fix(report): portable basename in GRAPH_REPORT.md header, not the host absolute path (#2628)

[ousamabenyounes]

Summary

Fix #2628

GRAPH_REPORT.md's header interpolated the scan root verbatim
(report.py:104), so passing an absolute root baked the build machine's full
path into a tracked artifact:

# Graph Report - /Users/<user>/dev/apps/<project>  (2026-08-03)

The same graph then produces different bytes on different machines and the host
directory layout ends up in git history. This is the same class of defect as
#2598 (fixed for graph.html's <title> in 0.9.40).

The fix labels the header with the project directory basename via a small
_portable_root_label() helper, so graphify update ., graphify update ./proj,
and graphify update /abs/path/proj all render proj — portable and stable
across machines, no filesystem access for absolute inputs.

Reproduces with

On unmodified v8, report.generate(..., root="/Users/mike/dev/apps/secretproj")
yields:

# Graph Report - /Users/mike/dev/apps/secretproj  (2026-08-12)

Test verification (RED → GREEN)

Two new tests in tests/test_report.py
(test_report_header_does_not_embed_host_absolute_path, test_portable_root_label).

RED — new tests on v8 with the fix reverted (report.py only):

FAILED tests/test_report.py::test_report_header_does_not_embed_host_absolute_path
FAILED tests/test_report.py::test_portable_root_label - ImportError: cannot import name '_portable_root_label'
2 failed

GREEN — with the fix:

tests/test_report.py::test_report_header_does_not_embed_host_absolute_path PASSED
tests/test_report.py::test_portable_root_label PASSED
2 passed

Full suite (Python 3.13, local): 4330 passed, 3 skipped; the only failures are
3 pre-existing, environment-dependent test_ollama.py backend-detection tests
that also fail on unmodified v8 (local ollama present) — no new failures, no
regressions. skillgen --check/--audit-coverage/--schema-singleton/
--monolith-roundtrip/--always-on-roundtrip and the graphify --help/install
smoke all pass.

Files changed

File	Change
graphify/report.py	add _portable_root_label(); use it in the header
tests/test_report.py	RED→GREEN tests for the header + helper
CHANGELOG.md	entry under 0.9.41 keyed to #2628

[graphify-labs]

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

---

Graphify review — findings

This PR modifies how the GRAPH_REPORT.md header is generated in graphify/report.py. It adds a new _portable_root_label helper that reduces the root argument to the project directory's basename (stripping absolute path prefixes, handling trailing slashes and degenerate cases like ./..), and uses it in the header line instead of the raw root value. A changelog entry and two new tests (covering the header behavior and the helper across POSIX/Windows/relative inputs) are also added.

No blocking issues surfaced. 2 lower-confidence candidates did not survive cross-model review.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 475 functions depend on the 217 functions this change touches.

Health — this change adds coupling hotspots:

• worse: generate() — 30 callers, 6 callees
• worse: make_inputs() — 14 callers, 5 callees

Verification — 475 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 335 function(s) in the blast radius were not formally verified this run

· 2 more finding(s) on lines outside this diff (see the check run).

[safishamsi]

Shipped in v0.9.42 (graphifyy==0.9.42 on PyPI). Portable basename in the GRAPH_REPORT header. Credited in the release notes. Thanks @ousamabenyounes!