Integrate SQL-cov and SARIF reporting into CI

.github/workflows/ci.yml

@@ -1456,6 +1456,9 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y z3
+      - name: Install SQLFluff
+        run: |
+          pip install sqlfluff
       - uses: dtolnay/rust-toolchain@stable
       - uses: actions/setup-go@v5
         with:
@@ -1474,6 +1477,7 @@ jobs:
         run: |
           cargo build --release --manifest-path gems/fact-mine/Cargo.toml
           cargo build --release --manifest-path gems/decomplex/Cargo.toml
+          cargo build --release --manifest-path gems/sql-cov/Cargo.toml
       - name: Download Ruby coverage artifacts
         if: ${{ needs['ruby-gems-coverage'].result == 'success' || needs['ruby-unit'].result == 'success' || needs['ruby-integration'].result == 'success' || needs['transpile-tests'].result == 'success' || needs['examples-benchmarks-coverage-shard'].result == 'success' || needs['tools-fuzz-shard'].result == 'success' || needs['bc-lower-coverage-shard'].result == 'success' }}
         uses: actions/download-artifact@v4
@@ -1516,6 +1520,11 @@ jobs:
             --top=80 \
             --decomplex-binary=./gems/decomplex/target/release/decomplex-rust \
             "${coverage_args[@]}"
+          ./tools/generate_sql_cov_sarif.rb \
+            --repo=. \
+            --out-dir=tmp/generalized-gems-sarif \
+            --setup=gems/lineage/sql/storage/init_schema.sql \
+            --sql-cov-bin=./gems/sql-cov/target/release/sql-cov
       - name: Upload Decomplex SARIF
         uses: github/codeql-action/upload-sarif@v4
         with:
@@ -1541,6 +1550,11 @@ jobs:
         with:
           sarif_file: tmp/generalized-gems-sarif/nil-kill.sarif
           category: nil-kill
+      - name: Upload SQL-cov SARIF
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: tmp/generalized-gems-sarif/sql-cov.sarif
+          category: sql-cov
       - uses: actions/upload-artifact@v4
         with:
           name: generalized-gems-sarif

codecov.yml

@@ -42,7 +42,7 @@ comment:
 flags:
   ruby:
     paths:
-      - src/
+      - compiler/
     carryforward: false
     joined: false
   zig:

compiler/spec/ast_coverage_burndown_spec.rb

@@ -14,7 +14,7 @@
 require_relative "../ruby/ast/type" unless defined?(Type)
 require_relative "../ruby/annotator/helpers/function_signature" unless defined?(FunctionSignature::AnalysisFacts)
 
-RSpec.describe "AST coverage burndown" do
+RSpec.describe ClearParser do
   def token(type = :VAR_ID, value = "x", line: 1, column: 1)
     Lexer::Token.new(type, value, line, column)
   end

gems/README.md

@@ -13,15 +13,14 @@ quality work scalable.
 ## Projects
 
 - `decomplex`: static complexity and duplicated-decision analysis.
-- `boobytrap`: risk ranking from coverage, branch gaps, churn, and
-  structural evidence.
+- `boobytrap`: risk ranking from coverage, branch gaps, churn, and structural evidence.
 - `slopcop`: sloppiness and guardrail reporting.
 - `nil-kill`: nil/type-pressure evidence.
-- `auto-type`: automated type and nilability rewrites driven by analyzer
-  evidence.
+- `auto-type`: automated type and nilability rewrites driven by analyzer evidence.
 - `espalier`: architecture and public-surface analysis.
 - `lineage`: source/test/quality lineage UI and ingestion tooling.
 - `zig-mutants`: mutation testing for Zig runtime/lib code.
+- `sql-cov`: dynamic and schema-aware SQL branch coverage and logic hazard analysis.
 
 ## Contribution Rules
 

gems/decomplex/docs/agents/iterator-invalidation-reliability.md

@@ -0,0 +1,72 @@
+# Iterator Invalidation Detector: Product and Architecture Decision
+
+Status: **Do not implement the proposed all-language detector.**
+
+The detailed extraction and feasibility assessment lives in
+`gems/fact-mine/docs/agents/iterator-invalidation-reliability.md`. This document
+records the Decomplex-side decision and prevents a future agent from building a
+plausible-looking detector on insufficient facts.
+
+## Decision
+
+Do not add an `IteratorInvalidationDetector` based on loop spans, textual
+collection variables, mutation method names, or `(method, parameter-index)`
+reachability. Do not put language mutation registries or language branches in a
+Decomplex detector.
+
+Across the 15 supported languages, mutation during traversal can mean undefined
+behavior, a fail-fast runtime exception, a compiler error, defined live traversal,
+snapshot/copy traversal, a permitted operation, or merely surprising logic.
+Calling all of these “iterator invalidation” would be inaccurate. Reliably
+distinguishing them requires resolved types and symbols, heap-object aliasing,
+call/return/callback flow, and collection/version-specific contracts. Current
+FactMine facts provide none of those guarantees.
+
+This is also low-value relative to its cost:
+
+- Rust already rejects the ordinary safe-borrow case.
+- Java, C#, C++, Swift, TypeScript, and Zig need compiler semantic services for
+  useful precision.
+- C needs a points-to analysis plus annotated library/allocator contracts.
+- Ruby, Python, JavaScript, Lua, and PHP retain unresolved dynamic behavior even
+  after substantial analysis.
+- Go deliberately specifies several mutations during `range`; mutation is not
+  synonymous with invalidation.
+- Existing compilers, runtimes, and focused linters already cover many of the
+  strongest cases.
+
+## Architectural boundary
+
+If future evidence justifies a narrow implementation, FactMine must emit a
+language-neutral, already-adjudicated `IteratorInteraction` fact containing:
+
+- stable iteration and mutation IDs/spans;
+- resolved iterable and mutation target value identity;
+- resolved iteration and mutation contracts;
+- an outcome such as `invalidated`, `runtime_fail_fast`, `traversal_changes`,
+  `safe`, or `unknown`;
+- the contract source and confidence; and
+- enough evidence to explain why the mutation targets the traversed object.
+
+Decomplex may consume only those facts. It must not:
+
+- parse source or normalized nodes;
+- compare source-text receiver/argument names;
+- infer aliases or callees;
+- own standard-library mutation lists;
+- inspect `Document.language`; or
+- reinterpret `unknown` as hazardous.
+
+This follows the existing boundary: FactMine establishes semantic evidence;
+Decomplex groups, thresholds, explains, and reports it.
+
+## Reconsideration gate
+
+Reconsider only after a separate, compiler-backed, standard-library-only pilot
+for one language achieves at least 95% reviewed precision on real repositories
+and finds useful issues not already reported by that ecosystem's compiler or
+standard linters. C++/Clang, Java/javac or JDT, and C#/Roslyn are plausible pilot
+choices. A Tree-sitter-only or YAML-registry prototype is not evidence that the
+design works.
+
+Until that gate is met, the correct implementation is no implementation.

gems/espalier/README.md

@@ -69,6 +69,20 @@ bundle exec gems/espalier/exe/espalier \
 Espalier can output a compact architecture manifest for tools and LLMs,
 or a Markdown report for human architectural review.
 
+### Versioned architecture graph
+
+```bash
+bundle exec gems/espalier/exe/espalier \
+  --format architecture \
+  --output=tmp/espalier-architecture.json \
+  src/
+```
+
+This output contains stable owner/function/state IDs, first-class call and
+state-access edges, confidence, source citations, and explainable function
+pressure. It is the structured ingestion contract for Lineage; SARIF, DOT, and
+human-readable manifests are not parsed to reconstruct the graph.
+
 ### Architecture Report
 
 ```bash

gems/espalier/exe/espalier

@@ -24,7 +24,7 @@ end
 OptionParser.new do |opts|
   opts.banner = "Usage: espalier [options] <files/directories...>"
 
-  opts.on("-f", "--format FORMAT", [:markdown, :yaml, :report, :dot, :sarif, :json], "Output format (markdown, yaml, report, dot, sarif, json). Default: markdown") do |f|
+  opts.on("-f", "--format FORMAT", [:markdown, :yaml, :report, :dot, :sarif, :json, :architecture], "Output format (markdown, yaml, report, dot, sarif, json, architecture). Default: markdown") do |f|
     options[:format] = f
   end
 
@@ -136,7 +136,22 @@ if options[:risk] && File.exist?(options[:risk])
 end
 
 # Extract Static Skeletons
-evidence = Espalier::StaticEvidence.build(targets, root: Dir.pwd, vcs: options[:vcs])
+evidence = Espalier::StaticEvidence.build(
+  targets,
+  root: Dir.pwd,
+  vcs: options[:vcs],
+  include_annotations: options[:format] != :architecture
+)
+
+if options[:format] == :architecture
+  output_contents = JSON.pretty_generate(Espalier::ArchitectureArtifact.build(evidence, root: Dir.pwd))
+  if options[:output]
+    File.write(options[:output], output_contents)
+  else
+    puts output_contents
+  end
+  exit 0
+end
 
 # Group flat evidence into module structures expected by aggregator/analyzers
 modules = Espalier::StaticEvidence.project_modules(evidence)

gems/espalier/lib/espalier.rb

@@ -14,6 +14,7 @@ module Espalier
 require_relative "espalier/architecture_analyzer"
 require_relative "espalier/aggregator"
 require_relative "espalier/dependency_graph"
+require_relative "espalier/architecture_artifact"
 require_relative "espalier/graphviz_formatter"
 require_relative "espalier/formatter"
 require_relative "espalier/reporter"

gems/espalier/lib/espalier/aggregator.rb

@@ -111,6 +111,9 @@ def aggregate(modules)
 
           big_o_result = analyzer.analyze_method(key, ast_nodes, local_types: local_types_for_signature(sig))
           quality[:big_o] = big_o_result[:lower_bound_complexity]
+          quality[:big_o_space] = big_o_result[:space_complexity] if big_o_result[:space_complexity]
+          quality[:big_o_dynamic] = big_o_result[:is_dynamic]
+          quality[:complexity_trigger] = big_o_result[:trigger] if big_o_result[:trigger]
           quality[:big_o_warnings] = big_o_result[:warnings] unless big_o_result[:warnings].empty?
           quality[:big_o_unknowns] = big_o_result[:unknown_operations] unless big_o_result[:unknown_operations].empty?