SDK relationship events, graph analytics, and bounded agent context

.agents/pm/chores/pm-m2il.toon

@@ -6,7 +6,7 @@ status: open
 priority: 2
 tags[7]: "area:graph",benchmark,conformance,property-testing,scale,testing,token-efficiency
 created_at: "2026-07-13T22:03:31.210Z"
-updated_at: "2026-07-13T22:03:31.210Z"
+updated_at: "2026-07-14T11:06:37.229Z"
 author: codex-root
 estimated_minutes: 600
 acceptance_criteria: "Fixtures cover empty and seconds-old scratch projects, representative medium histories, deep and cyclic typed graphs, multi-decade event streams, disconnected archives, and deterministic 10k, 100k, and one-million-item workspaces; Property tests cover registry invariants, inverse and alias rules, append-only mutation, replay equivalence, snapshot isolation, cursor stability, migration, merge or federation, and correction by superseding event; Algorithm tests verify exact results on bounded fixtures and deterministic seeds, error bounds, freshness, provenance, and monotonic resource limits for approximations; Concurrency tests exercise thousands-agent read and write contention, crashes, stale indexes, retries, idempotency, checkpoints, and non-overlapping reconstruction claims; CLI, MCP, SDK, extension, and shell pipeline parity share golden semantics while allowing intentionally different compact projections; Performance gates record p50, p95, and p99 latency, peak memory, incremental update cost, bytes and tokens, truncation quality, and index rebuild time with documented hardware and envelopes; Every test runs in sandboxed PM_PATH and PM_GLOBAL_PATH and never reads or writes the real repository tracker"
@@ -26,6 +26,20 @@ dependencies[6]{id,kind,created_at,author,source_kind}:
   pm-g2zz,related,"2026-07-13T22:03:31.210Z",null,null
   pm-ju83,blocked_by,"2026-07-13T22:03:31.210Z",null,null
   pm-mi2x,related,"2026-07-13T22:03:31.210Z",null,null
-comments[1]{created_at,author,text}:
+comments[6]{created_at,author,text}:
   "2026-07-13T22:03:31.210Z",codex-root,"Duplicate check 2026-07-13: pm-mi2x supplies generic scale fixtures and pm-atfm evaluates context quality,but no item owns typed-graph property,replay,migration,adapter-parity,and reconstruction conformance across those fixtures."
+  "2026-07-14T09:43:38.102Z",codex-gpt5,"Implementation start 2026-07-14: add replay, snapshot, adversarial topology, deterministic analytics, and token-bound conformance coverage for the broad graph SDK bundle; all tests remain sandbox-safe."
+  "2026-07-14T10:02:22.642Z",codex-gpt5,"TDD evidence: focused relationship suites pass 21 tests. New relationship history, analytics, and context modules plus the precedence additions report literal 100% statements/branches/functions/lines in focused V8 coverage; static quality, docstring, audit-boundary, and token-budget gates pass."
+  "2026-07-14T10:19:34.994Z",codex-gpt5,"Verification evidence: focused relationship suite 21/21 passed; pnpm lint, typecheck, docs/skills, contracts, static quality, audit, and secrets gates passed; full all-source coverage is statements 36575/36575, branches 26252/26252, functions 7405/7405, lines 35721/35721 across 287 files / 5,678 tests. Packed npx smoke passed, package-first dogfood passed 88 real commands, and a fresh pnpm-installed tarball exercised custom ownership, relationship replay, critical-path analytics, and bounded context through @unbrained/pm-cli/sdk. Release gates fail only at live Sentry PM-CLI-29, owned by open pm-7n5a; telemetry is healthy at 0.29% error rate with zero missing error codes."
+  "2026-07-14T10:48:29.783Z",codex-gpt5,"PR #556 review round 1 verification: every Gemini/Greptile inline finding was reacted to, answered, and resolved; CodeRabbit/Sourcery rate limits and Codecov success were acknowledged. Focused SDK suite passes 23/23; full suite passes 287 files / 5,680 tests with statements 36,592/36,592, branches 26,271/26,271, functions 7,411/7,411, lines 35,735/35,735. Lint, typecheck, static/docstring 100%, package boundary, token budget, and zero-clone gates pass."
+  "2026-07-14T11:06:16.983Z",codex-gpt5,"PR #556 review round 2 verification: six new Gemini/Greptile findings were up-voted, individually answered, tested, and resolved. Full repository gate passes 287 files / 5,680 tests with statements 36,607/36,607, branches 26,286/26,286, functions 7,412/7,412, lines 35,749/35,749; lint, zero-clone, typecheck, static/docstring, package boundary, and token gates pass."
+notes[1]{created_at,author,text}:
+  "2026-07-14T10:19:37.624Z",codex-gpt5,"Remaining canonical scope after this PR: property generators, concurrent durable adapters, migration matrix, and million-item proof; keep chore open."
+files[2]{path,scope,note}:
+  tests/unit/sdk/relationship-history-analytics.spec.ts,project,"event replay,analytics,cursor,token,semantic,and adversarial conformance"
+  tests/unit/sdk/relationships.spec.ts,project,registry precedence and validation conformance
+tests[1]{command,scope,timeout_seconds}:
+  node scripts/run-tests.mjs test -- tests/unit/sdk/relationships.spec.ts tests/unit/sdk/relationship-history-analytics.spec.ts,project,240
+docs[1]{path,scope,note}:
+  docs/RELATIONSHIP_GRAPH.md,project,"public event,snapshot,analytics,and graph-context contracts"
 body: "## Matrix axes\n\nScale; graph topology; edge-kind family; history age; mutation concurrency; index state; query budget; adapter; serialization; schema version; failure injection; permissions or redaction; exact versus approximate algorithm.\n\n## Required adversarial cases\n\nDense cliques; long chains; wide stars; duplicate aliases; associative cycles; genuine ordering cycles; dangling imported endpoints; self-links; contradictory inverses; high-degree hubs; temporal supersession; checkpoint corruption; concurrent retyping; stale cursors; severe token limits.\n\n## Reporting\n\nDefault CI output is a compact pass or fail envelope with deltas. Full evidence is stored as artifacts or linked results and remains available by case, seed, snapshot, and scale. No benchmark may silently skip or downscale."

.agents/pm/epics/pm-qwoy.toon

@@ -6,13 +6,14 @@ status: open
 priority: 2
 tags[5]: capability,code-scanning,dependabot,security,semgrep
 created_at: "2026-07-06T21:07:27.273Z"
-updated_at: "2026-07-13T19:42:42.258Z"
+updated_at: "2026-07-14T10:18:55.307Z"
 author: maintainer-agent
 estimated_minutes: 2400
 acceptance_criteria: All code-scanning findings (Semgrep/CodeQL/dependabot/secrets) are tracked as pm issues under this epic with source links and triage state; recurring scanner imports parent their batch tasks here; epic stays OPEN as a living backlog even at 0 open children.
 parent: pm-doxj
 risk: high
 confidence: high
-comments[1]{created_at,author,text}:
+comments[2]{created_at,author,text}:
   "2026-07-13T19:42:42.258Z",codex-root,"Live GitHub security/dependency sweep 2026-07-13: Dependabot alert API contains 39 fixed and 0 open alerts; code-scanning contains 10 fixed and 0 open alerts; secret-scanning contains 0 alerts; pnpm audit reports 0 vulnerabilities at every severity. Five dependency-update PRs are open and remain isolated for their own review: #537 dev-dependencies group, #538 @sentry/node 10.64.0, #539 TypeScript 7.0.2, #540 @types/node 26.1.1, #541 eslint-plugin-unicorn 71.1.0. No duplicate pm item created and none were claimed in this context implementation lane."
+  "2026-07-14T10:18:55.307Z",codex-gpt5,"Live GitHub security/dependency sweep 2026-07-14: Dependabot, code-scanning, and secret-scanning APIs each return zero open alerts; pnpm audit --audit-level high reports no known vulnerabilities. Open dependency PRs are #552 grouped dev dependencies, #541 eslint-plugin-unicorn 71.1.0, #540 @types/node 26.1.1, #539 TypeScript 7.0.2, and #538 @sentry/node 10.65.0. They remain isolated/unclaimed for their own compatibility review."
 body: "# Capability: Security & code scanning (living backlog)\n\nOwns repository security posture work that previously had no capability home:\n- Semgrep Code finding triage batches (first import: pm-oz8u, 40 findings from 2026-07-06 CSV — 6 High spawn-shell-true, 34 Medium prototype-pollution/non-literal-RegExp/dependabot-cooldown).\n- Dependabot dependency hygiene (pm-2czc closed the 2026-07-06 unblock: @types/node 26, pnpm cooldown, codeql-action lockstep group).\n- Secret guardrails and history-redact usage policy (see 2026-05-22 history-repair learning: never quote secret-pattern literals into pm text).\n- Future CodeQL / scanner integrations.\n\nConvention: each scanner import creates one batch Task parented here, with one Issue per platform finding (Semgrep ID as issue code) so findings stay individually triageable. Sibling epic pm-92if owns CodeFactor (maintainability) findings; this epic owns security-class findings."

.agents/pm/extensions/.managed-extensions.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "updated_at": "2026-07-14T09:23:55.581Z",
+  "updated_at": "2026-07-14T12:10:59.291Z",
   "entries": [
     {
       "name": "pm-changelog",

.agents/pm/features/pm-7ob5.toon

@@ -6,7 +6,7 @@ status: open
 priority: 2
 tags[7]: algorithms,"area:context","area:graph",context-management,performance,planning,scale
 created_at: "2026-07-13T21:58:35.029Z"
-updated_at: "2026-07-13T21:58:35.029Z"
+updated_at: "2026-07-14T11:44:59.388Z"
 author: codex-root
 estimated_minutes: 900
 acceptance_criteria: "Order-bearing DAG analysis provides topological order, critical path, slack, prerequisite depth, frontier, dominators, and transitive reduction while reporting genuine cycles separately; Impact analysis provides reverse reachability, bounded blast radius, articulation points or bridges, dependency fan-in and fan-out, bottlenecks, and change-risk propagation; Knowledge-graph analysis provides connected components, strongly connected components by edge family, community detection, centrality, redundancy, structural holes, and orphan classification; Algorithms are exact where bounded and expose deterministic approximation method, seed, error or confidence bounds, freshness, and omitted counts otherwise; Incremental and temporal variants consume immutable history and support snapshot comparison, trend, change-point, and counterfactual what-if analysis; Each signal includes provenance and a concise explanation suitable for context packing; no opaque score is authoritative by itself; Evaluation compares quality, latency, memory, update cost, and token savings on scratch, medium, adversarial, multi-decade, and one-million-item fixtures"
@@ -26,6 +26,22 @@ dependencies[6]{id,kind,created_at,author,source_kind}:
   pm-atfm,related,"2026-07-13T21:58:35.029Z",null,null
   pm-g2zz,related,"2026-07-13T21:58:35.029Z",null,null
   pm-ju83,blocked_by,"2026-07-13T21:58:35.029Z",null,null
-comments[1]{created_at,author,text}:
+comments[7]{created_at,author,text}:
   "2026-07-13T21:58:35.029Z",codex-root,"Duplicate check 2026-07-13: context-engine items define relevance assembly and evaluation but no dedicated typed-graph analytics portfolio covering project planning,impact,community,and incremental temporal algorithms; this item supplies those graph primitives without duplicating ranking policy."
+  "2026-07-14T09:43:36.815Z",codex-gpt5,"Implementation start 2026-07-14: deliver the first exact deterministic analytics tranche over registered relationship semantics, including execution-order and impact/knowledge signals with provenance rather than opaque scores."
+  "2026-07-14T10:19:33.632Z",codex-gpt5,"Implementation evidence: added exact deterministic ordering analytics with Kahn layers, frontier, depth, topological order, critical path, and SCC cycle reporting; bounded impact with shortest explanation paths; weak/strong knowledge components, orphans, hubs; and temporal snapshot comparison. Associative relationships are excluded from execution blockers through registry precedence rather than hard-coded kind names."
+  "2026-07-14T10:48:29.881Z",codex-gpt5,"PR #556 review round 1 evidence: longest-path analysis now explicitly excludes cyclic targets reached from the acyclic prefix, and temporal comparison recursively stabilizes complete edge/payload key ordering. Cycle-entry and nested payload-order regressions pass; full repository coverage is exact 100/100/100/100."
+  "2026-07-14T11:06:16.985Z",codex-gpt5,"PR #556 review round 2 evidence: stable temporal keys now honor runtime objects with custom toJSON semantics before recursive key sorting. Equivalent Date and ISO payload values compare unchanged without altering native undefined omission behavior."
+  "2026-07-14T11:19:54.468Z",codex-gpt5,"PR #556 review round 3 evidence: documented the deliberate source-before-target fallback as compatibility behavior for legacy and JSON-parsed relationship definitions; focused SDK tests, lint, duplicate detection, CodeFactor rules, and typecheck pass."
+  "2026-07-14T11:44:56.773Z",codex-gpt5,"PR #556 review round 4 evidence: impact analysis now performs one BFS with parent-map path reconstruction instead of one shortest-path traversal per affected node. Regression coverage proves bounded and cyclic semantics and zero shortestPath calls; installed-package 10,000-node fan-out visited 10,001 nodes once in 27.28 ms. Full coverage is exact 100/100/100/100 across 5,681 tests."
+notes[1]{created_at,author,text}:
+  "2026-07-14T10:19:36.348Z",codex-gpt5,"Remaining canonical scope after this PR: dominators, community algorithms beyond exact components, redundancy detection, incremental cached analytics, and CLI/MCP projections; keep feature open."
+learnings[1]{created_at,author,text}:
+  "2026-07-14T10:02:21.487Z",codex-gpt5,Execution analytics need an explicit precedence direction in each ordering-kind definition. An ordering boolean alone cannot distinguish source-blocks-target from source-blocked-by-target without guessing from labels.
+files[1]{path,scope,note}:
+  src/sdk/relationship-analytics.ts,project,"exact execution,impact,knowledge,and temporal graph analytics"
+tests[1]{command,scope,timeout_seconds}:
+  node scripts/run-tests.mjs test -- tests/unit/sdk/relationships.spec.ts tests/unit/sdk/relationship-history-analytics.spec.ts,project,240
+docs[1]{path,scope,note}:
+  docs/RELATIONSHIP_GRAPH.md,project,"public event,snapshot,analytics,and graph-context contracts"
 body: "## Algorithm portfolio\n\n### Execution graph\nTopological layering; longest weighted path and slack; dominators; prerequisite frontier; transitive reduction; minimum cut candidates; resource-constrained scheduling inputs.\n\n### Impact graph\nReverse reachability; bounded personalized PageRank or diffusion; articulation and bridge analysis; fan-in or fan-out; dependency cones; affected evidence and ownership.\n\n### Knowledge graph\nWeak and strong components by kind family; Leiden or Louvain-style communities with deterministic seeds; degree, eigenvector, betweenness approximations; structural similarity; redundant and contradictory paths.\n\n### Temporal and multi-agent graph\nIncremental maintenance; snapshot deltas; edge survival and decay; change-point detection; event-time windows; merge or federation boundaries; contention hot spots.\n\n### Context selection\nGraph-distance features; spreading activation; prerequisite and evidence boosts; diversity-aware MMR or DPP-style packing; novelty and redundancy penalties; bounded anytime assembly.\n\nAll outputs must identify edge families, snapshot, exact or approximate status, limits, freshness, and why each result matters."