Optional tooling

Narrow optional tools: first-contact terrain, supported-code navigation, and checkpoint assistance; never required for normal runs.

Graphify

Graphify is a candidate only for an unfamiliar, majority-code repo and a terrain-shaped question that one deterministic search cannot answer.
Data-file consumers, constants/literals, embedded languages, prose censuses, definition/consumer lookup, and Git topology route to ordinary tools.

An outside-repo catalogue records canonical scan root, Graphify-manifest population, exact file/config hashes from repo root through that root, matching root-prefixed graph source_file population, ancestor build provenance, graph digest, and a proper covering parent.
--graph-scope selects/checks the smallest scope covering the paths; symlinks and info/global Git excludes cannot conceal new files. .graphifyignore takes precedence over fallback .gitignore; divergent positive double-star patterns and active nested ignore/include rules fail closed to live files as unsupported-config. --graph-parent broadens one declared step for miss, ambiguity, or cross-scope need; relation-omission first revalidates the child, then exits to deterministic live-file census without broadening/model dispatch. Drift or corrupt data fire stale-sidecar. Legacy graphs may compare built_at_commit with git rev-parse HEAD.

The qualified scoped route is structural llm: false. Graphify 0.8.37 has no --code-only flag, and its incremental --no-cluster route was rejected after dropping unchanged terrain. A relation absent from the graph routes to deterministic live-file census, not repeated broadening or model inference.

The scoped feature does not qualify semantic/Luna behaviour. Any later model pass requires positive/control cells, an owner-named backend/model, exact corpus, privacy, usage, and out-of-band spend disclosure. Filtering is a filename heuristic, spend may be unmeasurable, auto-detection is refused, and Ollama is explicitly unauthorized.

TokenSave

TokenSave is explicit, on-demand optional code navigation for supported symbol and dependency relations when a repeated or transitive source walk earns its cost; it is not automatically detected or routed. Only an operator/checker-controlled adapter outside candidate authority can establish currentness; claim fields alone never do. The checker runs its fixed supported sync/reconnect route against the live checkout and compares the strict result with the claimed checkout/database expectation. An absent, failed, timed-out, malformed or mismatched execution is TOKENSAVE_FRESHNESS_UNVERIFIED, never derived-current, and routes to ordinary Gemba. A successfully established current index provides bounded derived or partial evidence; consequential results still require live-source confirmation.

Documentation, policy, public projection, non-code artefacts, an exact supplied file and tiny reversible work are NO TOKENSAVE paths. Installation and indexing require separate authorisation. The repo-local database is a representation-specific storage exception that can retain complete function bodies and rendered-source cache; it requires retention/cleanup disclosure, remains untracked, and never enters the package. Editing, test-running, session/memory tools, broad auto-approval and discovery-interception hooks are outside supported use.

ActiveGraph

ActiveGraph may provide authorised fork / diff resume-from-checkpoint assistance.
An event store is an optional non-authoritative mirror; the run root remains the sole lifecycle authority, and replay does not reconstruct the tested custom-event custody use case.

ActiveGraph precision

ActiveGraph is optional checkpoint assistance or a non-authoritative mirror, not lifecycle authority or correctness proof.

• Do not turn one small run into a broad capability or resume-style claim.
• Custom event names such as repo.patch.applied describe this repo's evidence model; they are not upstream proof by themselves.
• activegraph.toml is a configuration clue, not authorisation to write events.
• Live custody and historical backfill must be labeled differently.

Authorisation gates

Tool install, indexing, event-store setup, and export are separate owner-authorised actions.

• Do not install Graphify without authorisation.
• Do not install or index with TokenSave without authorisation.
• Do not index a repo without authorisation.
• Do not configure ActiveGraph without authorisation.
• Do not export sidecar data without authorisation.

Self-maintenance sidecars

The scoped qualification is dogfood-only: one Windows host, Python 3.11, graphifyy 0.8.37, and the 2026-08-09 candidate measurements.
A 14-file release/package scope answered a question the whole-code graph missed; neither represented a variable-mediated checker invocation. No semantic/Luna route was configured or called. Consuming repos remain optional and broader claims still require an unfamiliar-third-party-repo trial.
Live files, AGENTS.md, run-folder state, Smoke A/B, and final audit closure outrank sidecars.

Sidecar conventions

Historical backfill

When older evidence is loaded into a sidecar, label it as historical backfill rather than pretending it was captured live during the current run.
This keeps custody evidence honest.

A historical backfill record should name:

• custody_mode: historical_backfill
• source
• backfilled_at
• original_event_time
• evidence_boundary.

Capability Ledger (narrow evidence record)

A Capability Ledger is a narrow record of what this run evidenced.

• It can be backed by Markdown or authorised ActiveGraph events.
• When ActiveGraph is configured and authorised, entries can be event-backed.
• The Markdown ledger remains first-class when ActiveGraph is absent, stale, or out of scope.
• No ledger entry should turn a small fix into a general competence claim or infer success from chat memory.

When ActiveGraph is configured and authorised, a narrow Capability Ledger entry may include:

• repo
• run id
• owner/source
• quality route
• quality-route and reflection notes
• whether Graphify terrain was used
• ActiveGraph event ids
• checks run
• final status
• remaining risk.

Fallback

Missing optional tooling does not block a run.
Markdown work records, ledgers, final reports, and run folders when phased remain the durable fallback.

Source surfaces

README.md optional tooling, skills/implementaudit/references/sidecars.md, skills/implementaudit/templates/PROTOCOL.md, skills/implementaudit/templates/sidecars.md, and skills/implementaudit/references/lean-operating-discipline.md.

Absent-safe rule

If Graphify, TokenSave or ActiveGraph is missing, stale, unsupported or unauthorised, continue with live file inspection and Markdown ledgers.
Missing optional tooling is not a blocker for ordinary consuming repos, and dogfood sidecars still do not prove correctness by themselves.

When optional tools help

Qualified terrain may orient first contact.
An authorised mirror may copy already-recorded run-root events.
Neither replaces deterministic owner/source checks, before/after evidence, final audit, or source evidence.