feat(llm): openai-cli backend — semantic extraction through the locally authenticated Codex CLI

[Azeem1985]

What

A sibling of the existing claude-cli backend for operators whose OpenAI access is a ChatGPT subscription (Codex CLI OAuth), not an API key: graphify extract . --backend openai-cli.

Mechanics (field-proven implementation, measured ~308 docs/hour at concurrency 6 on an 8 GB box): codex exec --skip-git-repo-check --json --sandbox read-only, prompt via stdin (a real chunk exceeds Linux MAX_ARG_STRLEN as an argv entry), result via -o file, empty-graph refusal so a hollow reply cannot trigger a bisect storm. Two per-call config pins via codex's own -c mechanism: mcp_servers={} (each exec otherwise spawns the user's configured MCP servers per call — measured 160–300 MB each, more than the extraction itself) and model_reasoning_effort (GRAPHIFY_OPENAI_CLI_EFFORT). Model via GRAPHIFY_OPENAI_CLI_MODEL. The extract credential gate treats a present codex binary as the credential, mirroring claude-cli.

Tests

tests/test_openai_cli_backend.py (argv contract, env overrides, missing-binary error); full suite 4,812 passed.

Live verification

One-document extraction on a real box: 9 nodes / 10 edges landed, 98,519 in / 4,733 out tokens, $0 (subscription).

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 5 advisory finding(s) below merit a look before merge.

Formal verification. 2 change(s) alter behavior, breaking input(s) attached.

Behavior changes: \_\_getattr\_\_ changes behavior, here is the input that shows it.

The verifier found a concrete input on which \_\_getattr\_\_ behaves differently before and after the change. If that change is intended, ship it; if not, this is your bug.

Guarantee: This difference was REPRODUCED, the verifier actually ran both versions on that input and saw them disagree. It is real, not an artifact.

Evidence: On input \{"name":"'save\_query\_result'"\}, the old code produced raises AttributeError but the new code produces \<function save\_query\_result at 0x7f958d8fe340\>. Paste that input straight into a regression test.

Behavior changes: run\_benchmark changes behavior, here is the input that shows it.

The verifier found a concrete input on which run\_benchmark behaves differently before and after the change. If that change is intended, ship it; if not, this is your bug.

Guarantee: This difference was REPRODUCED, the verifier actually ran both versions on that input and saw them disagree. It is real, not an artifact.

Evidence: On input \{"graph\_path":"None","corpus\_words":"None","questions":"None"\}, the old code produced raises TypeError but the new code produces \{'corpus\_tokens': 991400, 'corpus\_words': 743550, 'nodes': 14871, 'edges': 27533, 'avg\_query\_tokens': 6343, 'reduction\_ratio': 156\.3, 'per\_question': \[\{'question': 'how does authentication…. Paste that input straight into a regression test.

---

Graphify review — findings

Adds full CI/CD and repo-hygiene infrastructure: GitHub Actions workflows for testing (ci.yml), PyPI trusted publishing (publish.yml), and self-graph release assets (release-graph.yml), plus a skillgen-check pre-commit hook enforcing that generated skill artifacts stay in sync with tools/skillgen/ fragments. Adds .dockerignore, .gitattributes (Linguist HTML vendoring), FUNDING.yml, AGENTS.md, and expands .gitignore to cover generated outputs while whitelisting the committed graphify/skills/ bundles and skillgen core fragments.

Worth a look

• Dedup leaves hyperedges pointing at removed node ids — graphify/build.py · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Python matrix is not applied to test interpreter — .github/workflows/ci.yml:65 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Unpinned publishing action runs with OIDC token minting permission — .github/workflows/publish.yml:55 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• README documents invalid cluster-only subcommand — README.md · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• README contradicts query logging default — README.md · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 14548 functions depend on the 14548 functions this change touches.

Health — this change adds coupling hotspots:

• new: extract() — 474 callers, 42 callees
• new: _rebuild_code() — 98 callers, 50 callees
• new: build_from_json() — 185 callers, 18 callees
• new: detect() — 108 callers, 15 callees
• new: deduplicate_entities() — 63 callers, 21 callees
• new: build_merge() — 46 callers, 14 callees
• new: save_semantic_cache() — 55 callers, 11 callees
• new: _extract_generic() — 18 callers, 24 callees
• …and 216 more — each is listed as a finding

Verification — 14548 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit b2cd362 (diverged from this PR's base — delta is approximate).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 14548 function(s) in the blast radius were not formally verified this run

Formal verification

Behavior changes: \_\_getattr\_\_ changes behavior, here is the input that shows it.

The verifier found a concrete input on which \_\_getattr\_\_ behaves differently before and after the change. If that change is intended, ship it; if not, this is your bug.

Guarantee: This difference was REPRODUCED, the verifier actually ran both versions on that input and saw them disagree. It is real, not an artifact.

Evidence: On input \{"name":"'save\_query\_result'"\}, the old code produced raises AttributeError but the new code produces \<function save\_query\_result at 0x7f958d8fe340\>. Paste that input straight into a regression test.

Behavior changes: run\_benchmark changes behavior, here is the input that shows it.

The verifier found a concrete input on which run\_benchmark behaves differently before and after the change. If that change is intended, ship it; if not, this is your bug.

Guarantee: This difference was REPRODUCED, the verifier actually ran both versions on that input and saw them disagree. It is real, not an artifact.

Evidence: On input \{"graph\_path":"None","corpus\_words":"None","questions":"None"\}, the old code produced raises TypeError but the new code produces \{'corpus\_tokens': 991400, 'corpus\_words': 743550, 'nodes': 14871, 'edges': 27533, 'avg\_query\_tokens': 6343, 'reduction\_ratio': 156\.3, 'per\_question': \[\{'question': 'how does authentication…. Paste that input straight into a regression test.

No difference found (not proven): No behavior difference found in main (not a proof).

The verifier ran both versions of main on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

No difference found (not proven): No behavior difference found in \_cross\_community\_surprises (not a proof).

The verifier ran both versions of \_cross\_community\_surprises on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

No difference found (not proven): No behavior difference found in \_cross\_file\_surprises (not a proof).

The verifier ran both versions of \_cross\_file\_surprises on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

No difference found (not proven): No behavior difference found in \_file\_category (not a proof).

The verifier ran both versions of \_file\_category on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

Could not verify: Could not verify \_is\_file\_node.

The verifier did not have enough to check \_is\_file\_node, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: non-vacuity: domain too small (only 1 distinct inputs exercised, need 3) — 'no divergence' would be near-vacuous

Could not verify: Could not verify \_surprise\_score.

The verifier did not have enough to check \_surprise\_score, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 200 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly TypeError — names the real obstacle, not a sampling gap)

No difference found (not proven): No behavior difference found in god\_nodes (not a proof).

The verifier ran both versions of god\_nodes on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

Could not verify: Could not verify graph\_diff.

The verifier did not have enough to check graph\_diff, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: the input domain has 25 values but only 5 distinct were tested — a small finite domain must be EXHAUSTED, not sampled (an untested input could invert the result)

Could not verify: Could not verify suggest\_questions.

The verifier did not have enough to check suggest\_questions, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 200 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly ValueError — names the real obstacle, not a sampling gap)

No difference found (not proven): No behavior difference found in \_query\_subgraph\_tokens (not a proof).

The verifier ran both versions of \_query\_subgraph\_tokens on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

Could not verify: Could not verify print\_benchmark.

The verifier did not have enough to check print\_benchmark, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 6 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly KeyError — names the real obstacle, not a sampling gap)

Could not verify: Could not verify build.

The verifier did not have enough to check build, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 9 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly AttributeError — names the real obstacle, not a sampling gap)

Could not verify: Could not verify build\_from\_json.

The verifier did not have enough to check build\_from\_json, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 6 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly NameError — names the real obstacle, not a sampling gap)

Could not verify: Could not verify cache\_dir.

The verifier did not have enough to check cache\_dir, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `root` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify cached\_files.

The verifier did not have enough to check cached\_files, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `root` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify check\_semantic\_cache.

The verifier did not have enough to check check\_semantic\_cache, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `root` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify clear\_cache.

The verifier did not have enough to check clear\_cache, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `root` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify file\_hash.

The verifier did not have enough to check file\_hash, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `path` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify load\_cached.

The verifier did not have enough to check load\_cached, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `path` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify save\_cached.

The verifier did not have enough to check save\_cached, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `path` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify save\_semantic\_cache.

The verifier did not have enough to check save\_semantic\_cache, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `root` is annotated `Path` — outside the synthesizable primitive/collection set

No difference found (not proven): No behavior difference found in \_split\_community (not a proof).

The verifier ran both versions of \_split\_community on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

Could not verify: Could not verify cluster.

The verifier did not have enough to check cluster, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: non-vacuity: domain too small (only 2 distinct inputs exercised, need 3) — 'no divergence' would be near-vacuous

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 5 advisory finding(s) below merit a look before merge.

Formal verification. 2 change(s) alter behavior, breaking input(s) attached.

Behavior changes: \_\_getattr\_\_ changes behavior, here is the input that shows it.

The verifier found a concrete input on which \_\_getattr\_\_ behaves differently before and after the change. If that change is intended, ship it; if not, this is your bug.

Guarantee: This difference was REPRODUCED, the verifier actually ran both versions on that input and saw them disagree. It is real, not an artifact.

Evidence: On input \{"name":"'save\_query\_result'"\}, the old code produced raises AttributeError but the new code produces \<function save\_query\_result at 0x7fccec4ee340\>. Paste that input straight into a regression test.

Behavior changes: run\_benchmark changes behavior, here is the input that shows it.

The verifier found a concrete input on which run\_benchmark behaves differently before and after the change. If that change is intended, ship it; if not, this is your bug.

Guarantee: This difference was REPRODUCED, the verifier actually ran both versions on that input and saw them disagree. It is real, not an artifact.

Evidence: On input \{"graph\_path":"None","corpus\_words":"None","questions":"None"\}, the old code produced raises TypeError but the new code produces \{'corpus\_tokens': 991800, 'corpus\_words': 743850, 'nodes': 14877, 'edges': 27545, 'avg\_query\_tokens': 6343, 'reduction\_ratio': 156\.4, 'per\_question': \[\{'question': 'how does authentication…. Paste that input straight into a regression test.

---

Graphify review — findings

Adds CI/CD and repo hygiene scaffolding: GitHub Actions workflows for tests, skillgen drift checks, PyPI trusted publishing, and a self-graph release asset. Introduces .dockerignore, .gitattributes (Linguist HTML vendoring), .pre-commit-config.yaml with the skillgen guard and ruff, AGENTS.md, and expands .gitignore for graphify outputs and local benchmark scripts.

Worth a look

• Manual dispatch can publish arbitrary ref to PyPI — .github/workflows/publish.yml:54 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Default container starts unauthenticated HTTP service on all interfaces — Dockerfile:25 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• PR CI runs untrusted code without read-only token permissions — .github/workflows/ci.yml:4 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Manual publish can run without release tag/version guard — .github/workflows/publish.yml:13 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Publish job drops contents permission needed by checkout — .github/workflows/publish.yml:30 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 14554 functions depend on the 14554 functions this change touches.

Health — this change adds coupling hotspots:

• new: extract() — 474 callers, 42 callees
• new: _rebuild_code() — 98 callers, 50 callees
• new: build_from_json() — 185 callers, 18 callees
• new: detect() — 108 callers, 15 callees
• new: deduplicate_entities() — 63 callers, 21 callees
• new: build_merge() — 46 callers, 14 callees
• new: save_semantic_cache() — 55 callers, 11 callees
• new: _extract_generic() — 18 callers, 24 callees
• …and 216 more — each is listed as a finding

Verification — 14554 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit b2cd362 (diverged from this PR's base — delta is approximate).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 14554 function(s) in the blast radius were not formally verified this run

Formal verification

Behavior changes: \_\_getattr\_\_ changes behavior, here is the input that shows it.

The verifier found a concrete input on which \_\_getattr\_\_ behaves differently before and after the change. If that change is intended, ship it; if not, this is your bug.

Guarantee: This difference was REPRODUCED, the verifier actually ran both versions on that input and saw them disagree. It is real, not an artifact.

Evidence: On input \{"name":"'save\_query\_result'"\}, the old code produced raises AttributeError but the new code produces \<function save\_query\_result at 0x7fccec4ee340\>. Paste that input straight into a regression test.

Behavior changes: run\_benchmark changes behavior, here is the input that shows it.

The verifier found a concrete input on which run\_benchmark behaves differently before and after the change. If that change is intended, ship it; if not, this is your bug.

Guarantee: This difference was REPRODUCED, the verifier actually ran both versions on that input and saw them disagree. It is real, not an artifact.

Evidence: On input \{"graph\_path":"None","corpus\_words":"None","questions":"None"\}, the old code produced raises TypeError but the new code produces \{'corpus\_tokens': 991800, 'corpus\_words': 743850, 'nodes': 14877, 'edges': 27545, 'avg\_query\_tokens': 6343, 'reduction\_ratio': 156\.4, 'per\_question': \[\{'question': 'how does authentication…. Paste that input straight into a regression test.

No difference found (not proven): No behavior difference found in main (not a proof).

The verifier ran both versions of main on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

No difference found (not proven): No behavior difference found in \_cross\_community\_surprises (not a proof).

The verifier ran both versions of \_cross\_community\_surprises on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

No difference found (not proven): No behavior difference found in \_cross\_file\_surprises (not a proof).

The verifier ran both versions of \_cross\_file\_surprises on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

No difference found (not proven): No behavior difference found in \_file\_category (not a proof).

The verifier ran both versions of \_file\_category on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

Could not verify: Could not verify \_is\_file\_node.

The verifier did not have enough to check \_is\_file\_node, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: non-vacuity: domain too small (only 1 distinct inputs exercised, need 3) — 'no divergence' would be near-vacuous

Could not verify: Could not verify \_surprise\_score.

The verifier did not have enough to check \_surprise\_score, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 200 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly TypeError — names the real obstacle, not a sampling gap)

No difference found (not proven): No behavior difference found in god\_nodes (not a proof).

The verifier ran both versions of god\_nodes on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

Could not verify: Could not verify graph\_diff.

The verifier did not have enough to check graph\_diff, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: the input domain has 25 values but only 5 distinct were tested — a small finite domain must be EXHAUSTED, not sampled (an untested input could invert the result)

Could not verify: Could not verify suggest\_questions.

The verifier did not have enough to check suggest\_questions, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 200 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly ValueError — names the real obstacle, not a sampling gap)

No difference found (not proven): No behavior difference found in \_query\_subgraph\_tokens (not a proof).

The verifier ran both versions of \_query\_subgraph\_tokens on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

Could not verify: Could not verify print\_benchmark.

The verifier did not have enough to check print\_benchmark, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 6 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly KeyError — names the real obstacle, not a sampling gap)

Could not verify: Could not verify build.

The verifier did not have enough to check build, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 9 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly AttributeError — names the real obstacle, not a sampling gap)

Could not verify: Could not verify build\_from\_json.

The verifier did not have enough to check build\_from\_json, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 6 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly NameError — names the real obstacle, not a sampling gap)

Could not verify: Could not verify cache\_dir.

The verifier did not have enough to check cache\_dir, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `root` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify cached\_files.

The verifier did not have enough to check cached\_files, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `root` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify check\_semantic\_cache.

The verifier did not have enough to check check\_semantic\_cache, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `root` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify clear\_cache.

The verifier did not have enough to check clear\_cache, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `root` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify file\_hash.

The verifier did not have enough to check file\_hash, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `path` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify load\_cached.

The verifier did not have enough to check load\_cached, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `path` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify save\_cached.

The verifier did not have enough to check save\_cached, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `path` is annotated `Path` — outside the synthesizable primitive/collection set

Could not verify: Could not verify save\_semantic\_cache.

The verifier did not have enough to check save\_semantic\_cache, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `root` is annotated `Path` — outside the synthesizable primitive/collection set

No difference found (not proven): No behavior difference found in \_split\_community (not a proof).

The verifier ran both versions of \_split\_community on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

Could not verify: Could not verify cluster.

The verifier did not have enough to check cluster, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: non-vacuity: domain too small (only 2 distinct inputs exercised, need 3) — 'no divergence' would be near-vacuous

[Azeem1985]

Re-targeted from main to v8 (the development branch — my mistake on opening). The earlier automated reviews ran against main, so they diffed the whole v8↔main divergence (100 files / ~280k lines); the __getattr__ and run_benchmark behavior deltas and the CI/Dockerfile findings come from that divergence, not from this change. Actual change: 4 files, +398/-5 — graphify/llm.py (the openai-cli backend + per-server MCP disable), graphify/cli.py (extract credential gate treats a present codex binary as the credential, mirroring claude-cli), graphify/__main__.py (help text), tests/test_openai_cli_backend.py (5 tests). Full suite on the branch: 4,812 passed, 50 skipped. Live: a one-document extraction produced 9 nodes / 10 edges, 98,519 in / 4,733 out tokens.

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 5 advisory finding(s) below merit a look before merge.

---

Graphify review — findings

Adds an openai-cli backend that runs semantic extraction and community labeling through the locally authenticated Codex CLI (stdin-fed prompts, read-only sandbox, per-server MCP disabling, turn.completed usage parsing, forced-serial by default), and gates it on a present codex binary like claude-cli. Adds graphify extract --fallback-backend/GRAPHIFY_FALLBACK_BACKEND for a one-shot retry of failed chunks on a second backend, and makes extract hold the per-repo rebuild lock across its whole pipeline. Extends graphify watch --semantic to auto-run extraction as a locked subprocess on doc/image changes, and batches export neo4j|falkordb --push into UNWIND queries with a --batch-size flag (default 100).

Worth a look

• --no-cluster path now builds and writes clustered graph — graphify/cli.py · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• --global-merge no longer merges into global graph — graphify/cli.py · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• AST extraction and downstream logic moved under if needs_llm: block — graphify/cli.py · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Default extract no longer writes analysis/manifest or final output — graphify/cli.py · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Extract finalization is guarded by global_merge — graphify/cli.py · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 1356 functions depend on the 617 functions this change touches.

Health — this change adds coupling hotspots:

• new: _rebuild_code() — 98 callers, 50 callees
• new: deduplicate_entities() — 63 callers, 21 callees
• new: build_merge() — 46 callers, 14 callees
• new: extract_files_direct() — 17 callers, 21 callees
• new: extract_corpus_parallel() — 26 callers, 11 callees
• new: _call_claude_cli() — 31 callers, 9 callees
• new: dispatch_command() — 2 callers, 121 callees
• new: _call_llm() — 11 callers, 21 callees
• …and 24 more — each is listed as a finding

Verification — 1356 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 1292 function(s) in the blast radius were not formally verified this run

· 4 grounded finding(s) anchored inline below; 28 more finding(s) on lines outside this diff (see the check run).

[graphify-labs]

⚠️ Health regression — push_to_neo4j()

6 callers depend on it (afferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[graphify-labs]

⚠️ Health regression — _call_claude_cli()

fans out to 9 callees (efferent coupling); 31 callers depend on it (afferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[graphify-labs]

⚠️ Health regression — _call_openai_cli()

fans out to 9 callees (efferent coupling); 11 callers depend on it (afferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[graphify-labs]

⚠️ Health regression — watch()

fans out to 8 callees (efferent coupling); 6 callers depend on it (afferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[Azeem1985]

Closing this in favour of #3073, which is the same change on a branch cut from v8 — 5 files instead of the 11 this one shows.

This PR was opened from a branch that also carried unrelated work from our fork, so its diff was 11 files of the backend plus the whole of our fork's in-flight work. That is my mistake in how I cut the branch, and it made this unreviewable. Nothing about the proposed change has altered; only the packaging.

#3073 has the full rationale and measurements. Sorry for the extra noise, and thank you for your patience.