feat(phase-67): statusline value-metric integration (context-mode savings + CMM index health)

[halindrome]

Summary

Phase 67 — statusline value-metric integration. Replaces the augmented statusline's self-estimated / activity metrics with authoritative upstream value, defaulting to a minimal Style-C rendering with richer detail behind opt-in toggles.

Default render: …wrapped upstream segment… | <savings> | CMM <glyph> — e.g. … | 170 KB kept out | CMM ✓.

What's here

• Style-C rewrite in setup.sh heredocs (both the GLOBAL standalone and the PROJECT wrapper — the statusline script is generated by setup.sh; .claude/hooks/statusline-cmm.sh is output only and is never edited):
  • Savings segment shells out to context-mode statusline, strips the context-mode ● brand prefix, takes the first · field, suppresses stderr (2>/dev/null — the Node ExperimentalWarning: SQLite), and skips fail-open when context-mode is absent/old/non-zero exit.
  • CMM health glyph is ✓ when the /tmp/cmm-session-ready-<hash> sentinel exists, else ⟳; optional Nn/Me node/edge counts come from a direct sqlite3 read of ~/.cache/codebase-memory-mcp/<project>.db — no index_status or any MCP call from the statusline.
  • Retired: the misleading CTX:N call-count display (it double-counted the plugin-form + legacy-server-form context-mode registrations) and the home-grown token-savings estimate.
  • New toggles in _statusline-config-<hash>.json: ctx_savings (true), cmm_health (true), cmm_nodes_edges (false), cmm_calls (false), blocks_total (false); existing block/CMM-call counters remain the source for the opt-in segments (no tracking removed). Config-writer synced.
• Tests: tests/test-phase-67-statusline.sh (22 assertions) — Style-C default render, each toggle on/off, context-mode/sqlite/sentinel fail-open, stderr-silence (phase-66 PATH-stub pattern).
• CHECKSUMS.sha256 regenerated.
• CLAUDE.md — added a Project Conventions guardrail: never modify .claude/ in this repo (local working config / install output, not feature-dev output); changes go in source (hooks/, agents/, rules/, setup.sh).

Phase planning artifacts under .vbw-planning/phases/67-* are intentionally local-only per the repo's .vbw-planning/ gitignore convention (as with phases 64–66), so they are not part of this diff.

Verification

• tests/test-phase-67-statusline.sh: 22 passed, 0 failed.
• Regression: tests/test-statusline-path.sh pass; tests/test-phase-48-statusline-reprompt.sh 14/0.
• Internal VBW QA: PASS (17/17).

QA

Ready for the CONTRIBUTING.md QA cycle (2–4 rounds, fresh Opus-class session per round). Touches setup.sh + tests/ → not docs-only; use the global /pr-qa.

🤖 Generated with Claude Code

[halindrome]

QA Round 1

Reviewed via a 3-lens Claude panel (contract+security / regression+edges / schema+tests), each running the test suites live and reproducing findings against the real context-mode binary and live CMM DBs. Guardrail invariant confirmed: the diff touches zero .claude/ paths.

Fixes applied this round in b4a5b6e (fix(cmm): address QA round 1) — F1, F2, F4 fixed; tests strengthened (F3); F5 documented. Round 2 will verify.

[claude] Finding 1 — cmm_nodes_edges reads an md5-named DB; CMM names DBs by path-slug → counts never render ✅ FIXED

• Area: setup.sh (both heredocs: global L2305–2312, wrapper L2450–2457)
• What was tested: md5(PROJECT_ROOT)=20268273… → ${PROJECT_HASH}.db does not exist; all 11 real CMM DBs are path-slug named (e.g. Users-ahby-Sources-cmm-claude-code-setup.db, 1794 nodes). The [ -f "$CMM_DB" ] guard is always false.
• Risk: the opt-in node/edge counts can never appear in real installs; the feature is inert. Fail-open (no crash). Test T4 fabricated an md5-named DB, masking it.
• Severity: major · Status: confirmed · Fix: both heredocs now derive the DB filename via CMM's actual slug algorithm (cbm_project_name_from_path, codebase-memory-mcp/src/pipeline/fqn.c:322): non-[A-Za-z0-9._-]→-, collapse --/.., trim leading -/. and trailing -.

[claude] Finding 2 — savings field carries stray leading+trailing spaces on the real double-spaced output ✅ FIXED

• Area: setup.sh (both heredocs: global L2284–2292, wrapper L2429–2436)
• What was tested: real context-mode statusline is double-spaced ( ● … · …); the strip chain left 170 KB kept out → renders … | 170 KB kept out | CMM ✓ with doubled padding (contradicts the contract's single-space example).
• Severity: minor · Status: confirmed · Fix: split on [[:space:]]*[·•][[:space:]]* and trim all surrounding whitespace.

[claude] Finding 3 — test stub used single-space format, so F1/F2 went uncaught (false green) ✅ FIXED

• Area: tests/test-phase-67-statusline.sh
• Severity: minor · Status: confirmed · Fix: stub now emits the real double-space format; savings assertion checks | 170 KB kept out | (no doubled spaces); T4/T7 use the real slug DB path; new T9b asserts no brand leak. Suite now 27/0 (was 22/0).

[claude] Finding 4 — brand-strip is a no-op if ● absent/ANSI-wrapped; no NO_COLOR=1 ✅ FIXED (hardening)

• Area: setup.sh (both heredocs)
• Status: hypothetical (not reproducible against the installed binary) · Fix: invoke NO_COLOR=1 context-mode statusline; brand-strip falls back to stripping a literal context-mode prefix + leading ANSI when ● is absent.

[claude] Finding 5 — statusline couples to CMM-internal nodes/edges table names ◻ tracked

• Area: setup.sh (both heredocs)
• Status: confirmed · Disposition: observation, bounded + fail-open (opt-in, sqlite-gated, 2>/dev/null||true + non-empty guards → degrades to glyph-only if CMM renames tables). Documented with an inline comment; not a blocker.

Contract Verification (post-review)

Criterion	Round-1 verdict	Note
Style-C default render	⚠️ partial → fixed	whitespace padding (F2) resolved
Savings from context-mode statusline (strip/first-field/stderr/fail-open)	⚠️ partial → fixed	F2/F4 resolved; fail-open was always intact
CMM health glyph from sentinel, same md5 PROJECT_HASH	✅ pass
No MCP/index_status; sqlite direct read only	✅ pass
CTX:N display retired	✅ pass
Node/edge counts via sqlite behind cmm_nodes_edges	❌ fail → fixed	F1 (md5→slug) resolved
New toggle flags reconciled; config-writer valid JSON	✅ pass	6 keys, no trailing comma
Self-wrap guard	✅ pass
Absent-config defaults	✅ pass
No .claude/ path touched	✅ pass	guardrail confirmed
CHECKSUMS no drift	✅ pass	89 OK
Tests cover default/toggles/fail-open/stderr	✅ pass	strengthened to 27/0

Summary

Severity	Count	Fixed
Critical	0	—
Major	1	1
Minor	4	3 + 1 tracked
Total	5	4 fixed, 1 tracked

---

SAST review skipped

Code scanning is not available for halindrome/cmm-claude-code-setup (no enabled CodeQL/SARIF analysis, or the API returned no alert array for ref feature/phase-67-statusline-value-metrics). No SAST delta is computed. This is a graceful skip — enable GitHub code scanning to populate this section.

Dependabot (SCA) — advisory, repo-wide

Dependabot alerts unavailable (not enabled, or token lacks security_events scope). Skipped — non-blocking.

---

QA performed by Claude Code (claude-opus-4-8)

[halindrome]

QA Round 2

Reviewed via a 3-lens Claude panel (contract+security / regression+edges / schema+tests), adversarially verifying the round-1 fixes (incl. cross-checking the CMM_SLUG derivation against CMM's C source cbm_project_name_from_path, fqn.c:322-378) and running all three suites live. 0 critical, 0 major. The round-1 major bug (DB md5→slug) is functionally resolved; round 2 surfaced 5 minor robustness nits, all now addressed.

Fixes applied this round: 628bd23 (fix(cmm): address QA round 2) + 1e13240 (fix(cmm): correct slug dot-collapse and trim to match CMM). Round 3 will verify.

[claude] Finding R2-1 — CMM_SLUG dot-collapse regex malformed ✅ FIXED

• Area: setup.sh (both heredocs, ~L2277/2442)
• Risk: s/\.\.\*/./g matched a literal ..*, not consecutive dots — so R2-1's intent (faithfully replicate cbm_project_name_from_path) was unmet. (Only bites paths containing ...)
• Severity: minor · Status: confirmed · Fix: corrected to s/\.\.*/./g (collapse a run of dots → single dot, as CMM does). Note: the initial round-2 commit mistakenly collapsed dots to -; 1e13240 corrected the replacement char and aligned the trim (all leading -/.; trailing - only) to CMM. Verified /a..b/c → a.b-c.

[claude] Finding R2-2 — empty-slug edge case had no fallback ✅ FIXED

• Area: setup.sh (both heredocs)
• Risk: an all-separator path trims to empty; CMM falls back to "root" (fqn.c:324,377) but the script left it empty.
• Severity: minor · Status: confirmed · Fix: [ -n "$CMM_SLUG" ] || CMM_SLUG="root".

[claude] Finding R2-3 — BSD/macOS sed portability of the ANSI-strip fallback ✅ FIXED

• Area: setup.sh (both heredocs)
• Risk: the no-● fallback used GNU-only \x1b; a no-op under BSD/macOS sed. Only reachable when ● is absent and NO_COLOR=1 is set (ANSI then unlikely); cosmetic + fail-open.
• Severity: minor · Status: confirmed · Fix: build the literal ESC via printf '\033' and interpolate — portable across BSD/GNU sed.

[claude] Finding R2-4 — PROJECT wrapper heredoc had no direct test assertions ✅ FIXED

• Area: tests/test-phase-67-statusline.sh
• Risk: tests generated only the GLOBAL standalone; the wrapper's Style-C/fail-open logic was only covered indirectly (test-statusline-path.sh).
• Severity: minor · Status: confirmed · Fix: added T12 — generates the PROJECT wrapper via setup.sh --project and asserts Style-C render (T12a) + context-mode-absent fail-open (T12b). Suite now 33/0 (was 27).

[claude] Finding R2-5 — statusline couples to CMM-internal nodes/edges table names ◻ tracked

• Area: setup.sh (both heredocs)
• Status: confirmed · Disposition: observation (carried from R1) — bounded + fail-open (opt-in, sqlite-gated, degrades to glyph-only if CMM renames tables). Documented inline; not a blocker.

Contract Verification (post-fix)

Criterion	R2 verdict	Note
F1 (R1 fix): DB path uses CMM path-slug, reads ${CMM_SLUG}.db	⚠️ partial → ✅ resolved	slug now faithfully matches cbm_project_name_from_path
F4 (R1 fix): NO_COLOR=1 + no-op-safe brand strip	⚠️ partial → ✅ resolved	ANSI-strip fallback now BSD/GNU-portable
Style-C default render	✅ pass
Savings parse (strip/first-field/stderr/fail-open)	✅ pass
CMM health glyph from sentinel	✅ pass
No MCP/index_status; sqlite direct read	✅ pass
CTX:N retired	✅ pass
Toggle flags reconciled; config-writer valid JSON	✅ pass
Self-wrap guard; absent-config defaults	✅ pass
No .claude/ path touched	✅ pass	guardrail confirmed
CHECKSUMS no drift; tests cover default/toggles/fail-open/stderr/wrapper	✅ pass	89 OK; suite 33/0

Summary

Severity	Count	Fixed
Critical	0	—
Major	0	—
Minor	5	4 fixed, 1 tracked
Total	5	4 fixed, 1 tracked

---

SAST review skipped

Code scanning is not available for halindrome/cmm-claude-code-setup (no enabled CodeQL/SARIF analysis). No SAST delta is computed. Graceful skip.

Dependabot (SCA) — advisory, repo-wide

Dependabot alerts unavailable (not enabled, or token lacks security_events scope). Skipped — non-blocking.

---

QA performed by Claude Code (claude-opus-4-8)

[halindrome]

QA Round 3 — Verification (CLEAN ✅)

Final verification round via a 3-lens Claude panel. All round-1 and round-2 fixes confirmed complete and correct. No critical/major/actionable findings — the PR is clean for merge from a QA standpoint.

Verification highlights:

• CMM_SLUG is now byte-faithful to CMM. The bash pipeline (setup.sh:2276-2280 / 2442-2446, byte-identical in both heredocs) was diff-tested against a faithful re-implementation of cbm_project_name_from_path (codebase-memory-mcp/src/pipeline/fqn.c:322-383) across 20 adversarial cases — consecutive dots (a..b→a.b), independent dash/dot run-collapse (no cross-collapse), leading ./.. trim, trailing-dot-survives vs trailing-dash-trimmed asymmetry, all-separator→root, empty→root, unicode — with 0 mismatches (empty results resolve via the ||"root" guard, identical to C).
• Savings parse verified whitespace-clean against the real double-spaced context-mode statusline output and 8 adversarial variants (no-●, ANSI, empty).
• R2-3 portable ANSI strip (_ESC=$(printf '\033')) confirmed BSD+GNU sed safe.
• Tests: phase-67 33/0 (incl. T12 PROJECT-wrapper render+fail-open, T9b no-● brand-leak, exact-savings assertions); test-statusline-path.sh pass; test-phase-48-statusline-reprompt.sh 14/0. CHECKSUMS: 89 OK / 0 failed.
• Guardrail: git diff origin/develop..HEAD --name-only = setup.sh, tests/test-phase-67-statusline.sh, CHECKSUMS.sha256, .vbw-planning/ROADMAP.md, CLAUDE.md — zero .claude/ paths.

Contract verification: all criteria PASS (Style-C render, savings parse, faithful CMM slug, sentinel glyph, no-MCP, CTX:N retired, toggles+config-writer JSON, self-wrap guard, absent-config defaults, fail-open, backward-compat, heredoc parity, no-.claude/, CHECKSUMS).

Pre-existing issues discovered (minor observations — non-blocking, no fix)

• [claude] F5 — nodes/edges CMM-internal table coupling (setup.sh:2327): opt-in (cmm_nodes_edges default false), sqlite-gated, fail-open (2>/dev/null||true + non-empty guards → degrades to glyph-only if CMM renames tables). Documented inline; accepted.
• [claude] Self-wrap guard has no direct test assertion (setup.sh:2539-2541): the case … *statusline-cmm.sh*) GLOBAL_CMD="" ;; guard is correct by inspection and covered indirectly by T12; a dedicated assertion would be a cheap future add.
• [claude] Windows lowercase-drive-letter not uppercased by the bash slug: CMM uppercases c:/→C:/, the bash slug does not — but the statusline's PROJECT_ROOT is always /-rooted (from git rev-parse/pwd), where CMM's drive canonicalization is a no-op, so this is unreachable in the real input domain.

Summary

Severity	Count	Status
Critical	0	—
Major	0	—
Minor	3	observations only (non-blocking)
Total	3	0 actionable

---

SAST review skipped

Code scanning is not available for halindrome/cmm-claude-code-setup. No SAST delta computed — graceful skip, non-blocking.

Dependabot (SCA) — advisory, repo-wide

Dependabot alerts unavailable. Skipped — non-blocking.

---

QA performed by Claude Code (claude-opus-4-8)