Key a node on the code it reaches, not on the repository around it

`sync` follows each node function's imports through the project's own modules
— stopping at the standard library, at anything installed, and at Fluksio
itself, whose checkout would otherwise be most of every digest — and records
the file list with what it hashed to. The engine hashes those files again when
the run is claimed, so the fingerprint is live rather than a snapshot, and
falls back to what sync recorded when it cannot see them: a remote worker's
runs used to share one empty digest, and therefore one key.

Three things follow. Editing a helper a node calls into re-runs that node, as
before. Editing something the node never reaches no longer re-runs anything —
a notebook two directories away was invalidating every arm. And
`Run.code_digest` is now the hash of its nodes' digests, so it is neither
looser nor tighter than "the code behind these numbers", which is what makes
it worth joining an exported table on.

`sync` says so too: it compares the per-node digest against the stored one, so
a helper edit prints `train: updated (flow, fit)` instead of `unchanged`. The
digest is read when the document is built rather than when the flow is
declared, so a second `sync()` in one process sees an edit between them.

Also: `fluksio runs` shows only the inputs that differ from what the flow
declares, fitted to the terminal, so a flow taking a few kB of json no longer
wraps every line.

Every existing cache entry misses once — the fingerprint changed shape.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A9Hdrmf2cwNABCnE5x9UJa

backend/fluksio/sdk/imports.py

@@ -0,0 +1,155 @@
+"""What code a node actually reaches, so a cache key can name it.
+
+A node's stored body is a shim that imports the real function, so it says
+nothing about what that function calls into. Hashing the whole repository
+instead says too much: it moves when a notebook two directories away does,
+which makes the digest neither necessary nor sufficient for "this run's
+numbers came from that code".
+
+This walks the imports out from the module a node's function lives in and
+stops at anything installed or standard, so what is left is the project's own
+code — including a package installed editable from its own checkout, whose
+files are its source rather than a copy under `site-packages`.
+
+The walk is static: it reads the imports out of each file rather than running
+it. A module imported by a name the code computes is therefore not followed,
+which is the same limit the yield check has, and for the same reason.
+"""
+
+from __future__ import annotations
+
+import ast
+import hashlib
+import importlib.util
+import sys
+import sysconfig
+from collections.abc import Iterator
+from pathlib import Path
+from typing import Any
+
+__all__ = ["digest_of", "reached"]
+
+
+#: Never the project's own code, however it happens to be installed. Every
+#: node's module imports the authoring API, and from a checkout or an editable
+#: install that is a source tree like any other — so without this, a node's
+#: digest is mostly this tool, and upgrading it invalidates every cache entry
+#: anybody has.
+_SELF = frozenset({"fluksio", "fluksio_worker"})
+
+
+def _foreign() -> tuple[str, ...]:
+    """Where code that is not the project's lives.
+
+    The standard library and whatever `pip install` copied. An editable
+    install is deliberately not here: its files are the checkout, and a
+    checkout is somebody's code.
+    """
+    roots = {
+        path
+        for key in ("stdlib", "platstdlib", "purelib", "platlib")
+        if (path := sysconfig.get_paths().get(key))
+    }
+    roots.update(
+        entry
+        for entry in sys.path
+        if entry.endswith(("site-packages", "dist-packages"))
+    )
+    return tuple(sorted(roots))
+
+
+def _project_file(name: str, foreign: tuple[str, ...]) -> Path | None:
+    """The file a dotted module is, if it is the project's own python."""
+    module = sys.modules.get(name)
+    origin = getattr(module, "__file__", None) if module is not None else None
+    if origin is None:
+        try:
+            spec = importlib.util.find_spec(name)
+        except (ImportError, ValueError, AttributeError):
+            return None
+        origin = spec.origin if spec is not None else None
+    if not origin or not origin.endswith(".py"):
+        return None
+    return None if origin.startswith(foreign) else Path(origin)
+
+
+def _package_of(name: str, path: Path) -> str:
+    """The package a relative import inside this module resolves against."""
+    return name if path.name == "__init__.py" else name.rpartition(".")[0]
+
+
+def _imported(tree: ast.AST, package: str) -> Iterator[str]:
+    """Every module name a file imports, relative ones resolved.
+
+    `from pkg import thing` yields both `pkg` and `pkg.thing`, since only
+    trying to resolve them says which of the two `thing` is.
+    """
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                yield alias.name
+        elif isinstance(node, ast.ImportFrom):
+            base = node.module or ""
+            if node.level:
+                parts = package.split(".") if package else []
+                parts = parts[: len(parts) - (node.level - 1)]
+                base = ".".join([*parts, base]) if base else ".".join(parts)
+            if not base:
+                continue
+            yield base
+            for alias in node.names:
+                yield f"{base}.{alias.name}"
+
+
+def reached(fn: Any) -> dict[str, str]:
+    """The project modules ``fn``'s own module reaches, itself included.
+
+    Dotted name to the file it is on this machine — the name is what the
+    digest is keyed on, so an engine hashing the same code arrives at the same
+    answer; the path is how it finds the file.
+    """
+    start = getattr(fn, "__module__", "")
+    if not start:
+        return {}
+    foreign = _foreign()
+    found: dict[str, str] = {}
+    queue = [start]
+    while queue:
+        name = queue.pop()
+        if name in found or name.partition(".")[0] in _SELF:
+            continue
+        path = _project_file(name, foreign)
+        if path is None:
+            continue
+        try:
+            tree = ast.parse(path.read_bytes())
+        except (OSError, SyntaxError, ValueError):
+            continue
+        found[name] = str(path)
+        queue.extend(_imported(tree, _package_of(name, path)))
+        # The packages above it, whose `__init__` runs on the way to importing
+        # this module and is as much a part of what it does as an import is.
+        parts = name.split(".")[:-1]
+        queue.extend(".".join(parts[: index + 1]) for index in range(len(parts)))
+    return found
+
+
+def digest_of(files: dict[str, str]) -> str:
+    """What those modules hash to now, or empty if one is not readable here.
+
+    All or nothing: a digest over the half of the code an engine happens to
+    have would be a confident answer to a question it cannot see.
+    """
+    if not files:
+        return ""
+    digest = hashlib.sha256()
+    for name, path in sorted(files.items()):
+        try:
+            body = Path(path).read_bytes()
+        except OSError:
+            return ""
+        digest.update(name.encode())
+        digest.update(b"\0")
+        digest.update(body)
+        digest.update(b"\0")
+    return digest.hexdigest()