fix(k8s): restore Resource label so the K8s pipeline produces nodes + INFRA_MAPS

An earlier relabel (extract_k8s.c Resource->Class, to satisfy labels-valid)
left pass_k8s.c filtering on label=='Resource' (line 391) — so it skipped every
K8s def and produced ZERO Resource nodes and ZERO INFRA_MAPS edges (7 make-test
failures + the consequent LeakSanitizer leak from those tests early-returning).
Fix the whole chain accurately: add 'Resource' to inv_label_valid (the def-label
allowlist), revert extract_k8s.c to emit 'Resource' (manifest + kustomize), so
pass_k8s.c matches -> Resource nodes + INFRA_MAPS restored. K8s repro goldens
updated Class->Resource to match. Also guard 3 vendored scanners' zero-length
memcpy (crystal/rescript/purescript) against UBSan NULL-nonnull (documented in
vendored MANIFEST.md).

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

Author: DeusData

internal/cbm/extract_k8s.c

@@ -179,7 +179,7 @@ static void emit_kustomize_kind_def(CBMExtractCtx *ctx, TSNode mapping) {
         CBMDefinition def = {0};
         def.name = cbm_arena_strdup(a, kind);
         def.qualified_name = cbm_arena_sprintf(a, "%s.%s", ctx->module_qn, kind);
-        def.label = cbm_arena_strdup(a, "Class");
+        def.label = cbm_arena_strdup(a, "Resource");
         def.file_path = ctx->rel_path;
         def.start_line = ts_node_start_point(mapping).row + TS_LINE_OFFSET;
         def.end_line = ts_node_end_point(mapping).row + TS_LINE_OFFSET;
@@ -334,10 +334,10 @@ static void extract_k8s_manifest(CBMExtractCtx *ctx) {
         CBMDefinition def = {0};
         def.name = cbm_arena_strdup(a, def_name);
         def.qualified_name = cbm_arena_sprintf(a, "%s.%s", ctx->module_qn, def_name);
-        // "Class" is the canonical def label for a K8s resource kind: "Resource"
-        // is not in the graph's known label set, so a resource def carrying it is
-        // dropped by downstream label validation.
-        def.label = cbm_arena_strdup(a, "Class");
+        // "Resource" is the canonical def label for a K8s resource kind. It is a
+        // valid graph label and is what the K8s pipeline pass (pass_k8s.c) filters
+        // on to upsert Resource nodes and emit INFRA_MAPS edges.
+        def.label = cbm_arena_strdup(a, "Resource");
         def.file_path = ctx->rel_path;
         def.start_line = ts_node_start_point(mapping).row + TS_LINE_OFFSET;
         def.end_line = ts_node_end_point(mapping).row + TS_LINE_OFFSET;

internal/cbm/vendored/grammars/MANIFEST.md

@@ -50,6 +50,18 @@ Guarded by the `contract_all_grammars_in_graph` graph-breadth test in
 | slang    | added to the C-family declarator-name gate (tree-sitter-cpp/hlsl fork) |
 | squirrel | `resolve_func_name`: `function_declaration` → `identifier` child |
 
+## Local source patches (applied atop pinned upstream)
+
+The grammars below carry a small local patch to their vendored `scanner.c`, on
+top of the pinned upstream commit recorded in the vendoring table below.
+Re-vendoring from upstream must re-apply these.
+
+| grammar | location | patch | reason |
+|---|---|---|---|
+| crystal    | `crystal/scanner.c`, serialize    | guard `memcpy(&buffer[offset], state->literals.contents, literal_content_size)` with `if (literal_content_size > 0)` | UBSan: zero-length `memcpy` with a NULL/0-size source on the empty-state serialize round-trip (formal UB, harmless) |
+| rescript   | `rescript/scanner.c`, deserialize | guard `memcpy(state, buffer, n_bytes)` with `if (n_bytes > 0)` | UBSan: zero-length `memcpy` with a NULL `buffer` / `n_bytes == 0` on empty-state deserialize (formal UB, harmless). The sibling serialize copies a fixed `sizeof(ScannerState)` (always > 0, non-NULL src) and needs no guard. |
+| purescript | `purescript/scanner.c`, serialize | guard `memcpy(buffer, indents->data, to_copy)` with `if (to_copy > 0)` | UBSan: zero-length `memcpy` with a NULL/0-size source when the indent vector is empty (formal UB, harmless) |
+
 ## Vendored from verified upstream
 
 | grammar | cur ABI | upstream repo | pinned commit | verdict | LICENSE |

internal/cbm/vendored/grammars/crystal/scanner.c

@@ -72,8 +72,8 @@
  *   STRUCTURAL WITH DEFS (dims 1-5 + R):
  *     DOCKERFILE     -- var_types = {env_instruction, arg_instruction} -> "Variable".
  *     GOMOD          -- var_types = {require_directive, replace_directive} -> "Variable".
- *     K8S            -- semantic extractor (cbm_extract_k8s); extracts kind -> "Class".
- *     KUSTOMIZE      -- semantic extractor (cbm_extract_k8s); extracts kind -> "Class".
+ *     K8S            -- semantic extractor (cbm_extract_k8s); extracts kind -> "Resource".
+ *     KUSTOMIZE      -- semantic extractor (cbm_extract_k8s); extracts kind -> "Resource".
  *
  *   CALLABLE (dims 1-6 + R, no pipeline):
  *     GN             -- call_types = {call_expression}; no func_types -> no Function def.
@@ -656,12 +656,12 @@ TEST(repro_grammar_build_just) {
  * Idiomatic Kubernetes manifest with a Deployment (apiVersion: apps/v1,
  * kind: Deployment). The K8s/Kustomize semantic extractor cbm_extract_k8s()
  * is called for CBM_LANG_K8S; it reads the kind field from the YAML tree and
- * maps it to a def with label "Class" and qualified_name based on the kind.
+ * maps it to a def with label "Resource" and qualified_name based on the kind.
  * The grammar itself reuses yaml grammar + yaml_var_types; the semantic layer
- * adds the kind-based "Class" def.
+ * adds the kind-based "Resource" def.
  *
- * Dims asserted: 1-5 + R ("Class" for the Deployment kind).
- * Dim 5 expected GREEN: "Class" def extracted by cbm_extract_k8s for the kind.
+ * Dims asserted: 1-5 + R ("Resource" for the Deployment kind).
+ * Dim 5 expected GREEN: "Resource" def extracted by cbm_extract_k8s for the kind.
  *   RED documents that the K8s semantic extractor is not minting the kind def.
  * Dims 6-8 SKIPPED: no call_types in the K8s spec; no pipeline.
  * Expected GREEN: dims 1-5. Robustness should pass.
@@ -695,19 +695,19 @@ TEST(repro_grammar_build_k8s) {
         "              value: info\n";
     static const char bad[] = "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name:";
     if (build_struct_battery("K8s", src, CBM_LANG_K8S, "deployment.yaml",
-                             "Class", NULL) != 0)
+                             "Resource", NULL) != 0)
         return 1;
     return build_robustness("K8s", bad, CBM_LANG_K8S, "deployment.yaml");
 }
 
 /* ── Kustomize ────────────────────────────────────────────────────────────────
  * Idiomatic kustomization.yaml: the Kustomize overlay tool's root file
  * (kind: Kustomization). cbm_extract_k8s() is called for CBM_LANG_KUSTOMIZE
- * just as for CBM_LANG_K8S; it should mint a "Class" def for the
+ * just as for CBM_LANG_K8S; it should mint a "Resource" def for the
  * "Kustomization" kind, which is the canonical Kustomize resource kind.
  *
- * Dims asserted: 1-5 + R ("Class" for the Kustomization kind).
- * Dim 5 expected GREEN: "Class" def for "Kustomization" from cbm_extract_k8s.
+ * Dims asserted: 1-5 + R ("Resource" for the Kustomization kind).
+ * Dim 5 expected GREEN: "Resource" def for "Kustomization" from cbm_extract_k8s.
  *   RED documents that the Kustomize path in the semantic extractor is broken.
  * Dims 6-8 SKIPPED: no call_types in the Kustomize spec; no pipeline.
  * Expected GREEN: dims 1-5. Robustness should pass.
@@ -738,7 +738,7 @@ TEST(repro_grammar_build_kustomize) {
         "      - PORT=8080\n";
     static const char bad[] = "apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:";
     if (build_struct_battery("Kustomize", src, CBM_LANG_KUSTOMIZE,
-                             "kustomization.yaml", "Class", NULL) != 0)
+                             "kustomization.yaml", "Resource", NULL) != 0)
         return 1;
     return build_robustness("Kustomize", bad, CBM_LANG_KUSTOMIZE,
                             "kustomization.yaml");

internal/cbm/vendored/grammars/purescript/scanner.c

@@ -42,7 +42,7 @@ static inline int inv_label_valid(const char *label) {
         "Function",  "Method",   "Class",     "Interface", "Struct",   "Enum",    "EnumMember",
         "Module",    "Variable", "Constant",  "Field",     "Trait",    "Type",    "TypeAlias",
         "Namespace", "Property", "Route",     "Macro",     "Union",    "Protocol","Mixin",
-        "Package",   "Object",   "Section",   "Impl",      "Annotation", NULL};
+        "Package",   "Object",   "Section",   "Impl",      "Annotation", "Resource", NULL};
     if (!label)
         return 0;
     for (const char **v = valid; *v; v++)