[alexei-led]

Summary

Update only the Archfit workflow's three immutable pins:

• qualified Action commit e0a1ef9473d68b426e9c56b2da5986bcee2fc769;
• Engine v3.2.2;
• published linux/amd64 manifest sha256:bd351ac70610555237974fac5ff914967a1100fb8ef754853151300d5d19ca35.

The job uses an amd64 GitHub-hosted runner. Endpoint, audience, mode, workflow triggers/permissions, owners, gate mode, policy, baseline and labels remain unchanged. No application code or deployment scripts change.

Evidence

Engine release/native images are verified (133 assertions per native platform, four binary checksums). The exact Action source passed both native image smokes (33 assertions each), conformance and required-evidence controls. Action PR5 is merged; no image tag or multiarch-index digest is used as a platform pin.

Actionlint and zizmor pass. Normal signed commit/push; no hook or required-check bypass.

This PR is part of the App-wide rollout. It will be marked ready/merged only after the App deployment approves this new tuple, then fresh CI confirms admission. Any required baseline migration remains a separate reviewed change; this PR accepts no debt.

[archfit-review]

Archfit: Architecture needs attention · advisory · no baseline

Next: Advisories never block. Review the listed dimensions and diagnostics on the archfit/state check.

Details in Archfit

95 advisories · never block

Dependency	Where	Strength	Suggested move
api → session_protocol	src/ccgram/api/server.py:18, src/ccgram/api/server.py:19, src/ccgram/api/server.py:20 and 3 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
app_bootstrap → api	src/ccgram/bootstrap.py:425	functional	Move the functionality: lower the distance, so the coupled code lives in one module
app_bootstrap → domain_config	src/ccgram/bootstrap.py:30, src/ccgram/bootstrap.py:67, src/ccgram/cli.py:306 and 15 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
app_bootstrap → handlers	src/ccgram/bootstrap.py:29, src/ccgram/bootstrap.py:32, src/ccgram/bootstrap.py:33 and 12 more	intrusive	Introduce a contract: lower the integration strength, so the target can change without breaking this module
app_bootstrap → handlers	src/ccgram/bootstrap.py:523	intrusive	Introduce a contract: lower the integration strength, so the target can change without breaking this module
app_bootstrap → hooks	src/ccgram/hook.py:29, src/ccgram/hook.py:33, src/ccgram/hook.py:1155 and 2 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
app_bootstrap → multiplexer	src/ccgram/bootstrap.py:553, src/ccgram/hook.py:37	functional	Introduce a contract: lower the integration strength, so the target can change without breaking this module
app_bootstrap → multiplexer_backends	src/ccgram/hook.py:35, src/ccgram/hook.py:36, src/ccgram/main.py:227	functional	Move the functionality: lower the distance, so the coupled code lives in one module
app_bootstrap → providers	src/ccgram/bootstrap.py:52, src/ccgram/doctor_cmd.py:25, src/ccgram/doctor_cmd.py:182 and 1 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
app_bootstrap → session_protocol	src/ccgram/bootstrap.py:401, src/ccgram/cli.py:303, src/ccgram/cli.py:357 and 2 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
app_bootstrap → session_state	src/ccgram/bootstrap.py:53, src/ccgram/bootstrap.py:56, src/ccgram/bootstrap.py:65 and 3 more	intrusive	Introduce a contract: lower the integration strength, so the target can change without breaking this module
app_bootstrap → session_state	src/ccgram/bootstrap.py:49, src/ccgram/bootstrap.py:404, src/ccgram/bootstrap.py:528	intrusive	Introduce a contract: lower the integration strength, so the target can change without breaking this module
app_bootstrap → telegram_adapter	src/ccgram/doctor_cmd.py:26, src/ccgram/main.py:54, src/ccgram/main.py:318	functional	Move the functionality: lower the distance, so the coupled code lives in one module
app_bootstrap → terminal_adapter	src/ccgram/bootstrap.py:55, src/ccgram/bootstrap.py:358	functional	Move the functionality: lower the distance, so the coupled code lives in one module
app_bootstrap → transcript	src/ccgram/bootstrap.py:66	functional	Move the functionality: lower the distance, so the coupled code lives in one module
app_bootstrap → window_state	src/ccgram/bootstrap.py:534, src/ccgram/status_cmd.py:30	functional	Move the functionality: lower the distance, so the coupled code lives in one module
domain_config → handlers	src/ccgram/utils.py:418	functional	Introduce a contract: lower the integration strength, so the target can change without breaking this module
domain_config → multiplexer_backends	src/ccgram/config.py:274	functional	Move the functionality: lower the distance, so the coupled code lives in one module
domain_config → providers	src/ccgram/command_catalog.py:11	functional	Move the functionality: lower the distance, so the coupled code lives in one module
domain_config → session_protocol	src/ccgram/utils.py:32	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → domain_config	src/ccgram/handlers/agent_command.py:31, src/ccgram/handlers/callback_registry.py:21, src/ccgram/handlers/callback_tokens.py:19 and 72 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → llm	src/ccgram/handlers/hook_events.py:178, src/ccgram/handlers/shell/shell_capture.py:517, src/ccgram/handlers/shell/shell_commands.py:34 and 1 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → miniapp	src/ccgram/handlers/status/status_bar_actions.py:32	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → multiplexer	src/ccgram/handlers/polling/window_tick/apply.py:30, src/ccgram/handlers/polling/window_tick/observe.py:21, src/ccgram/handlers/polling/window_tick/observe.py:24	functional	Introduce a contract: lower the integration strength, so the target can change without breaking this module
handlers → providers	src/ccgram/handlers/agent_command.py:215, src/ccgram/handlers/agent_command.py:281, src/ccgram/handlers/commands/forward.py:28 and 39 more	intrusive	Introduce a contract: lower the integration strength, so the target can change without breaking this module
handlers → providers	src/ccgram/handlers/recovery/resume_command.py:42	intrusive	Introduce a contract: lower the integration strength, so the target can change without breaking this module
handlers → session_protocol	src/ccgram/handlers/commands/failure_probe.py:30, src/ccgram/handlers/interactive/interactive_callbacks.py:18, src/ccgram/handlers/recovery/recovery_banner.py:44 and 4 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → session_state	src/ccgram/handlers/agent_command.py:32, src/ccgram/handlers/agent_command.py:199, src/ccgram/handlers/agent_command.py:321 and 51 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → session_state_ports	src/ccgram/handlers/hook_events.py:25, src/ccgram/handlers/status/status_bubble.py:22	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → telegram_adapter	src/ccgram/handlers/commands/menu_sync.py:23, src/ccgram/handlers/commands/panel.py:23, src/ccgram/handlers/dashboard_command.py:12 and 41 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → terminal_adapter	src/ccgram/handlers/agent_command.py:35, src/ccgram/handlers/callback_helpers.py:10, src/ccgram/handlers/callback_registry.py:22 and 47 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → transcript	src/ccgram/handlers/last_reply.py:51, src/ccgram/handlers/polling/polling_state.py:163, src/ccgram/handlers/polling/polling_state.py:202 and 1 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → tts	src/ccgram/handlers/messaging_pipeline/message_queue.py:40	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → whisper	src/ccgram/handlers/voice/voice_handler.py:21, src/ccgram/handlers/voice/voice_handler.py:22	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → window_state	src/ccgram/handlers/commands/__init__.py:25, src/ccgram/handlers/commands/failure_probe.py:28, src/ccgram/handlers/commands/forward.py:31 and 41 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
handlers → window_state_ports	src/ccgram/handlers/agent_command.py:36, src/ccgram/handlers/cleanup.py:25, src/ccgram/handlers/hook_events.py:24 and 19 more	functional	Move the functionality: lower the distance, so the coupled code lives in one module
hooks → providers	src/ccgram/hooks/adapters.py:15	functional	Move the functionality: lower the distance, so the coupled code lives in one module
llm → domain_config	src/ccgram/llm/__init__.py:62	functional	Move the functionality: lower the distance, so the coupled code lives in one module
llm → session_protocol	src/ccgram/llm/summarizer.py:14	functional	Move the functionality: lower the distance, so the coupled code lives in one module
miniapp → domain_config	src/ccgram/miniapp/api/terminal.py:32	functional	Move the functionality: lower the distance, so the coupled code lives in one module
miniapp → session_state	src/ccgram/miniapp/api/transcript.py:53	functional	Move the functionality: lower the distance, so the coupled code lives in one module
miniapp → window_state_ports	src/ccgram/miniapp/api/terminal.py:98	functional	Move the functionality: lower the distance, so the coupled code lives in one module
multiplexer → multiplexer_backends	src/ccgram/multiplexer/__init__.py:23	functional	Move the functionality: lower the distance, so the coupled code lives in one module
multiplexer → session_state	src/ccgram/multiplexer/vim_state.py:20	functional	Move the functionality: lower the distance, so the coupled code lives in one module
multiplexer → window_state	src/ccgram/multiplexer/reconciliation.py:11, src/ccgram/multiplexer/window_liveness.py:14	functional	Move the functionality: lower the distance, so the coupled code lives in one module
multiplexer_backends → domain_config	src/ccgram/multiplexer/agterm.py:53, src/ccgram/multiplexer/tmux.py:38	functional	Move the functionality: lower the distance, so the coupled code lives in one module
multiplexer_backends → multiplexer	src/ccgram/multiplexer/herdr.py:72	intrusive	Introduce a contract: lower the integration strength, so the target can change without breaking this module
multiplexer_backends → multiplexer	src/ccgram/multiplexer/tmux.py:51	intrusive	Introduce a contract: lower the integration strength, so the target can change without breaking this module
multiplexer_backends → provider_detection	src/ccgram/multiplexer/agterm.py:195, src/ccgram/multiplexer/agterm_panes.py:55	functional	Move the functionality: lower the distance, so the coupled code lives in one module
multiplexer_backends → providers	src/ccgram/multiplexer/agterm.py:520	functional	Move the functionality: lower the distance, so the coupled code lives in one module

On every row: Imbalanced coupling · critical · existed before this pull request · across modules · high volatility.

• and 45 more

Why: base comparison: 6 of 6 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 1 of 1 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 8 of 8 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 10 of 10 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 1 of 1 current member finding IDs observed in base; balanced coupling: intrusive integration strength × distance across modules × high volatility → critical severity (intrusive (implementation-level) coupling across a module boundary with high effective volatility → change propagation risk)

Why: base comparison: 3 of 3 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 2 of 2 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 4 of 4 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 71 of 71 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 35 of 35 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 7 of 7 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 51 of 51 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 43 of 43 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 49 of 49 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Why: base comparison: 19 of 19 current member finding IDs observed in base; balanced coupling: functional integration strength × distance across modules × high volatility → critical severity (functional coupling across a module boundary with high effective volatility (higher of source and target) → change propagation risk)

Evidence and inputs

Decision

• Engine verdict needs attention: hard gates pass, 0 active blockers, every required rule evaluated
• The gate is advisory for this repository: the engine's verdict does not block merging.
• Attention only (architecture): dimensions not fully measured: intent, coupling, testability, operations, drift; active diagnostics: 95 · code attention_only

Dimensions

Dimension	Status	Measured	Confidence	Result
intent	partial	11/12 ("declared rules evaluated")	medium	pass
structure	measured	1280/1528 ("discovered dependencies resolved inside the declared module map")	high	warn
modularity	measured	5/24 ("declared modules with a declared public surface")	low	pass
coupling	partial	686/705 ("cross-boundary edges scored")	medium	warn
change_locality	measured	24/24 ("declared modules touched in the scanned history window")	high	pass
complexity	measured	24/24 ("declared modules with complete dependency-chain and degree values")	high	pass
testability	partial	547/547 ("classified source files")	medium	pass
operations	partial	0/24 ("declared modules with a corroborated deploy unit and qualifying owner")	medium	pass
drift	unmeasured	0/0	unrated	not applicable

Evidence gaps

• Analyzers that did not run (absent or disabled): go/packages, dependency-cruiser, cargo, ast-grep, cargo-modules
• Dimension intent, unknown fact: active rule conformance — one or more active rules lack the completed producer evidence their checks require: no-import-cycles
• Dimension structure, unknown fact: external dependency structure — 248 dependencies leave the declared module map (248 on libraries, 0 to or from first-party code no module owns), so their direction and layer are outside this claim
• Dimension coupling, unknown fact: coupling strength — integration strength is unknown on one or more cross-boundary candidates, so no rung is invented
• Dimension coupling, unknown fact: coupling distance — architectural distance is unknown on one or more cross-boundary candidates, so no rung is invented
• Dimension change_locality, unknown fact: essential vs accidental volatility — commit frequency corroborates a declared volatility; it cannot establish one
• Dimension complexity, unknown fact: cognitive complexity — no cognitive-complexity analyzer is claimed; module-graph shape is the architecture-level measure
• Dimension testability, unknown fact: supplied coverage units — coverage is disabled, so no supplied coverage units were observed
• Dimension testability, unknown fact: coverage path resolution — coverage is disabled, so no supplied coverage paths were available to resolve
• Dimension testability, unknown fact: coverage module attribution — coverage is disabled, so no supplied coverage was available to attribute to declared modules
• Dimension testability, unknown fact: coverage freshness — coverage is disabled, so no supplied coverage freshness could be established
• Dimension operations, unknown fact: corroborated deploy unit — one or more declared modules have no independently corroborating deploy manifest
• Dimension operations, unknown fact: observed runtime topology — committed manifests corroborate declared deploy units; they do not observe what is actually running
• Dimension operations, unknown fact: supply-chain inventory — SBOM and vulnerability facts are a separate report family and have no collector in v1
• Dimension drift, unknown fact: admissible persisted reference — no comparable architecture-state reference is stored
• Dimension drift, unknown fact: complete two-sided seam identity — two-sided seam identity cannot be compared without an admissible persisted reference
• No baseline: every finding counts as new, including older debt. New does not mean added by this pull request.

Inputs and identity

• Policy digest: 29f0b18ab48a2b0855a6585fd8435f4bdd074e6383ef5730b1028280a1930f25
• Baseline digest: no baseline
• Labels digest: no labels file
• Measurement profile: version archfit.measurement.v2, settings hash 0bb81030aa53141846de3953d5df392c8ab250618e04f4388b06d4dc3016b0cb
• Producer identity, claimed: engine v3.2.2, image sha256:bd351ac70610555237974fac5ff914967a1100fb8ef754853151300d5d19ca35, linux/amd64
• Protected path change: owner approval by alexei-led

Measurement is customer-attested: the producer is authenticated, the report content is not independently checked.

For coding agents

Agent tasks

[]

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The pin-only update appears safe to merge; no concrete blocking issue was found.

Summary

Updates only the three producer pins in .github/workflows/archfit.yaml:

• The Archfit workflow runs the qualified v3.2.2 producer.

Triggers, permissions, runner, endpoint, audience, and mode remain unchanged. No actionable issues were found.

_{Reviews (1) · Last reviewed commit: "ci: adopt the qualified Archfit v3.2.2 p..." · Reviewed by Greptile}