add cross-service resolution mode flag for pass6 matching

[HumanBean17]

Summary

• add cached .lancedb-mcp.yml reader for cross_service_resolution (auto/brownfield_only) and thread the mode into graph build tables
• gate pass6 cross-service promotion in brownfield_only so only fully brownfield-sourced caller+route matches remain cross-service, with suppression logging
• persist and surface the mode via GraphMeta / KuzuGraph.meta() / MCP graph_meta, bump ontology to 8, and document the new config in README
• add PR-G1 tests for mode behavior, unknown-value fallback, and old-graph meta() fallback

Test plan

• ruff check .
• pytest tests/test_cross_service_resolution_flag.py tests/test_call_edge_matching.py -v --tb=short
• pytest tests -q --tb=line
• pytest tests/test_mcp_tools.py -q --tb=line -k graph_meta

Made with Cursor

[HumanBean17]

Review: PR-G1 — cross_service_resolution config flag

Verdict: Approved ✅

Clean, scope-disciplined implementation of the brownfield-first opt-in flag exactly as specified in plans/PLAN-CROSS-SERVICE-RESOLUTION-FLAG.md. All 8 plan-mandated tests pass, manual evidence reproduces, ontology bump is justified, and the gate logic is symmetric across HTTP and async loops. No leakage into PR-F1 (Feign-not-an-exposer) or PR-H1 (CLIENT rename) territory.

Scope discipline (out-of-scope checks)

Sentinel	Status
FEIGN_CLIENT	✅ 0 hits — no leakage from PR-H1
HTTP_CLIENT	✅ 0 hits — no capability work
_TYPE_ANN_TO_CAPABILITY	✅ 0 hits — ast_java.py capability table untouched
EXPOSES / feign_not_an_exposer	✅ 0 hits — no leakage from PR-F1
incremental.rebuild / rebuild_partial	✅ 0 hits — Tier-2 untouched
@mcp.tool registrations	✅ 0 new tools — surfaced via existing graph_meta
REST_CONTROLLER	✅ 0 hits — controller vocabulary untouched
New annotation types	✅ 0 — reuses existing @CodebaseRoute / @CodebaseClient

Plan compliance

#	Step from plan	Verified
1	_load_config_cross_service_resolution reader, mirrors _load_config_microservice_roots	✅ graph_enrich.py:147 — same caching/error-handling/warn-and-fall-back
2	cross_service_resolution: str = "auto" field on GraphTables	✅ build_ast_graph.py:258
3	Field populated at the three load_brownfield_overrides call sites	✅ build_ast_graph.py:1281, 1417, 2002
4	_is_brownfield_sourced helper near pass6_match_edges	✅ build_ast_graph.py:1655-1676 with both-sides-must-be-brownfield logic and defensive empty-candidates guard
5	Gate inside both HTTP and async loops of pass6_match_edges	✅ build_ast_graph.py:1746-1753 (HTTP) and 1791-1798 (async); identical structure
6	GraphMeta schema extended with cross_service_resolution STRING	✅ build_ast_graph.py:1878
7	ONTOLOGY_VERSION 7 → 8 with phase-comment update	✅ ast_java.py:74 (with "Phase 6" comment)
8	KuzuGraph.meta() extended with None fallback for old graphs	✅ kuzu_queries.py:350 (full mode) + :426 (default to None when not in tier) — the existing tiered _META_FULL/_META_PRE_E3/_META_LEGACY fallback chain absorbs the new column cleanly
9	Verbose log line per propose §2.5 (count + first 5 examples)	✅ build_ast_graph.py:1822-1830 — capped at 5
10	README brownfield section updated	✅ Mentions ontology_version 8, both modes, the strict both-sides rule, and the rebuild requirement

Tests

274 passed, 4 skipped in 101.29s

Plan target was 280 = 266 baseline + 8 (this PR) + 6 (PR-F1, not yet shipped). Math: 266 + 8 = 274 ✅. The full +14 target lands once PR-F1 merges.

All 8 plan-enumerated tests are present in tests/test_cross_service_resolution_flag.py (273 LOC) and pass in 1.03s on their own.

Manual evidence reproduced

Auto mode (default, on the cross_service_smoke fixture):

[pass6] http_match={'ambiguous': 1, 'cross_service': 1, 'intra_service': 1, 'phantom': 1, 'unresolved': 1},
        async_match={'cross_service': 1}, cross_service_calls_total=2

brownfield_only mode (after dropping .lancedb-mcp.yml with the flag):

[pass6] cross_service_resolution=brownfield_only:
        0 cross_service edges from brownfield layers,
        2 auto-cross-service candidates suppressed -> unresolved
[pass6] http_match={'ambiguous': 1, 'intra_service': 1, 'phantom': 1, 'unresolved': 2},
        async_match={'unresolved': 1}, cross_service_calls_total=0

meta() round-trip:

auto:  'auto'
bo:    'brownfield_only'

Determinism: ✅ two consecutive auto-mode builds produced identical sorted route IDs (9/9 match).

Notes that earned my trust

• Gate symmetry. HTTP and async loops use identical 4-line guard blocks. No copy-paste drift in the suppressed_auto_cross_count or suppressed_auto_cross accumulator handling.
• Defensive empty-candidates guard. _is_brownfield_sourced returns False when candidates is empty — this is the correct (and conservative) interpretation when both sides are unknown, even though _match_call_edge rarely returns cross_service with empty candidates today.
• Reset of cross_service_calls_total at the top of pass6. Future-proofs against incremental rebuild (Tier-2). The inline comment makes the intent explicit, which is exactly the right note for a follow-up implementer.
• Tiered meta() fallback absorbed the new column without a new tier — the existing _META_PRE_E3 / _META_LEGACY chain does the work, and old graphs return None via the meta_mode == "pre_e3" branch's lack of column read.
• Test add brownfield route overrides and codebase route composition (PR-A3) #8 (test_brownfield_client_with_auto_route_does_not_match) explicitly exercises the asymmetric case the propose [TBD-2] resolved — this is the test that protects the "both sides must be brownfield" decision against future relaxation by accident.
• README update documents the rebuild requirement and the strict both-sides rule prominently. Users who upgrade and skip rebuild will read it immediately because it sits inside the brownfield section.

Observations (non-blocking)

1. _load_config_cross_service_resolution redefines yaml import locally (graph_enrich.py:158). The sibling _load_config_microservice_roots does the same, so this is faithful mirroring — not a regression. If yaml is ever promoted to a top-level import in this file, both should change together.
2. suppressed_auto_cross accumulator is shared between HTTP and async loops. This means the "first 5 examples" line could end up mixing channels. Probably fine, but if a future debug session needs to know which channel a suppressed FQN came from, splitting into suppressed_auto_cross_http / suppressed_auto_cross_async is a 4-LOC follow-up.
3. getattr(c, "source_layer", "builtin") in _is_brownfield_sourced — the default "builtin" is correct (it's not in _BROWNFIELD_LAYERS, so it short-circuits to False), but RouteRow.source_layer is a declared field on master, so the getattr defensive default is dead code today. Leave it for forward compat with synthetic phantoms.
4. Test Document Kuzu MAP-as-STRING pattern in plan + prompts #6 inlines a 26-line CREATE NODE TABLE GraphMeta(...) schema for the legacy fixture. If the schema changes again (e.g. PR-F1 adds another column), this test will need to be updated. Acceptable trade-off — it's documenting the "what does the v7 schema look like" contract for the fallback path.
5. No CLI override (--cross-service-resolution=...) per plan §Out-of-scope. Confirmed — only YAML reads it. Listed as follow-up AST by Opus #1.

Plan deltas needed

None. The plan and PR are in lockstep.

---

Ready to merge. Next: PR-F1 (Feign-not-an-exposer) per plans/PLAN-FEIGN-NOT-AN-EXPOSER.md. Once both F1 and G1 are in, PR-H1 (CLIENT role rename, propose merged in #28) can land on top with ontology 8→9.