Arbor

Graph-native intelligence for codebases.
Know what breaks before you break it.

_{Simulated replay — the arbor commands and their output are real (tokio @ 178k LOC). Methodology: BENCHMARKS.md}

v3.0.0 — The Right Node · v2.6.0 stopped dropping colliding symbols. It did not stop resolving them to the wrong one. When a bare name matched several modules, resolution fell through to "same directory" and confidently attached the edge to whichever definition happened to sit next to the caller. On a graded fixture the three largest hubs reported zero downstream impact while unrelated siblings inherited their centrality. A file's own imports now settle it. Reproduce it yourself: getArbor-dev/arbor-torture

Why Arbor

Most AI coding tools treat code as text. Arbor builds a semantic dependency graph — functions, classes, and modules as nodes; calls, imports, and inheritance as edges — then answers execution-aware questions with deterministic precision:

No keyword guessing. No embedding hallucinations. One graph, every interface.

Where the graph is unsure, it says so — edges carry a confidence, and ambiguous resolutions are labelled rather than hidden. An honest unknown beats a confident wrong answer.

What's new in v3.0.0

One fix, measured.

Symbol resolution consults the importing file. When a bare name matched definitions in several modules, resolve_ref fell through to SameDir and attached the edge to whichever definition sat in the caller's own directory — not a dropped edge, a confidently misrouted one, stamped at 0.55 confidence.

GraphBuilder already kept a per-file import map, but only apply_import_validation read it, and that scores an edge after one has been chosen. It never saw the references going to the wrong node. Consulting it between the same-file and same-directory checks keeps a local definition shadowing an import, while letting a written import beat mere adjacency. Resolution::ViaImport scores 0.93, above SameDir's 0.55.

Measured

A fixture of 260 modules across 10 layers, each layer defining the same 26 function names. Ground truth is derived from the generator's own edge list, so the expected answer is exact rather than estimated.

Previously flat at about 22 regardless of the real answer. Now it tracks. Risk on the largest hub moves from LOW to CRITICAL.

Total edge count barely moves (1335 → 1334). That is the signature of misrouting rather than loss: the edges were always there, pointing at the wrong nodes.

Breaking

• Resolution gains a ViaImport variant — an exhaustive match will not compile
• Edges land on different nodes, so cached graphs, stored node ids, and centrality baselines from 2.6.0 will differ

Call cycles are condensed before PageRank. Each strongly connected component is ranked once and that mass is shared across its members, so a closed ring does not fill the top of the ranking and a cycle that calls out keeps its members together. The number CentralityScores reports is still the v2.6.0 percentile, i / (n - 1).

Known and still open

Written down rather than left to be discovered:

• Small targets now over-report (36 → 61, 16 → 46). Safer direction than silence, but not yet correct.
• Inheritance produces no edges. class Middle(Base) is invisible, so changing a base class shows zero blast radius.
• Dynamic and reflective imports (importlib, __import__, import(), eval(require(...))) are unresolvable by construction and are documented as expected misses in the fixture rather than counted as defects.