kartograph v0.23.0

Kartograph 0.23.0

Distribution status

Publication is in progress. This page is temporarily marked pre-release while the original tag-triggered workflow runs. CLI archives, the Gradle plugin and optional compiler collectors are available only after the assets and checksums appear below and their verification completes. Gradle Plugin Portal availability and independent public installation are still pending; page creation alone does not establish either.

Opt-in source-use evidence and source-edit impact

• Capture compiler-selected source uses with snapshot --include-source-uses. This explicit mode requires compiler evidence, a scope, completed build witnesses and a producer with call positions enabled. It does not automatically discover or infer missing evidence.
• Preserve immutable, provenance-bound observations in a separate non-edge channel. A compiler selection can survive even when an inline call has no corresponding runtime CALL edge. Runtime graph, retention, reachability, dead-code analysis and ordinary query/impact behavior retain their established semantics.
• Inspect saved observations with query --source-uses and direct observed dependents with impact --source-edits. These separately typed version-1 documents retain the ordinary query/graph-impact result. Source-edit results include unchanged callers that directly selected an exact changed target; they do not perform transitive source-impact analysis.
• Keep capture availability, partial/unknown coverage and freshness separate. Saved reports identify the parsed snapshot and report currentness: notChecked; use snapshot verification separately. An empty captured set differs from unavailable evidence. No Gradle or MCP automatic activation is introduced.

The accepted compiler fixture retains two exact selections, including an erased inline caller-to-wrapper selection. Its producer also reports four unmapped calls and one uncovered root. This is bounded observed evidence, not complete source-use or edit-impact coverage and not authorization to delete code or skip tests.

Upgrade and compatibility

0.23.0 is a pre-1.0 minor release for additive APIs and opt-in formats. Keep the CLI, plugin, collectors and directly used library modules on matching versions. Build new-API consumers against matching 0.23.0 artifacts; do not mix 0.22.0 and 0.23.0 module JARs.

Plain and compact snapshot format numbers remain 1 and 2. The optional graph.compilerSourceUses extension has its own version 1. Older snapshots without it remain unavailable rather than captured-empty. A 0.22 reader can read a compatible graph but loses the source-use extension when it writes it back; this is not a lossless downgrade. Unsupported merge/aggregation paths refuse source-use state rather than silently discarding it. Recapture both revisions with matching 0.23.0 settings when the comparison requires equal analyzer versions; do not edit snapshot version fields to bypass checks.

The focused compatibility evidence preserves 132 inspected public declaration/descriptor pairs across 11 released classes and 252 pairs across 19 Stage A classes. A retained old binary client ran successfully. A fresh Java 17 new-API client compiled and ran against both readiness ZIP/TAR module sets; compilation against old artifacts produced the exact expected missing-API diagnostics and no class output. This is limited client/API evidence, not a guarantee for every API, client or Kotlin source program. Earlier upgrade requirements from 0.20/0.21 to 0.22, including recompilation where JVM signatures changed, still apply.

Verification and installation

The exact source passed PR182 CI, merged-main CI and the original nonpublishing readiness run. Readiness produced two matching clean-build artifact sets, checked unpacked ZIP/TAR bodies, metadata, bundled documentation and licenses, and ran both 206-case Python suites with two optional Homebrew-specific skips each plus the installed collector checks.

An additional focused readiness-archive validation accepted all 28 logical outcomes: two exact retained probe executions and 26 fresh checks. It covered ordinary/default parity, both snapshot encodings, source-use query and direct source-edit impact, matching-versus-stale build inputs and the scoped old/new clients. The original failed grader-layout attempt remains recorded. Reads of historical old-reserialized snapshots were fresh 0.23 reads, not new executions of the old reader. Capture index-staleness warnings remain distinct from the explicit build-input match result. Public-download and Portal consumer verification remains pending.

The intended seven assets are CLI ZIP/TAR archives, the Gradle-plugin JAR, optional compiler collectors, two runtime SBOMs and SHA256SUMS. Check the six payloads against that checksum file. Use plugin version 0.23.0 from the Gradle Plugin Portal only after the exact marker and implementation become available and their verification is complete.

Limits and preserved history

The planned IntelliJ PSI comparison has not run because its required pinned reference runtime could not be acquired in the validation environment. These results make no overall PSI/IDE accuracy or performance superiority claim. Broad draft PR158 is not included.

Published 0.22.0 and its assets remain unchanged. The 0.21.0 tag/page and failed original release run remain unchanged: its 20.346-second smoke total exceeded the 20-second budget before asset and Portal publication. Earlier 20.361/32.656 timing failures, fixture failures, rejected pilots, failed A/A and inconclusive comparisons retain their original outcomes. Later successful gates do not establish a cause for those failures. The prepared 0.20.1 was never issued.

Source: ed1d8fa9b624853640d4331b162ab73e4e21f846, tree d2dfd177d9897261af613809c0318eb908c9e3c9.