refactor: delete hawk A unmounted surfaces (redundancy pair-scan, grammar blobs, hook reexports, startup-health wait, worker pool)

.config/nextest.toml

@@ -84,7 +84,7 @@ platform = { host = 'cfg(windows)' }
 test-group = 'windows-session-sqlite'
 
 [[profile.ci.overrides]]
-filter = '(binary(=core_cli_suite) & test(/^tool_first_touch_test::/)) | (binary(=mcp_suite) & test(/^mcp_dashboard_tool_test::/)) | (binary(=hooks_lsp_suite) & (test(/^lsp_code_diagnostics_test::/) | test(/^extract_worker_test::/)))'
+filter = '(binary(=core_cli_suite) & test(/^tool_first_touch_test::/)) | (binary(=mcp_suite) & test(/^mcp_dashboard_tool_test::/)) | (binary(=hooks_lsp_suite) & test(/^lsp_code_diagnostics_test::/))'
 platform = { host = 'cfg(windows)' }
 test-group = 'windows-process-heavy'
 

Cargo.toml

@@ -343,7 +343,6 @@ gix = { version = "=0.86.0", default-features = false, features = ["revision", "
 dirs = "6"
 hex = "0.4"
 rayon = "1"
-bincode = "1.3"
 getrandom = "0.2"
 self-replace = "1"
 memmap2 = "0.9"

SECURITY.md

@@ -136,10 +136,6 @@ recursive-write primitive.
 
 tracedecay installs **no background daemon, system service, or autostart process by default**. Users can explicitly opt in with `tracedecay daemon install-service`, which installs a per-user systemd service on Linux or a per-user LaunchAgent on macOS. The daemon runs with **standard user privileges** and never requests elevation. Index freshness still relies on on-demand staleness checks, catch-up syncs when MCP clients connect, and bounded hook notifications; the daemon provides shared MCP process/socket reuse and scheduled automation for projects that connect to it.
 
-### Subprocess-isolated extraction
-
-Tree-sitter grammars are compiled C/C++ and can crash the process in ways Rust cannot catch. Each file is parsed inside a short-lived worker subprocess (the hidden `extract-worker` subcommand). The worker authenticates against its parent with a 256-bit per-spawn token supplied via the `TRACEDECAY_WORKER_TOKEN` environment variable; a user invoking `tracedecay extract-worker` directly fails immediately. Opt out with `TRACEDECAY_DISABLE_SUBPROCESS=1`.
-
 ### Unsafe code
 
 The codebase contains minimal `unsafe`, used in two cross-platform places:

crates/tracedecay-code-extraction/src/ts_provider.rs

@@ -7,7 +7,7 @@ use std::collections::HashMap;
 use std::sync::LazyLock;
 use tree_sitter::Language;
 
-/// Package-owned patched Rust grammar and its generated query assets.
+/// Package-owned patched Rust grammar.
 pub mod rust_grammar {
     use tree_sitter_language::LanguageFn;
 
@@ -17,16 +17,6 @@ pub mod rust_grammar {
 
     /// The patched Rust grammar compiled from `vendor/tree-sitter-rust`.
     pub const LANGUAGE: LanguageFn = unsafe { LanguageFn::from_raw(tracedecay_tree_sitter_rust) };
-    /// Generated node type metadata for the patched grammar.
-    pub const NODE_TYPES: &str = include_str!("../vendor/tree-sitter-rust/src/node-types.json");
-    /// Syntax highlighting query for the patched grammar.
-    pub const HIGHLIGHTS_QUERY: &str =
-        include_str!("../vendor/tree-sitter-rust/queries/highlights.scm");
-    /// Injection query for the patched grammar.
-    pub const INJECTIONS_QUERY: &str =
-        include_str!("../vendor/tree-sitter-rust/queries/injections.scm");
-    /// Symbol tagging query for the patched grammar.
-    pub const TAGS_QUERY: &str = include_str!("../vendor/tree-sitter-rust/queries/tags.scm");
 }
 
 // tree-sitter-wgsl 0.0.6 was built against tree-sitter 0.20, whose Language

crates/tracedecay-hooks/src/lib.rs

@@ -18,50 +18,42 @@ pub mod runtime;
 pub mod spool;
 
 pub use admission_ledger::{
-    HookAdmissionDecisionV1, HookAdmissionLedgerError, HookAdmissionLedgerLimitsV1,
-    HookAdmissionLedgerOpenReportV1, HookAdmissionLedgerReceiptV1, HookAdmissionLedgerV1,
-    hook_admission_digest,
+    HookAdmissionDecisionV1, HookAdmissionLedgerLimitsV1, HookAdmissionLedgerReceiptV1,
+    HookAdmissionLedgerV1,
 };
 pub use capture::{
     NativeHookCaptureOutcomeV1, NativeHookCaptureSourceV1, capture_native_event_for_replay,
 };
 pub use config::{
     HOOK_CONFIGURATION_SCHEMA_VERSION, HookConfigurationFileReaderV1,
-    HookConfigurationFileWriterV1, HookConfigurationPublicationError,
-    HookConfigurationPublicationOutcomeV1, HookConfigurationPublicationStoreV1,
-    HookConfigurationPublisherV1, HookConfigurationReadOutcomeV1, HookConfigurationReadStoreV1,
-    HookConfigurationSnapshotV1, HookConfigurationSubscriberV1, MAX_HOOK_CONFIGURATION_BYTES,
-    hook_configuration_path,
+    HookConfigurationFileWriterV1, HookConfigurationPublisherV1, HookConfigurationReadOutcomeV1,
+    HookConfigurationSnapshotV1, HookConfigurationSubscriberV1, hook_configuration_path,
 };
 pub use core_events::{
     DaemonHookEvent, HOOK_EVENT_METHOD, HookAgent, HookEventNotifyOutcomeV1, HookRouteMetadata,
     HookTerminalReceipt,
 };
 pub use delivery_spool::{
-    HookDeliveryReceiptSpoolV1, HookDeliverySourceReceiptV1, HookDeliverySpoolError,
-    hook_delivery_receipt_spool_root,
+    HookDeliveryReceiptSpoolV1, HookDeliverySourceReceiptV1, hook_delivery_receipt_spool_root,
 };
 pub use native::{
-    DecodedNativeHookEventV1, DecodedOpenCodeLspEventV1, NativeEnvelopeMaterialV1,
-    NativeHookDecodeError, NativeHookSignalV1, OpenCodePluginSurfaceV1,
-    ProfileScopedNativeHookAdmissionV1, decode_bound_native_hook_event, decode_native_hook_event,
-    decode_opencode_lsp_event, decode_opencode_plugin_event,
+    DecodedNativeHookEventV1, NativeEnvelopeMaterialV1, NativeHookDecodeError,
+    OpenCodePluginSurfaceV1, ProfileScopedNativeHookAdmissionV1, decode_bound_native_hook_event,
+    decode_native_hook_event, decode_opencode_lsp_event, decode_opencode_plugin_event,
 };
 pub use runtime::{
-    AsyncHookAdmissionPortV1, AsyncHookFeedbackDeliveryPortV1, HOOK_SYNCHRONOUS_BUDGET_MICROS,
-    HookAdmissionFutureV1, HookAdmissionReceiptV1, HookDeliveryFutureV1,
-    HookFeedbackDeliveryOutcomeV1, HookFeedbackDeliveryPortV1, HookFeedbackDeliveryRouteV1,
-    HookFeedbackDeliveryV1, HookFeedbackRollbackSwitchV1, HookGuidanceDispositionV1,
-    HookGuidanceStateV1, HookImmediateAdmissionStateV1, HookImmediateAdmissionV1,
-    HookReadyGuidanceV1, HookRuntimeControlV1, HookRuntimeErrorV1, HookScopedFeedbackV1,
-    HookSynchronousDeadlineV1, HookSynchronousResultV1, admit_async_exact_scope,
-    deliver_feedback_with_rollback, deliver_feedback_with_rollback_async, deliver_hook_feedback,
+    AsyncHookAdmissionPortV1, AsyncHookFeedbackDeliveryPortV1, HookAdmissionFutureV1,
+    HookAdmissionReceiptV1, HookDeliveryFutureV1, HookFeedbackDeliveryOutcomeV1,
+    HookFeedbackDeliveryPortV1, HookFeedbackDeliveryRouteV1, HookFeedbackDeliveryV1,
+    HookFeedbackRollbackSwitchV1, HookGuidanceDispositionV1, HookGuidanceStateV1,
+    HookImmediateAdmissionStateV1, HookImmediateAdmissionV1, HookReadyGuidanceV1,
+    HookRuntimeControlV1, HookRuntimeErrorV1, HookScopedFeedbackV1, HookSynchronousDeadlineV1,
+    admit_async_exact_scope, deliver_feedback_with_rollback, deliver_hook_feedback,
     finish_synchronous_hook,
 };
 pub use spool::{
-    HookReplayBatchV1, HookSpoolAckDispositionV1, HookSpoolAckV1, HookSpoolConfigV1,
-    HookSpoolError, HookSpoolLimitsV1, HookSpoolOpenReportV1, HookSpoolRecordV1,
-    HookSpoolResetReasonV1, HookSpoolV1, HookSpoolWriterLeaseV1, hook_spool_checksum,
+    HookSpoolAckDispositionV1, HookSpoolAckV1, HookSpoolConfigV1, HookSpoolError,
+    HookSpoolRecordV1, HookSpoolV1,
 };
 
 use serde::{Deserialize, Serialize};