: graph.EdgeImports})
+	mi := &MultiIndexer{graph: g, repos: map[string]*RepoMetadata{"provider": {RootPath: provider}, "consumer": {RootPath: consumer}}}
+	for range 2 {
+		require.Empty(t, mi.cargoAddedFileConsumers("provider"))
+	}
+	require.Zero(t, g.lightScans)
+	writeWorkspaceFile(t, consumer, "Cargo.toml", "[package]\nname = 'app'\n[dependencies]\nlibrary = '1'\n")
+	require.Equal(t, []string{"consumer/src/lib.rs"}, mi.cargoAddedFileConsumers("provider"))
+	require.Equal(t, 1, g.lightScans)
+	writeWorkspaceFile(t, consumer, "Cargo.toml", "[package]\nname = 'app'\n")
+	g.lightScans = 0
+	require.Empty(t, mi.cargoAddedFileConsumers("provider"))
+	require.Zero(t, g.lightScans)
+	prior := readDiskFile
+	readDiskFile = func(file string) ([]byte, bool) { return nil, false }
+	t.Cleanup(func() { readDiskFile = prior })
+	require.Equal(t, []string{"consumer/src/lib.rs"}, mi.cargoAddedFileConsumers("provider"))
+	require.Equal(t, 1, g.lightScans)
+}
+
+func TestPythonAddedTestPackageDoesNotScan(t *testing.T) {
+	provider, consumer := t.TempDir(), t.TempDir()
+	writeWorkspaceFile(t, provider, "pyproject.toml", "[project]\nname = 'library'\n")
+	writeWorkspaceFile(t, consumer, "pyproject.toml", "[project]\ndependencies = ['library']\n")
+	g := &pythonLookupScanStore{Store: graph.New()}
+	mi := &MultiIndexer{graph: g, repos: map[string]*RepoMetadata{"provider": {RootPath: provider}, "consumer": {RootPath: consumer}}}
+	require.Empty(t, mi.pythonAddedFileConsumers([]string{"provider/tests/__init__.py", "provider/src/test/helpers.py"}))
+	require.Zero(t, g.importScans)
+}
+
+func TestAddedFileAfterDeclarationMatchesCold(t *testing.T) {
+	for _, backend := range []string{"memory", "sqlite"} {
+		for _, lang := range []string{"python", "cargo"} {
+			t.Run(backend+"/"+lang, func(t *testing.T) {
+				provider, consumer := t.TempDir(), t.TempDir()
+				manifest, caller, added := "pyproject.toml", "app.py", "pkg/extra.py"
+				providerManifest, consumerManifest := "[project]\nname = 'library'\n", "[project]\nname = 'app'\n"
+				declaration := "dependencies = ['library']\n"
+				providerSource, consumerSource := "", "from pkg.extra import f\ndef run(): return f()\n"
+				if lang == "cargo" {
+					manifest, caller, added = "Cargo.toml", "src/lib.rs", "src/extra.rs"
+					providerManifest, consumerManifest = "[package]\nname = 'library'\n", "[package]\nname = 'app'\n"
+					declaration = "[dependencies]\nlibrary = '1'\n"
+					providerSource, consumerSource = "pub mod extra;\n", "use library::extra::f;\npub fn run() { f(); }\n"
+					writeWorkspaceFile(t, provider, "src/lib.rs", providerSource)
+				} else {
+					writeWorkspaceFile(t, provider, "pkg/__init__.py", providerSource)
+				}
+				writeWorkspaceFile(t, provider, manifest, providerManifest)
+				writeWorkspaceFile(t, consumer, manifest, consumerManifest)
+				writeWorkspaceFile(t, consumer, caller, consumerSource)
+				entries := []config.RepoEntry{{Path: consumer, Name: "consumer", Workspace: "shared"}, {Path: provider, Name: "provider", Workspace: "shared"}}
+				mi, g := newPythonBridgeIdentityIndexer(t, backend, entries)
+				mi.registry.Register(languages.NewRustExtractor())
+				_, err := mi.IndexAll()
+				require.NoError(t, err)
+				for _, target := range revisionCallTargets(g, "consumer/"+caller, graph.EdgeImports) {
+					require.False(t, strings.HasPrefix(target, "provider/"))
+				}
+				// The declaration changes without recreating the MultiIndexer or resolver registry.
+				writeWorkspaceFile(t, consumer, manifest, consumerManifest+declaration)
+				if lang == "cargo" {
+					providerSource = "pub fn f() {}\n"
+				} else {
+					providerSource = "def f(): pass\n"
+				}
+				writeWorkspaceFile(t, provider, added, providerSource)
+				_, err = mi.IncrementalReindexRepo("provider", []string{filepath.Join(provider, added)})
+				require.NoError(t, err)
+				targets := revisionCallTargets(g, "consumer/"+caller, graph.EdgeImports)
+				require.Contains(t, targets, "provider/"+added)
+				cold, coldGraph := newPythonBridgeIdentityIndexer(t, backend, entries)
+				cold.registry.Register(languages.NewRustExtractor())
+				_, err = cold.IndexAll()
+				require.NoError(t, err)
+				require.ElementsMatch(t, revisionCallTargets(coldGraph, "consumer/"+caller, graph.EdgeImports), targets)
+				require.ElementsMatch(t, revisionCallTargets(coldGraph, "consumer/"+caller+"::run", graph.EdgeCalls), revisionCallTargets(g, "consumer/"+caller+"::run", graph.EdgeCalls))
+				// Removal closes admission for the next addition. Full/retrack recovery is separate.
+				writeWorkspaceFile(t, consumer, manifest, consumerManifest)
+				if lang == "cargo" {
+					require.Empty(t, mi.cargoAddedFileConsumers("provider"))
+				} else {
+					require.Empty(t, mi.pythonAddedFileConsumers([]string{"provider/pkg/next.py"}))
+				}
+				require.NoError(t, mi.GetIndexer("provider").IndexFile(filepath.Join(provider, added)))
+			})
+		}
+	}
+}
+
+func TestCargoRootOwnWorkspaceDependencyIsNotBridge(t *testing.T) {
+	first, second := t.TempDir(), t.TempDir()
+	own := "[package]\nname='app'\n[workspace]\nmembers=['member']\n[dependencies]\nmember={path='member'}\n"
+	writeWorkspaceFile(t, first, "Cargo.toml", own)
+	writeWorkspaceFile(t, first, "member/Cargo.toml", "[package]\nname='member'\n")
+	writeWorkspaceFile(t, second, "Cargo.toml", "[package]\nname='other'\n")
+	g := &cargoWarmScanStore{Store: graph.New()}
+	g.AddEdge(&graph.Edge{From: "first/src/lib.rs", FilePath: "first/src/lib.rs", To: "external::other/extra", Kind: graph.EdgeImports})
+	mi := &MultiIndexer{graph: g, repos: map[string]*RepoMetadata{"first": {RootPath: first}, "second": {RootPath: second}}}
+	require.False(t, mi.cargoManifestSnapshot().cargoDeclared)
+	require.Empty(t, mi.cargoAddedFileConsumers("first"))
+	require.Zero(t, g.lightScans, "a local workspace dependency is not a tracked bridge")
+	writeWorkspaceFile(t, first, "Cargo.toml", own+"other='1'\n")
+	require.True(t, mi.cargoManifestSnapshot().cargoDeclared)
+	require.Equal(t, []string{"first/src/lib.rs"}, mi.cargoAddedFileConsumers("second"))
+	require.Equal(t, 1, g.lightScans)
+	writeWorkspaceFile(t, first, "Cargo.toml", own)
+	require.False(t, mi.cargoManifestSnapshot().cargoDeclared)
+	g.lightScans = 0
+	require.Empty(t, mi.cargoAddedFileConsumers("first"))
+	require.Zero(t, g.lightScans)
+}

internal/indexer/affected_by_bound_test.go

@@ -387,7 +387,7 @@ func TestDeletionShapedStagesCarryNoInEdges(t *testing.T) {
 	stages := []*incrementalBatchStage{{graphPath: restubDefPath, priorNodes: prior}}
 	view := loadIncrementalPriorView(st, stages)
 
-	carried, _ := restubIncomingRefsFromView(st, stages, view)
+	carried, _, _, _ := restubIncomingRefsFromView(st, stages, view)
 	require.Empty(t, carried,
 		"a deletion stage must park every in-edge; a carried edge has no re-state path here")
 	assert.Equal(t, 1, st.restubWrites("Foo"),