Skip to content

ContextForge v0.2.0

Choose a tag to compare

View all tags
@kallist kallist released this 04 Sep 12:05
· 32 commits to main since this release
v0.2.0
5741d72
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ContextForge v0.2.0

What changed

  • Deterministic TaskAnalysis, hybrid Retrieval V2 evidence fusion and lexical symbol ownership.
  • Bounded transient caller, test and implementation relationship evidence.
  • Experimental ContextPlan and plan-aware Pack V2, with exact final budget verification and bounded request-local fragment reuse.
  • Final frozen six-system evaluation, failure taxonomy and release evidence checks.

Stable default

V1 remains the public/default CLI and MCP Search/Pack behavior. Node.js support remains >=24.15 <25. Package identity is @kallist/contextforge; executable is contextforge.

Experimental V2

The selected candidate is contextforge-v2-plan-pack, retained INTERNAL_ONLY. There is no public V2 flag or MCP strategy field. ADR-009/010/011 are accepted as maintained experimental architecture, not public-default promotion.

Benchmark

The frozen 24-task/four-repository/five-budget comparison completed 720 cases with zero estimator-budget violations. All historical final case objects were reproduced. At 8K, required-symbol recall is 0.886364 versus V1's 0.863636, Overall Gold is 0.899802 versus 0.870866, and required-file recall is unchanged at 0.916667. All 19 V1 successes remain successful. Pack V2 retains 36/39 pre-Pack-present required symbols versus 35/39 for the relationship candidate with Pack V1.

The same-run Windows/Node 24.20 measurements give a fixed-corpus median total ratio of 1.478582x V1 (within the 1.5x guardrail, with limited headroom) and a synthetic 1,000-file ratio of 1.084919x. These are environment-specific measurements, not an SLA.

Important limitations

Cross-budget evidence remains mixed: weaker 2K symbol recall, weaker 16K/32K file recall than the V2 Pack V1 alternatives, and weaker precision outside 8K versus the relationship alternative. Task-aware planning is not proven stably superior. The strict .917 file and .900 symbol design thresholds are not met. No universal superiority or general token-savings claim is made.

Not measured

Coding-agent success was not measured. Docker, third-party agent-host integration, and external very-large repository generalization were not tested. V0.3 was not started.

See final evaluation and release report for evidence, provenance and release gates.

Release closeout — verified 2026-09-04

The release was completed from merged main 5741d72791c1c8fb2fa3fb6faa223fa0257f02fc, following release PR #10. No product, dependency, benchmark or audit-configuration changes were made during audit recovery.

Audit recovery and CI

The original post-main run failed when the public npm Security Audit endpoint returned HTTP 503, so tagging and publication stopped. At 2026-09-04 09:03:42 UTC, the official npm status endpoint reported Security Audit, Package publishing and Package installation operational; this was supporting evidence, not proof of request success.

One authorized no-code retry was performed: run 33854962429, attempt 2. All five mandatory post-main jobs passed. The audit returned zero vulnerabilities at every severity (info, low, moderate, high and critical), across 101 dependencies. The same job completed all 720 benchmark cases and the release-evidence check. Classification: TRANSIENT_NPM_AUDIT_SERVICE_503.

Existing main local release:check passed, including 172/172 tests, zero skips, package/MCP smoke and release hardening. Earlier local audit timeouts remain historical NOT VERIFIED results; the successful mandatory Hosted audit closes the release gate.

Immutable tag and published package

  • Annotated tag: v0.2.0.
  • Tag object: f90eb3b7eb8832a9c5b0a5aa0eeb7d8fcf89a8aa.
  • Peeled target: 5741d72791c1c8fb2fa3fb6faa223fa0257f02fc, verified locally and remotely.
  • Public package: @kallist/contextforge@0.2.0; registry latest verified as 0.2.0.
  • License: MIT; Node engine: >=24.15 <25; bin: contextforge -> dist/cli/main.js.
  • Reviewed tarball: 169 files, 663755 packed bytes, 4840887 unpacked bytes, five WASM assets.
  • Public registry SHA-1: 7cc93872b29c2416bba40f3c312662977123d06a.
  • Public registry integrity: sha512-PH3SvNVBYk82DeJG0/zRavFd5DJJGfPH7EwCgr3AetxKBzOQIplCyYyq1N3t+FC4PvmWz210ex72tRkjWK7iXA==.

The public registry metadata and the fresh installation lockfile integrity match the reviewed tarball. Publication used the exact reviewed tarball from the validated main checkout, following a successful final publish dry-run and legitimate npm authentication.

Fresh public installation

npm run package:smoke -- --public-registry passed on Windows x64 / Node 24.20.0. The consumer used a new temporary project and fresh cache, installing the exact version from https://registry.npmjs.org, not a local tarball.

Verified CLI --help, --version (0.2.0), map, index, inspect, graph, search and pack; packaged WASM parsers and SQLite; MCP initialization, status, index, search, pack and shutdown. The existing standalone CLI has no status command: status is an MCP tool, and no new CLI command was added. CLI/MCP ranking remains contextforge-structural-v1, and packing remains contextforge-pack-v1; public default remains V1.

Actual installed contents passed the leakage scan. OS process inspection found zero matching smoke processes before and after the run, with zero orphans. Temporary smoke resources were cleaned up.

This is public packaging/transport evidence, not coding-agent success. Third-party coding-agent hosts, agent-success quality, Docker, external very-large repository generalization and Pack V2-specific OS-process symlink/concurrency races remain NOT TESTED. The frozen mixed-evidence candidate decision and unmet strict recall targets above remain unchanged. V0.3 NOT STARTED.

Assets 2
Loading