feat(query): embed Grafeo code graph projection

[ScriptedAlchemy]

Summary

• replace the generation-local BTreeMap adjacency and hand-written BFS behind CodeGraphEvidenceAdapterV1 with embedded, in-process Grafeo
• keep the published code-index generation authoritative; Grafeo is a disposable read projection rebuilt once per generation
• use Grafeo's direct Rust LpgStore, filtered GraphProjection, and BFS visitor APIs; no server, sidecar, query strings, second durable store, dual path, or fallback
• pin grafeo-{adapters,common,core} exactly to 0.5.42 with only algos/lpg; no petgraph or Grafeo query/storage feature

Preserved contracts

• generation/project identity, freshness, authorization, exact/lexical lane independence
• edge-kind filtering, canonical edge deduplication, depth/candidate bounds, typed missing/conflicting bindings
• deterministic full-path tie-breaking, weakest-authority score propagation, and coverage accounting
• cancellation/deadline behavior remains owned by the unchanged graph-lane boundary

The traversal retains a bounded Pareto frontier per node. This is necessary for byte-equivalent canonical results when a later weak edge equalizes paths that had different authority earlier.

Evidence

Final branch checks on PR #421 head 4615475cff7383a6f8c232953fc65f1e038eb75f:

• cargo test -p tracedecay-query --lib: 139 passed, 1 ignored
• cargo clippy -p tracedecay-query --all-targets -- -D warnings: passed
• cargo test -p tracedecay-search-eval --lib: 38 passed
• exact production-owner binding test: 1 passed, 2167 filtered
• exact activation/warm-generation test: 1 passed, 2167 filtered
• cargo fmt --all -- --check: passed
• dependency feature audit: minimal-grafeo-features-ok
• independent final review: no Critical or Important findings

Falsifiable graph tests cover cycles/self-loops, convergent fanout, equal-cost and downstream-bottleneck paths, edge filtering, duplicate edges, missing/conflicting/foreign bindings, depth/candidate limits, deterministic ordering, stale/cancelled/unavailable states, and byte-equivalent duplicate-edge output.

Measurements

Same 16-symbol/30-edge fixture, 25 samples per process, three isolated process runs; table reports the median run. Peak RSS is /usr/bin/time process RSS, not runtime instrumentation.

Adapter	Build p50 / p95	Traversal p50 / p95	Peak RSS
Prior adjacency/BFS	61 / 118 µs	137 / 239 µs	6.0 MiB
Embedded Grafeo	536 / 636 µs	455 / 532 µs	7.5 MiB

The fixture shows expected embedded-projection overhead: about 8.8× build p50, 3.3× traversal p50, and +1.5 MiB peak RSS. Absolute p95 remains below 0.7 ms; projection construction occurs once per immutable generation. No benchmark or memory API was added to production.

Limitations and future Work DAG safety

This PR does not implement Work/task DAG, git history, sessions/LCM, memory, or vectors.

Grafeo's direct topological_sort/is_dag APIs can operate over a label/type-filtered projection, so the domain-scoped code labels and edge types leave one embedded substrate available for a future Work DAG. Two constraints must be handled in that future adapter:

• topological order is not canonical because the implementation seeds a LIFO Vec from an FxHashMap; user-visible order must be canonicalized
• cycle validation is not an atomic check-and-mutate transaction across node_ids and edges_from; Work DAG mutation must use an application-owned single-writer lock or validate an immutable snapshot

The plugin registry wrapper also reports a cycle as a successful string row; a future typed adapter must call the direct Option/boolean APIs instead. These are explicit adapter constraints, not reasons to add petgraph or a standalone service.

Rollback

Revert this child PR. Grafeo holds only a disposable derived projection, so rollback requires no persisted-data migration.

References

• Grafeo 0.5.42 release
• grafeo-core 0.5.42
• GraphProjection
• bfs_with_visitor

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8ccdc86

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR