Skip to content

fix(sourcehunt): restore reliable reads and callgraph coverage - #190

Open
whatever wants to merge 16 commits into
mainfrom
fix/soft-read-overlap
Open

fix(sourcehunt): restore reliable reads and callgraph coverage#190
whatever wants to merge 16 commits into
mainfrom
fix/soft-read-overlap

Conversation

@whatever

@whatever whatever commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Summary

  • report truthful read_file coverage using the lines actually returned, including requested/returned ranges, EOF, truncation, overlap, and new-line metadata
  • remove hard overlap failures while preserving target-window provenance as the initial visible context
  • decouple repository-wide callgraph construction from subsystem-scoped taint analysis

Validation

  • 119 combined target-window, read, preprocessor, and telemetry regression tests passed
  • Ruff passed on every changed file
  • git diff --check passed
  • successful CVE-2026-27775 benchmark run after combining this change with the target-window stack

Stack and integration

  • stacked on feat(sourcehunt): add exact target file windows #188 (codex/sourcehunt-07-target-file-windows)
  • required conflict scan: no blocker or high findings against the intended stacked base
  • callgraph construction remains repository-wide while taint analysis retains its narrower subsystem budget

Local state

Unrelated local evaluation-ledger and skill files were excluded from this PR.

Eric Hartford and others added 14 commits August 28, 2026 05:58
…stem

The checkpoint system (#151-#164) resumes at stage granularity: a stage is
restored only when it ran to completion, so a hunt interrupted part way through
re-runs every already-finished file. PR #143 solved that with a separate
work-item memoization path (its own resume.py, manifest, fingerprints, and
--resume CLI), which collided with the checkpoint architecture.

This folds #143's memoization *into* the checkpoint system instead of running a
second one, so there is a single resume path with finer resolution.

- hunt_work_cache.py: HuntWorkCache — an incremental, write-once per-work-item
  store (adapted from #143's resume.py load/save, minus the manifest /
  fingerprint / rank-plan machinery, which the checkpoint stages already
  provide). Malformed, missing, or non-completed entries are cache misses, so
  the work simply re-runs.
- pool.py: WorkItem.stable_identifier folds in tier / entry-point identity /
  seed context / a per-file context_id so a cached result is never reused
  across changed inputs; HunterPool loads a completed result from the cache
  (as a resolved future) or runs and saves it.
- findings_pool.py: FindingsPool.add is idempotent on finding id, so findings
  carried in from cached work are not double-counted on resume.
- budget.py: SpendLedger(resume=True) replays the existing spend ledger so the
  dollar cap stays a lifetime budget across a resume; an interrupted
  reservation is charged once.
- runner.py / CLI: the hunt stage always memoizes work items under
  <session>/hunt-work/; `--resume SESSION_ID` continues a prior session
  directory in place, routing entirely through the existing checkpoint /
  ledger / findings-pool machinery — no parallel resume path or CLI.

Supersedes #143. Tests: 14 new (store, pool reuse, idempotent replay, ledger
resume, work-item identity, --resume validation); full affected suite green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ShCktZJoeBkVa3kGj6BKVS
Never put max_tokens, max_completion_tokens, or max_output_tokens on provider requests. Remove the rejection retry and cap-based truncation retry paths.
Co-authored-by: Matt Owen <matt.owen@lazarus.enterprises>
Co-authored-by: Matt Owen <matt.owen@lazarus.enterprises>
Co-authored-by: Matt Owen <matt.owen@lazarus.enterprises>
Co-authored-by: Matt Owen <matt.owen@lazarus.enterprises>
Run each finding through a bounded verifier tool loop in a fresh writable no-network sandbox. Record and redact all tool evidence, clamp evidence levels to host-observed crashes, fail closed on operational errors, and bind durable checkpoints to verifier inputs and policy versions.

Co-authored-by: Matt Owen <matt.owen@lazarus.enterprises>
Bypass ranking for explicit repository-relative source files and seed each hunter with a bounded, line-numbered first-turn window. Bind target fingerprints, window ranges, and effective prompt context to checkpoints and granular work-cache identities, and fail incomplete plans closed before verification.
@ropoctl

ropoctl commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

are read behavior, callgraph, and otel provenace issues separable into different prs?

@whatever

Copy link
Copy Markdown
Contributor Author

are read behavior, callgraph, and otel provenace issues separable into different prs?

I'll zap the provenance stuff since it's just about tracking performance for OTEL against commits. The callgraph stuff is just the preferred navigation mechanism, but is disabled for large code-bases (we should use a LSP approach as a follow-up)

@ehartford
ehartford force-pushed the codex/sourcehunt-07-target-file-windows branch 8 times, most recently from 7d5dfaf to 9b83919 Compare August 30, 2026 07:23
Base automatically changed from codex/sourcehunt-07-target-file-windows to main August 30, 2026 07:32
@ehartford

Copy link
Copy Markdown
Contributor

Please rebase @whatever

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants