Train 28: --for stops when complete + owner body, per-definition attribution, declined-call rows, git child hardening, #380

.github/pargates-shard-weights.json

@@ -25,6 +25,7 @@
 "artifactcheck.sh": 5.4,
 "atcheck.sh": 12.1,
 "atomscheck.sh": 4.2,
+"attribmultidefcheck.sh": 75.0,
 "attrvocabcheck.sh": 66.7,
 "baselinecheck.sh": 1.8,
 "baselinedirtycheck.sh": 9.8,
@@ -111,6 +112,7 @@
 "deadprecisioncheck.sh": 0.8,
 "deckcheck.sh": 54.8,
 "deckclaimcheck.sh": 0.1,
+"declinedsitecheck.sh": 35.0,
 "deeptailcheck.sh": 1.0,
 "defaultceilingcheck.sh": 20.1,
 "defectshapecheck.sh": 14.2,
@@ -187,6 +189,7 @@
 "fnptrcheck.sh": 11.3,
 "forautobodycheck.sh": 21.6,
 "forblowupcheck.sh": 1.0,
+"forbodyslotcheck.sh": 150.0,
 "forbudgetmonotoncheck.sh": 2.5,
 "forcalibfactscheck.sh": 8.0,
 "forcompresscheck.sh": 6.4,
@@ -200,6 +203,7 @@
 "forrootlegendcheck.sh": 8.6,
 "forsectioncollapsecheck.sh": 5.2,
 "forsigspancheck.sh": 6.0,
+"forsoftbudgetcheck.sh": 120.0,
 "freshclonecheck.sh": 170.8,
 "freshnesscheck.sh": 4.4,
 "g1configcheck.sh": 0.8,
@@ -428,6 +432,7 @@
 "qbaselineproducercheck.sh": 5.0,
 "qchurncheck.sh": 3.7,
 "qchurnmemocheck.sh": 4.3,
+"qddegradecheck.sh": 20.0,
 "qdrefpaircheck.sh": 92.2,
 "qextractionkeycheck.sh": 2.8,
 "qoriginoraclecheck.sh": 8.7,

README.md

@@ -982,9 +982,9 @@ Full retrieval tables — including the MRR figures behind the router numbers ab
 ## What it answers
 
 <details>
-<summary><b>190 long flags</b> across seven families, plus the MCP server — and <code>--help-task</code> names the ONE command a task wants, or abstains honestly when the evidence is too thin</summary>
+<summary><b>192 long flags</b> across seven families, plus the MCP server — and <code>--help-task</code> names the ONE command a task wants, or abstains honestly when the evidence is too thin</summary>
 
-Around the core sit 191 long flags advertised in `--help`, across seven families — plus an MCP
+Around the core sit 192 long flags advertised in `--help`, across seven families — plus an MCP
 server, so a coding agent can call any of them mid-task instead of grepping and reading whole files.
 `--help` prints one line per flag (~4.5K tokens); `--help=--FLAG` prints that flag's full entry with
 every caveat, `--help=SECTION` one family, and `--help=all` the whole catalog.
@@ -2120,9 +2120,9 @@ wrong, and it has. These are the results that say so, all in-tree, all published
 ### In the tests
 
 <details>
-<summary><b>685 gate scripts</b>, five contracts no unit test can hold, and the house rule: write the gate before the code it measures</summary> <!-- gatecount -->
+<summary><b>692 gate scripts</b>, five contracts no unit test can hold, and the house rule: write the gate before the code it measures</summary> <!-- gatecount -->
 
-`test/regression.sh` names **685 gate scripts** and is the authoritative list; <!-- gatecount -->
+`test/regression.sh` names **692 gate scripts** and is the authoritative list; <!-- gatecount -->
 `python3 test/pargates.py . ./build/ripwire -j 6` runs the same set in parallel. On top of them sit the
 contracts that do not fit a unit test: two runs byte-identical, warm output identical to cold, output
 that pipes clean through `xmllint --noout`, a sanitizer build with `-fno-sanitize-recover=all`, and a
@@ -2684,7 +2684,7 @@ identity of the index, and says which one is at fault.
 
 ### 5. Command families
 
-The `--help` output groups 191 long flags advertised in `--help` into seven families. The `--help=`
+The `--help` output groups 192 long flags advertised in `--help` into seven families. The `--help=`
 column below is the argument that prints one family: `ripwire --help=navigate`. `ripwire
 --help=--FLAG` prints one flag's full text — the caveats, the units, what it refuses and why.
 `ripwire --help=all` is the whole catalog, about 46,000 tokens.
@@ -2878,7 +2878,7 @@ python3 test/pargates.py . ./build/ripwire -j 6
 A new gate script must be added to `test/regression.sh` in the same change. The gate
 `test/manifestcheck.sh` enforces this rule.
 
-Another gate derives the cap inventory. The tool has 253 compile-time caps and 7 ranking parameters.
+Another gate derives the cap inventory. The tool has 259 compile-time caps and 7 ranking parameters.
 `docs/LIMITS.md` lists each cap, its value, and whether the file discloses a truncation when the cap
 fires, and `python3 docs/limits_build.py --check` proves that list against `src/`. `docs/TUNING.md`
 lists the measured cost of each cap.

SECURITY.md

@@ -18,7 +18,7 @@ ripwire is a command-line indexing tool with the following security model:
 - **Input:** Arbitrary source code repositories on the local filesystem
 - **Output:** XML summaries and analysis results streamed to stdout or written to cache
 - **Trust boundary:** The tool operates only on local files with the user's own permissions. It does not communicate over the network, with two named exceptions: a root given as a git URL is cloned into the cache (`git clone --depth=1`, with `protocol.ext.allow=never` and `protocol.file.allow=user` pinned on the command), and the tree-sitter registry is listed during initial setup
-- **Subprocesses:** ripwire runs **read-only `git`** inside the analysed checkout (`status --porcelain`, `ls-files`, `log`, `diff --numstat`, `archive`, `rev-parse`), and — only for binary document formats, which are not collected by default — `markitdown`. Git honours the checkout's **own** `.git/config`. A *hook-form* `core.fsmonitor` there is a command git would run on every one of those calls, so ripwire neutralises that one key for its own git children at process start and says so (`--doctor`'s `git-config-trust` row; a stderr line carrying `git_harden=fsmonitor-hook`); boolean values, git's builtin daemon, are left alone. `git clone` never copies `.git/config`, so a repository you cloned yourself carries no such key — a tarball, a copied worktree or a shared checkout carries whatever its last owner wrote. Treat pointing ripwire at one as you would treat running `git status` there yourself
+- **Subprocesses:** ripwire runs **read-only `git`** inside the analysed checkout (`status --porcelain`, `ls-files`, `log`, `diff --numstat`, `archive`, `rev-parse`), and — only for binary document formats, which are not collected by default — `markitdown`. Git honours the checkout's **own** `.git/config`. A *hook-form* `core.fsmonitor` there is a command git would run on every one of those calls, so ripwire neutralises that one key for its own git children at process start and says so (`--doctor`'s `git-config-trust` row; a stderr line carrying `git_harden=fsmonitor-hook`); boolean values, git's builtin daemon, are left alone. ripwire likewise neutralises repository-configured filter and diff programs for its own git children: the repository's own `filter.<name>.clean/smudge/process` drivers are pinned to an empty command on every git child ripwire starts (a stderr line carrying `git_harden=filter-driver`, and `--doctor`'s `git-config-trust` row: `filter_drivers=`, `filter_scope=`, `filter_pinned=`), diff programs are refused with `--no-ext-diff --no-textconv`, signature display is pinned off, and `status`/`diff` do not enter submodule repositories (`--ignore-submodules=dirty`). The MCP and LSP servers apply the same pinning to every root a request names. The user-visible cost: files behind a repository-local filter (git-crypt, a per-repository LFS driver) are read as stored, and edits inside a submodule no longer mark `+dirty`. `git clone` never copies `.git/config`, so a repository you cloned yourself carries no such key — a tarball, a copied worktree or a shared checkout carries whatever its last owner wrote. Treat pointing ripwire at one as you would treat running `git status` there yourself
 
 Security vulnerabilities relevant to this tool include:
 

docs/ARCHITECTURE.md

@@ -166,7 +166,16 @@ metadata do not become executable calls. Alias/import/require/use and behaviour
 module dependencies resolved through declared module identities, regardless of umbrella/file layout.
 `@behaviour` and `defimpl` supply contract/implementation relationships for `--uses` and `--lego`.
 
-**Static limits:** quoted AST and macro-generated definitions are not expanded. `use` records the
+**Static limits:** quoted AST and macro-generated definitions are not expanded. Ordinary call,
+operator and named-function-capture candidates inside a `quote` body mint no edges and are counted
+in the map's `declined=` gauge; `--callees` counts those sites on their enclosing function.
+Bare variable-shaped AST identifiers are not counted merely for being identifiers. Calls inside `unquote(...)` and
+`unquote_splicing(...)` are live when enabled, as are expressions in `bind_quoted:` options.
+`bind_quoted` disables unquoting by default; explicit `unquote: true` re-enables it and
+`unquote: false` keeps its argument inert. Nonliteral unquote options cannot prove a live hole.
+Nested quotes become inert again inside a live hole; an inner quote that is itself inert
+cannot execute its own holes in the current stage. Quoted module declarations do not change the lexical module of evaluated holes. Quoted declaration heads and metadata
+do not suppress evaluated hole arguments; bound variables in those arguments remain variables. `use` records the
 dependency, but does not execute `__using__`; framework DSLs and generated Phoenix/Ecto functions
 therefore need an explicit source definition to appear. A call that only an injected import could
 answer has no lexical candidate: no edge is minted from a same-named function elsewhere, and the call
@@ -197,9 +206,7 @@ that function — the underscore rule is for unused variables, and a bare `_seed
 (`src/ingest_elixir.h`); and a call that omits a defaulted argument reaches the bodyless head that
 evaluates the default beside the clauses, so `--path` and `--impact` see the default expression's calls
 from that caller, while a call that supplies the argument reaches the clauses alone
-(`src/elixir_resolve.h`). One gap stays open: executable `unquote(...)` and `bind_quoted:` expressions
-under `quote` are omitted with the rest of the quoted-AST filter, so a helper called only from inside
-an `unquote` has no caller edge from its macro.
+(`src/elixir_resolve.h`).
 
 `test/elixircheck.sh`, `test/eliximportcheck.sh` and `test/elixirsemanticcheck.sh` cover extraction,
 metrics, exact target selection against decoys, lexical boundaries, contracts, CLI/MCP use-site parity,