v2.1.24

Cartograph v2.1.24

Cartograph v2.1.24 centralizes every workspace dependency contract, adds a
fail-closed CI check that prevents member manifests from drifting, and updates
the ABAP Tree-sitter package to its current major release without changing the
published grammar behavior.

Complete workspace dependency inheritance

• All internal cartograph-* crates are declared once in
  [workspace.dependencies], and member manifests inherit those canonical
  paths with workspace = true across normal, development, build, and
  target-specific dependency tables.
• A deterministic workspace contract derives the authoritative member set from
  locked Cargo metadata, parses each TOML manifest, and rejects missing root
  declarations, direct member paths or versions, and non-inherited internal
  dependencies.
• The contract includes adversarial coverage for comments, indentation, dotted
  keys, dependency subtables, implicit members, and globbed members.

Fail-closed release validation

• The full GitHub quality gate now runs the workspace dependency contract as an
  exact blocking step. Documentation-only validation remains bounded to its
  approved allowlist, while dependency, workflow, source, and unknown changes
  continue to select the complete gate.
• The release-workflow contract parses GitHub Actions YAML and rejects semantic
  job- or step-level continue-on-error keys, including quoted, escaped,
  explicit-key, and whitespace variants. It also requires the workspace
  dependency check exactly once under the full-gate condition.

Current ABAP grammar package

• tree-sitter-abap-sqry and its support crate are updated from 29.0.6 to
  30.0.0 while retaining Tree-sitter 0.26 compatibility.
• The published 29.0.6 and 30.0.0 parser, grammar, node types, headers, Rust
  bindings, build script, and support implementation are byte-identical. The
  package-major update therefore does not change extraction identities or the
  generation digest contract.

Upgrade

Use the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

Require completed: true. This release adds no database migration or generation
digest change. Restart or reopen an attached agent host only when the report
says restartRequired: true; an already-attached process cannot hot-load the
new binary.

Cartograph v2.1.24 remains native Rust and PostgreSQL-only. It does not bundle
PostgreSQL, ParadeDB, pgvector, a database, or a container image, and it has no
SQLite runtime, importer, optional feature, or fallback.

Full changelog: v2.1.23...v2.1.24