docs(readme): add pending Zoo Code integration

[taltas]

Summary

• add Zoo Code to the assistant platform table
• link directly to the Zoo Code repository
• describe the marketplace integration as pending upstream review
• preserve the no-mistakes pipeline fixes validated with OpenCode

Testing

• uv run pytest -q tests/test_extract.py::test_collect_files_skips_hidden tests/test_labeling.py::test_label_communities_batches_when_over_batch_size tests/test_ollama.py

[graphify-labs]

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

---

Graphify review — findings

This PR makes three unrelated changes across the codebase: 1. README: Adds a new row to the platform installation table for "Zoo Code," noting marketplace integration is pending upstream review. 2. graphify/llm.py: Adds an early-return in _ollama_host_is_link_local_or_metadata that returns False for localhost, ::1, and 127.* hosts before the existing blocklist checks run. 3. Tests: Adjusts two existing tests—test_collect_files_skips_hidden now checks path parts relative to the fixtures directory, and test_label_communities_batches_when_over_batch_size compares the batch sizes as a sorted list rather than in order. The surface area spans documentation, one SSRF/host-validation helper, and two test assertions. The large list of "changed symbols" appears to reflect line-shift noise in the diffing tool rather than substantive edits to those functions.

Worth a look

• SSRF guard bypassed by localhost-prefixed hostnames — graphify/llm.py:2707 · Escalate · high
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 945 functions depend on the 507 functions this change touches.

Health — grade A; 10 existing hotspot(s) in the area this change touches (pre-existing, not introduced here):

• deduplicate_entities() — 49 callers, 21 callees (high)
• extract_files_direct() — 15 callers, 19 callees (high)
• build_merge() — 29 callers, 8 callees (high)
• dispatch_command() — 2 callers, 110 callees (high)
• _call_claude_cli() — 26 callers, 8 callees (high)
• _call_openai_compat() — 23 callers, 8 callees (high)
• build() — 31 callers, 4 callees (high)
• extract_corpus_parallel() — 23 callers, 5 callees (high)
• …and 2 more

Verification — 945 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 738 function(s) in the blast radius were not formally verified this run