Refactor and clean up code across multiple files

- Updated `hotSwap` method in `adapter_registry.h` to suppress unused parameter warning.
- Removed unnecessary class export specifier from `KnowledgeGraphReasoner`.
- Adjusted `GraphIndexManager` to avoid inconsistent DLL import/export bindings.
- Deleted unused `toUpper` function in `aql_autocomplete.cpp`.
- Renamed `rebuild_state` parameter to `new_rebuild_state` in `markPublished` method of `ArtifactManifest`.
- Suppressed unused parameter warning for `config` in `validateModelInitialization`.
- Updated tests in `test_llama_cpp_inference_contract_focused.cpp` to use direct object references instead of pointers.
- Added error handling for workspace initialization in `LLMWikiPluginImpl`.
- Suppressed unused parameter warnings in various test cases and functions.
- Improved error handling in `HissReshaper` tests for mismatched grid sizes.
- Cleaned up unused variables and improved readability in several test files.

Author: makr-code

.github/workflows/build-benchmarks.yml

@@ -134,7 +134,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-22.04
+          - os: ubuntu-latest
             compiler: gcc-12
             cc: gcc-12
             cxx: g++-12
@@ -469,7 +469,7 @@ jobs:
   # ─────────────────────────────────────────────────────────────────────────
   wave-d-observability-gates:
     name: Wave D Observability Gates (Trace, Metrics, Exporter Stress)
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     timeout-minutes: 120
     needs: [preflight-build-status]
     if: >
@@ -585,7 +585,7 @@ jobs:
   # ─────────────────────────────────────────────────────────────────────────
   sharding-release-gates:
     name: Sharding Release-Gate Benchmarks (SRG-01..06)
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     needs: [preflight-build-status]
     if: >
@@ -702,7 +702,7 @@ jobs:
   # ─────────────────────────────────────────────────────────────────────────
   wave-d-soak-tests:
     name: Wave D Soak Tests (48-hour Endurance)
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     timeout-minutes: 2880  # 48 hours
     needs: [preflight-build-status]
     if: >

.github/workflows/build-content-regression.yml

@@ -49,7 +49,7 @@ permissions:
 # ──────────────────────────────────────────────────────────────────────────────
 env:
   APT_PACKAGES: >-
-    build-essential cmake ninja-build pkg-config sccache
+    build-essential cmake ninja-build pkg-config ccache
     librocksdb-dev libgtest-dev libssl-dev zlib1g-dev libzstd-dev
     libfmt-dev libspdlog-dev nlohmann-json3-dev libtbb-dev
     libyaml-cpp-dev libmimalloc-dev libcurl4-openssl-dev
@@ -66,7 +66,7 @@ jobs:
   # ────────────────────────────────────────────────────────────────────────────
   content-regression:
     name: Content Regression (ctest --label-include "content")
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     if: >
       github.event_name == 'push' ||
@@ -110,6 +110,8 @@ jobs:
       - name: Configure (content tests only)
         run: |
           export VCPKG_ROOT="${GITHUB_WORKSPACE}/vcpkg"
+          ccache_path="$(command -v ccache)"
+          export THEMIS_COMPILER_CACHE_PROGRAM="${ccache_path}"
           cmake -S . -B "${{ env.BUILD_DIR }}" -G Ninja \
             -DCMAKE_BUILD_TYPE=Debug \
             -DTHEMIS_BUILD_TESTS=ON \
@@ -152,7 +154,7 @@ jobs:
   # ────────────────────────────────────────────────────────────────────────────
   wave-d-soak:
     name: Wave-D Soak (ctest --label-include "soak" --timeout 600)
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     timeout-minutes: 90
     if: >
       (github.event_name == 'schedule' && github.event.schedule == '30 5 * * 0') ||
@@ -199,6 +201,8 @@ jobs:
       - name: Configure (soak tests — Release for endurance realism)
         run: |
           export VCPKG_ROOT="${GITHUB_WORKSPACE}/vcpkg"
+          ccache_path="$(command -v ccache)"
+          export THEMIS_COMPILER_CACHE_PROGRAM="${ccache_path}"
           cmake -S . -B "${{ env.BUILD_DIR_SOAK }}" -G Ninja \
             -DCMAKE_BUILD_TYPE=Release \
             -DTHEMIS_BUILD_TESTS=ON \

.github/workflows/build-llm-inference.yml

@@ -146,7 +146,7 @@ jobs:
           set -euo pipefail
           sudo apt-get update -qq
           sudo apt-get install -y --no-install-recommends \
-            build-essential cmake ninja-build pkg-config \
+            build-essential cmake ninja-build pkg-config ccache \
             librocksdb-dev libgtest-dev libssl-dev zlib1g-dev libzstd-dev \
             libfmt-dev libspdlog-dev nlohmann-json3-dev libtbb-dev \
             libyaml-cpp-dev libcurl4-openssl-dev libboost-system-dev \
@@ -159,6 +159,8 @@ jobs:
       - name: Configure CMake (inference tests enabled)
         run: |
           set -euo pipefail
+          ccache_path="$(command -v ccache)"
+          export THEMIS_COMPILER_CACHE_PROGRAM="${ccache_path}"
           cmake -S . -B "${{ env.CMAKE_BUILD_DIR }}" \
             -DTHEMIS_BUILD_TESTS=ON \
             -DTHEMIS_BUILD_BENCHMARKS=OFF \

.github/workflows/compliance-supply-chain.yml

@@ -76,7 +76,7 @@ permissions:
 jobs:
   license-gate:
     name: License Policy Gate
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: read
@@ -136,7 +136,7 @@ jobs:
     name: Publish License Release Assets
     if: github.event_name == 'release'
     needs: license-gate
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
@@ -159,7 +159,7 @@ jobs:
   # ──────────────────────────────────────────────────────────────────────────
   sbom:
     name: SBOM Generation & Verification
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
       contents: write
@@ -275,7 +275,7 @@ jobs:
   # ──────────────────────────────────────────────────────────────────────────
   dependency-freshness:
     name: Dependency Freshness Gate
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     # Run on monthly schedule (cron '0 4 1 * *'), workflow_dispatch, or release
     if: >
@@ -426,7 +426,7 @@ jobs:
   # ──────────────────────────────────────────────────────────────────────────
   soc2-evidence:
     name: SOC 2 Evidence Export
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     permissions:
@@ -440,8 +440,14 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Start ThemisDB container
+        env:
+          DOCKER_BUILDKIT: '0'
+          COMPOSE_DOCKER_CLI_BUILD: '0'
         run: |
-          docker compose -f docker-compose.yml up -d themis
+          test -f "${GITHUB_WORKSPACE}/LICENSE" || { echo "::error::Missing ${GITHUB_WORKSPACE}/LICENSE"; exit 1; }
+          test -d "${GITHUB_WORKSPACE}/internal" || { echo "::error::Missing ${GITHUB_WORKSPACE}/internal"; exit 1; }
+          docker compose --project-directory "${GITHUB_WORKSPACE}" -f "${GITHUB_WORKSPACE}/docker-compose.yml" build themis
+          docker compose --project-directory "${GITHUB_WORKSPACE}" -f "${GITHUB_WORKSPACE}/docker-compose.yml" up -d --no-build themis
           for _ in $(seq 1 30); do
             if curl -sk "${THEMIS_ADMIN_ENDPOINT}/v1/health" | grep -q "ok"; then
               echo "ThemisDB ready"; break
@@ -476,4 +482,4 @@ jobs:
 
       - name: Stop ThemisDB container
         if: always()
-        run: docker compose -f docker-compose.yml down --volumes
+        run: docker compose --project-directory "${GITHUB_WORKSPACE}" -f "${GITHUB_WORKSPACE}/docker-compose.yml" down --volumes

.github/workflows/security-consolidated.yml

@@ -207,7 +207,7 @@ jobs:
   # ────────────────────────────────────────────────────────────────────────────
   dast-scan:
     name: OWASP ZAP Baseline DAST
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     timeout-minutes: 45
     continue-on-error: true
     if: >

CMakePresets.json

@@ -602,7 +602,7 @@
     {
       "name": "windows-debug",
       "configurePreset": "windows-debug",
-      "jobs": 4
+      "jobs": 20
     },
     {
       "name": "hyperscaler-debug-windows",

cmake/CompilerOptions.cmake

@@ -226,6 +226,7 @@ if(MSVC)
         /W4              # Warning level 4
         /fp:precise      # Precise floating point
         /Gy              # Enable function-level linking
+        /Zm200           # Increase compiler heap for large Windows translation units
         /permissive-     # Conformance mode
         /EHsc            # Exception handling (C++ only, not SEH)
         /w14018          # Enable C4018: signed/unsigned mismatch warning

docker/Dockerfile.unified

@@ -27,7 +27,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && apt-get install -y --no-install-recommends \
         build-essential cmake ninja-build git curl ca-certificates pkg-config \
-        zip unzip tar wget flex bison aria2 python3 perl nasm autoconf \
+        zip unzip tar wget flex bison aria2 ccache python3 perl nasm autoconf \
         automake libtool && \
     if [ -n "${EXTRA_CA_CERT_B64}" ]; then \
         echo "${EXTRA_CA_CERT_B64}" | base64 -d > /usr/local/share/ca-certificates/themis-extra-ca.crt && \
@@ -47,7 +47,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
 FROM base AS deps
 
 ARG THEMIS_EDITION=COMMUNITY
-ARG TARGETARCH=amd64
+ARG TARGETARCH
 ARG VCPKG_MANIFEST_HASH=""
 
 WORKDIR /build
@@ -65,14 +65,17 @@ RUN set -eux; \
     else \
         echo "ERROR: vcpkg-${EDITION}.json not found!"; exit 1; \
     fi && \
+    ARCH="${TARGETARCH:-}"; \
+    if [ -z "${ARCH}" ]; then ARCH="$(uname -m)"; fi; \
     TRIPLET="x64-linux"; \
-    case "${TARGETARCH}" in \
-        amd64) TRIPLET="x64-linux" ;; \
-        arm64) TRIPLET="arm64-linux" ;; \
-        arm) TRIPLET="arm-linux" ;; \
+    case "${ARCH}" in \
+        amd64|x86_64) TRIPLET="x64-linux" ;; \
+        arm64|aarch64) TRIPLET="arm64-linux" ;; \
+        arm|armv7l) TRIPLET="arm-linux" ;; \
+        *) echo "WARN: Unknown TARGETARCH='${ARCH}', fallback to x64-linux" ;; \
     esac && \
     echo "${TRIPLET}" > /tmp/triplet.txt && \
-    echo "Architecture: ${TRIPLET}"
+    echo "Architecture: ${ARCH} -> ${TRIPLET}"
 
 # Copy vcpkg configuration and overlay ports
 COPY vcpkg-configuration.json ./
@@ -152,7 +155,7 @@ FROM deps AS build
 
 ARG THEMIS_EDITION=COMMUNITY
 ARG ENABLE_LLM=ON
-ARG TARGETARCH=amd64
+ARG TARGETARCH
 
 WORKDIR /src
 
@@ -163,13 +166,14 @@ COPY include ./include
 COPY src ./src
 COPY proto ./proto
 COPY internal ./internal
+COPY ports ./ports
 
 # Copy vcpkg config from deps stage (not from host!)
 COPY --from=deps /build/vcpkg.json ./vcpkg.json
 COPY --from=deps /build/vcpkg-configuration.json ./vcpkg-configuration.json
 
-# Copy vcpkg installed packages
-COPY --from=deps /build/vcpkg_installed /build/vcpkg_installed
+# Copy vcpkg installed packages where Dependencies.cmake expects them
+COPY --from=deps /build/vcpkg_installed /src/vcpkg_installed
 
 # Copy llama.cpp
 COPY --from=llama /opt/llama.cpp /opt/llama.cpp
@@ -188,9 +192,17 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
 ARG FORCE_CPU_ONLY=OFF
 
 RUN set -eux; \
-    TRIPLET=$(cat /tmp/triplet.txt); \
+    ARCH="${TARGETARCH:-}"; \
+    if [ -z "${ARCH}" ]; then ARCH="$(uname -m)"; fi; \
+    TRIPLET="x64-linux"; \
+    case "${ARCH}" in \
+        amd64|x86_64) TRIPLET="x64-linux" ;; \
+        arm64|aarch64) TRIPLET="arm64-linux" ;; \
+        arm|armv7l) TRIPLET="arm-linux" ;; \
+        *) echo "WARN: Unknown TARGETARCH='${ARCH}', fallback to x64-linux" ;; \
+    esac; \
     echo "Building ThemisDB ${THEMIS_EDITION} (LLM=${ENABLE_LLM}, FORCE_CPU_ONLY=${FORCE_CPU_ONLY})..."; \
-    echo "TRIPLET=${TRIPLET}"; \
+    echo "TARGETARCH=${ARCH} TRIPLET=${TRIPLET}"; \
     ls -la /build/vcpkg_installed/${TRIPLET} 2>/dev/null | head -20 || echo "No vcpkg_installed"; \
     \
     EXTRA_ARGS=""; \
@@ -206,10 +218,12 @@ RUN set -eux; \
     cmake --preset linux-release \
         -DTHEMIS_EDITION="${THEMIS_EDITION}" \
         -DTHEMIS_ENABLE_LLM="${ENABLE_LLM}" \
+        -DTHEMIS_AUTO_BOOTSTRAP_DEPS=OFF \
         -DVCPKG_TARGET_TRIPLET="${TRIPLET}" \
-        -DCMAKE_PREFIX_PATH="/build/vcpkg_installed/${TRIPLET};/build/vcpkg_installed/${TRIPLET}/share;/build/vcpkg_installed/${TRIPLET}/lib/cmake" \
-        -DOPENSSL_ROOT_DIR="/build/vcpkg_installed/${TRIPLET}" \
-        -DOpenSSL_DIR="/build/vcpkg_installed/${TRIPLET}/share/openssl" \
+        -DVCPKG_INSTALLED_DIR="/src/vcpkg_installed" \
+        -DCMAKE_PREFIX_PATH="/src/vcpkg_installed/${TRIPLET};/src/vcpkg_installed/${TRIPLET}/share;/src/vcpkg_installed/${TRIPLET}/lib/cmake" \
+        -DOPENSSL_ROOT_DIR="/src/vcpkg_installed/${TRIPLET}" \
+        -DOpenSSL_DIR="/src/vcpkg_installed/${TRIPLET}/share/openssl" \
         ${EXTRA_ARGS} && \
     ninja -C build -j$(nproc)
 

include/core/concerns/adapter_registry.h

@@ -220,7 +220,7 @@ class AdapterRegistry {
      * @throws std::invalid_argument if @p new_adapter is nullptr.
      */
     template<typename T>
-    bool hotSwap(std::shared_ptr<T> new_adapter, AdapterMetadata meta = {}) {
+    bool hotSwap(std::shared_ptr<T> new_adapter, [[maybe_unused]] AdapterMetadata meta = {}) {
         if (!new_adapter) {
             throw std::invalid_argument(
                 "[AdapterRegistry] hotSwap: new_adapter must not be nullptr");

include/graph/knowledge_graph_reasoner.h

@@ -266,7 +266,7 @@ class InferenceStore {
  * //                      {"bob","reports_to","carol"} ]
  * @endcode
  */
-class THEMIS_GRAPH_API KnowledgeGraphReasoner {
+class KnowledgeGraphReasoner {
 public:
     /// Default maximum inference hops per `infer()` call.
     static constexpr int kDefaultMaxHops = 5;