V0.7.2

.dockerignore

@@ -17,3 +17,4 @@ data/nlprule/
 data/snapshots/
 data/tagger/classes.txt
 data/tagger/weights.json
+assets/all-MiniLM-L6-v2/

.github/workflows/coverage.yml

@@ -0,0 +1,59 @@
+name: Rust Coverage
+
+on:
+  push:
+    branches:
+      - main
+      - v0.7.2
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  coverage:
+    name: Rust coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      CARGO_TERM_COLOR: always
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v6
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: llvm-tools-preview
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+
+      - name: Install nlprule tokenizer
+        env:
+          TOKENIZER_URL: https://cuemap.dev/assets/en_tokenizer.bin.gz
+          TOKENIZER_SHA256: f54fd31ec463f8646d0239bb531a64e0210ed1ae02bf5e3b42aeeb9bff8305ba
+        run: |
+          curl -fsSL --retry 3 "${TOKENIZER_URL}" -o "${RUNNER_TEMP}/en_tokenizer.bin.gz"
+          echo "${TOKENIZER_SHA256}  ${RUNNER_TEMP}/en_tokenizer.bin.gz" | sha256sum -c -
+          gzip -dc "${RUNNER_TEMP}/en_tokenizer.bin.gz" > "${RUNNER_TEMP}/en_tokenizer.bin"
+          echo "TOKENIZER_PATH=${RUNNER_TEMP}/en_tokenizer.bin" >> "${GITHUB_ENV}"
+
+      - name: Generate LCOV report
+        run: |
+          cargo llvm-cov clean --workspace
+          cargo llvm-cov --all-features --lib --no-report -- --test-threads=1
+          cargo llvm-cov --all-features --bin cuemap --no-report -- --test-threads=1
+          cargo llvm-cov --all-features --tests --no-report -- --test-threads=1
+          cargo llvm-cov report --lcov --output-path lcov.info
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: lcov.info
+          flags: rust-engine
+          name: rust-engine-${{ github.sha }}
+          fail_ci_if_error: true

.github/workflows/main.yml

@@ -1,8 +1,8 @@
 name: Build and Publish Optional NPM Binaries
 
 on:
-  release:
-    types: [created]
+  push:
+    branches: [main]
   workflow_dispatch: # Allow manual triggering
 
 jobs:
@@ -55,44 +55,64 @@ jobs:
           targets: ${{ matrix.target }}
 
       - name: Build Rust Engine
-        run: cargo build --release --target ${{ matrix.target }}
+        run: cargo build --locked --release --target ${{ matrix.target }}
 
       - name: Prepare NPM Package Structure
         shell: bash
         run: |
-          mkdir -p npm-packages/${{ matrix.pkg_name }}/bin
+          package_dir="npm-packages/${{ matrix.pkg_name }}"
+          mkdir -p "${package_dir}/bin" "${package_dir}/assets"
 
-          # Copy binary based on OS extension (.exe for Windows)
-          if [ "${{ matrix.os }}" = "windows-latest" ]; then
-            cp target/${{ matrix.target }}/release/cuemap.exe npm-packages/${{ matrix.pkg_name }}/bin/cuemap.exe
-          else
-            cp target/${{ matrix.target }}/release/cuemap npm-packages/${{ matrix.pkg_name }}/bin/cuemap
-            chmod +x npm-packages/${{ matrix.pkg_name }}/bin/cuemap
-          fi
+          cp target/${{ matrix.target }}/release/cuemap "${package_dir}/bin/cuemap-native"
+          cp scripts/npm-native-wrapper.cjs "${package_dir}/bin/cuemap"
+          cp scripts/npm-native-README.md "${package_dir}/README.md"
+          cp LICENSE "${package_dir}/LICENSE"
+          chmod +x "${package_dir}/bin/cuemap" "${package_dir}/bin/cuemap-native"
+
+          tokenizer_url="https://cuemap.dev/assets/en_tokenizer.bin.gz"
+          tokenizer_sha256="f54fd31ec463f8646d0239bb531a64e0210ed1ae02bf5e3b42aeeb9bff8305ba"
+          curl -fsSL --retry 3 "${tokenizer_url}" -o "${package_dir}/assets/en_tokenizer.bin.gz"
+          node -e '
+            const fs = require("node:fs");
+            const crypto = require("node:crypto");
+            const [file, expected] = process.argv.slice(1);
+            const actual = crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+            if (actual !== expected) throw new Error(`Tokenizer checksum mismatch: ${actual}`);
+          ' "${package_dir}/assets/en_tokenizer.bin.gz" "${tokenizer_sha256}"
+          gzip -dc "${package_dir}/assets/en_tokenizer.bin.gz" > "${package_dir}/assets/en_tokenizer.bin"
+          rm "${package_dir}/assets/en_tokenizer.bin.gz"
 
-          # Create the package.json for this specific architecture package
-          cat <<EOF > npm-packages/${{ matrix.pkg_name }}/package.json
-          {
-            "name": "@cuemap-dev/${{ matrix.pkg_name }}",
-            "version": "${{ github.event.release.tag_name || '0.6.6' }}",
-            "description": "Pre-compiled CueMap Engine for ${{ matrix.npm_os }} ${{ matrix.npm_arch }}",
-            "engines": {
-              "node": ">= 18"
-            },
-            "os": ["${{ matrix.npm_os }}"],
-            "cpu": ["${{ matrix.npm_arch }}"],
-            "bin": {
-              "cuemap": "bin/cuemap${{ matrix.os == 'windows-latest' && '.exe' || '' }}"
-            },
-            "repository": {
-              "type": "git",
-              "url": "https://github.com/cuemap-dev/cuemap.git"
-            },
-            "author": "Kaan Demirel",
-            "license": "BSL-1.1"
-          }
-          EOF
+          version="$(awk -F '"' '/^version = "/ { print $2; exit }' Cargo.toml)"
+          node -e '
+            const fs = require("node:fs");
+            const [output, version, os, cpu, packageName] = process.argv.slice(1);
+            const manifest = {
+              name: `@cuemap-dev/${packageName}`,
+              version,
+              description: `Pre-compiled CueMap Engine for ${os} ${cpu}`,
+              engines: { node: ">=18" },
+              os: [os],
+              cpu: [cpu],
+              bin: { cuemap: "bin/cuemap" },
+              files: ["bin", "assets", "README.md", "LICENSE"],
+              repository: { type: "git", url: "https://github.com/cuemap-dev/cuemap.git" },
+              author: "Kaan Demirel",
+              license: "BSL-1.1",
+              publishConfig: { access: "public" },
+            };
+            if (os === "linux") manifest.libc = ["glibc"];
+            fs.writeFileSync(output, `${JSON.stringify(manifest, null, 2)}\n`);
+          ' "${package_dir}/package.json" "${version}" "${{ matrix.npm_os }}" "${{ matrix.npm_arch }}" "${{ matrix.pkg_name }}"
+
+      - name: Verify NPM package contents
+        working-directory: npm-packages/${{ matrix.pkg_name }}
+        shell: bash
+        run: |
+          test -x bin/cuemap
+          test -x bin/cuemap-native
+          test -s assets/en_tokenizer.bin
+          npm pack --dry-run
 
       - name: Publish to NPM
         working-directory: npm-packages/${{ matrix.pkg_name }}
-        run: npm publish --access public --verbose
+        run: npm publish --access public --provenance --verbose

.gitignore

@@ -11,4 +11,20 @@ data/reports/
 data/snapshots/
 tests/data/
 snapshots/
-scripts/
+__pycache__/
+*.py[cod]
+evals/**/bin/
+vendor/onnxruntime/archives/
+vendor/onnxruntime/ios-arm64/
+vendor/onnxruntime/ios-arm64-sim/
+assets/all-MiniLM-L6-v2/
+coverage/
+lcov.info
+codecov.json
+evals/intent/
+vendor/
+
+# Local release outputs and helpers
+benchmarks/benchmark_nl_results.json
+evals/release-20260815_122352/
+scripts/run-sdk-integration-tests.sh

CHANGELOG.md

@@ -2,6 +2,37 @@
 
 All notable changes to the CueMap Rust Engine will be documented in this file.
 
+## [0.7.2] - 2026-08-04
+
+### Added
+- **Bundled semantic reranking**: The default `semantic-encoder` build now uses qint8 `all-MiniLM-L3-v2` for memory/query embeddings and bounded hybrid reranking; no runtime model download or external service is required. The `edge` profile uses a bundled q4 build of the same model.
+- **Intent classification and reranking**: Added local query/memory intent classification, confidence-weighted hybrid reranking, persisted memory annotations, the `/intent/classify` API, and intent coverage/progress fields in `/jobs/status`.
+- **Caller-provided vectors**: Added per-memory `embedding`, per-query `query_embedding`, semantic recall modes, and one-vector-per-produced-chunk `embeddings` for `/ingest/content`.
+- **Edge semantic profile**: Added the `edge` profile for constrained devices. It selects q4 MiniLM-L3 while lowering ANN fanout and the vector memory budget.
+- **External unit-test files**: Moved all Rust unit-test modules out of `src` into `tests/unit`, preserving parent-module privacy while keeping production files focused on implementation.
+- **Coverage reporting**: Added a `cargo-llvm-cov` GitHub Actions workflow with Codecov upload and a Rust README coverage badge.
+- **CLI startup and handler coverage**: Added deterministic tests for layered profile/CLI configuration, snapshot-directory recovery, encryption-key precedence, context signing, KDF salt selection, configurable file/URL ingestion, lexicon inspection, default-project persistence, HTTP-backed add/recall/status/project/alias/memory/ingest flows, connection failures, recall modes, log rendering modes, static/live server bootstrap, detached readiness, and stop lifecycle handling.
+- **Critical-path coverage**: Added deterministic HTTP API guard/reload and semantic-recall tests, parent-fusion and projection helper tests, CueBridge gap-expansion coverage, read-only/global route guards, recursive URL ingestion and persisted web recall tests, unconfigured backup checks, persistence corruption and local-backup tests, job-processing tests, ingester state/preview/deduplication tests, watcher event tests, and offline web-search parsing tests.
+- **Engine coverage gate**: Added focused lifecycle, disk-content, temporal-chunking, semantic budget/error, structured-reranking, source-order expansion, decay/consolidation, and generic MainStats/LexiconStats tests. `src/engine.rs` now measures 94.10% lines, 93.79% regions, and 90.91% functions across the library and dedicated engine integration suite.
+- **Server-health coverage gate**: Added project-context lifecycle, cue resolution/cache, symbol routing, alias filtering, snapshot version/corruption, atomic save/load, background snapshot, and local cloud-backup tests. `src/projects.rs` now measures 95.30% lines, 94.67% regions, and 95.83% functions; `src/persistence.rs` measures 90.40% lines, 87.30% regions, and 88.24% functions in the focused library/project coverage run.
+- **Snapshot recovery**: New snapshots use zstd-compressed JSON so arbitrary `serde_json::Value` metadata survives restart; legacy bincode snapshots remain supported where decodable. Startup now reports per-project snapshot load failures and can discover the legacy sibling snapshot directory. Pre-v0.7.2 bincode snapshots containing dynamic JSON metadata may still require reingestion because bincode cannot decode `deserialize_any` values.
+
+### Changed
+- **Semantic defaults**: The quality/default profile reports `all-MiniLM-L3-v2` (`bundled-qint8-minilm-l3`) with a 128-token window; the previous bundled L6 model is no longer part of the release binary.
+- **Structural-only core semantics**: Removed CuePacks and domain-ontology facet rules from ingestion/query planning. The remaining deterministic planner emits structural evidence, metadata, grammatical perspective, answer shape, ordering, and reference-time signals.
+- **Trained embedding-only intent categories**: Removed exact-match semantic phrase/vocabulary adjustments and runtime semantic anchor lists. A tiny model-specific linear head now maps frozen MiniLM embeddings to intent scores; syntax-only query shape can only admit an uncertain recall check without relabelling the intent or changing durable-memory eligibility.
+- **Leakage-guarded intent training**: Added deterministic NumPy training for the L3-qint8 and L3-q4 intent heads.
+- **Release package hygiene**: Native builds and Cargo packages now expose only the `cuemap` server binary and exclude local diagnostics, benchmarks, evals, vendor archives, caches, and the retired L6 assets.
+
+### Fixed
+- **CLI stop PID validation**: Reject Unix PID values that cannot be represented as a positive `pid_t`, preventing malformed or stale PID files from turning a targeted shutdown into a process-wide signal.
+- **Native npm Publishing**: Updated the GitHub Actions publisher to ship the checksum-verified tokenizer and package launcher on every supported platform, matching the local release packager.
+- **Container semantic build**: Added bundled model assets to the Docker build context and synchronized the image version metadata.
+- **Intent job completion**: Failed intent annotations now reach a terminal job phase while keeping `intent_ready=false`, rather than leaving ingestion permanently in `processing`.
+- **Snapshot Coverage**: Added regression coverage for periodically persisting projects created after the snapshot scheduler starts.
+- **Watcher deletion path normalization**: Deletion events now canonicalize the surviving parent path so files under macOS `/var` symlinked temporary roots remove the same tracking keys created during ingestion.
+- **VerifyFile deadlock**: Verification now releases the cue-index read guard before deleting stale memories, preventing worker hangs during file re-ingestion cleanup.
+
 ## [0.7.1] - 2026-07-17
 
 ### Fixed