chore: v0.5.1 Stabilization and Trustworthy Gates

.github/workflows/ci.yml

@@ -25,10 +25,16 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip setuptools wheel
-          pip install -r requirements.txt
+          pip install -e ".[dev]"
 
-      - name: Run tests
-        run: pytest --tb=short -q
+      - name: Run tests with coverage
+        run: pytest --cov=semantic_code_intelligence --cov-fail-under=70
+
+      - name: Run security checks
+        run: |
+          pip install bandit pip-audit
+          bandit -r semantic_code_intelligence -x semantic_code_intelligence/tests -ll
+          pip-audit
 
   lint:
     runs-on: ubuntu-latest
@@ -42,3 +48,27 @@ jobs:
 
       - name: Check syntax
         run: python -m py_compile semantic_code_intelligence/__init__.py
+
+  rust-stable:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check formatting
+        run: cargo fmt --check --manifest-path codexa-core/Cargo.toml
+      - name: Run Clippy
+        run: cargo clippy --manifest-path codexa-core/Cargo.toml --all-targets -- -D warnings
+      - name: Run tests
+        run: cargo test --manifest-path codexa-core/Cargo.toml
+
+  cargo-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+      - name: Run cargo audit
+        working-directory: codexa-core
+        run: cargo audit

CONTRIBUTING.md

@@ -16,7 +16,7 @@ source .venv/bin/activate # macOS/Linux
 
 # Install in development mode
 pip install -e ".[dev]"
-pip install -r requirements.txt
+
 
 # Run the test suite
 pytest
@@ -56,7 +56,6 @@ CodexA/
 │   └── tests/                      # All test files (2596+ tests)
 ├── vscode-extension/               # VS Code sidebar extension
 ├── pyproject.toml
-├── requirements.txt
 ├── ROADMAP.md
 └── CHANGELOG.md
 ```
@@ -93,6 +92,19 @@ CodexA/
 - Import from `semantic_code_intelligence.utils.logging` for consistent output
 - Keep modules focused — one responsibility per file
 
+### Rust Core Development
+
+The `codexa-core` native extension requires Rust and Cargo.
+When developing on Windows, the `pyo3-build-config` crate may fail to find your Python interpreter if you are using a virtual environment. To work around this, explicitly set the `PYO3_PYTHON` environment variable:
+
+```powershell
+# Windows PowerShell
+$env:PYO3_PYTHON = "..\.venv\Scripts\python.exe"
+cd codexa-core
+cargo clippy -- -D warnings
+cargo test
+```
+
 ## Plugin Development
 
 CodexA has a plugin system with 22 hook points. See `codexa docs --section plugins` for the full reference, or check the [Plugin SDK](semantic_code_intelligence/plugins/__init__.py).

README.md

@@ -38,8 +38,7 @@ structured tool protocol that any AI agent can call over HTTP or CLI.
 | **Interactive TUI** | Terminal REPL with mode switching for interactive exploration |
 | **Streaming Responses** | Token-by-token streaming for chat and investigation commands |
 | **Plugin System** | 22 hooks for extending every layer — from indexing to tool invocation |
-| **VS Code Extension** | 4-panel sidebar (Search, Symbols, Quality, Tools), 8 commands, CodeLens, context menus, status bar |
-| **Editor Plugins** | Zed, JetBrains (IntelliJ/PyCharm), Neovim (telescope.nvim), Vim, Sublime Text, Emacs, Helix, Eclipse -- all sharing the same MCP/bridge protocol |
+| **VS Code Extension** | 4-panel sidebar (Search, Symbols, Quality, Tools), 8 commands, context menus, status bar |
 | **Cross-Language Intelligence** | FFI pattern detection, polyglot dependency graphs, language-aware search boosting, universal multi-language call graph |
 | **Multi-Agent Sessions** | Concurrent AI agent sessions with shared discovery, semantic diff (rename/move/signature/body detection), RAG code generation |