Spine
Turn any repository into a queryable Program Knowledge Graph — symbols, calls, imports, database schema, and documentation, as universal facts that carry provenance back to the line they came from.
Extraction is deterministic and model-free. The same commit in always yields the same facts out, so the output is diffable, cacheable, and safe to gate CI on.
pip install spine-pkg
spine extract .
Commands
spine extract [path] |
Scan a repo, print a summary. --query <symbol> shows callers and blast radius; --json dumps facts. |
spine verify [path] |
Check graph invariants — dangling edges, unresolvable provenance, unjoined imports. Exits non-zero on error, so it can stand guard in CI. |
spine export [path] |
Export the whole graph as sqlite, graphml, dot, or json. Never truncated. |
spine docs [path] -d FILE |
Reconcile documentation claims against the code graph and report drift. |
spine languages |
Show which language front-ends are active in this install. |
spine media extract PATHS |
OCR images and transcribe audio/video into reviewable artifacts. Opt-in; see below. |
Languages
Python works out of the box with no extra dependencies. Every other front-end lazy-imports its parser, so the base install stays small and you pay only for what you use:
pip install 'spine-pkg[java]' # or typescript, csharp, c, cpp, go, sql
pip install 'spine-pkg[all]' # every front-end at once
If a language's extra isn't installed, its files are invisible to the graph rather
than an error — so spine extract counts them and tells you what to install:
Scanned . — 0 grounded nodes, 0 external, 0 edges.
! 103 Go file(s) found but NOT extracted — install the front-end: pip install 'spine-pkg[go]'
spine languages shows the same thing ahead of time. Both warnings go to stderr, so
extract --json and export stay pipe-safe.
Documents and media
Markdown, reStructuredText, plain text, and HTML parse with the standard library.
PDF needs [docs]; Word and Excel need [office].
spine media extract is deliberately separate from the graph build. It MAY run a
model and be slow, so it is explicit and opt-in: it writes reviewable artifacts under
.spine-media/ that you commit, and the deterministic extractor only ever reads
those. Image OCR ([media], plus a system tesseract binary) and --asr local
([asr]) run entirely on your machine. --asr api uploads audio and video
off-machine and refuses to run without an explicit --allow-remote.
Caching
Facts are cached per commit under ~/.cache/spine/, and the cache is trusted only on
a clean working tree — a dirty tree always re-extracts, because a stale graph is
worse than a slow one.
Design notes
- The graph is the source of truth. Consumers render facts; they never re-derive
them from paths or filenames. A new fact means extending
facts.pyand the front-ends, not the renderer. - Bounded output is honest output. Aggregations cap their results and record what was elided. Exports are the exception — they are always complete, because the point of handing the graph to another tool is that its filtering is better than ours.
- Local paths only.
spinescans a checkout on disk and never clones for you.
License
MIT
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file spine_pkg-0.0.1.tar.gz.
File metadata
- Download URL: spine_pkg-0.0.1.tar.gz
- Upload date:
- Size: 152.6 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
ee342137864f95b40d1a10c89d47a7009b0e68c7cc3b3b1080305674514a4715
|
|
| MD5 |
cd55e6fa2f4f9421b3a02b9ed1796e29
|
|
| BLAKE2b-256 |
cea4fee42efe60e6efbce48d7ad427016cb98c9f655228be2b3e7727dcd3f79f
|
Provenance
The following attestation bundles were made for spine_pkg-0.0.1.tar.gz:
Publisher:
release.yml on synaptixs/spine-pkg
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
spine_pkg-0.0.1.tar.gz -
Subject digest:
ee342137864f95b40d1a10c89d47a7009b0e68c7cc3b3b1080305674514a4715 - Sigstore transparency entry: 2335680587
- Sigstore integration time:
-
Permalink:
synaptixs/spine-pkg@123d341ba38078078a98864737159466b05a1288 -
Branch / Tag:
refs/tags/v0.0.1 - Owner: https://github.com/synaptixs
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@123d341ba38078078a98864737159466b05a1288 -
Trigger Event:
push
-
Statement type:
File details
Details for the file spine_pkg-0.0.1-py3-none-any.whl.
File metadata
- Download URL: spine_pkg-0.0.1-py3-none-any.whl
- Upload date:
- Size: 125.4 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
e2550447e13e8d162436ce5c7052c628ab5b72aaca8ef94de73cb007a3440d8b
|
|
| MD5 |
ffa19fa736dfd4ea3ebc91673c680988
|
|
| BLAKE2b-256 |
ea3693e8cf51b765469bb189df1e152b8ddacd9f1ce175af3c994dd7cd72dd27
|
Provenance
The following attestation bundles were made for spine_pkg-0.0.1-py3-none-any.whl:
Publisher:
release.yml on synaptixs/spine-pkg
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
spine_pkg-0.0.1-py3-none-any.whl -
Subject digest:
e2550447e13e8d162436ce5c7052c628ab5b72aaca8ef94de73cb007a3440d8b - Sigstore transparency entry: 2335680598
- Sigstore integration time:
-
Permalink:
synaptixs/spine-pkg@123d341ba38078078a98864737159466b05a1288 -
Branch / Tag:
refs/tags/v0.0.1 - Owner: https://github.com/synaptixs
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@123d341ba38078078a98864737159466b05a1288 -
Trigger Event:
push
-
Statement type:
