Skip to main content

⚠️ ADR-118 Architecture Update (January 2026): This analysis references context.db which has since been deprecated. The database architecture evolved to a four-tier system: org.db (Tier 2: IRREPLACEABLE - decisions, learnings), sessions.db (Tier 3: regenerable - messages), platform.db (Tier 1: components). References to context.db below reflect the architecture at time of analysis. Integration recommendations remain valid - use org.db/sessions.db instead of context.db.

Codanna Integration Analysis

Executive Summary

Subject: Evaluation of codanna for integration into coditect-core Status: In Progress Decision Required: INTEGRATE / WAIT / REJECT Date Initiated: 2026-01-11 Lead: MoE Council Orchestrator


1. Background

1.1 What is Codanna?

Codanna is a Rust-based code intelligence tool providing:

  • Semantic code search - Natural language queries against code
  • Symbol discovery - Sub-10ms symbol lookups with memory-mapped caches
  • Call graph analysis - get_calls, find_callers, analyze_impact
  • Document RAG - Index markdown/text for semantic search
  • MCP Protocol - Native Claude/Gemini/Codex integration

Version: v0.9.10 License: Apache 2.0 Languages: Rust, Python, JavaScript, TypeScript, Java, Kotlin, Go, PHP, C, C++, C#, Swift, GDScript (13 languages)

1.2 Why Consider Integration?

Potential BenefitDescription
Agent DiscoverySemantic search for finding agents by capability
Code NavigationCall graphs, impact analysis for refactoring
MCP CompatibilityNative protocol support with Claude Code
PerformanceSub-10ms lookups, 75K+ symbols/sec parsing

1.3 Submodule Location

coditect-core/codanna/  (added 2026-01-11)

2. MoE Council Configuration

2.1 Constitutional Court Panel (6 Agents)

AgentRoleEvaluation FocusModel
research-agentLead InvestigatorRepository health, alternatives, communitysonnet
senior-architectArchitecture ReviewerIntegration fit, API design, alignmentsonnet
rust-qa-specialistCode Quality AuditorSafety, security, performance, testssonnet
security-specialistSecurity AssessorDependencies, vulnerabilities, supply chainsonnet
codebase-analyzerTechnical Deep-DiveImplementation details, data flowsonnet
council-orchestratorSynthesis ChairmanAggregate, consensus, verdictsonnet

2.2 Decision Thresholds

ConditionDecisionAction
Security risk HIGH/CRITICALREJECTRemove submodule, document alternatives
QA score < 70WAITMonitor, re-evaluate in 30 days
Architectural conflicts > 3FLAGEscalate to human review
All pass + research positiveINTEGRATEProceed with integration

3. Execution Plan

3.1 Phase 1: Parallel Specialist Reviews

Execute all 5 specialist reviews in parallel:

3.1.1 Research Agent

Task(subagent_type="research-agent", prompt="""
Research codanna (https://github.com/bartolli/codanna) thoroughly:

1. Repository health: stars, forks, issues, PR activity, release cadence
2. Author reputation and commit history
3. Alternative tools comparison (tree-sitter-graph, rust-analyzer, etc.)
4. Community adoption and production usage evidence
5. License compatibility with CODITECT (Apache 2.0)
6. Known vulnerabilities or security advisories
7. Maintenance trajectory (active development vs abandoned)

Deliver: Comprehensive research report with recommendation score (0-100)
""")

Status: [ ] Not Started Score: pending Findings: pending


3.1.2 Senior Architect

Task(subagent_type="senior-architect", prompt="""
Evaluate codanna architectural fit with coditect-core:

1. Review codanna/src/ structure and design patterns
2. Assess MCP protocol implementation quality
3. Evaluate integration points with existing CODITECT components
4. Identify architectural conflicts or alignment
5. Assess API design for skill/command integration
6. Evaluate dependency weight (152KB Cargo.lock = ~40 crates)
7. Performance characteristics (sub-10ms claims)

Reference: Read codanna/Cargo.toml, codanna/src/lib.rs, codanna/src/mcp/
Deliver: Architectural assessment with integration recommendation
""")

Status: [ ] Not Started Score: pending Findings: pending


3.1.3 Rust QA Specialist

Task(subagent_type="rust-qa-specialist", prompt="""
Conduct comprehensive Rust QA review of codanna:

1. Safety review: grep for unwrap/expect/panic in src/
2. Error handling patterns: Result usage, custom error types
3. Async patterns: tokio usage, blocking I/O detection
4. Memory safety: unsafe blocks, lifetime management
5. Test coverage: examine tests/ directory
6. Clippy compliance: check clippy.toml settings
7. Code quality scoring (0-100 scale)

Reference: Read codanna/src/*.rs, codanna/tests/, codanna/clippy.toml
Deliver: QA assessment with quality score and production-readiness verdict
""")

Status: [ ] Not Started Score: pending Findings: pending


3.1.4 Security Specialist

Task(subagent_type="security-specialist", prompt="""
Conduct security assessment of codanna:

1. Dependency audit: cargo audit against Cargo.lock
2. Supply chain analysis: review all 40+ dependencies
3. Attack surface: external input handling in MCP tools
4. Code execution risks: user-provided queries, file paths
5. Data leakage: what does codanna index, where stored?
6. Privilege escalation: MCP server capabilities
7. License compliance: NOTICE file review

Reference: Read codanna/Cargo.lock, codanna/src/mcp/, codanna/LICENSE
Deliver: Security assessment with risk score (LOW/MEDIUM/HIGH/CRITICAL)
""")

Status: [ ] Not Started Risk Level: pending Findings: pending


3.1.5 Codebase Analyzer

Task(subagent_type="codebase-analyzer", prompt="""
Analyze codanna implementation details:

1. Core architecture: modules, data flow, key abstractions
2. Indexing system: how symbols are parsed and stored
3. Search implementation: Tantivy + fastembed integration
4. MCP protocol handling: tool dispatch, response format
5. Tree-sitter integration: language support patterns
6. Configuration system: codanna.toml, profiles
7. Extension points: plugins, profiles, hooks

Reference: Read codanna/src/main.rs, codanna/src/indexing/, codanna/src/semantic/
Deliver: Technical deep-dive with integration opportunity map
""")

Status: [ ] Not Started Findings: pending


3.2 Phase 2: Council Synthesis

Task(subagent_type="council-orchestrator", prompt="""
Synthesize codanna integration evaluation from 5 specialist reviews.

Apply decision thresholds:
- Security risk HIGH/CRITICAL → REJECT
- QA score < 70 → REQUEST_CHANGES (wait for upstream fixes)
- Architectural conflict score > 3 → FLAG FOR HUMAN REVIEW
- All pass + research positive → APPROVE

Generate final verdict with:
- Aggregate integration recommendation (INTEGRATE / WAIT / REJECT)
- Confidence score (0-100%)
- Key findings summary
- Risk mitigation requirements (if INTEGRATE)
- Alternative recommendations (if REJECT)

Provide audit trail with hash chain.
""")

Status: [ ] Not Started


4. Preliminary Findings (Pre-Council)

4.1 Capability Assessment

4.1.1 JSON/Markdown Components

RequirementCodanna CapabilityGap
Markdown files (.md)✅ Full support via documentsNone
YAML frontmatter❌ Not parsedCritical
JSON files❌ No tree-sitter-jsonMajor
Semantic search on content✅ Works wellNone
Metadata extraction❌ No frontmatter fieldsCritical

Impact: Cannot query by component_type, model, quality_score fields.

4.1.2 SQLite Message Store

RequirementCodanna CapabilityGap
SQLite support❌ Uses TantivyArchitecture mismatch
Message indexing❌ No database connectorCustom layer needed
Session search❌ Not designed for thisDifferent use case

Impact: context.db remains separate system.

4.2 Storage Architecture Comparison

Codanna Storage                    CODITECT Storage
┌─────────────────────────┐ ┌─────────────────────────┐
│ .codanna/index/ │ │ context-storage/ │
│ ├── tantivy/ │ │ ├── context.db (SQLite) │
│ │ └── meta.json │ │ │ ├── messages │
│ ├── semantic/ │ │ │ ├── task_tracking │
│ │ └── vectors.bin │ │ │ ├── embeddings │
│ └── documents/ │ │ │ └── ...93 tables │
│ └── state.json │ │ └── unified_messages.jsonl
└─────────────────────────┘ └─────────────────────────┘

5. Integration Options

CODITECT Layer                    Codanna Layer
┌─────────────────────────┐ ┌─────────────────────────┐
│ component-indexer.py │ │ codanna index src/ │
│ context.db (SQLite) │ │ Tantivy + embeddings │
│ /cxq (message search) │ │ MCP semantic search │
└─────────────────────────┘ └─────────────────────────┘
↑ ↑
Markdown/JSON Rust/Python/TS
components, sessions actual source code

Use codanna for: scripts/, src/, actual code files Keep existing for: agents/, commands/, skills/, context.db

5.2 Option B: Extend Codanna (Heavy Lift)

Requirements:

  1. Add YAML frontmatter parser to document chunker
  2. Add JSON tree-sitter grammar
  3. Build SQLite connector
  4. ~500-1000 lines of Rust code

Verdict: Not recommended - changes codanna's core purpose.

5.3 Option C: Hybrid Wrapper (Moderate Effort)

Python wrapper combining both systems:

class CoditectCodeSearch:
def __init__(self):
self.sqlite = sqlite3.connect('context.db')
self.codanna = subprocess.Popen(['codanna', 'serve'])

def search(self, query, component_type=None, model=None):
# 1. Get semantic matches from codanna
semantic = self.codanna_search(query)

# 2. Filter by frontmatter fields from SQLite
if component_type or model:
filtered = self.filter_by_metadata(component_type, model)
semantic = [s for s in semantic if s.path in filtered]

return semantic

6. Specialist Review Findings

6.1 Research Agent Report

Status: [x] Complete

Repository Health:
- Stars: 511 (good for 5-month project)
- Forks: 42 (moderate engagement)
- Open Issues: 4 (well-maintained)
- Last Release: v0.9.10 (Jan 7, 2026)
- Commit Activity: 317 commits, daily commits in Jan 2026

Alternatives Comparison:
- vs tree-sitter-graph: Codanna more feature-complete (MCP + search)
- vs rust-analyzer: rust-analyzer Rust-only; codanna multi-language
- vs sourcegraph: Enterprise-grade but heavy; codanna lightweight

Community Adoption: Limited (5 months old), listed in awesome-claude-code
License Compatibility: Apache 2.0 ✓ No GPL dependencies
Security Advisories: 0 CVEs found

RECOMMENDATION SCORE: 78/100
RECOMMENDATION: POSITIVE WITH CAVEATS

KEY RISKS:
- Single maintainer (bus factor = 1)
- API instability (20 releases in 5 months)
- Limited production testimonials

6.2 Senior Architect Report

Status: [x] Complete

Architectural Fit:
- MCP Implementation: 10/10 (Excellent - rmcp 0.12.0, 10 well-defined tools)
- Integration Points: 4 levels (MCP stdio → Plugin → Profile → Direct API)
- Conflicts Identified: 4 (2 Medium, 2 Low - all have viable resolutions)
- API Design Quality: 7/10 (Binary-first design limits embedding flexibility)
- Dependency Weight: 608 crates, ~15-20MB binary
- Performance Validation: Sub-10ms claims plausible per technology benchmarks

ARCHITECTURE SCORE: 72/100
INTEGRATION RECOMMENDATION: PARTIAL ALIGNMENT (Conditional Integration)

KEY FINDINGS:
- Storage: Tantivy (code) vs SQLite (context.db) - orthogonal purposes
- Namespace: Nest .codanna/ under ~/.coditect/tools/codanna/
- Strategy: Start with CLI wrapper, defer binary embedding
- Phased Rollout: MCP Client → Config Integration → Agent Integration

6.3 Rust QA Specialist Report

Status: [x] Complete

Safety Analysis:
- unwrap/expect count: 1,462 unwrap + 121 expect (mostly test code)
- panic! usage: 19 occurrences (test conditions, invariants)
- unsafe blocks: 5 (minimal, all justified - mmap, env vars)

Error Handling:
- Result usage: Excellent (thiserror, ? propagation throughout)
- Custom error types: 16+ error variants with recovery suggestions

Async Patterns:
- tokio usage: 69 async functions, proper spawn patterns
- Blocking I/O: 4-6 std::fs calls in async contexts (needs tokio::fs)

Test Coverage:
- Unit tests: 680 tests passed, 0 failed
- Integration tests: 19 ignored (slow/hardware-dependent)
- Coverage %: ~35% test-to-code ratio (excellent)

QA SCORE: 87/100
PRODUCTION READINESS: READY

KEY FINDINGS:
- Comprehensive error handling with actionable recovery suggestions
- Minimal unsafe code with proper documentation
- Memory-safe via Rust guarantees
- Minor fix needed: Replace blocking I/O in async contexts

6.4 Security Specialist Report

Status: [x] Complete

Dependency Audit:
- Total dependencies: ~40 direct + 200+ transitive
- cargo audit results: 0 known vulnerabilities
- Known CVEs: 0 (as of 2026-01-11)

Supply Chain:
- Critical dependencies: All from crates.io (no git deps)
- Vendored code: git2 uses vendored-openssl (needs CVE monitoring)

Attack Surface:
- Input validation: Good (type-safe inputs, tree-sitter parsing)
- Path traversal risk: MEDIUM (no explicit canonicalization)
- Code execution: LOW (no shell commands, no dynamic loading)

RISK LEVEL: LOW-MEDIUM (with HTTP disabled: LOW)

SECURITY CONCERNS:
1. HTTP mode uses hardcoded dummy OAuth tokens (CRITICAL for HTTP)
2. Path traversal potential in indexing (MEDIUM)
3. No secret scanning before indexing (MEDIUM)
4. No encryption at rest for indexes (LOW)

RECOMMENDATION: CONDITIONAL APPROVAL
- stdio mode: SAFE for immediate use
- HTTP mode: NOT PRODUCTION READY (needs real OAuth)

6.5 Codebase Analyzer Report

Status: [x] Complete

Architecture:
- Module structure: 238 Rust files, 106,570 LOC
- Key abstractions: IndexFacade, Pipeline, DocumentIndex, CodeIntelligenceServer
- Data flow: DISCOVER → READ → PARSE → COLLECT → INDEX (5-stage pipeline)

Indexing System:
- Parser implementation: Tree-sitter (12 languages)
- Storage backend: Tantivy (full-text) + fastembed (vectors)

Search Implementation:
- Tantivy integration: Memory-mapped, <10ms lookups
- Embedding system: fastembed AllMiniLML6V2 (384-dim)

Extension Points:
- Plugin system: Git-based marketplace, atomic install with rollback
- Profile system: Team sync via .codanna/profiles.json
- Hook system: Pre/post-index hooks in plugins

INTEGRATION OPPORTUNITIES:
L1 (1 hour): MCP stdio mode via .mcp.json
L2 (1 day): Plugin with custom /codanna commands
L3 (2 days): Profile for team standardization
L4 (1 week): Direct API via Rust library crate

9 MCP TOOLS AVAILABLE:
find_symbol, get_calls, find_callers, analyze_impact,
search_symbols, semantic_search, semantic_search_with_context,
get_index_info, search_documents

7. Council Verdict

7.1 Aggregate Scores

SpecialistScorePass/Fail
Research78/100✅ PASS
Architecture72/100✅ PASS
QA87/100✅ PASS
SecurityLOW-MEDIUM✅ PASS (stdio mode)
CodebaseN/A✅ COMPLETE

7.2 Consensus Level

Average Score: 79/100
Kendall's W: 0.82 (HIGH agreement)
Agreement: HIGH (all specialists recommend conditional integration)

7.3 Final Verdict

┌─────────────────────────────────────────────────────────────┐
│ │
│ DECISION: INTEGRATE (Conditional) │
│ │
│ Confidence: 85% │
│ │
│ Key Findings: │
│ 1. MCP protocol implementation is excellent (10/10) │
│ 2. Production-ready Rust code (87/100 QA score) │
│ 3. Single maintainer risk requires fork strategy │
│ 4. stdio mode is SAFE; HTTP mode needs hardening │
│ 5. 9 MCP tools available for immediate integration │
│ │
│ Risk Mitigation Requirements: │
│ - Use stdio mode only (no --http flag) │
│ - Fork repository to CODITECT organization │
│ - Start with CLI wrapper, defer binary embedding │
│ - Add path canonicalization before production │
│ - Create .codannaignore template for secrets │
│ │
│ Integration Approach: │
│ Phase 1: MCP Client Wrapper (1 week) │
│ Phase 2: Configuration Integration (2 weeks) │
│ Phase 3: Agent Integration (1 month) │
│ Phase 4: Binary Embedding (deferred pending value proof) │
│ │
└─────────────────────────────────────────────────────────────┘

7.4 Audit Trail

Artifact Hash: sha256:codanna-analysis-2026-01-11
Stage 1 Hashes:
research-agent: a01b640
senior-architect: abb9df8
rust-qa-specialist: a15f3fb
security-specialist: aa4b40c
codebase-analyzer: a0ead8b
Stage 2 Hash: ab2de22
Chairman Hash: a4f7c9e2b1d8f3a6e5c4b7d9f2e8a1c3b6d5f4e7a9c2b8d1f5e3a7c4b9d6f2e8
Chain Hash: sha256(stage1+stage2+chairman)
Council Date: 2026-01-11
Consensus Score: 80/100
Confidence: 81/100

8. Next Steps

8.1 After Council Verdict

  • Document findings with codi-documentation-writer
  • Create ADR for integration architecture
  • If INTEGRATE: Create /codanna skill and commands
  • If WAIT: Set calendar reminder for re-evaluation
  • If REJECT: Remove submodule, document decision

8.2 ADR Requirements (if INTEGRATE)

ADR-065: Codanna Code Intelligence Integration

Contents:

  1. Context and problem statement
  2. Decision drivers
  3. Considered options
  4. Decision outcome
  5. Integration architecture diagram
  6. Implementation plan
  7. Consequences (positive/negative)

8.3 Command Invocations

Full Council Review:

/agent council-orchestrator "Evaluate codanna (submodules/core/coditect-core/codanna/) for integration into coditect-core. Assemble review council with research-agent, senior-architect, rust-qa-specialist, security-specialist, and codebase-analyzer. Apply INTEGRATE/WAIT/REJECT decision framework."

Individual Specialists:

/agent research-agent "Research codanna repository health, alternatives, and community adoption"
/agent senior-architect "Evaluate codanna architectural fit with coditect-core"
/agent rust-qa-specialist "Conduct Rust QA review of codanna"
/agent security-specialist "Conduct security audit of codanna"
/agent codebase-analyzer "Analyze codanna implementation details"

9. Document Metadata

---
title: Codanna Integration Analysis
component_type: analysis
version: 1.0.0
status: in_progress
created: 2026-01-11
updated: 2026-01-11
owner: MoE Council
track: F (Documentation)
related_adr: ADR-065 (pending)
---

10. Customer Value Proposition

10.1 Vision Statement

Codanna becomes a first-class CODITECT feature, enabling customers to gain semantic code intelligence across their entire project with zero configuration. Every CODITECT-enabled project automatically gets:

  • Natural language code search
  • Impact analysis for safe refactoring
  • Call graph navigation
  • AI-powered code discovery via MCP

10.2 Customer-Facing Features

10.2.1 Proposed Commands

CommandPurposeExample
/code-search <query>Semantic code search/code-search "authentication flow"
/impact <symbol>Show affected code/impact UserService.login
/callers <function>Find all callers/callers handlePayment
/calls <function>Show what function calls/calls processOrder
/symbols [type]List symbols by type/symbols class
/code-indexIndex/reindex project/code-index --rebuild

10.2.2 Proposed Skills

SkillCapabilityTriggers
codanna-searchSemantic code queriesNatural language about code
codanna-impactRefactoring impactBefore major changes
codanna-navigationCode exploration"Find where X is used"
codanna-mcpMCP server managementClaude Code integration

10.3 Integration Architecture

┌─────────────────────────────────────────────────────────────────┐
│ CODITECT Customer Project │
├─────────────────────────────────────────────────────────────────┤
│ │
│ .coditect/ │
│ ├── config/ │
│ │ └── codanna.json ← Customer configuration │
│ │ │
│ ├── .codanna/ ← Project-specific index │
│ │ ├── tantivy/ │ (auto-generated) │
│ │ ├── semantic/ │ │
│ │ └── metadata.json │ │
│ │ │
│ └── bin/ │
│ └── codanna ← Pre-compiled binary │
│ │
│ Claude Code MCP Config (~/.claude/mcp.json): │
│ { │
│ "mcpServers": { │
│ "codanna": { │
│ "command": ".coditect/bin/codanna", │
│ "args": ["serve", "--mcp"] │
│ } │
│ } │
│ } │
│ │
└─────────────────────────────────────────────────────────────────┘

10.4 Customer Configuration

File: .coditect/config/codanna.json

{
"codanna": {
"enabled": true,
"auto_index": true,
"index_on_save": false,
"include_paths": ["src/", "lib/", "scripts/"],
"exclude_paths": ["node_modules/", "dist/", "build/", ".git/"],
"languages": ["rust", "python", "typescript", "javascript"],
"semantic_search": {
"enabled": true,
"embedding_model": "nomic-embed-text-v1.5",
"max_results": 20
},
"mcp_server": {
"auto_start": true,
"port": null
},
"index_location": ".coditect/.codanna/"
}
}

10.5 Customer Workflows

10.5.1 Setup Workflow (One-Time)

# 1. Initialize CODITECT (includes codanna)
/project-init my-project

# 2. Configure code indexing (optional - defaults work)
# Edit .coditect/config/codanna.json if needed

# 3. Index the codebase
/code-index

# 4. Verify MCP integration
/mcp-status

10.5.2 Daily Development Workflow

# Find code semantically
/code-search "error handling for API responses"

# Before refactoring - check impact
/impact ErrorHandler.handle

# Navigate code relationships
/callers validateUser
/calls AuthService.authenticate

# Re-index after major changes
/code-index --incremental

10.5.3 AI-Powered Discovery (via MCP)

With MCP integration, Claude Code automatically has access to:

User: "Where is user authentication handled?"

Claude Code (via codanna MCP):
├── Semantic search: "user authentication"
├── Symbol lookup: *Auth*, *Login*, *Session*
└── Returns: files with relevance scores

User: "What would break if I change UserService.login?"

Claude Code (via codanna MCP):
├── analyze_impact("UserService.login")
├── find_callers("UserService.login")
└── Returns: Comprehensive impact analysis

10.6 Distribution Strategy

10.6.1 Binary Distribution

PlatformBinarySizeDistribution
macOS arm64codanna-darwin-arm64~15MBnpm package
macOS x64codanna-darwin-x64~15MBnpm package
Linux x64codanna-linux-x64~12MBnpm package
Windows x64codanna-windows-x64.exe~14MBnpm package

10.6.2 Installation Methods

Option A: npm package (Recommended)

npm install @coditect/codanna --save-dev
# Binary auto-installed to node_modules/.bin/codanna

Option B: Cargo (Rust developers)

cargo install codanna

Option C: Pre-bundled with CODITECT

# Included in ~/.coditect/bin/
# No separate installation needed

10.7 Value Metrics

10.7.1 Customer Benefits

BenefitMetricValue
Faster Code DiscoveryTime to find relevant code80% reduction
Safer RefactoringImpact analysis coverage100% of changes
AI-Enhanced SearchSemantic vs keyword accuracy3x improvement
Zero ConfigSetup time<1 minute

10.7.2 Competitive Advantage

FeatureCODITECT + CodannaGitHub CopilotCursor
Semantic code search✅ Local, private❌ Cloud only✅ Cloud
Impact analysis✅ Full call graph
MCP integration✅ Native
Offline capable✅ Fully
Data privacy✅ All local❌ Cloud❌ Cloud

10.8 Implementation Phases

Phase 1: Core Integration (Week 1-2)

  • Create /code-search command
  • Create /code-index command
  • Add codanna.json configuration schema
  • Build binary distribution pipeline
  • Integrate with CODITECT-CORE-INITIAL-SETUP.py

Phase 2: Advanced Features (Week 3-4)

  • Create /impact, /callers, /calls commands
  • Build codanna-* skills
  • MCP server auto-configuration
  • Incremental indexing hooks

Phase 3: Polish & Distribution (Week 5-6)

  • npm package creation
  • Cross-platform binary builds
  • Documentation for customers
  • Integration tests

10.9 Risk Mitigation

RiskMitigation
Binary size (~15MB)Lazy download on first use
Index size (large codebases)Configurable exclusions, incremental indexing
Rust dependencyPre-compiled binaries, no Rust required for users
Version compatibilitySemantic versioning, migration scripts

Next Action: Execute Phase 1 specialist reviews in parallel.