On-disk persistance layer

.github/workflows/ci.yml

@@ -6,6 +6,13 @@ on:
   pull_request:
     branches: [main]
 
+# liblbug static-links on linux; its #cgo LDFLAGS use -Wl,--whole-archive to
+# force liblbug's weak C++ RTTI into the binary for the dlopen'd FTS extension
+# (see internal/thirdparty/go-ladybug/cgo_shared.go). --whole-archive isn't on
+# cgo's built-in #cgo LDFLAGS allowlist, so permit it for every job's build/test.
+env:
+  CGO_LDFLAGS_ALLOW: '-Wl,--(no-)?whole-archive'
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
@@ -20,6 +27,9 @@ jobs:
         with:
           go-version: ${{ matrix.go-version }}
 
+      - name: Fetch liblbug
+        run: bash scripts/fetch-lbug.sh
+
       - name: Build
         run: go build -o gortex ./cmd/gortex/
 
@@ -47,6 +57,10 @@ jobs:
         with:
           go-version: '1.26'
 
+      - name: Fetch liblbug (windows dynamic — lbug_shared.dll)
+        shell: bash
+        run: bash scripts/fetch-lbug.sh
+
       - name: Build CLI
         run: go build -o gortex.exe ./cmd/gortex/
 
@@ -77,6 +91,9 @@ jobs:
         with:
           go-version: '1.26'
 
+      - name: Fetch liblbug
+        run: bash scripts/fetch-lbug.sh
+
       - name: Install ONNX Runtime
         run: |
           wget -q https://github.com/microsoft/onnxruntime/releases/download/v1.24.4/onnxruntime-linux-x64-1.24.4.tgz

.github/workflows/init-smoke.yml

@@ -18,6 +18,12 @@ on:
       - "cmd/gortex/init*.go"
       - "internal/agents/**"
 
+# liblbug static-links on linux with -Wl,--whole-archive (forces its weak C++
+# RTTI into the binary for the dlopen'd FTS extension; see cgo_shared.go).
+# Not on cgo's #cgo LDFLAGS allowlist, so permit it for the build step below.
+env:
+  CGO_LDFLAGS_ALLOW: '-Wl,--(no-)?whole-archive'
+
 jobs:
   dry-run:
     runs-on: ubuntu-latest
@@ -29,6 +35,9 @@ jobs:
           go-version-file: go.mod
           cache: true
 
+      - name: Fetch liblbug
+        run: bash scripts/fetch-lbug.sh
+
       - name: Build gortex
         run: go build -o /tmp/gortex ./cmd/gortex
 

.github/workflows/release.yml

@@ -79,6 +79,18 @@ jobs:
 
           chmod 600 "$SIGNING_DIR"/cert.* "$SIGNING_DIR"/notary.*
 
+      # Fetch the static liblbug for every unix target into
+      # lib/static/<os>-<arch>/ on the host. $PWD is bind-mounted into the
+      # goreleaser-cross container, so the cross-compiles below link them
+      # in (self-contained binaries, nothing to ship alongside). Pinned by
+      # LBUG_VERSION inside the script.
+      - name: Fetch liblbug (linux + darwin, static)
+        run: |
+          bash scripts/fetch-lbug.sh linux amd64
+          bash scripts/fetch-lbug.sh linux arm64
+          bash scripts/fetch-lbug.sh darwin amd64
+          bash scripts/fetch-lbug.sh darwin arm64
+
       - name: Run GoReleaser (cross-compile via Docker)
         # goreleaser-cross ships osxcross + aarch64/x86_64 gcc toolchains
         # so all 4 targets (linux/amd64, linux/arm64, darwin/amd64,
@@ -208,6 +220,119 @@ jobs:
             rm -rf /tmp/macos-signing
           fi
 
+  # Windows is built on a NATIVE windows runner because lbug's windows lib
+  # is MSVC-built and must be linked dynamically — the mingw .exe loads
+  # lbug_shared.dll via `-l:lbug_shared.dll` (no import lib / gendef
+  # needed), so it can't be produced by the goreleaser-cross job above.
+  # This job builds, bundles the .exe with lbug_shared.dll + the mingw and
+  # VC++ runtime DLLs it needs, zips, cosign-signs, and appends the zip to
+  # the release the `release` job already created.
+  release-windows:
+    needs: release
+    runs-on: windows-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version: '1.26'
+
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: v2.4.1
+
+      # Fetches lbug_shared.dll (the MSVC-built DLL) into
+      # lib/dynamic/windows/. The mingw-w64 toolchain the runner ships on
+      # PATH links the .exe directly against it.
+      - name: Fetch liblbug (windows, dynamic)
+        shell: bash
+        run: bash scripts/fetch-lbug.sh windows amd64
+
+      - name: Build gortex.exe
+        shell: bash
+        env:
+          CGO_ENABLED: "1"
+        run: |
+          set -euo pipefail
+          VER="${GITHUB_REF#refs/tags/}"
+          go build -ldflags "-s -w -X main.version=${VER} -X main.commit=$(git rev-parse --short HEAD) -X main.date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" -o gortex.exe ./cmd/gortex/
+
+      - name: Stage exe + runtime DLLs
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p stage
+          cp gortex.exe stage/
+          cp internal/thirdparty/go-ladybug/lib/dynamic/windows/lbug_shared.dll stage/
+
+          # A missing runtime DLL must FAIL the release, never ship a
+          # zip whose .exe can't start. `gcc -print-file-name` echoes the
+          # bare name (exit 0) when it can't find the file, and the mingw
+          # runtime DLLs live in the toolchain's bin/ dir (not the lib/
+          # dir -print-file-name searches), so resolve via bin/ and assert
+          # an absolute, existing path.
+          find_dll() {
+            local name="$1" hit
+            for base in \
+              "$(dirname "$(command -v gcc 2>/dev/null || true)")" \
+              "$(dirname "$(command -v x86_64-w64-mingw32-gcc 2>/dev/null || true)")" \
+              /c/mingw64/bin /c/msys64/mingw64/bin /c/ProgramData/mingw64/mingw64/bin; do
+              [ -n "$base" ] && [ -f "$base/$name" ] && { echo "$base/$name"; return 0; }
+            done
+            hit="$(find /c/mingw64 /c/msys64 -name "$name" 2>/dev/null | head -1 || true)"
+            [ -n "$hit" ] && { echo "$hit"; return 0; }
+            return 1
+          }
+          # mingw C/C++ runtime the .exe links dynamically.
+          for lib in libstdc++-6.dll libgcc_s_seh-1.dll libwinpthread-1.dll; do
+            p="$(find_dll "$lib")" || { echo "FATAL: mingw runtime $lib not found"; exit 1; }
+            cp "$p" stage/; echo "bundled $lib  <- $p"
+          done
+          # VC++ runtime the MSVC-built lbug_shared.dll imports
+          # (MSVCP140/VCRUNTIME140*). Present on windows-latest (VS).
+          for d in VCRUNTIME140.dll VCRUNTIME140_1.dll MSVCP140.dll; do
+            if [ -f "/c/Windows/System32/$d" ]; then cp "/c/Windows/System32/$d" stage/; echo "bundled $d";
+            else echo "FATAL: VC++ runtime $d not found on runner"; exit 1; fi
+          done
+          ls -la stage/
+
+      - name: Zip (gortex_windows_amd64.zip)
+        shell: pwsh
+        run: Compress-Archive -Path stage/* -DestinationPath gortex_windows_amd64.zip -Force
+
+      - name: Sign + upload to release
+        shell: bash
+        env:
+          COSIGN_YES: "true"
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          cosign sign-blob \
+            --output-signature gortex_windows_amd64.zip.sig \
+            --output-certificate gortex_windows_amd64.zip.pem \
+            gortex_windows_amd64.zip
+          TAG="${GITHUB_REF#refs/tags/}"
+          gh release upload "$TAG" \
+            gortex_windows_amd64.zip \
+            gortex_windows_amd64.zip.sig \
+            gortex_windows_amd64.zip.pem \
+            --clobber
+
+          # Append the windows zip's sha256 to the release checksums.txt so
+          # the one-line installer (scripts/install.ps1, which verifies
+          # against checksums.txt) covers windows too — the unix goreleaser
+          # run only hashed its own artifacts. needs:release guarantees
+          # checksums.txt already exists.
+          sha="$(sha256sum gortex_windows_amd64.zip | awk '{print $1}')"
+          gh release download "$TAG" --pattern checksums.txt --clobber 2>/dev/null || : > checksums.txt
+          if ! grep -q "gortex_windows_amd64.zip" checksums.txt; then
+            printf '%s  gortex_windows_amd64.zip\n' "$sha" >> checksums.txt
+            gh release upload "$TAG" checksums.txt --clobber
+          fi
+
   # SLSA-3 provenance via the OpenSSF reusable workflow. This runs in a
   # separate, isolated job that the `release` job can't tamper with —
   # that isolation is what elevates us from SLSA-2 to SLSA-3. Output is

.github/workflows/security.yml

@@ -12,6 +12,14 @@ permissions:
   contents: read
   security-events: write
 
+# liblbug static-links on linux with -Wl,--whole-archive (forces its weak C++
+# RTTI into the binary so the dlopen'd FTS extension resolves — see
+# internal/thirdparty/go-ladybug/cgo_shared.go). --whole-archive isn't on cgo's
+# #cgo LDFLAGS allowlist, so govulncheck — which loads the cgo packages through
+# the Go toolchain — must allow it, the same way ci.yml does.
+env:
+  CGO_LDFLAGS_ALLOW: '-Wl,--(no-)?whole-archive'
+
 jobs:
   govulncheck:
     runs-on: ubuntu-latest

.gitignore

@@ -51,3 +51,20 @@ eval/scripts/
 eval/logs/
 
 internal_docs/
+
+# liblbug native libraries are fetched at build time by
+# scripts/fetch-lbug.sh (run by make / CI / release), never committed.
+internal/thirdparty/go-ladybug/lib/
+
+# Ad-hoc bench/probe tooling — kept locally, not part of the repo.
+bench/all-tools-bench/
+bench/daemon-bench/
+bench/edge-diff/
+bench/ladybug-bundle-probe/
+bench/multi-repo-bench/
+bench/node-diff/
+bench/store-bench/
+bench/unresolved-audit/
+bench/run-linux.sh
+bench/run-linux-rest.sh
+cmd/lbug-probe/

.goreleaser.yml

@@ -1,8 +1,17 @@
 version: 2
 
 # Run inside ghcr.io/goreleaser/goreleaser-cross — the Docker image ships
-# cross-compile toolchains for all four targets below so CGO (tree-sitter)
-# links cleanly on a single Linux runner. See .github/workflows/release.yml.
+# cross-compile toolchains so CGO (tree-sitter + the statically-linked
+# liblbug) links cleanly on a single Linux runner. This config builds the
+# UNIX targets only (linux + darwin, both with liblbug static-linked into
+# a self-contained binary). Windows is built separately on a native
+# windows runner (see the `release-windows` job in release.yml) because
+# lbug's windows lib is MSVC-built and must be linked dynamically + shipped
+# as a DLL — it can't be static-linked from mingw.
+#
+# liblbug static archives are fetched into lib/static/<os>-<arch>/ by the
+# "Fetch liblbug" step in release.yml before this runs (the repo is
+# bind-mounted into the container).
 before:
   hooks:
     - go mod tidy
@@ -19,30 +28,19 @@ builds:
       # Version (see internal/version). Commit lands in the +build slot so
       # `gortex version` output round-trips as canonical semver.
       - -s -w -X main.version={{.Version}} -X main.commit={{.ShortCommit}} -X main.date={{.Date}}
-      # Statically link the mingw-w64 C/C++ runtime (libstdc++, libgcc,
-      # winpthread) into the Windows binary. CGO is on for tree-sitter and
-      # some grammar scanners ship C++; without -static the released
-      # gortex.exe dynamically links libstdc++-6.dll et al., which are not
-      # present on a stock Windows box — the binary fails to start with a
-      # missing-DLL error. No-op on linux/darwin, which keep their normal
-      # dynamic libc/libc++.
-      - '{{ if eq .Os "windows" }}-extldflags "-static"{{ end }}'
     env:
       - CGO_ENABLED=1
+      # liblbug static-links on linux with -Wl,--whole-archive (forces its
+      # weak C++ RTTI into the binary for the dlopen'd FTS extension; see
+      # internal/thirdparty/go-ladybug/cgo_shared.go). --whole-archive isn't
+      # on cgo's #cgo LDFLAGS allowlist, so permit it. No-op for darwin.
+      - 'CGO_LDFLAGS_ALLOW=-Wl,--(no-)?whole-archive'
     goos:
       - linux
       - darwin
-      - windows
     goarch:
       - amd64
       - arm64
-    ignore:
-      # windows/arm64 needs an aarch64-w64-mingw32 cross-toolchain that
-      # the goreleaser-cross image doesn't ship; windows/amd64 covers
-      # every mainstream Windows dev box. Revisit when the image gains
-      # the llvm-mingw arm64 target.
-      - goos: windows
-        goarch: arm64
     # Per-target CC + CXX. goreleaser-cross exposes these cross-toolchains
     # on PATH; CGO needs both set per target triple because some deps
     # (tree-sitter yaml scanner, etc.) ship C++. Without CXX, the system
@@ -69,11 +67,6 @@ builds:
         env:
           - CC=aarch64-linux-gnu-gcc
           - CXX=aarch64-linux-gnu-g++
-      - goos: windows
-        goarch: amd64
-        env:
-          - CC=x86_64-w64-mingw32-gcc
-          - CXX=x86_64-w64-mingw32-g++
     # Per-target build hook. Fires after each Mach-O / ELF is linked,
     # before the archive step. The script is a no-op for non-darwin
     # targets, so we don't need a per-override hook list.
@@ -151,20 +144,9 @@ homebrew_casks:
       executable: gortex
       shell_parameter_format: cobra
 
-# Scoop manifest — `scoop install gortex` on Windows. goreleaser commits
-# the generated manifest (pointing at the signed windows/amd64 .zip in
-# this release) to a separate bucket repo on every tagged release,
-# exactly like the Homebrew cask above.
-scoops:
-  - name: gortex
-    repository:
-      owner: gortexhq
-      name: scoop-bucket
-      # GITHUB_TOKEN can only push to the source repo, so the bucket
-      # needs its own PAT with `repo` scope on gortexhq/scoop-bucket,
-      # stored as SCOOP_BUCKET_TOKEN in repo secrets. release.yml wires
-      # it in.
-      token: "{{ .Env.SCOOP_BUCKET_TOKEN }}"
-    homepage: "https://github.com/zzet/gortex"
-    description: "Code intelligence engine that indexes repositories into an in-memory knowledge graph."
-    license: "Custom"
+# NOTE: the Scoop manifest is intentionally NOT generated here. Windows is
+# built by the separate `release-windows` job (native runner, dynamic
+# liblbug) and isn't an artifact of this goreleaser-cross run, so goreleaser
+# has no windows zip to point a scoop manifest at. Re-add a scoop manifest
+# (pointing at the windows job's zip) as a follow-up once the windows
+# release path is settled.