Graphify-Labs/graphify

Review signals: 1 connection review, 127 known vulnerability, 1 outside write, 2 sensitive read. 1 static matches retained as context.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 8 distinct locations. 1 attributed processes.

PID 3123: <guest-path> · tests

OSV reports a known vulnerability in this dependency version. 12 distinct locations. 127 findings.

Repository processes attempted these writes outside documented output/cache paths. /usr/bin/cat 1 attributed processes.

PID 3123: <guest-path> · tests

A repository process attempted to read this sensitive path. 2 distinct locations. 2 findings. 1 attributed processes.

PID 3123: <guest-path> · tests

1 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Explain one concept from the graph: Real input produced the expected result: Node: build_from_json()

  Source: Ask a question, trace the path between two things, or explain one concept.

  Input: graphify/build.py::build_from_json

  Expected: Node explanation with source location and connections

  Command: <guest-path> explain graphify/build.py::build_from_json

  Observed: Node: build_from_json() ID: graphify_build_build_from_json Source: graphify/build.py L1153 Type: code Community: 11 Degree: 294 Connections (294): <-- test_languages.py [imports] [EXTRACTED] tests/test_languages.py:L1593 <-- test_extract.py [imports] [EXTRACTED] tests/test_extract.py:L9 <-- _rebuild_code() [calls] [EXTRACTED] graphify/watch.py:L2355 --> networkx [calls] [EXTRACTED] graphify/build.py:L1319 --> re [calls] [EXTRACTED] graphify/build.py:L1249 <-- cli.py [imports] [EXTRACTED] graphify/cli.py:L2437 <-- dispatch_command() [calls] [EXTRACTED]

• Query returns a scoped subgraph for a plain-language question: Real input produced the expected result: NODE extract()

  Source: returns a scoped subgraph for a plain-language question

  Input: what connects extract to the graph?

  Expected: Subgraph listing the extract() node

  Command: <guest-path> query 'what connects extract to the graph?' --budget 800

  Observed: NODE extract() [src=graphify/extract.py loc=L9219 community=12] NODE Graph [src= loc= community=85] NODE graph() [src=tests/test_cache_stale_import_target.py loc=L89 community=35] NODE test_cpp_cross_file_member_call_connects_with_relative_paths() [src=tests/test_cpp_objc_cross_file_calls.py loc=L45 community=306] NODE extract.py [src=graphify/extract.py loc=L1 community=2] NODE test_languages.py [src=tests/test_languages.py loc=L1 community=3] NODE test_extract.py [src=tests/test_extract.py loc=L1 community=4] NODE _rebuild_code() [src=graphify/watch.py loc=L1677 community=19] NODE _make_id()

Examples

• Offline code-only extraction builds the graph without an LLM: command completed successfully

  Source: README.md Privacy: graphify extract runs fully offline with --code-only

  Input: . --code-only

  Expected: graph.json written with no LLM

  Command: <guest-path> extract . --code-only

  Observed: ile(s) contributed nothing to the graph because a dependency is missing: robotframework not installed. Install it with: pip install "graphifyy[robot]" (#1745) warning: 1 .sol file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-solidity not installed. Install it with: pip install "graphifyy[solidity]" (#1745) warning: 1 .vb file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-vb-dotnet not installed. Install it with: pip install "graphifyy[vbnet]" (#1745) [graphify] Pruned 8 node(s) from 8 deleted or excluded source file(s).

• Path between two nodes (README common commands; undirected because no directed path exists): command completed successfully

  Source: README.md Common commands: graphify path

  Input: build_from_json to dispatch_command, undirected

  Expected: Shortest path of 1 hop

  Command: <guest-path> path graphify/build.py::build_from_json graphify/cli.py::dispatch_command --undirected

  Observed: Shortest path (1 hops): build_from_json() <--calls [EXTRACTED]-- dispatch_command()

• Repository test suite (CONTRIBUTING.md) run with the documented command: Ran uv run --frozen pytest tests/ -q: 8240 passed, 213 skipped, 18 failed. 15 test_skillgen failures need git history blobs (not in depth-1 pinned fetch); 3 test_ext_tagged_id_clash failures need the optional sql extra (passes with --extra sql). Not replayed as an example.

  Source: CONTRIBUTING.md: uv run pytest tests/ -q

  Expected: documented command completes successfully

  Observed: Ran uv run --frozen pytest tests/ -q: 8240 passed, 213 skipped, 18 failed. 15 test_skillgen failures need git history blobs (not in depth-1 pinned fetch); 3 test_ext_tagged_id_clash failures need the optional sql extra (passes with --extra sql). Not replayed as an example.

Cycles

• Watch loop rebuilds the graph on code changes; one rebuild run by hand: Triggered one cycle by hand (run-once: graphify update on the same tree with no source edits (watch loop not started); normal trigger: watch loop (debounced rebuild when files change)): Re-extracting code files in <guest-path> (no LLM needed)... [graphify watch] 13 file(s) not classified (no supported extension or shebang), skipped: .dockerignore, .gitattributes, .gitignore, .gitkeep, CODEOWNERS, Dockerfile (+7 more) AST extraction: 28/28 uncached files (100%) [2 workers] [graphify watch] Rebuilt (no clustering): 22253 nodes, 47412 edges [graphify watch] graph.json updated in <guest-path> Code graph updated. For doc/paper/image changes run /graphify --update in your AI assistant. Tip: set GEMINI_API_KEY or GOOGLE_API_KEY to use Gemini for semantic extraction. warning: 7 .sql file(s) contributed nothing to the graph because a dependency is missing: tree_sitter_sql not installed. Install it with: pip install "graphifyy[sql]" (#1745) warning: 1 .dm file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-dm not installed. Install it with: pip install "graphifyy[dm]" (#1745) warning: 1 .erl file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-language-pack not installed. Install it with: pip install "graphifyy[erlang]" (#1745) warning: 1 .lisp file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-commonlisp not installed. Install it with: pip install "graphifyy[commonlisp]" (#1745) warning: 1 .r file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-language-pack not installed. Install it with: pip install "graphifyy[r]" (#1745) warning: 1 .resource file(s) contributed nothing to the graph because a dependency is missing: robotframework not installed. Install it with: pip install "graphifyy[robot]" (#1745) warning: 1 .robot file(s) contributed nothing to the graph because a dependency is missing: robotframework not installed. Install it with: pip install "graphifyy[robot]" (#1745) warning: 1 .sol file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-solidity not installed. Install it with: pip install "graphifyy[solidity]" (#1745) warning: 1 .vb file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-vb-dotnet not installed. Install it with: pip install "graphifyy[vbnet]" (#1745) warning: 1 file(s) had syntax errors and may be partially extracted: tests/fixtures/sample.luau (first error at line 8, 4 symbol(s) extracted) warning: 26 code file(s) yielded no symbols (0.03 MB) — a data file, or source this extractor models no symbols for: graphify/exporters/__init__.py, graphify/manifest.py, pyproject.toml, tests/fixtures/cpp_samedir/plain.h, tests/fixtures/crate_a/Cargo.toml (+21 more)

  Source: graphify/watch.py

  Input: <guest-path> --no-cluster

  Expected: one rebuild pass writes graph.json

  Command: <guest-path> update <guest-path> --no-cluster

  Observed: Re-extracting code files in <guest-path> (no LLM needed)... [graphify watch] 13 file(s) not classified (no supported extension or shebang), skipped: .dockerignore, .gitattributes, .gitignore, .gitkeep, CODEOWNERS, Dockerfile (+7 more) AST extraction: 28/28 uncached files (100%) [2 workers] [graphify watch] Rebuilt (no clustering): 22253 nodes, 47412 edges [graphify watch] graph.json updated in <guest-path> Code graph updated. For doc/paper/image changes run /graphify --update in your AI assistant. Tip: set GEMINI_API_KEY or GOOGLE_API_KEY to use Gemini for semantic extraction. warning: 7 .sql file(s) contributed nothing to the graph because a dependency is missing: tree_sitter_sql not installed. Install it with: pip install "graphifyy[sql]" (#1745) warning: 1 .dm file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-dm not installed. Install it with: pip install "graphifyy[dm]" (#1745) warning: 1 .erl file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-language-pack not installed. Install it with: pip install "graphifyy[erlang]" (#1745) warning: 1 .lisp file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-commonlisp not installed. Install it with: pip install "graphifyy[commonlisp]" (#1745) warning: 1 .r file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-language-pack not installed. Install it with: pip install "graphifyy[r]" (#1745) warning: 1 .resource file(s) contributed nothing to the graph because a dependency is missing: robotframework not installed. Install it with: pip install "graphifyy[robot]" (#1745) warning: 1 .robot file(s) contributed nothing to the graph because a dependency is missing: robotframework not installed. Install it with: pip install "graphifyy[robot]" (#1745) warning: 1 .sol file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-solidity not installed. Install it with: pip install "graphifyy[solidity]" (#1745) warning: 1 .vb file(s) contributed nothing to the graph because a dependency is missing: tree-sitter-vb-dotnet not installed. Install it with: pip install "graphifyy[vbnet]" (#1745) warning: 1 file(s) had syntax errors and may be partially extracted: tests/fixtures/sample.luau (first error at line 8, 4 symbol(s) extracted) warning: 26 code file(s) yielded no symbols (0.03 MB) — a data file, or source this extractor models no symbols for: graphify/exporters/__init__.py, graphify/manifest.py, pyproject.toml, tests/fixtures/cpp_samedir/plain.h, tests/fixtures/crate_a/Cargo.toml (+21 more)

Local or hosted: both

Build an offline code knowledge graph of the repository with graphify extract --code-only, then query it with graphify explain and graphify path

cd <guest-path> && ls -la && git -C . rev-parse --is-inside-work-tree 2>&1; python3 --version; id -u; cat /etc/os-release | head -3; ls /inputs 2>&1
cd <guest-path> && cat README.md 2>/dev/null | head -200
cd <guest-path> && sed -n 200,400p README.md | cut -c1-400
cd <guest-path> && grep -n -i "telemetry\|graphify update\|--watch\|--once\|cron\|schedule\|hook\|webhook\|graphify serve\|mcp" README.md | cut -c1-300; which uv pipx; uv --version 2>&1
export NODE_USE_ENV_PROXY=1; curl -LsSf https://astral.sh/uv/install.sh | sh 2>&1 | tail -5; export PATH="$HOME/.local/bin:$PATH"; uv --version
export PATH="$HOME/.local/bin:$PATH"; uv tool install graphifyy 2>&1 | tail -15; echo "rc=$?"; which graphify; graphify --help 2>&1 | head -60
export PATH="$HOME/.local/bin:$PATH"; graphify --help 2>&1 | sed -n 60,200p; cd <guest-path> && sed -n 415,430p README.md | cut -c1-500
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && time GRAPHIFY_BACKEND=none GRAPHIFY_QUERY_LOG_DISABLE=1 graphify extract . --code-only 2>&1 | tail -30; echo "rc=${PIPESTATUS[0]}"; ls -la graphify-out 2>&1
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && time GRAPHIFY_BACKEND=none GRAPHIFY_QUERY_LOG_DISABLE=1 graphify cluster-only <guest-path> --no-label 2>&1 | tail -15; echo "rc=${PIPESTATUS[0]}"; ls -la graphify-out
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && export GRAPHIFY_QUERY_LOG_DISABLE=1; graphify god-nodes --top 5 2>&1; echo ---; graphify query "what connects extract to the graph?" --budget 800 2>&1 | head -40; echo "rc=${PIPESTATUS[0]}"
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && export GRAPHIFY_QUERY_LOG_DISABLE=1; graphify explain "_make_id" 2>&1 | head -25; echo "rc=${PIPESTATUS[0]}"; graphify explain "_make_id" >/dev/null 2>&1; echo "rc2=$?"
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && export GRAPHIFY_QUERY_LOG_DISABLE=1; graphify explain "build_from_json" 2>&1 | head -20; echo "rc=${PIPESTATUS[0]}"; echo ---; graphify path "build_from_json" "extract" 2>&1 | head -12; echo "rc=${PIPESTATUS[0]}"
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && export GRAPHIFY_QUERY_LOG_DISABLE=1; graphify explain "graphify/build.py::build_from_json" 2>&1 | head -20; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && grep -n "Ask a question, trace the path\|Code is parsed with tree-sitter AST\|returns a scoped subgraph\|graphify explain \\\\\"APIRouter\|graphify query" README.md | cut -c1-260; echo ---; grep -n -i "pytest\|uv run\|make test" CONTRIBUTING.md AGENTS.md | head; echo ---; grep -n "def \|while\|sleep\|Observer" graphify/watch.py | head -40
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && grep -n "def watch\|watch <path>\|def _cmd_watch\|\"watch\"" graphify/cli.py graphify/watch.py | head; echo ---; export GRAPHIFY_QUERY_LOG_DISABLE=1; GRAPHIFY_BACKEND=none timeout 600 graphify update <guest-path> --no-cluster 2>&1 | tail -8; echo "rc=${PIPESTATUS[0]}"
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && time timeout 1500 uv run pytest tests/ -q 2>&1 | tail -15; echo "rc=${PIPESTATUS[0]}"
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && timeout 600 uv run pytest tests/test_skillgen.py -q -x 2>&1 | grep -v "^  warning" | grep -i "error\|git\|fatal\|assert\|SystemExit" | head -20
cd <guest-path> && git init -q && git remote add origin https://github.com/Graphify-Labs/graphify && timeout 300 git fetch --depth 1 origin c588b72d936927790a87ad009955078ed40562a3 2>&1 | tail -5; echo "fetch rc=${PIPESTATUS[0]}"; git reset --mixed FETCH_HEAD 2>&1 | tail -3; git rev-parse HEAD; git status --short | head -10
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && git diff --stat; git diff uv.lock | head -20; echo ---; timeout 900 uv run pytest tests/test_skillgen.py tests/test_ext_tagged_id_clash.py -q 2>&1 | tail -4
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && git checkout -- uv.lock && git status --short; timeout 900 uv run --frozen pytest tests/test_skillgen.py tests/test_ext_tagged_id_clash.py -q 2>&1 | tail -4; git status --short
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && timeout 900 uv run --frozen pytest tests/test_skillgen.py -q 2>&1 | grep "^E " | sort | uniq -c | head -8; echo ---; timeout 900 uv run --frozen pytest "tests/test_ext_tagged_id_clash.py::test_a_swift_type_named_like_the_sibling_extension_keeps_both_file_nodes" -q 2>&1 | grep "^E " | head -8; git status --short
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && grep -n "extras\|sql\s*=" pyproject.toml | head -5; timeout 900 uv run --frozen --extra sql pytest tests/test_ext_tagged_id_clash.py -q 2>&1 | tail -2; git status --short
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && export GRAPHIFY_QUERY_LOG_DISABLE=1; timeout 300 graphify install 2>&1 | tail -8; echo "install rc=${PIPESTATUS[0]}"; echo ---; graphify path "graphify/build.py::build_from_json" "graphify/cli.py::dispatch_command" 2>&1 | head -8; echo "path rc=${PIPESTATUS[0]}"; echo ---; graphify god-nodes --top 3 2>&1; echo "rc=$?"
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && export GRAPHIFY_QUERY_LOG_DISABLE=1; graphify path "graphify/build.py::build_from_json" "graphify/cli.py::dispatch_command" --undirected 2>&1 | head -6; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && G=<guest-path> && W=<guest-path> && cat > probe.json <<EOF
{"kind":"cli","argv":["$G","explain","graphify/build.py::build_from_json"],"cwd":"$W","env":{"GRAPHIFY_QUERY_LOG_DISABLE":"1"},"expected_text":"Node: build_from_json()"}
EOF
cat > claims.json <<EOF
[
{"kind":"claim","claim":"Explain one concept from the graph","source":"Ask a question, trace the path between two things, or explain one concept.","input":"graphify/build.py::build_from_json","expected":"Node explanation with source location and connections","probe_kind":"cli","argv":["$G","explain","graphify/build.py::build_from_json"],"env":{"GRAPHIFY_QUERY_LOG_DISABLE":"1"},"expected_text":"Node: build_from_json()","cwd":"$W"},
{"kind":"claim","claim":"Query returns a scoped subgraph for a plain-language question","source":"returns a scoped subgraph for a plain-language question","input":"what connects extract to the graph?","expected":"Subgraph listing the extract() node","probe_kind":"cli","argv":["$G","query","what connects extract to the graph?","--budget","800"],"env":{"GRAPHIFY_QUERY_LOG_DISABLE":"1"},"expected_text":"NODE extract()","cwd":"$W"}
]
EOF
cat > examples.json <<EOF
[
{"kind":"example","claim":"Offline code-only extraction builds the graph without an LLM","source":"README.md Privacy: graphify extract runs fully offline with --code-only","input":". --code-only","expected":"graph.json written with no LLM","argv":["$G","extract",".","--code-only"],"cwd":"$W","env":{"GRAPHIFY_BACKEND":"none","GRAPHIFY_QUERY_LOG_DISABLE":"1"},"expected_text":"[graphify extract] wrote"},
{"kind":"example","claim":"Path between two nodes (README common commands; undirected because no directed path exists)","source":"README.md Common commands: graphify path","input":"build_from_json to dispatch_command, undirected","expected":"Shortest path of 1 hop","argv":["$G","path","graphify/build.py::build_from_json","graphify/cli.py::dispatch_command","--undirected"],"cwd":"$W","env":{"GRAPHIFY_QUERY_LOG_DISABLE":"1"},"expected_text":"Shortest path (1 hops)"},
{"kind":"example","claim":"Repository test suite (CONTRIBUTING.md) run with the documented command","source":"CONTRIBUTING.md: uv run pytest tests/ -q","reason":"Ran uv run --frozen pytest tests/ -q: 8240 passed, 213 skipped, 18 failed. 15 test_skillgen failures need git history blobs (not in depth-1 pinned fetch); 3 test_ext_tagged_id_clash failures need the optional sql extra (passes with --extra sql). Not replayed as an example."}
]
EOF
cat > cycles.json <<EOF
{"detected":true,"checks":[{"claim":"Watch loop rebuilds the graph on code changes; one rebuild run by hand","source":"graphify/watch.py","quote":"def watch(watch_path: Path, debounce: float = 3.0) -> None:","schedule":"watch loop (debounced rebuild when files change)","method":"run-once: graphify update on the same tree with no source edits (watch loop not started)","input":"<guest-path> --no-cluster","expected":"one rebuild pass writes graph.json","kind":"cli","argv":["$G","update","$W","--no-cluster"],"cwd":"$W","env":{"GRAPHIFY_BACKEND":"none","GRAPHIFY_QUERY_LOG_DISABLE":"1"},"expected_text":"[graphify watch] Rebuilt (no clustering)"}]}
EOF
for f in probe.json claims.json examples.json cycles.json; do python3 -I -c "import json,sys;json.load(open(sys.argv[1]));print(sys.argv[1],'ok')" $f; done; cat probe.json
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && cat > report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Build an offline code knowledge graph of the repository and query it with graphify explain, query, path and the watch-style rebuild",
  "operation_scope": "Ubuntu 24.04 guest (uid 1000), Python 3.12.3, uv 0.13.5 installed via the README's curl installer, graphifyy installed with uv tool install. Offline code-only path: GRAPHIFY_BACKEND=none, no API keys, no browser, no credentials. Optional extras (sql, dm, robot, etc.) not installed. Source pinned at c588b72d936927790a87ad009955078ed40562a3.",
  "steps": [
    "curl -LsSf https://astral.sh/uv/install.sh | sh",
    "uv tool install graphifyy",
    "graphify install",
    "graphify extract . --code-only (GRAPHIFY_BACKEND=none)",
    "graphify cluster-only <guest-path> --no-label",
    "graphify explain graphify/build.py::build_from_json",
    "graphify query \"what connects extract to the graph?\" --budget 800",
    "graphify path graphify/build.py::build_from_json graphify/cli.py::dispatch_command --undirected",
    "graphify update <guest-path> --no-cluster (one manual rebuild cycle)",
    "uv run --frozen pytest tests/ -q (repo test suite, documented in CONTRIBUTING.md)",
    "<env-var>=<guest-path> python3 -I <guest-path> --validate --replay (PASS, no problems)"
  ],
  "deviations": [
    "uv was not installed in the guest; installed it with the README's curl | sh installer (uv 0.13.5). Python 3.12.3 already satisfied the 3.10+ requirement.",
    "Workspace was not a git repository. Ran git init, git remote add origin https://github.com/Graphify-Labs/graphify, git fetch --depth 1 origin c588b72d936927790a87ad009955078ed40562a3, git reset --mixed FETCH_HEAD. HEAD now matches the pin; the only working-tree difference was uv.lock.",
    "uv run (without --frozen) rewrote uv.lock (revision 3 to 5, reordered markers). Restored it with git checkout -- uv.lock and used uv run --frozen for all later runs.",
    "Full test suite (uv run --frozen pytest tests/ -q): 8240 passed, 213 skipped, 18 failed, rc=1. 15 failures are tests/test_skillgen.py: they run git show on baseline blob 47042beb... which the depth-1 pinned fetch does not contain (needs full history). 3 failures are tests/test_ext_tagged_id_clash.py (x.sql / postgres cases) which need the optional sql extra; with uv run --frozen --extra sql that file passes 14/14.",
    "graphify update on the whole tree (without --code-only) reported 22253 nodes, while graphify extract --code-only reported 18698 nodes. Observed difference, not investigated further.",
    "Set GRAPHIFY_QUERY_LOG_DISABLE=1 to opt out of query logging, and GRAPHIFY_BACKEND=none to keep semantic LLM extraction off. graphify install ran with no telemetry prompt (none offered).",
    "graphify-out/ was created inside the workspace by graphify extract/update; this is the tool's default output location."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": "No fix needed for the core operation. For a full green test run: use a full git clone (not depth 1) so the skillgen baseline blobs exist, and install the optional sql extra for the tagged-ID tests. Consider pinning uv or using --frozen so uv run does not rewrite uv.lock."
}
EOF
python3 -I -c "import json;d=json.load(open('<guest-path>'));print(d['outcome'])"; cd <guest-path> && ls -la .coldpass; ls report.json 2>&1; git status --short
cd <guest-path> && cat > report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Build an offline code knowledge graph of the repository with graphify extract --code-only, then query it with graphify explain and graphify path",
  "operation_scope": "Ubuntu guest, Python 3.12.3 (README requires 3.10+), uv 0.13.5 installed with the README curl installer, graphifyy installed via uv tool install. Offline code-only path with GRAPHIFY_BACKEND=none and GRAPHIFY_QUERY_LOG_DISABLE=1. No API keys, no browser, no credentials. Source pinned at c588b72d936927790a87ad009955078ed40562a3.",
  "steps": [
    "curl -LsSf https://astral.sh/uv/install.sh | sh (uv was missing)",
    "uv tool install graphifyy",
    "git init; git remote add origin https://github.com/Graphify-Labs/graphify; git fetch --depth 1 origin c588b72d936927790a87ad009955078ed40562a3; git reset --mixed FETCH_HEAD",
    "graphify extract . --code-only (GRAPHIFY_BACKEND=none)",
    "graphify cluster-only <guest-path>",
    "graphify explain graphify/build.py::build_from_json",
    "graphify path --undirected between two code nodes",
    "graphify update <guest-path> --no-cluster (watch-style rebuild cycle)",
    "uv run --frozen pytest tests/ -q (documented in CONTRIBUTING.md)",
    "<env-var>=<guest-path> python3 -I <guest-path> --validate --replay"
  ],
  "deviations": [
    "uv was not preinstalled; installed it with the README's curl | sh installer.",
    "The workspace was not a git repository, so the source was pinned with a depth-1 fetch of the commit and git reset --mixed FETCH_HEAD.",
    "uv run without --frozen rewrote uv.lock (revision 3 to 5). Restored it with git checkout -- uv.lock and used uv run --frozen afterwards.",
    "Test suite: 18 failures. 15 are in tests/test_skillgen.py, which needs a historical git blob that the depth-1 fetch does not contain. 3 are in tests/test_ext_tagged_id_clash.py, which need the optional sql extra; they pass with --extra sql. Not fixed in the repo; recorded as prerequisites.",
    "graphify update without --code-only reported about 22k nodes, while extract --code-only reported 18698 nodes. This inconsistency was observed but not investigated."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": "For a fully green test run, use a full clone instead of depth 1 so the skillgen baseline blobs exist, and install the optional sql extra. Use --frozen (or pin uv) so uv run does not rewrite uv.lock. Investigate the node-count difference between update and extract --code-only."
}
EOF
python3 -I -c "import json;json.load(open('report.json'));print('ok')"; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -n 40