build(deps): update crawlkit to v0.16.7

[vincentkoc]

What Problem This Solves

Gitcrawl still pins Crawlkit v0.16.6 instead of the current consumable v0.16.7 module.

User Impact

User impact: no CLI or storage contract changes; Gitcrawl stays current with the shared crawler toolkit.

Why This Change Was Made

Updates only go.mod and go.sum. The patch is API-compatible and carries Crawlkit sidecar case-rename correctness forward.

Evidence

• Focused store, config, provider, CLI, and vector tests passed.
• Module verification passed.
• Hosted exact-head checks are tracked on this draft; local make check also identified a pre-existing gofmt finding outside this diff.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 1, 2026, 4:24 AM ET / 08:24 UTC.

ClawSweeper review

What this changes

Updates Gitcrawl’s shared Crawlkit library to v0.16.7 and replaces its module checksums.

Merge readiness

✅ Ready for maintainer review

The update remains useful: current main and v0.14.0 still pin Crawlkit v0.16.6. No introduced correctness or security defect was found, and the MEMBER-authored PR is protected from automatic closure.

Priority: P3
Reviewed head: 815b830835e7924b36d7b226b3288b77165b7c6c

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency update with compatible upstream changes and no identified blocking defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: The MEMBER-authored update is exempt from ordinary contributor runtime proof. The upstream change preserves public and stored-format contracts, and Gitcrawl has no direct caller of the changed sidecar routine; reported tests remain supplemental.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The MEMBER-authored update is exempt from ordinary contributor runtime proof. The upstream change preserves public and stored-format contracts, and Gitcrawl has no direct caller of the changed sidecar routine; reported tests remain supplemental.
Evidence reviewed	7 items	Exact introduced change: The pinned introduction changes only the Crawlkit requirement from v0.16.6 to v0.16.7 and its two checksums; the module-file checksum is unchanged. The verified test-merge delta has the same two files and three additions/deletions. Still necessary on main: The fetched main revision requires Crawlkit v0.16.6 and is tagged v0.14.0. Recent pull-request metadata shows the preceding v0.16.6 update merged, with no merged v0.16.7 replacement. Affirmative dependency contract: Gitcrawl directly imports Crawlkit store and configuration packages, establishing that the dependency’s compatibility contract applies. Its source has no direct import of Crawlkit snapshot or call to SyncSidecarTree.
Findings	None	None.
Security	None	None.

How this fits together

Gitcrawl mirrors GitHub conversations into a local searchable archive. Crawlkit supplies shared configuration, SQLite, remote-access, and vector helpers used by that workflow.

flowchart LR
  A[GitHub conversations] --> B[Gitcrawl sync]
  C[Crawlkit library] --> B
  C --> D[Local archive helpers]
  B --> D
  D --> E[SQLite archive]
  E --> F[Search and terminal browser]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Consume the published Crawlkit patch through the existing module requirement without adding application-specific changes.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is dependency maintenance, and no current Gitcrawl failure is reported.

Is this the best way to solve the issue?

Yes: changing the existing module pin and matching checksums is the narrowest way to consume this API-compatible patch.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against bd95ddeb1e3f.

Labels

Label changes:

• add P3: This is a narrowly scoped dependency maintenance update with no demonstrated urgent Gitcrawl regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The MEMBER-authored update is exempt from ordinary contributor runtime proof. The upstream change preserves public and stored-format contracts, and Gitcrawl has no direct caller of the changed sidecar routine; reported tests remain supplemental.

Label justifications:

• P3: This is a narrowly scoped dependency maintenance update with no demonstrated urgent Gitcrawl regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The MEMBER-authored update is exempt from ordinary contributor runtime proof. The upstream change preserves public and stored-format contracts, and Gitcrawl has no direct caller of the changed sidecar routine; reported tests remain supplemental.

Evidence

What I checked:

• Exact introduced change: The pinned introduction changes only the Crawlkit requirement from v0.16.6 to v0.16.7 and its two checksums; the module-file checksum is unchanged. The verified test-merge delta has the same two files and three additions/deletions. (go.mod:13, 815b830835e7)
• Still necessary on main: The fetched main revision requires Crawlkit v0.16.6 and is tagged v0.14.0. Recent pull-request metadata shows the preceding v0.16.6 update merged, with no merged v0.16.7 replacement. (go.mod:13, bd95ddeb1e3f)
• Affirmative dependency contract: Gitcrawl directly imports Crawlkit store and configuration packages, establishing that the dependency’s compatibility contract applies. Its source has no direct import of Crawlkit snapshot or call to SyncSidecarTree. (internal/store/store.go:15, 815b830835e7)
• Upstream release delta: The complete version comparison contains only changelog changes, snapshot/sidecar.go, and its new regression tests. The fix resolves on-disk filename spelling before pruning while preserving manifest spelling; exported APIs, module requirements, and stored schemas are unchanged. (snapshot/sidecar.go:119, 33d2d16c9b97)
• Dependency policy and tag identity: Read the full dependency AGENTS.md because this PR consumes its module. Its guidance favors stable APIs and published tags. The v0.16.7 annotated tag resolves to this commit; the inspected update preserves public APIs and module requirements. (AGENTS.md:1, 33d2d16c9b97)
• Merged dependency-update history: Main history records Peter Steinberger’s recent Crawlkit updates and Vincent Koc’s earlier merged update. GitHub confirms build(deps): update crawlkit to v0.16.6 #223 and chore: update CrawlKit to v0.15.0 #176 merged. Historical blob reads for blame and older patches failed through the promisor remote; routing uses available logs and verified PR metadata rather than introduction claims. (go.mod, d8d19effd37d)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.