v2.1.25

Cartograph v2.1.25

Cartograph v2.1.25 adds a provider-agnostic, shell-free CLI bridge for optional
generative tiers, hardens managed-database migration and replacement failures,
and prevents parse-cache garbage collection from deleting rows still owned by
durable spill work. It also advances the supported toolchain and dependency
graph to their current compatible releases.

Provider-agnostic CLI bridge

• provider: "cli-bridge" runs an operator-selected executable with an ordered,
  bounded argv template. Cartograph never invokes a shell; only the exact
  {model} and {prompt} placeholders are accepted.
• Prompts can be delivered through bounded stdin or one exact argv token.
  Responses can be decoded as trimmed raw text, through a validated bounded JSON
  path, or through the legacy Claude response envelope.
• Wall-clock timeout, kill-on-drop, stdout, stderr, exit-status, prompt-template,
  command, argv, model, and response-path bounds all fail closed before an
  invalid configuration can run.
• The native llm setup command and MCP llm-plan/llm-apply operations expose
  the same bridge contract. Existing claude-bridge and claudeBin
  configurations remain readable, while the hybrid Claude preset writes the
  generic representation with byte-compatible historical behavior.

Managed-database recovery diagnostics

• Managed startup applies schema migrations with a bounded PostgreSQL statement
  timeout and verifies the append-only ledger after failure. A database that is
  valid but behind now reports its recorded version, required version, and exact
  pending migration instead of surfacing a later missing-column query.
• doctor verifies the schema ledger before reading generation tables, so an
  older supported schema produces actionable upgrade guidance without querying
  a column that its migration has not created yet.
• Managed image replacement proves free space on the exact owned data mount
  before renaming the healthy container. The requirement scales to the current
  schema's full index allocation plus ten percent of database allocation, with
  a 64-MiB floor, so extension rebuilds retain a replacement copy plus bounded
  WAL/catalog scratch. Once an extension catalog has advanced, the existing
  forward-resumable recovery contract still retains the new image and refuses
  an unsafe downgrade restart.

Parse-cache and automatic-sync recovery

• Single-row, batch, and exact parse-cache eviction now preserve cache entries
  referenced by generation spill rows through the durable composite foreign-key
  identity. Live regression coverage exercises both same-path replacement modes
  and exact eviction.
• Automatic sync now opens a bounded circuit after five consecutive revisions
  fail with the same stable non-status error code. Successful sync resets the
  circuit, alternating failures do not trip it, and JSON status reports both
  repeated-failure attempts and retry suppression explicitly.
• db prune --maximum-cascade-rows and MCP prune-generations now expose the
  retention engine's existing hard-bounded row override. This lets an audited
  recovery remove one terminal generation that is slightly larger than the
  conservative five-million-row default without weakening the independent
  search-relation or DDL caps.
• The existing capacity-specific circuit breaker remains unchanged.

Current supported dependencies

• The pinned stable compiler and minimum supported Rust version advance to
  Rust 1.98.0. Linux validation and release builders use digest-pinned official
  Rust 1.98.0 Debian 13 images.
• Direct Tree-sitter dependencies advance to tree-sitter 0.26.13 and
  tree-sitter-sfapex 3.0.1. The lockfile also refreshes compatible transitive
  releases and removes the now-unused arrayref package and BSD-2-Clause
  allowance.
• PostgreSQL 18, ParadeDB pg_search 0.25.3, managed pgvector 0.8.4, and the
  PostgreSQL-only storage contract are unchanged.

Upgrade

Use the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

Require completed: true. This release adds no database migration or generation
digest change. Restart or reopen an attached agent host only when the report
says restartRequired: true; an already-attached process cannot hot-load the
new binary.

Cartograph v2.1.25 remains native Rust and PostgreSQL-only. It does not bundle
PostgreSQL, ParadeDB, pgvector, a database, or a container image, and it has no
SQLite runtime, importer, optional feature, or fallback.

Full changelog: v2.1.24...v2.1.25