Let explicit ignore rules exclude memory notes (issue 3637)

[ayushcodes10]

What

detect() unconditionally included graphify-out/memory/ and exempted it from every ignore mechanism, so there was no supported way to keep a specific saved query note out of the graph, as described in issue #3637.

Fix

Adds _explicitly_ignored_for_scan(), which checks only the .graphifyignore/--exclude patterns (never a plain .gitignore entry). Inside graphify-out/memory/:

• A plain .gitignore entry (e.g. the documented graphify-out/ convention) still cannot drop a memory note — the same protection already given to the converted/ sidecar directory for issue Office sidecars in graphify-out/converted/ are silently dropped when graphify-out is gitignored #3504.
• A deliberate .graphifyignore/--exclude rule targeting a specific note or subdirectory is now honored, both at the directory pruning level and the file level.

This follows option 1 from the issue ("honor _ignored_for_scan inside the memory dir") while preserving the reason the hard include exists in the first place: without it, the documented "gitignore the whole output dir" convention would silently drop every memory note for anyone following the docs, not just the ones a user actually wants excluded.

Tests

Four new regression tests in tests/test_detect.py:

• a memory note survives a plain .gitignore entry on the whole output dir (baseline, matches the existing converted/ sidecar test)
• a .graphifyignore rule can exclude a specific memory note
• a .graphifyignore rule can exclude a whole memory subdirectory
• a plain .gitignore match alone (not .graphifyignore/--exclude) is not treated as deliberate enough to exclude a note

Full suite: 5625 passed, 68 skipped, 0 failures.

Fixes #3637

[graphify-labs]

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Formal verification. No changes could be formally verified in this run.

---

Graphify review — findings

Makes detect() honor deliberate .graphifyignore/--exclude rules inside graphify-out/memory/ while keeping memory notes immune to plain .gitignore entries. Both the directory-level prune and the per-file check now run _explicitly_ignored_for_scan against only the explicit patterns, so users can drop a specific note or subpath from the graph without a generic VCS ignore silently removing saved query notes.

No blocking issues surfaced. 3 lower-confidence candidates did not survive cross-model review.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 2725 functions depend on the 747 functions this change touches.

Health — this change adds coupling hotspots:

• new: extract() — 645 callers, 45 callees
• new: _rebuild_code() — 129 callers, 54 callees
• new: detect() — 116 callers, 16 callees
• new: _extract_generic() — 18 callers, 29 callees
• new: save_manifest() — 40 callers, 11 callees
• new: extract_files_direct() — 17 callers, 20 callees
• new: extract_js() — 85 callers, 4 callees
• new: extract_xaml() — 19 callers, 17 callees
• …and 45 more — each is listed as a finding

Verification — 2725 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 1196 function(s) in the blast radius were not formally verified this run

Test selection

Test selection

286 of 286 test file(s) selected (100%) via static blast radius.

Escalated to a full run for safety — the selection is not trustworthy on its own (see below). CI should run the whole suite.

• tests/test_affected_cli.py — full-run-safety
• tests/test_affected_member_seed.py — full-run-safety
• tests/test_agents_platform.py — full-run-safety
• tests/test_analyze.py — full-run-safety
• tests/test_anthropic_custom_endpoint.py — full-run-safety
• tests/test_antigravity_install.py — full-run-safety
• tests/test_apm_fallback_version.py — full-run-safety
• tests/test_architecture_doc.py — full-run-safety
• tests/test_astro_extraction.py — impact, full-run-safety
• tests/test_astro_import_ids.py — full-run-safety
• tests/test_atomic_canvas_export.py — full-run-safety
• tests/test_atomic_version_stamp.py — full-run-safety
• tests/test_atomic_writes.py — impact, full-run-safety
• tests/test_backend_env_isolation.py — full-run-safety
• tests/test_backend_extras.py — full-run-safety
• tests/test_benchmark.py — full-run-safety
• tests/test_benchmark_raw_graph.py — full-run-safety
• tests/test_build.py — impact, full-run-safety
• tests/test_build_merge_dedup_scope.py — full-run-safety
• tests/test_build_merge_hyperedges_and_prune.py — full-run-safety
• tests/test_build_merge_shrink_guard.py — full-run-safety
• tests/test_builtin_global_type_refs.py — full-run-safety
• tests/test_cache.py — full-run-safety
• tests/test_callflow_html.py — full-run-safety
• tests/test_cargo_introspect.py — full-run-safety
• tests/test_carried_hyperedge_remap.py — full-run-safety
• tests/test_case_sensitive_resolution.py — full-run-safety
• tests/test_charmap_encoding.py — impact, full-run-safety
• tests/test_chunking.py — impact, full-run-safety
• tests/test_cjs_module_extension.py — impact, full-run-safety
• tests/test_claude_cli_backend.py — impact, full-run-safety
• tests/test_claude_md.py — full-run-safety
• tests/test_cli_broken_pipe.py — full-run-safety
• tests/test_cli_export.py — full-run-safety
• tests/test_cli_help.py — full-run-safety
• tests/test_cluster.py — full-run-safety
• tests/test_codebuddy.py — full-run-safety
• tests/test_community_hub_labels.py — full-run-safety
• tests/test_community_labels_skill.py — full-run-safety
• tests/test_confidence.py — full-run-safety
• tests/test_corrupt_graph_json.py — full-run-safety
• tests/test_cpp_nested_and_cli.py — impact, full-run-safety
• tests/test_cpp_objc_cross_file_calls.py — full-run-safety
• tests/test_cpp_preprocess.py — full-run-safety
• tests/test_cross_extension_reexport_self_cycle.py — full-run-safety
• tests/test_cross_language_call_resolution.py — full-run-safety
• tests/test_cross_repo_external_call_guards.py — full-run-safety
• tests/test_cross_repo_member_calls.py — full-run-safety
• tests/test_cross_repo_shared_types.py — full-run-safety
• tests/test_csharp_call_site_generic_args.py — full-run-safety
• … and 236 more

non-code file(s) changed (CHANGELOG.md) → running the full suite for safety (a code graph can't see config/fixture/data deps)

changed code file(s) with no mapped test (CHANGELOG.md) — a coverage gap or a missing link — running the full suite rather than only the selected tests

Selection is safe under the controlled-regression assumption; always-run tests + a periodic full run are the backstops. Advisory — it never changes the check verdict.

Formal verification

Could not verify: Could not verify detect.

The verifier did not have enough to check detect, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: no capturable inputs from the test suite; property tier: parameter `root` is annotated `Path` — outside the synthesizable primitive/collection set

· 53 more finding(s) on lines outside this diff (see the check run).