v2.1.18

Cartograph v2.1.18

Cartograph v2.1.18 makes file-local indexing failures actionable without
weakening the source/privacy boundary. It resolves
issue #137: a failed
parse no longer collapses to an unexplained parse_failed result when the
native pipeline can identify the input and a credential-safe cause.

Actionable parse diagnostics

• Memory and PostgreSQL-spill indexing retain one exact normalized
  project-relative input path across the parse worker, indexer supervisor, and
  project runtime boundaries.
• Source drift, bounded source-read failure, unavailable or mismatched grammar,
  parser stop, cancellation, invalid span or nesting policy, nesting exhaustion,
  modeled-output exhaustion, and generation capacity remain distinct fixed
  reasons.
• The failed generation cannot publish. An existing current generation remains
  visible and queryable while the named input is fixed or deliberately ignored.

Structured CLI and MCP output

• Text errors name the escaped project-relative path and qualified stable
  reason code.
• cartograph index <path> --format json exits nonzero and emits standalone
  structured JSON on stderr. The error.file_failure object contains path,
  reason, and a fixed description; the parent object retains the stable
  failure code and stage.
• MCP admin job status carries the same bounded evidence as fileFailure, so a
  background index does not flatten the diagnostic back to parse_failed.
• Auto-sync retains the qualified stable reason code for retry/backoff policy.

Privacy and safety boundary

Only a validated relative NormalizedPath and allowlisted enum reason cross the
native pipeline boundary. Absolute checkout roots, source or parser text,
literal values, database URLs, credentials, and database/driver errors remain
discarded. Text rendering escapes path control characters, JSON uses ordinary
string escaping, and the diagnostic stays bounded to one failed input.

Upgrade

Use the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

Require completed: true. Restart or reopen an attached agent host only when
the report says restartRequired: true; a process that was already attached
cannot hot-load the new native child.

Cartograph v2.1.18 remains native Rust and PostgreSQL-only. It does not bundle
PostgreSQL, ParadeDB, pgvector, a database, or a container image, and it has no
SQLite runtime, importer, optional feature, or fallback.

Full changelog: v2.1.17...v2.1.18