[sinha108]

Closes #436.

codeanalyzer-go 0.3.0 emits the full L3/L4 substrate; the SDK's models stopped at L2 and could
not parse current -a 1 output at all. This adds the consumer surface.

Two bugs this fixes

GoType.kind omitted alias. kind is a Literal and extra="ignore" does not cover a
Literal mismatch, so an unlisted kind fails the whole document. Any project containing a single
type Alias = int did not load:

Input should be 'struct', 'interface' or 'defined' [input_value='alias']

A -a 4 document parsed and silently dropped the graph. GoApplication had no
param_in/param_out/external_symbols, the envelope no degraded, and GoBodyNode kept only
kind/span/callee/is_goroutine. _argv also capped -a at 2, so a level-4 request quietly
produced a level-2 analysis whose empty dataflow was indistinguishable from a proved absence.

The surface

get_cfg / get_cdg / get_ddg, resolve_callable / resolve_value, slice_backward /
slice_forward / backward_cone, reaches / paths_between, flows_to_call /
flows_to_argument, taint, get_external_symbols, get_degraded, describe — on CLDK.go(...)
and on both backends, with PythonAnalysisBackend's names and signatures.

taint is concrete on GoAnalysisBackend, so neither backend owns the policy. The
port-connectivity gate is Java's, declared on the ABC and implemented on both; it reads the data,
never a version string.

Four Go-specific traps, in cldk/analysis/go/ids.py

Each is a rule that holds for Python or TypeScript and not for Go, so a shared helper would be
wrong rather than absent. All measured on real 0.3.0 output:

Trap	Evidence
Never split a body-node id on its first @ — a stand-in's id holds /@external/ before the vertex @	the naive partition("@") mis-owns all 129 external vertices
A formal resolves by its own of, never by ordinal into parameters[]	a method's formal_in:0 is the receiver; of == parameters[0].name on only 174 of 276 callables
A global's module half is slash-separated	libflow.Last failed dot-wise segment_match on all 23 globals; the package-qualified spelling is added as a second match name
degraded[] is the honesty signal, not a refusal	voids every exhausted certification; envelope scope, beside application — not on it, as the issue text implies

A Go signature is also not always a unique address: several files in one package may each declare
their own init(). Both backends hand the shared policy one candidate per declaration, and
in_module= naming a path picks one.

Verification

A real Neo4j was stood up and a real L4 graph pushed (3,936 nodes, 11,112 relationships) rather than
shipping the Cypher unverified. That found four bugs invisible from the local side:

Bug	Symptom
the scope guard admitted only <app>/go/	every stand-in id refused as out-of-scope
:GoExternal conflates callable stand-ins with import ghosts	get_external_symbols reported 51 against 35
_REACHES pinned its endpoint to :GoCallable	reaches(caller, "DB.Query") was False for a call that exists; 69 of 247 GO_CALLS edges land on a stand-in
reconstruct.body_node dropped of/parent	the graph spells them var/call_node, so every L4 vertex came back with of=None

Review found two more, both fixed: the colliding-signature divergence above, and
get_cfg/get_cdg/get_ddg raising AttributeError on a stand-in where the graph returned an
empty page (empty is correct — a stand-in has no statements, only ports).

• models round-trip real -a 4 losslessly: 319 callables, 1299 cfg / 666 cdg / 2854 ddg / 704
  summary edges, 3324 body nodes, zero unmodeled wire fields
• both backends answer identically on 66 probed questions, miss paths and taint verdicts included
• 178 Go tests with the live graph, 146 + 32 clean skips without it
• 2024 tests pass overall. The one failure, test_public_surface.py::test_c_modules_are_gone,
  reproduces on main
• every factual claim in the new docs section checked against running code

The gated HTTP→SQL flow answers end to end: flows_to_argument("id", "DB.Query", "query", within="sqlRepo.Find") is True, with paths_between returning the
id → n → query → DB.Query.query witness.

Relation sweeps

The dataflow tests pinned each property at one hand-picked position. A follow-up commit keeps the
relations and adds the sampling — every addressable position, both backends: a deeper slice reaches
more; a capped slice is a prefix and reports the whole total; flows_to_argument ⟹
flows_to_call; a returned path ⟹ the predicate agrees; every edge endpoint is an id get_source
can read.

This is the one part of the analyzer's metamorphic design that transfers. It varies the input
program and holds the analyzer fixed, which the SDK cannot do because it produces no analysis — so
the SDK's dual is to vary the query and hold the analysis fixed. Not generative: a property-based
library over this space found nothing a sweep did not.

They found a parity gap on their first run. get_source accepted a body-node id on the graph
backend and raised on the local one, whose index held only types, callables and fields — and every
edge endpoint and SliceNode.ref is a body-node id. Fixing it exposed describe diverging the
other way: local accepted a bare id, the graph silently dropped it. Both now accept both forms.

Checked by mutation, not by passing: six behavior-changing mutations in the shapes these relations
guard are all caught.

Real-app evaluation

Run against the analyzer's own pinned eval corpus (codeanalyzer-go/scripts/eval_l3.sh), comparing
counts taken from the json module against the same counts taken from cldk.models.go over the
same file — a toolchain-independent oracle, where any difference is the SDK losing or miscounting
something. Seven of the eight apps; dae is Linux-only.

app	payload	callables	body nodes	DDG edges	summary	RAW==SDK	unmodelled fields
cobra	6.9 MB	320	11,171	22,887	6,056	23/23	none
listmonk	105 MB	820	74,801	583,307	40,912	23/23	none
memos	188 MB	6,077	250,434	406,509	236,583	23/23	none
k8s-api	369 MB	15,427	598,588	1,107,780	205,643	23/23	none
openbao	582 MB	8,725	625,208	1,164,315	680,354	23/23	none
kubernetes	1,469 MB	44,535	1,708,051	3,210,628	1,361,329	23/23	none
nats-server	1,829 MB	5,286	1,690,827	3,749,264	2,577,267	23/23	none

10.2M DDG edges and 5.0M body nodes across the corpus, with zero unmodelled wire fields
anywhere. Every count also matched the analyzer's published figures
(codeanalyzer-go/docs/design/notes/l3-dataflow-metrics.md § L4) except points_to_ddg, which
drifts 0.004–0.03% from this host's go1.26.4 against the doc's go1.27.3. The scale benchmark
reproduced closely: Kubernetes at 38.90 s / 8.72 GB against the doc's 38.37 s / 8,076 MB.

The traps also hold at a scale the fixture cannot reach. On memos, formal_in:0 is absent from
parameters[] on 3,950 of 3,950 methods (trap 2); on nats-server, 343 of 355 globals need
the package-qualified spelling (trap 3). api.init is declared in 9 generated .pb.go files in
memos, so the multi-file init() collision is real in the wild — it raises AmbiguousName and
narrows by in_module. And degraded[] is common: listmonk, memos, openbao, nats-server and
kubernetes all carry range_func / unmapped_ssa, where the committed fixture is clean — so trap 4
is now verified on real data rather than by monkeypatching get_degraded.

Two defects it found, fixed here

• reach expanded each node once per predecessor, not once. seen was updated after the level
  was built, so a node with k predecessors in the current frontier entered it k times and the
  next level expanded every copy — the frontier tracked path count. Answers were never wrong (a set
  cannot hold duplicates), so only cost showed it: 151,417,783 frontier expansions at depth 8
  against 670,450, and unbounded it did not terminate. depth=None is the default on
  paths_between / flows_to_* / taint, so the unusable case was the default one. The walk is
  now commons.graphs.reach, lifted out of four byte-identical copies, so Python, Java and
  TypeScript are fixed too — four copies were four places to drift, which is how one bug came to
  live in all of them.
• split_body_node_id re-sorted its candidate list on every call, so a bulk get_source over a
  page's endpoints sorted 5,955 ids per endpoint on nats-server. Hoisted to a cached
  longest-first order.

Scale guidance

On nats-server an unbounded reach from a typical port touches 1,631,237 of 1,693,330 nodes —
96% of the graph. The slices default to DEFAULT_DEPTH = 5 and are unaffected; paths_between,
flows_to_* and taint default to depth=None, which is correct for soundness (a bound makes a
False ambiguous) but means the default query on a large application is inherently whole-graph.
Peak SDK memory is 13–19× the payload: 3.4 GB on memos, 8.1 GB on openbao, 23.2 GB on nats-server.

Known limitation, tracked separately

#446 — shortest_walks cannot produce a witness for a flow flows_to_argument confirms. On
nats-server the predicate answers True in 0.9 s while taint / paths_between do not return in
180 s, because the DFS replay prunes only on BFS layer boundaries and never toward the sink: dst
sits at distance 42 with 110,833 nodes sharing that distance, so it enumerates ~1.49e16 shortest
paths where 736,848 reach dst. Pre-existing, shared by all four languages, and not fixed here
— it needs its own change, because the pruning interacts with the max_paths prefix contract, the
sanitizer cuts, and backend parity.

Reproducing the live tests

docker run -d --name neo4j -p 7687:7687 -e NEO4J_AUTH=neo4j/<pw> neo4j:5.26
cango -i <analyzer>/testdata/dataflow -a 4 -o /tmp/go-l4 --app-name dataflow --namespace dataflow
NEO4J_URI=bolt://localhost:7687 NEO4J_USERNAME=neo4j NEO4J_PASSWORD=<pw> \
  cango -i <analyzer>/testdata/dataflow --emit neo4j --app-name dataflow --namespace dataflow

CLDK_TEST_GO_NEO4J_URI=bolt://localhost:7687 CLDK_TEST_GO_NEO4J_PASSWORD=<pw> \
CLDK_TEST_GO_NEO4J_APP=dataflow CLDK_TEST_GO_NEO4J_NAMESPACE=dataflow \
CLDK_TEST_GO_ANALYSIS_JSON=/tmp/go-l4/analysis.json \
  pytest tests/analysis/go/

Without those variables the live tests skip and the rest still run.

Also in this change

CLAUDE.md's language table (its Go row said -a 1..2 only and "no release cut yet", both stale)
plus a leg note; a Go section in docs/agent-api-reference.md alongside TypeScript's and Java's;
CLDK.go's docstring, which still claimed levels 1 and 2 only. Diagnostic.code gains
analysis_degraded — a closed Literal and a published contract, named language-neutrally because
"the analyzer told us it fell back" is not Go's alone.

Not addressed here

• Sanitizer semantics (taint(): sanitizer calls do not cut flows assigned at the call site (cross-language) .github#103): a callable cut on strconv.Atoi does not
  sever the SanitizedFind path, because the DDG runs id → n → query without passing through
  Atoi's nodes. Analyzer-side; a variable cut severs it correctly today.
• Context-insensitivity of the shared walk (SDG traversal is context-insensitive: walks may enter a callee at one call site and return to another #437): a returned path proves a may-flow.
• Global → global summary edges (L4: global → global summary edges are omitted; reverse for context-sensitive walks or finer wiring codeanalyzer-go#30): reachability unchanged,
  but a depth-bounded walk may stop short.
• projections.py for Go — out of SDK3 scope, additive later.

Scale is measured above rather than estimated; #446 is the one known limitation on this surface.