fix(path): resolve exact node IDs before fuzzy matching

[jinxianhao0001-creator]

Summary

• Resolve path endpoints directly when the query is an exact graph node ID.
• Preserve the existing fuzzy-scoring fallback for label queries.
• Share the resolver between the CLI path command and MCP shortest_path.
• Add a regression test where stronger fuzzy-label decoys must not override exact IDs.

Why

An exact node ID could be tokenized and sent through fuzzy scoring, allowing a label, rationale, or file node to outrank the requested ID. On the same graph, this could return a different path than a direct exact-ID shortest-path lookup.

Test plan

• pytest tests/test_path_cli.py tests/test_serve.py -q — 156 passed
• Full suite in the validated detached worktree — 5034 passed, 12 skipped
• ruff check graphify/serve.py graphify/cli.py tests/test_path_cli.py
• git diff --check origin/v8...HEAD
• Code-only graphify update . and real exact-ID path replay

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

Formal verification. No changes could be formally verified in this run.

---

Graphify review — findings

Adds _resolve_path_endpoint, which gives an exact graph node ID absolute priority when resolving path endpoints and otherwise falls back to fuzzy token scoring, and routes both the path CLI command and the shortest_path MCP tool through it so a query matching a real node ID resolves to that node instead of a stronger-scoring decoy label. Covers this with a test where labels are deliberately closer fuzzy matches than the exact IDs.

Worth a look

• Path endpoint resolution now prefers node IDs over existing fuzzy label matches — graphify/serve.py:1384 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 570 functions depend on the 199 functions this change touches.

Health — this change adds coupling hotspots:

• new: dispatch_command() — 2 callers, 121 callees
• new: _query_graph_text() — 20 callers, 9 callees
• new: _score_query() — 15 callers, 5 callees
• new: _query_terms() — 20 callers, 3 callees
• new: run_benchmark() — 16 callers, 3 callees
• new: _stale_graph_sources() — 7 callers, 6 callees
• new: _build_server() — 2 callers, 16 callees
• new: _run_hook_guard() — 4 callers, 7 callees
• …and 11 more — each is listed as a finding

Verification — 570 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 530 function(s) in the blast radius were not formally verified this run

Formal verification

Could not verify: Could not verify dispatch\_command.

The verifier did not have enough to check dispatch\_command, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 23 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly SystemExit — names the real obstacle, not a sampling gap)

Could not verify: Could not verify \_shortest\_path\_text.

The verifier did not have enough to check \_shortest\_path\_text, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 30 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly KeyError — names the real obstacle, not a sampling gap)

· 19 more finding(s) on lines outside this diff (see the check run).