Release 0.1.6

.github/workflows/ci.yml

@@ -26,7 +26,11 @@ name: CI
 
 on:
   push:
-    branches: [main, dev]   # dev takes direct pushes, so they get a result too
+    # dev takes direct pushes, so they get a result too. A release branch (0.1.6, ...)
+    # takes merges from pull requests: the run on the merge is what saves the compiled
+    # engines where the NEXT pull request into it can restore them — a cache a pull
+    # request saves is visible to that pull request alone.
+    branches: [main, dev, '0.*']
   pull_request:
   merge_group:
   workflow_dispatch:
@@ -78,6 +82,10 @@ jobs:
             echo "code=true" >> "$GITHUB_OUTPUT"; echo "engines=false" >> "$GITHUB_OUTPUT"
             echo "push to dev: suites run, platform engines wait for main"; exit 0
           fi
+          if [ "${{ github.event_name }}" = push ] && [[ "${{ github.ref }}" == refs/heads/0.* ]]; then
+            echo "code=true" >> "$GITHUB_OUTPUT"; echo "engines=false" >> "$GITHUB_OUTPUT"
+            echo "push to a release branch: suites run (and save its engines for pull requests into it), platform engines wait for main"; exit 0
+          fi
           # A push to main is a release when its version has no tag yet: that commit, and only that one,
           # builds every platform and runs the five-platform e2e, and release.yml drafts from it once
           # it is green. A push whose version is already tagged released nothing new and builds nothing.
@@ -246,6 +254,10 @@ jobs:
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-24.04
     timeout-minutes: 45
+    env:
+      # the engine is compiled for any x86-64 runner, so a cached one can be restored
+      # on whichever runner this job lands (see the engine cache step below)
+      AXIOM_ENGINE_MARCH: portable
     strategy:
       fail-fast: false
       matrix:
@@ -396,32 +408,61 @@ jobs:
       # one language recompiles that language only, and an unchanged one never does.
       # Two things decide the binary that ENGINE_ID does not cover, so they are in the
       # key too: the driver that compiles it (run-souffle.sh holds the compiler flags),
-      # and the runner's CPU, because the driver compiles with -march=native and a
-      # binary built on one CPU can die with an illegal instruction on another.
-      # The CPU part hashes the FEATURE FLAGS, not only the model name: hosted runners
-      # that report the same model name do not all expose the same instruction set, so
-      # a model-name key restored a binary that died with SIGILL on every case.
+      # and the target it is compiled for.
+      #
+      # THE TARGET IS PORTABLE, NOT THE RUNNER'S CPU. The driver's default is
+      # -march=native, and a binary built on one hosted runner died with SIGILL on
+      # another (runners that report the same model name do not all expose the same
+      # instruction set). The key used to carry a hash of the runner's CPU flags to
+      # keep such a binary off other CPUs — and so it missed on almost every run,
+      # since which CPU a job lands on is luck: a three-minute compile per language,
+      # per run, for rules nothing had changed. AXIOM_ENGINE_MARCH=portable compiles
+      # for the compiler's baseline x86-64 target instead, as the published engines
+      # are, so any runner can run any runner's binary and the CPU leaves the key.
+      #
+      # A cache saved by a pull request is visible to that pull request only. The
+      # ones every pull request can restore are the base branch's and the default
+      # branch's, which is why a push to a release branch runs the suites too (see
+      # `on.push` and the `changes` job): it leaves the engine for its rules where
+      # every pull request into that branch finds it.
       - name: this language's engine id
         id: eid
         run: |
           echo "id=$(bash graph/pipeline/run-souffle.sh --language ${{ matrix.lang }} --print-engine-id)" >> "$GITHUB_OUTPUT"
-          echo "cpu=$(grep -E '^(model name|flags)[[:space:]]*:' /proc/cpuinfo | sort -u | sha256sum | cut -c1-12)" >> "$GITHUB_OUTPUT"
 
-      - name: cache the compiled Soufflé engine
+      - name: restore the compiled Soufflé engine
+        id: engine-cache
         if: ${{ !inputs.fresh }}
-        uses: actions/cache@v4
+        uses: actions/cache/restore@v4
         with:
           path: .souffle-cache
-          key: souffle-engine-${{ matrix.lang }}-${{ steps.eid.outputs.id }}-${{ hashFiles('graph/pipeline/run-souffle.sh') }}-${{ steps.eid.outputs.cpu }}
+          key: souffle-engine-${{ matrix.lang }}-${{ steps.eid.outputs.id }}-${{ hashFiles('graph/pipeline/run-souffle.sh') }}-march-${{ env.AXIOM_ENGINE_MARCH }}
 
       - name: ${{ matrix.lang }} regression suite
         env:
           AXIOM_PARSER: ${{ github.workspace }}/parser/dist/index.js
           # The driver's default cache is ~/.cache/axiomcode/souffle; point it at the
           # directory the cache step above saves and restores, or it never hits.
           AXIOM_SOUFFLE_CACHE: ${{ github.workspace }}/.souffle-cache
+        # The cases run concurrently, up to one per CPU (graph/test/tools/case-pool.sh);
+        # AXIOM_SUITE_JOBS=1 here would run them one at a time, as they used to.
         run: bash .github/scripts/run-suite.sh ${{ matrix.lang }} ${{ matrix.oracle }}
 
+      # Saved whether or not the suite passed. The binary does not depend on the verdict:
+      # run-souffle.sh publishes it only whole and verified (a temp name, then a rename),
+      # so a red run's engine is as good as a green one's, and the run that most needs the
+      # next push to be fast is the red one. Not when cancelled, and not unless this
+      # language's engine is actually there: a key saved without it would stay taken, and
+      # every later run would restore the gap and could never save over it.
+      - name: save the compiled Soufflé engine
+        if: >-
+          ${{ !cancelled() && !inputs.fresh && steps.engine-cache.outputs.cache-hit != 'true'
+              && hashFiles(format('.souffle-cache/souffle-engine-{0}-{1}', matrix.lang, steps.eid.outputs.id)) != '' }}
+        uses: actions/cache/save@v4
+        with:
+          path: .souffle-cache
+          key: souffle-engine-${{ matrix.lang }}-${{ steps.eid.outputs.id }}-${{ hashFiles('graph/pipeline/run-souffle.sh') }}-march-${{ env.AXIOM_ENGINE_MARCH }}
+
   # Every language's engine, every platform, built once per release: on the push that
   # lands a new version on main (and in the nightly). publish-npm ships these very
   # artifacts, so what the e2e below tested is what users install (#1350).

gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "axiomcode",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Ask your repository how its code connects: who calls this, what breaks if I change it, which tests an edit reaches, how A reaches B. Answers come from a resolved call graph and are verified against it; nothing is guessed.",
   "contextFileName": "plugins/axiomcode/AGENTS.md",
   "mcpServers": {

graph/bundle/SCHEMA.md

@@ -552,7 +552,7 @@ THE GRAPH. One row per (site, resolved target). A site with N possible targets h
 | `implicit_constructor` | javascript | `new C()` / `super()` where no constructor exists up the chain: the synthesized default runs. A correct end; callee is NULL. |
 | `dynamic_terminal` | javascript | `obj[expr]()`, `eval`, `import()`: no static target by construction; callee is NULL. |
 | `fan_capped` | javascript, java, csharp | More targets than --dispatch-cap: the set was refused rather than emitted. JavaScript: callee is NULL. Java and C#: callee is the declared base method the fan would have started from; dispatch-capped-sites.csv carries the refused count. |
-| `callback_registered` | javascript | The site HANDS the callee this function (`xs.forEach(f)`, `p.then(f)`, `emitter.on('x', h)`, `setTimeout(f)`), which may invoke it. Not the site's own callee; a reachability edge, labelled so it is never read as a resolved call. |
+| `callback_registered` | javascript, typescript | The site HANDS the callee this function (`xs.forEach(f)`, `p.then(f)`, `emitter.on('x', h)`, `setTimeout(f)`), which may invoke it. Not the site's own callee; a reachability edge, labelled so it is never read as a resolved call. |
 | `event_dispatch` | javascript | `x.emit('name')` reaching a handler registered by `x.on('name', h)` on a value x may hold — name-sensitive for literal names, every handler on that value for a computed one. |
 | `event_dispatch` | java | A Spring application event: `publishEvent(e)` reaching each listener (`@EventListener`, `@TransactionalEventListener`, `ApplicationListener<E>.onApplicationEvent`) whose declared event type e's static type is, or is a subtype of. Added beside the publishEvent boundary row, never in place of it (call-edge-generation/event_dispatch.dl). |
 | `intrinsic_terminal` | typescript | The site is a JSX intrinsic element or a dynamic `import()` — a runtime intrinsic, not a function the graph can name. |
@@ -574,7 +574,7 @@ THE GRAPH. One row per (site, resolved target). A site with N possible targets h
 - **python** — A `boundary_lib` edge may point at a builtin (callee_provenance builtin, callee_label `builtin:NAME`) or at an unstaged import path (callee_provenance external) — neither has a methods row.
 - **java** — A `boundary_lib` edge with callee_provenance external names a method of an ancestor type no staged IR declares (callee_label `external:<type>.<name>`, no methods row). A site whose receiver is declared as such a type is multi_inferred even with one client override: the platform method itself, and the platform's own subclasses, are the other possible targets. Stage the library to replace the label with the real method.
 - **python** — The reason a site is ambiguous_unknown is exported per site in ext_call_site_unresolved (site, caller, reason, detail).
-- **all** — THE TRUST LINE, and it is not the same set of tiers in every language. RESOLVED (callee_method_id is set): known_edge and multi_inferred in every language, and boundary_lib where the library is staged (--library) — without it boundary_lib names the target in callee_label and leaves callee_method_id NULL; ALSO ambient_terminal in TypeScript, fan_capped in Java and C# (the declared base, the fan refused), and runtime_observed in C#. HANDED OVER (callee set, but the site passes the function rather than calling it): callback_registered and event_dispatch in JavaScript; event_dispatch in C# too, where a mediator Send or Publish runs the handler for the request type, beside the row for the site itself. CORRECT END (callee NULL, and nothing is missing): intrinsic_terminal in TypeScript; ambient_terminal, implicit_constructor and dynamic_terminal in JavaScript; known_implicit_ctor, known_builtin_operator and boundary_generated (callee_label set) in C#. BLIND SPOT (callee NULL; exactly the tiers named `ambiguous_*`, which are what unresolved_sites holds): ambiguous_unknown everywhere, ALSO ambiguous_anon in Java and ambiguous_dynamic in C#. CAPPED (callee NULL, not in unresolved_sites): fan_capped in JavaScript. Python emits only the four shared tiers. A filter written as `tier IN (known_edge, multi_inferred)` therefore drops resolved edges in every language but Python — derive the set from this note or from unresolved_sites, never from a hardcoded list.
+- **all** — THE TRUST LINE, and it is not the same set of tiers in every language. RESOLVED (callee_method_id is set): known_edge and multi_inferred in every language, and boundary_lib where the library is staged (--library) — without it boundary_lib names the target in callee_label and leaves callee_method_id NULL; ALSO ambient_terminal in TypeScript, fan_capped in Java and C# (the declared base, the fan refused), and runtime_observed in C#. HANDED OVER (callee set, but the site passes the function rather than calling it): callback_registered and event_dispatch in JavaScript, callback_registered in TypeScript; event_dispatch in C# too, where a mediator Send or Publish runs the handler for the request type, beside the row for the site itself. CORRECT END (callee NULL, and nothing is missing): intrinsic_terminal in TypeScript; ambient_terminal, implicit_constructor and dynamic_terminal in JavaScript; known_implicit_ctor, known_builtin_operator and boundary_generated (callee_label set) in C#. BLIND SPOT (callee NULL; exactly the tiers named `ambiguous_*`, which are what unresolved_sites holds): ambiguous_unknown everywhere, ALSO ambiguous_anon in Java and ambiguous_dynamic in C#. CAPPED (callee NULL, not in unresolved_sites): fan_capped in JavaScript. Python emits only the four shared tiers. A filter written as `tier IN (known_edge, multi_inferred)` therefore drops resolved edges in every language but Python — derive the set from this note or from unresolved_sites, never from a hardcoded list.
 - **java** — A multi_inferred fan is CHA-wide: it is every override the hierarchy admits, bounded only by the dispatch cap. type_instantiated is computed and exported but NOT read by any rule, so the fan is not narrowed to types the program constructs. Narrow it yourself by joining dispatch_candidates to type_instantiated — see the dispatch_envelope_of query. A receiver is ALSO typed by what flows into it (a local's initializer, the arguments callers pass to a parameter, the receivers callers invoke a method on for its `this`), and each flow-in type resolves its member directly, outside the fan: that is why a `fan_capped` site still carries edges, and why they are the types the program was seen to hand over, not the whole hierarchy.
 - **typescript** — A multi_inferred fan is CHA-wide, as in Java: type_instantiated is computed and exported but NOT read by any rule. The fan also has sources that are not virtual dispatch at all — an overload set or a union-typed receiver produces one too.
 - **python** — A multi_inferred fan IS narrowed by the instantiation set: type_instantiated_reachable (the constructed classes and their bases) bounds dispatch in resolution/dispatch.dl. Python is the only front end where that narrowing is applied, so a fan here is tighter than the same shape would be in Java or TypeScript.