Add /flow — capture, link, and draw investigation flows

[barkz]

Adds /flow — a local capture layer that records the investigations you run, enriches their citations with real document text, and finds the connections between them.

Replaces the "coming soon" teaser on main with the real thing.

The case it exists for

Two conversations that share no vocabulary, connected anyway:

  ●─ 1  what happened in the checkout incident?
  │     ▪ confluence Postmortem: Checkout Latency Incident (INC-1183)
  │     ▪ jira       INC-1183 — Elevated 5xx on checkout API
  │
  ├──◆ linked-document  0.60  →  2 ──────────────────────────────
  │    Postmortem: Checkout Latency Incident (INC-1183)
  │      ↓  shares: incident, checkout
  │    Customer QBR — Northwind Retail
  │
  ●─ 2  what are the risks going into the Northwind renewal?

Neither conversation mentions the other. The QBR refers to "the checkout incident" in prose — no ticket number, nothing to join on.

How it works

Capture hooks GleanClient._post, so every Client API call is recorded through one funnel. Chat turns group by the chatId the API returns, making threading exact rather than time-guessed.

Linking runs in three tiers, and every link stores its evidence so it can be explained rather than asserted:

1. Identifier — a shared ticket key or repo reference. Exact, score 1.0
2. Phrase — a shared bigram, or a word from one document's title appearing in the other's text. The title anchor is what makes it precise: ranking by rarity alone surfaces accidents like "across" and "percent", while a title is a curated human label, so prose echoing one is a genuine reference
3. Session — two sessions connect through a shared citation, or through a document cited by one that links to a document cited by the other

Privacy

Data lives in ~/.gleancode/flow.db (0600), partitioned by instance, mode, and act_as, so fictional corpus rows can never link to real tenant content.

Capture defaults to mock only. In live mode this file becomes a copy of company content with the permission model stripped off, so recording there is a deliberate act via flow_capture rather than a default.

Rendering

/flow show draws a rail. Connections are ordered by what they tell you, not by score — a shared-citation link scores 1.00 and says only "you ran this twice", while the linked-document link that found something scores lower. Colour is decoration only: piped or under NO_COLOR the glyphs still carry the structure, and no line exceeds the terminal width at any size.

/flow timeline renders the same graph as a self-contained HTML page with no external references.

Also in here

• Three MCP tools — get_flow, get_flow_summary, get_flow_collapsed
• Per-datasource colours in ui.py, so a source looks the same wherever it appears. Unknown sources fall back to grey rather than impersonating a known one
• width on ui.rule()
• Fixes mock /getdocuments returning no document content

Tests

835 total, 58 new in tests/test_flow.py — capture gating, linking, partition isolation, ordering, the schema migration, and the renderer at four terminal widths with colour on and off.

Full guide: docs/FLOW_MAPPER.md

🤖 Generated with Claude Code