Add native Windows validation workflow

.gitattributes

@@ -11,3 +11,7 @@ internal/cbm/vendored/grammars/**/scanner.c linguist-generated=true diff=false
 # the git hooks are extensionless and need explicit entries. (#1272)
 scripts/git-hooks/commit-msg   text eol=lf
 scripts/hooks/pre-commit       text eol=lf
+
+# Chialisp grammar corpus: one case asserts CRLF comment termination, so this
+# file must keep its exact bytes on every platform (no eol conversion). (#919)
+tools/tree-sitter-chialisp/test/corpus/comments.txt -text

.github/workflows/_build.yml

@@ -90,14 +90,14 @@ jobs:
         run: |
           scripts/ci/prepare-release-candidates.sh \
             "${{ matrix.goos }}" "${{ matrix.goarch }}" \
-            --binary build/c/codebase-memory-mcp \
+            --binary build/c/codebase-memory-cli \
             --out-dir release-candidates
           scripts/gen-third-party-notices.sh \
             "release-candidates/${{ matrix.goos }}-${{ matrix.goarch }}/THIRD_PARTY_NOTICES.md"
 
       - name: Attest release candidate provenance
         if: ${{ inputs.attest }}
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             release-candidates/${{ matrix.goos }}-${{ matrix.goarch }}/candidate-provenance.tsv
@@ -148,14 +148,14 @@ jobs:
         shell: msys2 {0}
         run: |
           scripts/ci/prepare-release-candidates.sh windows amd64 \
-            --binary build/c/codebase-memory-mcp.exe \
+            --binary build/c/codebase-memory-cli.exe \
             --out-dir release-candidates
           scripts/gen-third-party-notices.sh \
             release-candidates/windows-amd64/THIRD_PARTY_NOTICES.md
 
       - name: Attest release candidate provenance
         if: ${{ inputs.attest }}
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             release-candidates/windows-amd64/candidate-provenance.tsv
@@ -210,14 +210,14 @@ jobs:
         shell: msys2 {0}
         run: |
           scripts/ci/prepare-release-candidates.sh windows arm64 \
-            --binary build/c/codebase-memory-mcp.exe \
+            --binary build/c/codebase-memory-cli.exe \
             --out-dir release-candidates
           scripts/gen-third-party-notices.sh \
             release-candidates/windows-arm64/THIRD_PARTY_NOTICES.md
 
       - name: Attest release candidate provenance
         if: ${{ inputs.attest }}
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             release-candidates/windows-arm64/candidate-provenance.tsv
@@ -266,21 +266,21 @@ jobs:
 
       - name: Verify release static linking
         run: |
-          file build/c/codebase-memory-mcp
-          ldd build/c/codebase-memory-mcp 2>&1 | grep -q "not a dynamic executable" || ldd build/c/codebase-memory-mcp 2>&1 | grep -q "statically linked"
+          file build/c/codebase-memory-cli
+          ldd build/c/codebase-memory-cli 2>&1 | grep -q "not a dynamic executable" || ldd build/c/codebase-memory-cli 2>&1 | grep -q "statically linked"
 
       - name: Derive immutable stripped and unstripped release candidates
         run: |
           scripts/ci/prepare-release-candidates.sh \
             linux "${{ matrix.arch }}-portable" \
-            --binary build/c/codebase-memory-mcp \
+            --binary build/c/codebase-memory-cli \
             --out-dir release-candidates
           scripts/gen-third-party-notices.sh \
             "release-candidates/linux-${{ matrix.arch }}-portable/THIRD_PARTY_NOTICES.md"
 
       - name: Attest release candidate provenance
         if: ${{ inputs.attest }}
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             release-candidates/linux-${{ matrix.arch }}-portable/candidate-provenance.tsv
@@ -395,8 +395,8 @@ jobs:
             windows-amd64 windows-arm64; do
             goos="${target%%-*}"
             goarch="${target#*-}"
-            selected_name=codebase-memory-mcp
-            test "$goos" != windows || selected_name=codebase-memory-mcp.exe
+            selected_name=codebase-memory-cli
+            test "$goos" != windows || selected_name=codebase-memory-cli.exe
             selected="release-selection/selected/$target/$selected_name"
             notices="release-candidate-scan/notices/$target/THIRD_PARTY_NOTICES.md"
             test -f "$selected"
@@ -432,7 +432,7 @@ jobs:
 
       - name: Attest selected containers and decision evidence
         if: ${{ inputs.attest }}
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             release-containers/**/*.tar.gz

.github/workflows/_security.yml

@@ -42,19 +42,25 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 240
     steps:
-      - name: Wait for CodeQL on current commit (max 45 min)
+      - name: Wait for CodeQL on current commit (max 150 min)
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           # On pull_request events github.sha is the synthetic merge commit;
           # CodeQL runs are recorded against the PR head SHA.
           CURRENT_SHA="${{ github.event.pull_request.head.sha || github.sha }}"
           echo "Waiting for CodeQL to complete on $CURRENT_SHA..."
-          for attempt in $(seq 1 90); do
+          # 300 attempts x 30s = 150 min. The previous budget was 90 x 30s = 45 min,
+          # which is shorter than CodeQL actually takes on this repository: a measured
+          # run on PR #1426 (head 7b72652a) completed with conclusion=success after
+          # 124 min, 7 minutes AFTER this gate had already given up. That marked at
+          # least five contributor PRs red for a scan that passed. The job's own
+          # timeout-minutes is 240, so 150 still leaves headroom.
+          for attempt in $(seq 1 300); do
             LATEST=$(gh api "repos/${{ github.repository }}/actions/workflows/codeql.yml/runs?head_sha=$CURRENT_SHA&per_page=1" \
               --jq '.workflow_runs[] | "\(.conclusion) \(.status)"' 2>/dev/null | head -1 || echo "")
             if [ -z "$LATEST" ]; then
-              echo "  $attempt/90: no run yet..."; sleep 30; continue
+              echo "  $attempt/300: no run yet..."; sleep 30; continue
             fi
             CONCLUSION=$(echo "$LATEST" | cut -d' ' -f1)
             STATUS=$(echo "$LATEST" | cut -d' ' -f2)
@@ -63,7 +69,7 @@ jobs:
             elif [ "$STATUS" = "completed" ]; then
               echo "BLOCKED: CodeQL $CONCLUSION"; exit 1
             fi
-            echo "  $attempt/90: $STATUS..."; sleep 30
+            echo "  $attempt/300: $STATUS..."; sleep 30
           done
           echo "BLOCKED: CodeQL timeout"; exit 1
 

.github/workflows/_smoke.yml

@@ -102,9 +102,9 @@ jobs:
       - name: Extract release artifact
         run: |
           mkdir -p "$RUNNER_TEMP/cbm-artifact"
-          tar -xzf codebase-memory-mcp-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz \
+          tar -xzf codebase-memory-cli-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz \
             -C "$RUNNER_TEMP/cbm-artifact"
-          chmod +x "$RUNNER_TEMP/cbm-artifact/codebase-memory-mcp"
+          chmod +x "$RUNNER_TEMP/cbm-artifact/codebase-memory-cli"
 
       # ONE harness for every venue. This is the same wrapper local CI and PR CI
       # run, handed the DOWNLOADED artifact instead of a local build: it stages
@@ -114,22 +114,22 @@ jobs:
       # the wrapper (no env isolation, no user-PATH guard, fixed port).
       - name: Smoke test (shared wrapper)
         run: |
-          scripts/smoke-local.sh "$RUNNER_TEMP/cbm-artifact/codebase-memory-mcp"
+          scripts/smoke-local.sh "$RUNNER_TEMP/cbm-artifact/codebase-memory-cli"
         env:
           CBM_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/cbm-artifact
           SMOKE_REQUIRE_UI: "1"
 
       - name: Security audits
         run: |
-          BIN="$RUNNER_TEMP/cbm-artifact/codebase-memory-mcp"
+          BIN="$RUNNER_TEMP/cbm-artifact/codebase-memory-cli"
           scripts/security-strings.sh "$BIN"
           scripts/security-install.sh "$BIN"
           scripts/security-network.sh "$BIN"
 
       - name: MCP robustness test (selected linux-amd64 runtime)
         if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
         run: |
-          BIN="$RUNNER_TEMP/cbm-artifact/codebase-memory-mcp"
+          BIN="$RUNNER_TEMP/cbm-artifact/codebase-memory-cli"
           scripts/security-fuzz.sh "$BIN"
           scripts/security-fuzz-random.sh "$BIN" 60
 
@@ -145,7 +145,7 @@ jobs:
           grep -q "DatabaseMirror" /etc/clamav/freshclam.conf 2>/dev/null || \
             echo "DatabaseMirror database.clamav.net" | sudo tee -a /etc/clamav/freshclam.conf > /dev/null
           sudo freshclam --quiet
-          clamscan --no-summary "$RUNNER_TEMP/cbm-artifact/codebase-memory-mcp"
+          clamscan --no-summary "$RUNNER_TEMP/cbm-artifact/codebase-memory-cli"
 
       - name: ClamAV scan (macOS)
         if: startsWith(matrix.os, 'macos')
@@ -158,7 +158,7 @@ jobs:
             echo "DatabaseMirror database.clamav.net" >> "$CLAMAV_ETC/freshclam.conf"
           fi
           freshclam --quiet --no-warnings 2>/dev/null || freshclam --quiet 2>/dev/null || echo "WARNING: freshclam update failed"
-          clamscan --no-summary "$RUNNER_TEMP/cbm-artifact/codebase-memory-mcp"
+          clamscan --no-summary "$RUNNER_TEMP/cbm-artifact/codebase-memory-cli"
 
   smoke-windows:
     needs: setup-matrix
@@ -196,8 +196,8 @@ jobs:
           ARCH=${{ matrix.arch }}
           ARTIFACT_DIR="$(cygpath -u "$RUNNER_TEMP")/cbm-artifact"
           mkdir -p "$ARTIFACT_DIR"
-          unzip -o "codebase-memory-mcp-windows-${ARCH}.zip" -d "$ARTIFACT_DIR"
-          test -s "$ARTIFACT_DIR/codebase-memory-mcp.exe"
+          unzip -o "codebase-memory-cli-windows-${ARCH}.zip" -d "$ARTIFACT_DIR"
+          test -s "$ARTIFACT_DIR/codebase-memory-cli.exe"
           # ONE executable per runtime set: a payload sibling would mean the
           # removed launcher split came back.
           test ! -e "$ARTIFACT_DIR/codebase-memory-mcp.payload.exe"
@@ -209,8 +209,8 @@ jobs:
           # image's file busy for ~100ms (section teardown / first-touch AV),
           # and a temp dir on an ephemeral runner must never fail the job.
           trap 'rm -rf "$LAUNCH_DIR" 2>/dev/null || { sleep 2; rm -rf "$LAUNCH_DIR" 2>/dev/null || true; }' EXIT
-          cp "$ARTIFACT_DIR/codebase-memory-mcp.exe" "$LAUNCH_DIR/"
-          "$LAUNCH_DIR/codebase-memory-mcp.exe" --version
+          cp "$ARTIFACT_DIR/codebase-memory-cli.exe" "$LAUNCH_DIR/"
+          "$LAUNCH_DIR/codebase-memory-cli.exe" --version
 
       # ONE harness for every venue: the same script win.sh smoke-install and
       # pr.yml run, handed the DOWNLOADED artifact instead of a local build. It
@@ -232,21 +232,21 @@ jobs:
         shell: msys2 {0}
         run: |
           ARTIFACT_DIR="$(cygpath -u "$RUNNER_TEMP")/cbm-artifact"
-          scripts/security-strings.sh "$ARTIFACT_DIR/codebase-memory-mcp.exe"
+          scripts/security-strings.sh "$ARTIFACT_DIR/codebase-memory-cli.exe"
           PROFILE_ROOT="$(cygpath -u "$USERPROFILE")"
           SECURITY_DIR="$(mktemp -d "$PROFILE_ROOT/cbm-release-security.XXXXXX")"
           # Best-effort cleanup with one retry (see the version preflight).
           trap 'rm -rf "$SECURITY_DIR" 2>/dev/null || { sleep 2; rm -rf "$SECURITY_DIR" 2>/dev/null || true; }' EXIT
-          cp "$ARTIFACT_DIR/codebase-memory-mcp.exe" "$SECURITY_DIR/"
+          cp "$ARTIFACT_DIR/codebase-memory-cli.exe" "$SECURITY_DIR/"
           TMPDIR="$SECURITY_DIR" \
-            scripts/security-install.sh "$SECURITY_DIR/codebase-memory-mcp.exe"
+            scripts/security-install.sh "$SECURITY_DIR/codebase-memory-cli.exe"
 
       - name: Windows Defender scan
         shell: pwsh
         run: |
           & "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate 2>$null
           $artifactDir = Join-Path $env:RUNNER_TEMP "cbm-artifact"
-          foreach ($binary in @("codebase-memory-mcp.exe")) {
+          foreach ($binary in @("codebase-memory-cli.exe")) {
             $result = & "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File (Join-Path $artifactDir $binary) -DisableRemediation
             $code = $LASTEXITCODE
             Write-Host $result
@@ -286,9 +286,9 @@ jobs:
       - name: Extract release artifact
         run: |
           mkdir -p "$RUNNER_TEMP/cbm-artifact"
-          tar -xzf codebase-memory-mcp-linux-${{ matrix.arch }}-portable.tar.gz \
+          tar -xzf codebase-memory-cli-linux-${{ matrix.arch }}-portable.tar.gz \
             -C "$RUNNER_TEMP/cbm-artifact"
-          chmod +x "$RUNNER_TEMP/cbm-artifact/codebase-memory-mcp"
+          chmod +x "$RUNNER_TEMP/cbm-artifact/codebase-memory-cli"
 
       # Same wrapper as every other venue. This leg previously called
       # smoke-test.sh with no fixture server, which silently SKIPPED the
@@ -297,7 +297,7 @@ jobs:
       # exactly the phases it most needs to run.
       - name: Smoke test (shared wrapper)
         run: |
-          scripts/smoke-local.sh "$RUNNER_TEMP/cbm-artifact/codebase-memory-mcp"
+          scripts/smoke-local.sh "$RUNNER_TEMP/cbm-artifact/codebase-memory-cli"
         env:
           CBM_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/cbm-artifact
           SMOKE_REQUIRE_UI: "1"
@@ -307,11 +307,11 @@ jobs:
       # in debian:bullseye (glibc 2.31) — the standard dynamic binary would fail
       # here with `GLIBC_2.38 not found`.
       - name: Old-glibc compatibility
-        run: scripts/ci/check-glibc-compat.sh "$RUNNER_TEMP/cbm-artifact/codebase-memory-mcp"
+        run: scripts/ci/check-glibc-compat.sh "$RUNNER_TEMP/cbm-artifact/codebase-memory-cli"
 
       - name: Security audits
         run: |
-          BIN="$RUNNER_TEMP/cbm-artifact/codebase-memory-mcp"
+          BIN="$RUNNER_TEMP/cbm-artifact/codebase-memory-cli"
           scripts/security-strings.sh "$BIN"
           scripts/security-install.sh "$BIN"
           scripts/security-network.sh "$BIN"

.github/workflows/_soak.yml

@@ -92,7 +92,7 @@ jobs:
           SELECTED_BINARY: ${{ runner.temp }}/cbm-selected-artifact/codebase-memory-mcp
           USE_RELEASE_ARTIFACTS: ${{ inputs.use_release_artifacts }}
         run: |
-          binary=build/c/codebase-memory-mcp
+          binary=build/c/codebase-memory-cli
           test "$USE_RELEASE_ARTIFACTS" != true || binary="$SELECTED_BINARY"
           scripts/soak-legs.sh --legs "${{ inputs.legs }}" "$binary" ${{ inputs.duration_minutes }}
       - name: Upload metrics
@@ -156,9 +156,9 @@ jobs:
         run: |
           ARTIFACT_DIR="$(cygpath -u "$RUNNER_TEMP")/cbm-selected-artifact"
           mkdir -p "$ARTIFACT_DIR"
-          unzip -q "$(cygpath -u "$RUNNER_TEMP")/cbm-selected-container/codebase-memory-mcp-windows-amd64.zip" \
-            codebase-memory-mcp.exe -d "$ARTIFACT_DIR"
-          "$ARTIFACT_DIR/codebase-memory-mcp.exe" --version
+          unzip -q "$(cygpath -u "$RUNNER_TEMP")/cbm-selected-container/codebase-memory-cli-windows-amd64.zip" \
+            codebase-memory-cli.exe -d "$ARTIFACT_DIR"
+          "$ARTIFACT_DIR/codebase-memory-cli.exe" --version
       # Both release-gating legs via the ONE canonical soak entry; only the
       # protected-TEMP provisioning is venue text. soak-legs.sh resolves .exe.
       - name: Soak legs (${{ inputs.legs }}, ${{ inputs.duration_minutes }} min each)
@@ -167,9 +167,9 @@ jobs:
           export TEMP="$(cygpath -m "$CBM_CI_TEMP_ROOT")"
           export TMP="$TEMP"
           export TMPDIR="$(cygpath -u "$CBM_CI_TEMP_ROOT")"
-          binary=build/c/codebase-memory-mcp
+          binary=build/c/codebase-memory-cli
           if [ "${{ inputs.use_release_artifacts }}" = true ]; then
-            binary="$(cygpath -u "$RUNNER_TEMP")/cbm-selected-artifact/codebase-memory-mcp.exe"
+            binary="$(cygpath -u "$RUNNER_TEMP")/cbm-selected-artifact/codebase-memory-cli.exe"
           fi
           scripts/soak-legs.sh --legs "${{ inputs.legs }}" "$binary" ${{ inputs.duration_minutes }}
       - name: Upload metrics
@@ -234,9 +234,9 @@ jobs:
         run: |
           ARTIFACT_DIR="$(cygpath -u "$RUNNER_TEMP")/cbm-selected-artifact"
           mkdir -p "$ARTIFACT_DIR"
-          unzip -q "$(cygpath -u "$RUNNER_TEMP")/cbm-selected-container/codebase-memory-mcp-windows-arm64.zip" \
-            codebase-memory-mcp.exe -d "$ARTIFACT_DIR"
-          "$ARTIFACT_DIR/codebase-memory-mcp.exe" --version
+          unzip -q "$(cygpath -u "$RUNNER_TEMP")/cbm-selected-container/codebase-memory-cli-windows-arm64.zip" \
+            codebase-memory-cli.exe -d "$ARTIFACT_DIR"
+          "$ARTIFACT_DIR/codebase-memory-cli.exe" --version
       # Both release-gating legs via the ONE canonical soak entry; only the
       # protected-TEMP provisioning is venue text. soak-legs.sh resolves .exe.
       - name: Soak legs (${{ inputs.legs }}, ${{ inputs.duration_minutes }} min each)
@@ -245,9 +245,9 @@ jobs:
           export TEMP="$(cygpath -m "$CBM_CI_TEMP_ROOT")"
           export TMP="$TEMP"
           export TMPDIR="$(cygpath -u "$CBM_CI_TEMP_ROOT")"
-          binary=build/c/codebase-memory-mcp
+          binary=build/c/codebase-memory-cli
           if [ "${{ inputs.use_release_artifacts }}" = true ]; then
-            binary="$(cygpath -u "$RUNNER_TEMP")/cbm-selected-artifact/codebase-memory-mcp.exe"
+            binary="$(cygpath -u "$RUNNER_TEMP")/cbm-selected-artifact/codebase-memory-cli.exe"
           fi
           scripts/soak-legs.sh --legs "${{ inputs.legs }}" "$binary" ${{ inputs.duration_minutes }}
       - name: Upload metrics
@@ -292,7 +292,7 @@ jobs:
       - name: Extract selected portable executable
         run: |
           mkdir -p "$RUNNER_TEMP/cbm-selected-artifact"
-          tar -xzf "$RUNNER_TEMP/cbm-selected-container/codebase-memory-mcp-linux-${{ matrix.arch }}-portable.tar.gz" \
+          tar -xzf "$RUNNER_TEMP/cbm-selected-container/codebase-memory-cli-linux-${{ matrix.arch }}-portable.tar.gz" \
             -C "$RUNNER_TEMP/cbm-selected-artifact" codebase-memory-mcp
           chmod +x "$RUNNER_TEMP/cbm-selected-artifact/codebase-memory-mcp"
           "$RUNNER_TEMP/cbm-selected-artifact/codebase-memory-mcp" --version
@@ -367,7 +367,7 @@ jobs:
         # Single-leg variant of the canonical soak entry: the ASan build is too
         # slow for the two-leg sequence; leg selection is a documented flag, not
         # a divergent inline procedure.
-        run: scripts/soak-legs.sh --legs quick build/c/codebase-memory-mcp 15
+        run: scripts/soak-legs.sh --legs quick build/c/codebase-memory-cli 15
       - name: Upload metrics
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -407,7 +407,7 @@ jobs:
         env:
           ASAN_OPTIONS: "detect_leaks=0:halt_on_error=0:log_path=soak-results/asan"
         # Single-leg variant of the canonical soak entry (see the unix ASan job).
-        run: scripts/soak-legs.sh --legs quick build/c/codebase-memory-mcp 15
+        run: scripts/soak-legs.sh --legs quick build/c/codebase-memory-cli 15
       - name: Upload metrics
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/_test.yml

@@ -587,4 +587,4 @@ jobs:
         # against the real supervisor->worker spawn path: under the mandatory
         # coordination daemon, CBM_INDEX_SUPERVISOR=0 is a fail-closed refusal, so
         # the driver no longer sets it anywhere.
-        run: ./scripts/test-windows.ps1 -GuardsOnly -Binary build/c/codebase-memory-mcp.exe
+        run: ./scripts/test-windows.ps1 -GuardsOnly -Binary build/c/codebase-memory-cli.exe