Merge remote-tracking branch 'origin/main' into fix-issue1620-1621-1653-1657-1658

# Conflicts:
#	tests/CodeIndex.Tests/IndexCommandRunnerTests.cs

Author: Widthdom

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# Release-critical paths require review from the repository owner.
+/.github/workflows/ @Widthdom
+/install.sh @Widthdom
+/src/CodeIndex/CodeIndex.csproj @Widthdom
+/nuget.config @Widthdom

.github/workflows/release.yml

@@ -18,6 +18,8 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 jobs:
   release:
@@ -388,6 +390,52 @@ jobs:
           cd release-files
           sha256sum * > sha256sums.txt
 
+      - name: Import release GPG key
+        env:
+          RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
+          RELEASE_GPG_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
+        run: |
+          set -euo pipefail
+          if [ -z "${RELEASE_GPG_PRIVATE_KEY}" ]; then
+            echo "RELEASE_GPG_PRIVATE_KEY secret is required to sign sha256sums.txt." >&2
+            exit 1
+          fi
+
+          mkdir -p ~/.gnupg
+          chmod 700 ~/.gnupg
+          printf '%s' "${RELEASE_GPG_PRIVATE_KEY}" | gpg --batch --import
+          if [ -n "${RELEASE_GPG_PASSPHRASE}" ]; then
+            printf '%s' "${RELEASE_GPG_PASSPHRASE}" > ~/.gnupg/release-passphrase
+            chmod 600 ~/.gnupg/release-passphrase
+          fi
+
+      - name: Sign release checksum manifest
+        env:
+          RELEASE_GPG_KEY_ID: ${{ secrets.RELEASE_GPG_KEY_ID }}
+          RELEASE_GPG_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
+        run: |
+          set -euo pipefail
+          sign_args=(--batch --yes --armor --detach-sign)
+          if [ -n "${RELEASE_GPG_KEY_ID}" ]; then
+            sign_args+=(--local-user "${RELEASE_GPG_KEY_ID}")
+          fi
+          if [ -n "${RELEASE_GPG_PASSPHRASE}" ]; then
+            sign_args+=(--pinentry-mode loopback --passphrase-file ~/.gnupg/release-passphrase)
+          fi
+
+          gpg "${sign_args[@]}" --output release-files/sha256sums.txt.asc release-files/sha256sums.txt
+          test -s release-files/sha256sums.txt.asc
+
+      - name: Attest release artifacts
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            release-files/*.tar.gz
+            release-files/*.zip
+            release-files/*.cdx.json
+            release-files/sha256sums.txt
+            release-files/sha256sums.txt.asc
+
       - name: Write release install notes
         run: |
           cat > release-install-notes.md <<'EOF'
@@ -472,7 +520,7 @@ jobs:
           # リリースが "Failed to download sha256sums.txt ... HTTP 404" で
           # 失敗した。verify step が取得する全 asset をポーリングし、伝播の
           # 遅い asset があってもリリースを失敗させず待ち切る。
-          VERIFY_ASSET_NAMES: CodeIndex-linux-x64.tar.gz sha256sums.txt
+          VERIFY_ASSET_NAMES: CodeIndex-linux-x64.tar.gz sha256sums.txt sha256sums.txt.asc
         run: |
           set -euo pipefail
           mapfile -t expected_assets < <(cd release-files && printf '%s\n' *)

AGENT_GUIDE.md

@@ -131,8 +131,9 @@ CI watching must be bounded. Do not loop indefinitely.
 
 ## Status Contract
 
-- `status --json` and related JSON/MCP payloads currently expose the trust fields documented in `README.md` and `DEVELOPER_GUIDE.md`, including `fold_ready`, `fold_ready_reason`, `graph_table_available`, `issues_table_available`, `sql_graph_contract_ready`, `sql_graph_contract_degraded_reason`, `hotspot_family_ready`, `hotspot_family_degraded_reason`, `csharp_symbol_name_ready`, `csharp_metadata_target_ready`, `csharp_metadata_target_degraded_reason`, `indexed_head_commit`, `worktree_head_changed`, `index_writer_version`, `index_newer_than_reader`, `index_newer_than_reader_reason`, `unknown_extension_file_count`, `path_case_sensitive`, `data_dir`, `data_dir_source`, `data_dir_mode`, `mac_profile`, `db_pragma_settings` (`journal_mode`, `synchronous`, `wal_autocheckpoint`, `page_count`, `freelist_count`, `page_size`), `hooks`, MCP-only `mcp_session`, and the `status --check`-only `stale_after_seconds` / `index_age_seconds` threshold audit fields.
-- When `fold_ready` or `csharp_metadata_target_ready` is the only degraded readiness bit, the CLI also adds `degraded_reason`, `recommended_action`, and `alternative_action`.
+- `status --json` and related JSON/MCP payloads currently expose the trust fields documented in `README.md` and `DEVELOPER_GUIDE.md`, including `fold_ready`, `fold_ready_reason`, `graph_table_available`, `issues_table_available`, `file_issues_data_current`, `migration_in_progress`, `sql_graph_contract_ready`, `sql_graph_contract_degraded_reason`, `hotspot_family_ready`, `hotspot_family_degraded_reason`, `csharp_symbol_name_ready`, `csharp_metadata_target_ready`, `csharp_metadata_target_degraded_reason`, `indexed_head_commit`, `worktree_head_changed`, `index_writer_version`, `index_newer_than_reader`, `index_newer_than_reader_reason`, `unknown_extension_file_count`, `path_case_sensitive`, `data_dir`, `data_dir_source`, `data_dir_mode`, `mac_profile`, `db_pragma_settings` (`journal_mode`, `synchronous`, `wal_autocheckpoint`, `page_count`, `freelist_count`, `page_size`), `hooks`, MCP-only `mcp_session`, and the `status --check`-only `stale_after_seconds` / `index_age_seconds` threshold audit fields.
+- When any readiness field is degraded, the CLI adds `degraded_root_cause`, `degraded_reason`, `recommended_action`, `alternative_action`, and `readiness_degradations[]`. `degraded_root_cause` is the primary stable machine code; `readiness_degradations[]` lists every degraded field with `root_cause`, human reason, and remediation strings.
+- `issues_table_available` reports physical `file_issues` table presence only. `file_issues_data_current` reports whether the table is also stamped current for the active index generation.
 - `index_writer_version` records the `cdidx` version that last wrote to the DB (stamped into `codeindex_meta` as `cdidx_writer_version` on every full scan, update, and MCP index). `index_newer_than_reader` flips to `true` whenever any persisted numeric contract stamp in `codeindex_meta` (or unknown `PRAGMA user_version` readiness bits) exceeds the current binary's compiled maximum, so an older CLI re-opening a DB written by a newer CLI degrades loudly with an audit trail instead of silently dropping back to text-search fallbacks. `index_newer_than_reader_reason` enumerates the specific newer-than-reader stamps.
 - `status` also surfaces indexed-HEAD freshness via `indexed_head_sha`, `indexed_head_branch`, `indexed_head_timestamp`, and `commits_ahead_of_indexed_head`. They are stamped by `cdidx index` on every successful run (full scan AND partial update, distinct from `indexed_head_commit` which is full-scan only) on a best-effort basis (never blocks an otherwise-successful index) and omitted on non-git workspaces, detached HEAD (branch only), or legacy DBs created before this contract.
 - `status` also surfaces unknown-extension scan coverage via `unknown_extension_file_count`, stamped by successful full-repository index runs (`cdidx index <projectPath>` and MCP `index_project`) as the number of non-indexed files with non-empty extensions that do not map to a known language. It is omitted on legacy DBs or before a current full scan has stamped the value.

CONTRIBUTING.md

@@ -62,6 +62,20 @@ Keep changes focused and follow the existing style of the files you touch:
   contracts change;
 - add or update tests when behavior changes.
 
+## Release-Critical Paths
+
+Changes to release-critical files require CODEOWNERS review once branch
+protection is configured to require it:
+
+- `.github/workflows/`
+- `install.sh`
+- `src/CodeIndex/CodeIndex.csproj`
+- `nuget.config`
+
+When adding a new file that can affect release artifact contents, signing,
+publishing, installer behavior, or package restore trust, add it to
+`.github/CODEOWNERS` in the same change.
+
 Before opening a pull request, run the checks that match the change. For code
 changes, the default full validation is: