fix(extensions): enable default Windows bundled bytes (COD-53 subset)

Cargo.toml

@@ -36,6 +36,7 @@ panic = "unwind"
 name = "codebase_graph"
 
 [features]
+default = ["bundled-windows-extensions"]
 bundled-windows-extensions = []
 
 [dependencies]

docs/release.md

@@ -116,6 +116,41 @@ package-owned fixture smoke results. Templates and assets must be loaded from
 the packaged artifact; a smoke run that relies on the repository checkout is
 not sufficient. Generated `.kwiki/` state is never included in an archive.
 
+## Windows Cargo source installs
+
+For Windows x86_64, ordinary `cargo install codebase-graph` uses the default
+`bundled-windows-extensions` feature. The binary carries the existing Ladybug
+0.19.0 JSON and FTS extension bytes; no extension feature flag or runtime
+extension download is needed. Explicit `--no-default-features` opts out of these
+bytes. The workspace `k-wiki` build inherits the root dependency's defaults;
+`k-wiki` is not published as a separate crates.io package.
+
+Cargo is still a native source build, not a self-contained Windows distribution.
+It needs Rust and an MSVC C/C++ build environment, including the Windows SDK,
+for the vendored grammar. Ladybug's source-build fallback additionally uses
+CMake and Ninja and needs compatible native headers/libraries. The final
+native link needs OpenSSL libraries; runtime extension loading needs compatible
+OpenSSL 3 (`libssl-3-x64.dll`, `libcrypto-3-x64.dll`) and the required Visual C++
+runtime libraries. Bundled extension bytes do not supply those DLLs. Missing
+compiler, native-library or DLL prerequisites are errors, not permission to
+download extensions or switch installation routes silently.
+
+The default-feature change is tracked by [COD-53](https://linear.app/codebasegraph/issue/COD-53)
+under [CBG-PLAT-01 revision 0.10, R02/A16](https://github.com/rabii-chaarani/codebaseGraph/blob/1a9db7b558b60248888408daa6268a3b45f2f0df/docs/specs/CBG-PLAT-01/spec.md#a16).
+Before claiming source-install qualification, execute the plain install on a
+documented supported Windows 11 x86_64 build environment. Record the exact
+source/package, compiler, native-library and DLL prerequisites. Then use an
+isolated empty extension cache with runtime extension downloads disabled and
+verify real JSON/FTS loading, graph build, reopen and search. A prepared Windows
+Server CI build or a feature-selection check alone is not this qualification.
+
+Prefer the official prebuilt route if you do not want a native build environment.
+The separate D01 prebuilt-runtime work remains gated on permitted compatible
+runtime supply and controlled loading. This source-install guidance neither
+replaces that policy nor claims that the current prebuilt archive is qualified.
+No exact Windows source-build recipe or clean-consumer execution is claimed by
+the default-feature change alone.
+
 Each native archive must contain:
 
 - `codebase-graph` / `codebase-graph.exe`

docs/specs/CBG-PLAT-01/approvals/cod53-windows-native-runtimes.md

@@ -0,0 +1,12 @@
+# COD-53 — exact S02 implementation approval
+
+- **Work:** CBG-PLAT-01/S02; [Linear COD-53](https://linear.app/codebasegraph/issue/COD-53), Maintenance P-COD-2, team COD. COD-51 clears its implementation prerequisite for this slice only.
+- **Canonical specification:** `docs/specs/CBG-PLAT-01/spec.md`, revision **0.10**, full approved Git SHA **`1a9db7b558b60248888408daa6268a3b45f2f0df`**; [immutable approved content](https://github.com/rabii-chaarani/codebaseGraph/blob/1a9db7b558b60248888408daa6268a3b45f2f0df/docs/specs/CBG-PLAT-01/spec.md). Git blob `3e3bc03546607c4d6cc558fa34699f4349688640` was verified against the remote file.
+- **User decision reference:** 2026-10-27, Prime Agent session `01a17b9c-1a65-77b0-bcc9-caa7c08f4b98`. The assistant asked: “Approve this scope, or keep it preparation-only?” after recommending “COD-53 only under spec rev0.10: R02, A03/A04/A16—bundled Windows runtimes, default Cargo JSON/FTS extension bytes, and required verification.” The user replied **“approved”**.
+- **Approved scope:** S02/COD-53 only, requirement **R02**, criteria **A03, A04, A16**. Bundle compatible required redistributable Windows prebuilt native runtime sidecars, licenses/checksums and controlled DLL loading. Include JSON/FTS extension bytes by default in plain Windows Cargo installs; document and verify source-build/runtime prerequisites separately. Execute applicable success/failure checks and required reviews, record actual native/desktop/source-install evidence and limitations, and deliver a reviewed commit/branch/PR under repository procedure.
+- **Settled policies reused:** D01, D05b, D05c and D05d. Exact versions/layout/secure loading are implementation details within these constraints; no Ladybug/extension ABI or dependency-version upgrade is approved.
+- **Excluded:** other maintenance slices; package/release publication; merge, deployment or service restart; global PATH widening or arbitrary DLL fallback; changes to containment/COPY/cleanup contracts; aggregate qualification or milestone closure. Maintainer/user retains closure ownership. No implicit two-file installer rollback redesign.
+- **Starting source baseline:** main `7038e66ff8271ffddc511f879cf8d28353a09b2d` (4.0.0), isolated branch `fix/cod-53-windows-runtimes`; preserve the existing dirty user checkout. Revalidate exact source and graph evidence before dependent implementation.
+- **Scryer:** `chg-56s373`; existing Graph Store `resp-113` and Release Gate `resp-16`, `resp-17`, `resp-255`–`resp-258`. Detailed execution briefs/prerequisites/ownership belong in Scryer. This approval record does not assert model changes or passing execution.
+
+Approval, local implementation, native build/test evidence, clean Windows 11 desktop/source-install/shell qualification and aggregate closure remain distinct. Unavailable environments leave applicable acceptance pending; Windows Server CI alone is not desktop evidence. This file deliberately does not embed its own containing commit SHA.

docs/specs/CBG-PLAT-01/decisions/cod53-vc-runtime-licence.md

@@ -0,0 +1,30 @@
+# COD-53 — Visual C++ runtime redistribution licence route
+
+## Decision and scope
+
+- Work: **CBG-PLAT-01/S02**, [COD-53](https://linear.app/codebasegraph/issue/COD-53), R02 / A03, A04, A16. Canonical [specification revision0.10](https://github.com/rabii-chaarani/codebaseGraph/blob/1a9db7b558b60248888408daa6268a3b45f2f0df/docs/specs/CBG-PLAT-01/spec.md), full approved SHA `1a9db7b558b60248888408daa6268a3b45f2f0df`; [exact S02 approval](https://github.com/rabii-chaarani/codebaseGraph/blob/eaa430c849094078bb4c228ea03136dde5587e91/docs/specs/CBG-PLAT-01/approvals/cod53-windows-native-runtimes.md).
+- **Selected applicable licence route: Microsoft Visual Studio Community 2022**, subject to its eligibility, acquisition/use and redistribution terms. A paid Professional/Enterprise licence is not required if the distributor qualifies for Community and complies with its terms.
+- **User decision reference:** 2026-10-27, Prime Agent session `01a17b9c-1a65-77b0-bcc9-caa7c08f4b98`. After the assistant explained the Community2022 route and linked official eligibility/licence/REDIST terms, the user replied: **“Yes then, record the applicable licence for VC”**. This authorizes recording and using that route within the existing D01 bundling policy. It is not a statement that the agent acquired/installed Visual Studio or accepted terms on the user's behalf.
+- Existing D01 app-local bundling, compatibility, checksums/licences and controlled-loading requirements remain unchanged. No manual-runtime prerequisite substitute, ABI/dependency upgrade, release/publication, merge/deployment/restart or aggregate closure is approved by this record.
+
+## Governing Microsoft terms
+
+Primary sources inspected directly2026-10-27:
+
+1. [Visual Studio Community2022 licence terms](https://visualstudio.microsoft.com/license-terms/vs2022-ga-community/) — official embedded [English licence document](https://visualstudio.microsoft.com/wp-content/uploads/2021/11/Visual-Studio-2022-Community-License-EN.docx). Section1 permits an individual working on their own applications and permits organizational development/testing of applications released under OSI-approved open-source licences, subject to the complete terms. Other organizational scenarios have separate limits; no assumption of eligibility outside the applicable route is made.
+2. Section4, **Distributable Code**, permits distribution of object code listed in the referenced Distributable List within applications developed under the licence and permits application distributors to distribute it as part of those applications. Conditions include significant primary application functionality, terms protecting Distributable Code at least as much as Microsoft's agreement, and the listed restrictions. Do not present the Microsoft DLLs as licensed under the project's MIT licence or remove their notices.
+3. [Visual Studio2022 REDIST list](https://learn.microsoft.com/en-us/visualstudio/releases/2022/redistribution) explicitly names Community2022 alongside Professional/Enterprise, conditions redistribution on a validly licensed copy and the governing terms, and lists eligible **unmodified** files under `[VisualStudioFolder]\VC\redist`, with stated exclusions. Preview/pre-release/beta and debug/nonredistributable files are not supplied by this authorization.
+4. [Microsoft redistribution guidance](https://learn.microsoft.com/en-us/cpp/windows/redistributing-visual-cpp-files?view=msvc-170) applies the licence requirement to packages, merge modules and individual runtime binaries. Merely finding DLLs on a GitHub-hosted VS Enterprise runner is not evidence of distributor entitlement or an exact permitted file source.
+
+The official Community2022 English DOCX was fetched successfully; SHA256 **`41a207b10c8ab91d0d2f10a854715f73dca54509581692d2fe179aa3ffcb8540`**. This is an evidence identifier for the inspected terms, not a Microsoft DLL licence file or proof of acquisition. Read the complete applicable terms; this record is an engineering compliance handoff, not a substitute agreement or legal opinion.
+
+## Packaging evidence still required
+
+Before any VC DLLs are distributed:
+
+- The distribution owner must have an eligible, validly licensed Community2022 copy and comply with its applicable terms. No actual installation/acquisition/acceptance has been observed or performed by the agent. This decision selects the licence route; it does not invent those facts.
+- Identify the exact eligible unmodified release x64 runtime files, their official source/toolset version, names, hashes and applicable notices/terms. Current extension import tables require `MSVCP140.dll`, `VCRUNTIME140.dll` and `VCRUNTIME140_1.dll`; actual final transitive import/export closure can require more. Names alone are not byte/provenance or licence proof.
+- Preserve Microsoft component notices and licence restrictions separately from project MIT/OpenSSL Apache terms. Check exact selected files against the REDIST list and applicable distribution conditions; no copying arbitrary developer/debug DLLs.
+- Execute the specified archive integrity, safe-loader and real installed/native success/failure checks. This licence selection is not passing Windows11 consumer/source-install qualification or proof of compatible DLLs.
+
+The publisher/user retains responsibility for eligibility and compliance. Implementation within the selected route may proceed through the approved technical review gates; copying/shipping depends on the actual applicable entitlement and permitted-byte evidence above. No credentials, activation keys or purchase records are requested or stored.

docs/specs/CBG-PLAT-01/execution/cod53-default-extensions-evidence/default-feature-resolved-metadata.json

@@ -0,0 +1,14 @@
+{
+  "command": "cargo metadata --locked --format-version 1 (no --features)",
+  "target": "host macOS, not Windows byte execution",
+  "features_declared": {
+    "bundled-windows-extensions": [],
+    "default": [
+      "bundled-windows-extensions"
+    ]
+  },
+  "features_resolved": [
+    "bundled-windows-extensions",
+    "default"
+  ]
+}

docs/specs/CBG-PLAT-01/execution/cod53-default-extensions-evidence/default-feature-tree.txt

@@ -0,0 +1,4 @@
+codebase-graph v4.0.0 (/private/tmp/codebasegraph-cod53-windows-runtimes)
+├── codebase-graph feature "bundled-windows-extensions"
+│   └── codebase-graph feature "default" (command-line)
+└── codebase-graph feature "default" (command-line)

docs/specs/CBG-PLAT-01/execution/cod53-default-extensions-evidence/explicit-optout-feature-tree.txt

@@ -0,0 +1 @@
+codebase-graph v4.0.0 (/private/tmp/codebasegraph-cod53-windows-runtimes)