@holmes-lab/holmes-kit 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -4,6 +4,71 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+<!-- @implements A-SPEC-209 -->
+## [0.7.0] - 2026-09-02
+
+GOAL-7langs completes: all six analysis axes (relations, ast, cfg, ddg, cdg, taint) are now
+corpus-validated for all seven official languages — 42 cells, every one a measurement. The
+README's language table becomes a byte-pinned render of the same derivation, so it can no
+longer drift from what the code actually does.
+
+### Added
+
+- **Taint for all seven languages** (REQ-524): five vocabularies join the table (selected by
+  extension, never unioned), the flow-sensitive lane generalizes from Python-only to every
+  language with a CFG, and two measured engine holes close (Java/C# call nodes including
+  constructors; Java callee vs receiver). Validated with positive AND negative controls per
+  language, then measured over ten corpora: Go/Rust/Java/C# report zero (library code — same
+  structural decomposition as before), C++ reports two REAL argv→execv flows in leveldb's test
+  harness (verified; benign by intent, exactly what a taint tool should surface).
+- **Imports reach the graph in all seven languages** (REQ-525): extraction is a table row per
+  language; resolution is per-language semantics (Go strips the go.mod module prefix and fans
+  out to the package directory — with go.mod discovered by walking up from the file; Rust maps
+  crate::/super::/self:: and retries once without a trailing item segment; Java/C# resolve by
+  UNIQUE path suffix; C++ resolves quoted includes with extension preserved); ambiguity and
+  externals resolve to nothing, never to a guess. **Capability moved on measured arrival:
+  go 389, rust 64, java 2,688, csharp 316 (measurement overturned the ~0 expectation), cpp 482
+  resolved edges.**
+- **The README language table is a render** (REQ-526): a marker block generated from the live
+  matrix plus a corpus-evidence column (functions, zero violations, stated limits — C++'s 32.1%
+  L1 refusal rate is in the table), byte-pinned by the suite like docs/language-support.md.
+  The old hand-written table claimed "Full Support" for every language before it was true.
+
+<!-- @implements A-SPEC-209 -->
+## [0.6.0] - 2026-09-02
+
+Three more languages earn corpus-validated control- and data-flow: Java, C#, and Rust join
+TypeScript, Python and Go. Six of seven official languages now build CFG/DDG/CDG with zero
+invariant violations over real open-source corpora. Every grade in the matrix is a measurement.
+
+### Added
+
+- **Java CFG/DDG/CDG** (REQ-520): rides the TS chassis (same probed shapes for if/while/for/do
+  and the try clauses) plus the four seams where Java's semantics live: ONE switch node carrying
+  two styles (old groups fall through, arrow rules never touch), try-with-resources with resource
+  defs, catch parameters inside catch_formal_parameter, and field/method names excluded from
+  uses (`this.x = x` reads x once). **Measured over gson+junit4: 8,376/8,376 functions, zero
+  refusals, zero violations, 19,818 REACHING_DEF + 7,622 CDG edges.** The corpus caught three
+  would-have-shipped defects — named comment nodes, empty bodies (`while (c()) ;` — latent for
+  TS too), and Java's wrapperless else that lowered an else-if CONDITION as a statement.
+- **C# CFG/DDG/CDG** (REQ-521): same face as Java, opposite semantics where it hurts — switch
+  fallthrough is a compile error (sections isolate), `yield` is the iterator protocol
+  (yield return continues, yield break exits), and `#if/#else` arms are ALTERNATIVES lowered as
+  branches. **Measured over Newtonsoft.Json+RestSharp: 9,184 functions, zero violations; the
+  only refusals are designed (preproc_elif 3, goto 1); 51 files (4.4%) refuse honestly at L1
+  where conditional compilation crosses syntax.** One sealed design was corrected mid-slice and
+  re-sealed: a declaration pattern binds at the switch HEADER, because a def on the point that
+  uses it can never reach.
+- **Rust CFG/DDG/CDG** (REQ-522): control flow is an EXPRESSION in Rust (measured: if 1,170 /
+  match 468 / for 307 all inside expression_statement), which creates a new failure mode — a
+  zero-violation but HOLLOW graph. The corpus gate therefore demands branch edges exist, not
+  just that invariants hold. Match is exhaustive (no phantom escape — rustc enforces it), `?` is
+  an implicit early return (both paths leave the point), bare `loop` is infinite, let-else's
+  else arm diverges, and pattern bindings follow the lowercase-initial convention (documented
+  heuristic). **Measured over ripgrep+serde: 5,247/5,247 functions, zero refusals, zero
+  violations, 4,786 branch edges (avg 5.6 blocks/function), 13,647 REACHING_DEF + 6,808 CDG
+  edges.**
+
 <!-- @implements A-SPEC-209 -->
 ## [0.5.0] - 2026-09-02
 

package/README.md

@@ -217,15 +217,21 @@ flowchart LR
 Holmes-Kit embeds native AST & Code Property Graph (D-CPG) analyzers to track causal relationships and anchor implementations across diverse technology stacks.
 
 ### 💻 Supported Programming Languages
-| Language | CPG Parser | Anchor Syntax | Dataflow Taint & RTM |
-| :--- | :--- | :--- | :---: |
-| **TypeScript / JavaScript** | Tree-sitter TypeScript/JS | `// @implements A-SPEC-XXX` | ✅ Full Support |
-| **Python** | Tree-sitter Python | `# @implements A-SPEC-XXX` | ✅ Full Support |
-| **Go** | Tree-sitter Go | `// @implements A-SPEC-XXX` | ✅ Full Support |
-| **Rust** | Tree-sitter Rust | `// @implements A-SPEC-XXX` | ✅ Full Support |
-| **Java** | Tree-sitter Java | `// @implements A-SPEC-XXX` | ✅ Full Support |
-| **C / C++** | Tree-sitter C/C++ | `// @implements A-SPEC-XXX` | ✅ Full Support |
-| **C# (.NET)** | Tree-sitter C# | `// @implements A-SPEC-XXX` | ✅ Full Support |
+
+<!-- language-matrix:begin -->
+| Language | relations | ast | cfg | ddg | cdg | taint | Corpus evidence |
+| :--- | :---: | :---: | :---: | :---: | :---: | :---: | :--- |
+| **TypeScript / JavaScript** | ● | ● | ● | ● | ● | ● | 10,929 functions (this repository), zero invariant violations |
+| **Python** | ● | ● | ● | ● | ● | ● | 1,209 functions (jarvis), zero invariant violations |
+| **C#** | ● | ● | ● | ● | ● | ● | 9,184 functions (Newtonsoft.Json + RestSharp), zero invariant violations — 4.4% of files refuse at L1 (preprocessor across syntax) |
+| **Java** | ● | ● | ● | ● | ● | ● | 8,376 functions (gson + junit4), zero invariant violations |
+| **Go** | ● | ● | ● | ● | ● | ● | 2,637 functions (gin + cobra), zero invariant violations |
+| **Rust** | ● | ● | ● | ● | ● | ● | 5,247 functions (ripgrep + serde), zero invariant violations |
+| **C++** | ● | ● | ● | ● | ● | ● | 1,762 functions (nlohmann + fmt + leveldb), zero invariant violations — 32.1% of template/macro-heavy files refuse at L1 — layers above speak only for what parses |
+
+Every grade is a measurement, not a goal: a cell moves only when a real corpus proves it.
+Full per-cell bases (and every stated limit) live in [docs/language-support.md](docs/language-support.md), which is generated from the same derivation and byte-pinned by the suite — as is this table.
+<!-- language-matrix:end -->
 
 ### 🖥️ Supported Operating Systems & Runtimes
 | OS / Platform | Architecture | Status | Notes |

package/dist/.build-id

@@ -1 +1 @@
-8f00a9a-mtjc55io
+7cb32c4-mtjifuwa