@holmes-lab/holmes-kit 0.5.0 → 0.7.0

package/dist/holmes/cpg/foundation/ddg.js

@@ -17,7 +17,9 @@ function defUseOf(ast, cfg, fn, source) {
     const isPython = ast.lang === 'python';
     const isGo = ast.lang === 'go';
     const params = new Map();
-    const bareArrow = ast.nodes[fn.nodeIndex].type === 'arrow_function'
+    const bareArrow = (ast.nodes[fn.nodeIndex].type === 'arrow_function'
+        // @implements A-SPEC-520.1 — Java's single-parameter lambda (`z -> …`) has the same shape.
+        || ast.nodes[fn.nodeIndex].type === 'lambda_expression')
         && !kids.of(fn.nodeIndex).some((k) => ast.nodes[k].type === 'formal_parameters');
     for (const k of kids.of(fn.nodeIndex)) {
         // Only formal_parameters — a declaration's NAME identifier is not a parameter (measured: the
@@ -27,7 +29,9 @@ function defUseOf(ast, cfg, fn, source) {
         // times on one declaration: receiver, parameters, NAMED RESULTS. All of them bind names at
         // ENTRY, so Go must not break after the first (the probe pinned the second-list shape).
         const isParamList = ast.nodes[k].type === 'formal_parameters' || ast.nodes[k].type === 'parameters'
-            || ast.nodes[k].type === 'parameter_list';
+            || ast.nodes[k].type === 'parameter_list'
+            // @implements A-SPEC-522.1 — Rust: fn parameters and closure |x| parameters.
+            || ast.nodes[k].type === 'parameters' || ast.nodes[k].type === 'closure_parameters';
         if (!isParamList && !(bareArrow && ast.nodes[k].type === 'identifier'))
             continue;
         const collect = (n) => {
@@ -55,6 +59,21 @@ function defUseOf(ast, cfg, fn, source) {
     for (const b of cfg.blocks)
         for (const s of b.stmts)
             stmtSet.add(s);
+    // @implements A-SPEC-522.1 — walk a Rust PATTERN: lowercase-initial identifiers bind (defs),
+    // capitalized ones are constructors/types (skipped). Everything else recurses.
+    const walkRustPattern = (n, stmt) => {
+        const ty = ast.nodes[n].type;
+        if (ty === 'identifier') {
+            const t = text(n);
+            if (/^[a-z_]/.test(t) && t !== '_')
+                add(defs, stmt, t);
+            return;
+        }
+        if (ty.includes('literal') || ty === 'type_identifier')
+            return;
+        for (const c of kids.of(n))
+            walkRustPattern(c, stmt);
+    };
     const classify = (stmt) => {
         const walk = (n, defCtx) => {
             const ty = ast.nodes[n].type;
@@ -62,7 +81,7 @@ function defUseOf(ast, cfg, fn, source) {
                 return; // nested function boundary
             if (n !== stmt && stmtSet.has(n))
                 return; // nested statements are their own rows
-            if (ty === 'type_annotation' || ty === 'type_arguments' || ty === 'comment')
+            if (ty === 'type_annotation' || ty === 'type_arguments' || ty.includes('comment'))
                 return;
             if (ty === 'identifier' || ty === 'shorthand_property_identifier_pattern') {
                 if (defCtx)
@@ -78,6 +97,164 @@ function defUseOf(ast, cfg, fn, source) {
             if (ty === 'field_identifier' || ty === 'package_identifier' || ty === 'label_name')
                 return;
             switch (ty) {
+                // @implements A-SPEC-523.1 — C++'s binding shapes.
+                case 'init_declarator': {
+                    // `int y = g()` / `T& r = s` — the declarator's identifier (through reference/pointer
+                    // wrappers) is the def; the initializer is a use.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    const firstId = (m) => {
+                        if (ast.nodes[m].type === 'identifier')
+                            return m;
+                        for (const c of kids.of(m)) {
+                            const r = firstId(c);
+                            if (r !== undefined)
+                                return r;
+                        }
+                        return undefined;
+                    };
+                    if (named[0] !== undefined) {
+                        const id = firstId(named[0]);
+                        if (id !== undefined)
+                            add(defs, stmt, text(id));
+                    }
+                    for (const r of named.slice(1))
+                        walk(r, false);
+                    return;
+                }
+                case 'for_range_loop': {
+                    // `for (auto& s : xs)` — the declarator's identifier binds; the range is a use.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    const body = named.find((c) => ast.nodes[c].type === 'compound_statement');
+                    for (const c of named) {
+                        if (c === body)
+                            continue;
+                        const ty = ast.nodes[c].type;
+                        if (ty.endsWith('_declarator') || ty === 'identifier') {
+                            const firstId = (m) => {
+                                if (ast.nodes[m].type === 'identifier')
+                                    return m;
+                                for (const k of kids.of(m)) {
+                                    const r = firstId(k);
+                                    if (r !== undefined)
+                                        return r;
+                                }
+                                return undefined;
+                            };
+                            // the LAST such child before the body is the RANGE when it is a bare identifier —
+                            // walk order below fixes that: declarator-shaped nodes def, the final expr uses.
+                            if (ty === 'identifier' && c === named.filter((x) => x !== body).at(-1)) {
+                                walk(c, false);
+                                continue;
+                            }
+                            const id = firstId(c);
+                            if (id !== undefined)
+                                add(defs, stmt, text(id));
+                        }
+                        else if (!ty.includes('type') && ty !== 'placeholder_type_specifier') {
+                            walk(c, false);
+                        }
+                    }
+                    return;
+                }
+                // @implements A-SPEC-522.1 — Rust's binding shapes. Pattern identifiers bind by the
+                // LOWERCASE-INITIAL convention (rustc warns on violations): `Some(x)` binds x, skips the
+                // constructor Some — a documented heuristic, not a guess about arbitrary code.
+                case 'let_declaration': {
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (named[0] !== undefined)
+                        walkRustPattern(named[0], stmt);
+                    for (const r of named.slice(1))
+                        walk(r, false);
+                    return;
+                }
+                case 'compound_assignment_expr': {
+                    const [lhs, ...rest] = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (lhs !== undefined && ast.nodes[lhs].type === 'identifier') {
+                        add(defs, stmt, text(lhs));
+                        add(uses, stmt, text(lhs));
+                    }
+                    else if (lhs !== undefined)
+                        walk(lhs, false);
+                    for (const r of rest)
+                        walk(r, false);
+                    return;
+                }
+                case 'for_expression': {
+                    // `for PAT in ITER { .. }` — the pattern binds fresh; iterable is a use.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (named[0] !== undefined)
+                        walkRustPattern(named[0], stmt);
+                    for (const r of named.slice(1))
+                        walk(r, false);
+                    return;
+                }
+                case 'let_condition': {
+                    // `while let Some(x) = e` / `if let ...` — pattern binds at the header point.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (named[0] !== undefined)
+                        walkRustPattern(named[0], stmt);
+                    for (const r of named.slice(1))
+                        walk(r, false);
+                    return;
+                }
+                case 'scoped_identifier': {
+                    // a::b::c — path segments are module/type names, not local reads.
+                    return;
+                }
+                // @implements A-SPEC-520.1 — Java's shapes. A field's name and a method's name are plain
+                // `identifier` nodes in this grammar, so an unguarded walk would read `this.x = x` as TWO
+                // uses of x and every call as a use of its method name — with a same-named local, that is
+                // a fabricated reaching edge, not just noise.
+                // @implements A-SPEC-521.1 — C#: the LAST named child of a member access is the member's
+                // NAME (`this` is unnamed, so `this.x` has exactly one — the name). Walking it would read
+                // `this.x = x` as two uses of x. Delegates held in FIELDS lose their use through this
+                // (declared); a bare local delegate call (`a()`) keeps its use — the callee is walked.
+                case 'member_access_expression': {
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    for (let ix = 0; ix < named.length - 1; ix++)
+                        walk(named[ix], false);
+                    return;
+                }
+                case 'field_access': {
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (named.length > 0)
+                        walk(named[0], false); // the object; the field name is skipped
+                    return;
+                }
+                case 'method_invocation': {
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    const argsAt = named.findIndex((c) => ast.nodes[c].type === 'argument_list');
+                    named.forEach((c, ix) => {
+                        if (ix === (argsAt > 0 ? argsAt - 1 : -1) && ast.nodes[c].type === 'identifier')
+                            return; // the name
+                        if (ast.nodes[c].type === 'type_arguments')
+                            return;
+                        walk(c, false);
+                    });
+                    return;
+                }
+                case 'enhanced_for_statement':
+                case 'foreach_statement': {
+                    // `for (T s : xs)` — the binding is a def; the iterable and body-side reads are uses.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    for (const c of named) {
+                        if (ast.nodes[c].type === 'identifier')
+                            add(defs, stmt, text(c));
+                        else
+                            walk(c, false);
+                    }
+                    return;
+                }
+                case 'resource': {
+                    // try-with-resources: `var r = open()` — r defs at the resource point, the init is a use.
+                    for (const c of kids.of(n)) {
+                        if (ast.nodes[c].type === 'identifier')
+                            add(defs, stmt, text(c));
+                        else
+                            walk(c, false);
+                    }
+                    return;
+                }
                 // @implements A-SPEC-519.1 — Go's binding shapes, written from the probed grammar.
                 case 'short_var_declaration': {
                     // `a, b := e1, e2` — every LHS identifier is a def; the RHS list is uses.
@@ -285,13 +462,82 @@ function defUseOf(ast, cfg, fn, source) {
     };
     for (const s of stmtSet)
         classify(s);
+    // @implements A-SPEC-522.1 — Rust match patterns bind at the MATCH HEADER point (the same
+    // posture as C#'s declaration pattern, for the same measured reason: a def on the point that
+    // uses it can never reach). Guards (`n if g(n)`) read at the header too.
+    if (ast.lang === 'rust') {
+        ast.nodes.forEach((n, i) => {
+            if (n.type !== 'match_expression' || !stmtSet.has(i))
+                return;
+            const mb = kids.of(i).find((k) => ast.nodes[k].type === 'match_block');
+            for (const arm of mb === undefined ? [] : kids.of(mb)) {
+                if (ast.nodes[arm].type !== 'match_arm')
+                    continue;
+                const pat = kids.of(arm).find((k) => ast.nodes[k].type === 'match_pattern');
+                if (pat !== undefined) {
+                    walkRustPattern(pat, i);
+                    // a guard inside the pattern (`n if g(n)`) reads its names at dispatch time
+                    for (const g of kids.of(pat)) {
+                        if (ast.nodes[g].type !== 'match_pattern' && ast.nodes[g].named) {
+                            const collect = (m) => {
+                                if (ast.nodes[m].type === 'identifier' && /^[a-z_]/.test(text(m)))
+                                    add(uses, i, text(m));
+                                for (const c of kids.of(m))
+                                    collect(c);
+                            };
+                            collect(g);
+                        }
+                    }
+                }
+            }
+        });
+    }
+    // @implements A-SPEC-521.1 — a C# declaration pattern (`case string f:`) binds at the SWITCH
+    // HEADER point, the same posture as Go's type-switch binding. Attaching it to the section's
+    // first statement was the first design and measurably wrong: reaching definitions read a use
+    // against the statement's IN set, so a def on the same point can never reach `case string f:
+    // Use(f);` — and that first statement usually IS the use. (Design corrected mid-slice, re-sealed.)
+    ast.nodes.forEach((n, i) => {
+        if (n.type !== 'switch_section')
+            return;
+        const pat = kids.of(i).find((k) => ast.nodes[k].type === 'declaration_pattern');
+        if (pat === undefined)
+            return;
+        const bind = kids.of(pat).filter((k) => ast.nodes[k].named).at(-1);
+        if (bind === undefined || ast.nodes[bind].type !== 'identifier')
+            return;
+        let sw = ast.nodes[i].parent; // switch_body
+        while (sw >= 0 && ast.nodes[sw].type !== 'switch_statement')
+            sw = ast.nodes[sw].parent;
+        if (sw >= 0 && stmtSet.has(sw))
+            add(defs, sw, text(bind));
+    });
     // catch parameters: a def at the head of the handler body's first statement.
     ast.nodes.forEach((n, i) => {
         if (n.type !== 'catch_clause')
             return;
         const named = kids.of(i).filter((k) => ast.nodes[k].named);
-        const param = named.find((k) => ast.nodes[k].type === 'identifier');
-        const block = named.find((k) => ast.nodes[k].type === 'statement_block');
+        // @implements A-SPEC-520.1 — Java wraps the parameter in catch_formal_parameter; TS puts the
+        // identifier directly under the clause. One lookup serves both.
+        const formal = named.find((k) => ast.nodes[k].type === 'catch_formal_parameter');
+        // @implements A-SPEC-523.1 — C++ wraps it deeper still: parameter_list > parameter_declaration.
+        const plist = named.find((k) => ast.nodes[k].type === 'parameter_list');
+        const firstIdIn = (m) => {
+            if (ast.nodes[m].type === 'identifier')
+                return m;
+            for (const c of kids.of(m)) {
+                const r = firstIdIn(c);
+                if (r !== undefined)
+                    return r;
+            }
+            return undefined;
+        };
+        const param = named.find((k) => ast.nodes[k].type === 'identifier')
+            ?? (formal !== undefined
+                ? kids.of(formal).find((k) => ast.nodes[k].type === 'identifier')
+                : undefined)
+            ?? (plist !== undefined ? firstIdIn(plist) : undefined);
+        const block = named.find((k) => ['statement_block', 'block', 'compound_statement'].includes(ast.nodes[k].type));
         if (param === undefined || block === undefined)
             return;
         const first = kids.of(block).find((k) => stmtSet.has(k));

package/dist/holmes/cpg/foundation/language-matrix.d.ts

@@ -55,3 +55,20 @@ export type LanguageMatrix = Record<Layer, Record<string, Cell>>;
 export declare function languageMatrix(): LanguageMatrix;
 /** Render docs/language-support.md — the table is a PRODUCT of the code, not a claim beside it. */
 export declare function renderLanguageSupport(): string;
+/**
+ * The corpus evidence behind each language's grades — TRANSCRIBED from the activation log's
+ * measurements (sources: S-510 for ts/py, S-519.1..S-523.1 for the five), so the README can cite
+ * numbers without re-running corpora at test time. If a re-run moves a number, this table moves
+ * with it in the same commit — the pin in the test makes forgetting that a red suite.
+ */
+export declare const CORPUS_EVIDENCE: Record<MatrixLanguage, {
+    fns: string;
+    corpus: string;
+    note?: string;
+}>;
+/**
+ * The README's language table — a RENDER, like docs/language-support.md, byte-pinned by a test.
+ * Glyphs are derived from the live matrix; the evidence column is CORPUS_EVIDENCE. No slogans:
+ * a grade appears next to the measurement that earned it.
+ */
+export declare function renderReadmeLanguageTable(): string;

package/dist/holmes/cpg/foundation/language-matrix.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MATRIX_LANGUAGES = exports.LAYERS = void 0;
+exports.CORPUS_EVIDENCE = exports.MATRIX_LANGUAGES = exports.LAYERS = void 0;
 exports.languageMatrix = languageMatrix;
 exports.renderLanguageSupport = renderLanguageSupport;
+exports.renderReadmeLanguageTable = renderReadmeLanguageTable;
 // @implements A-SPEC-510.6
 /**
  * The layer × language support matrix — what "officially supported" MEANS, made checkable.
@@ -57,9 +58,15 @@ function relationsCell(ext) {
 function astCell(astLang) {
     // The TS grammar family covers tsx/js too — AST_LANGUAGES is the authority on which wasm applies.
     const covered = AST_LANG_SET.has(astLang) || (astLang === 'typescript' && AST_LANG_SET.has('tsx'));
-    return covered
-        ? { support: 'full', basis: 'vendored tree-sitter grammar (L1 AST persisted)' }
-        : { support: 'none', basis: 'no vendored grammar for the L1 substrate' };
+    if (!covered)
+        return { support: 'none', basis: 'no vendored grammar for the L1 substrate' };
+    // @implements A-SPEC-523.1 — the C++ cell carries its measured limit IN the table: 25-34% of
+    // template/macro-heavy real files refuse at L1 (nlohmann/fmt/leveldb), and every layer above
+    // speaks only about what L1 accepts. Same glyph, weaker evidence — the reader sees it here.
+    if (astLang === 'cpp') {
+        return { support: 'full', basis: 'vendored tree-sitter grammar (L1 AST persisted) — limit: template/macro-heavy real files can refuse at L1 (measured 25-34% on three corpora); layers above speak only for what parses' };
+    }
+    return { support: 'full', basis: 'vendored tree-sitter grammar (L1 AST persisted)' };
 }
 function cfgFamilyCell(astLang, layer) {
     const covered = cfg_1.CFG_LANGUAGES.has(astLang) || (astLang === 'typescript' && cfg_1.CFG_LANGUAGES.has('tsx'));
@@ -147,3 +154,44 @@ function renderLanguageSupport() {
         '',
     ].join('\n');
 }
+// @implements A-SPEC-526.1
+/**
+ * The corpus evidence behind each language's grades — TRANSCRIBED from the activation log's
+ * measurements (sources: S-510 for ts/py, S-519.1..S-523.1 for the five), so the README can cite
+ * numbers without re-running corpora at test time. If a re-run moves a number, this table moves
+ * with it in the same commit — the pin in the test makes forgetting that a red suite.
+ */
+exports.CORPUS_EVIDENCE = {
+    typescript: { fns: '10,929', corpus: 'this repository' },
+    python: { fns: '1,209', corpus: 'jarvis' },
+    csharp: { fns: '9,184', corpus: 'Newtonsoft.Json + RestSharp', note: '4.4% of files refuse at L1 (preprocessor across syntax)' },
+    java: { fns: '8,376', corpus: 'gson + junit4' },
+    go: { fns: '2,637', corpus: 'gin + cobra' },
+    rust: { fns: '5,247', corpus: 'ripgrep + serde' },
+    cpp: { fns: '1,762', corpus: 'nlohmann + fmt + leveldb', note: '32.1% of template/macro-heavy files refuse at L1 — layers above speak only for what parses' },
+};
+// @implements A-SPEC-526.1
+/**
+ * The README's language table — a RENDER, like docs/language-support.md, byte-pinned by a test.
+ * Glyphs are derived from the live matrix; the evidence column is CORPUS_EVIDENCE. No slogans:
+ * a grade appears next to the measurement that earned it.
+ */
+function renderReadmeLanguageTable() {
+    const m = languageMatrix();
+    const glyph = (s) => (s === 'full' ? '●' : s === 'partial' ? '◐' : '○');
+    const lines = [];
+    lines.push('| Language | relations | ast | cfg | ddg | cdg | taint | Corpus evidence |');
+    lines.push('| :--- | :---: | :---: | :---: | :---: | :---: | :---: | :--- |');
+    for (const { lang, label } of exports.MATRIX_LANGUAGES) {
+        const ev = exports.CORPUS_EVIDENCE[lang];
+        const cells = ['relations', 'ast', 'cfg', 'ddg', 'cdg', 'taint']
+            .map((layer) => glyph(m[layer][lang].support)).join(' | ');
+        const note = ev.note ? ` — ${ev.note}` : '';
+        lines.push(`| **${label}** | ${cells} | ${ev.fns} functions (${ev.corpus}), zero invariant violations${note} |`);
+    }
+    lines.push('');
+    lines.push('Every grade is a measurement, not a goal: a cell moves only when a real corpus proves it.');
+    lines.push('Full per-cell bases (and every stated limit) live in [docs/language-support.md](docs/language-support.md), which is generated from the same derivation and byte-pinned by the suite — as is this table.');
+    lines.push('');
+    return lines.join('\n');
+}

package/dist/holmes/cpg/language-capability.js

@@ -84,6 +84,17 @@ const CALLS_ONLY = { symbols: true, relations: ['calls'], graphResolved: ['calls
 const CALLS_AND_INHERITS = {
     symbols: true, relations: ['calls', 'inherits'], graphResolved: ['calls', 'inherits'],
 };
+// @implements A-SPEC-525.1
+/**
+ * All three relations, extracted AND graph-resolved. The five non-TS/Python languages moved here
+ * when their imports were measured ARRIVING (A-SPEC-286's column): go 389, rust 64, java 2,688,
+ * csharp 316, cpp 482 resolved edges over the ten corpora. Rates differ by language semantics —
+ * C# resolves only where namespace happens to mirror the folder layout, Rust skips use-trees as
+ * ambiguous — and the unresolved remainder is external/ambiguous by design, never guessed.
+ */
+const FULL_RELATIONS = {
+    symbols: true, relations: ['calls', 'imports', 'inherits'], graphResolved: ['calls', 'imports', 'inherits'],
+};
 exports.LANGUAGE_CAPABILITY = {
     '.ts': TS_FAMILY, '.mts': TS_FAMILY, '.cts': TS_FAMILY, '.tsx': TS_FAMILY,
     '.js': TS_FAMILY, '.mjs': TS_FAMILY, '.jsx': TS_FAMILY,
@@ -93,12 +104,13 @@ exports.LANGUAGE_CAPABILITY = {
     '.py': { symbols: true, relations: ['calls', 'imports', 'inherits'], graphResolved: ['calls', 'imports', 'inherits'] },
     // @implements A-SPEC-511.1 — inheritance recovered: Java extends/implements, C# base_list,
     // Go struct embedding (interface satisfaction is a declared permanent gap), Rust `impl T for S`.
-    '.java': CALLS_AND_INHERITS, '.cs': CALLS_AND_INHERITS, '.go': CALLS_AND_INHERITS, '.rs': CALLS_AND_INHERITS,
+    // @implements A-SPEC-525.1 — imports measured arriving for all five (see FULL_RELATIONS).
+    '.java': FULL_RELATIONS, '.cs': FULL_RELATIONS, '.go': FULL_RELATIONS, '.rs': FULL_RELATIONS,
     // @implements A-SPEC-287 — C++ used to extract calls that never became graph edges, because its
     // edge scope omitted the class node the symbol walk uses. Fixed; it now resolves like the others.
     // @implements A-SPEC-511.1 — base_class_clause recovered (access specifiers skipped).
-    '.cpp': CALLS_AND_INHERITS, '.cc': CALLS_AND_INHERITS, '.cxx': CALLS_AND_INHERITS,
-    '.hpp': CALLS_AND_INHERITS, '.hh': CALLS_AND_INHERITS, '.h': CALLS_AND_INHERITS,
+    '.cpp': FULL_RELATIONS, '.cc': FULL_RELATIONS, '.cxx': FULL_RELATIONS,
+    '.hpp': FULL_RELATIONS, '.hh': FULL_RELATIONS, '.h': FULL_RELATIONS,
 };
 function capabilityFor(ext) {
     return exports.LANGUAGE_CAPABILITY[ext.toLowerCase()];

package/dist/holmes/cpg/language-parser-walk.js

@@ -538,7 +538,9 @@ const EDGE_CONFIG = {
     // syntactic fact. Interface satisfaction is implicit and structural (no `implements` keyword), so
     // recovering it needs a type checker — a DECLARED PERMANENT LIMIT, never a guess.
     go: { callTypes: ['call_expression'], calleeField: 'function', scopeTypes: ['function_declaration', 'method_declaration'],
-        inherits: { declTypes: ['type_spec'], mode: 'go-embedding' } },
+        inherits: { declTypes: ['type_spec'], mode: 'go-embedding' },
+        // @implements A-SPEC-525.1 — import_spec's interpreted_string_literal, quotes stripped.
+        imports: { nodeType: 'import_spec', mode: 'go-string' } },
     // @implements A-SPEC-300
     // `impl_item`/`trait_item` must open a qualifying scope, exactly as the symbol walk does: a method
     // in `impl Greet for En` is the symbol `En.hello`, but its edges came out qualified as bare
@@ -547,18 +549,27 @@ const EDGE_CONFIG = {
     // @implements A-SPEC-511.1 — `impl Trait for Type` ⇒ Type inherits Trait (implementer → abstract).
     // An inherent `impl Type { … }` carries no trait field and is NOT inheritance: no edge.
     rust: { callTypes: ['call_expression'], calleeField: 'function', scopeTypes: ['function_item', 'impl_item', 'trait_item'],
-        inherits: { declTypes: ['impl_item'], mode: 'rust-impl' } },
+        inherits: { declTypes: ['impl_item'], mode: 'rust-impl' },
+        // @implements A-SPEC-525.1 — use_declaration's scoped path; use-trees (braces) are
+        // ambiguous fan-outs and are skipped rather than half-read.
+        imports: { nodeType: 'use_declaration', mode: 'rust-use' } },
     // @implements A-SPEC-511.1 — Java separates the two syntactically, and BOTH are inheritance edges:
     // `superclass` (extends) and `super_interfaces` (implements), plus an interface's own extends.
     java: { callTypes: ['method_invocation'], calleeField: 'name', scopeTypes: ['class_declaration', 'method_declaration'],
         inherits: { declTypes: ['class_declaration', 'interface_declaration', 'record_declaration', 'enum_declaration'],
-            fields: ['superclass', 'super_interfaces', 'interfaces', 'extends_interfaces'] } },
+            fields: ['superclass', 'super_interfaces', 'interfaces', 'extends_interfaces'] },
+        // @implements A-SPEC-525.1 — import_declaration's scoped_identifier; a wildcard
+        // (asterisk sibling) is ambiguous and skipped.
+        imports: { nodeType: 'import_declaration', mode: 'java-scoped' } },
     // @implements A-SPEC-511.1 — C# puts the base class AND the interfaces in ONE `base_list`, with no
     // syntactic marker telling them apart. Splitting them would be a guess, so BOTH become `inherits`
     // (a deliberate asymmetry with the TS walk, which emits extends only — H-SPEC-511 decision 1).
     csharp: { callTypes: ['invocation_expression'], calleeField: 'function', scopeTypes: ['class_declaration', 'method_declaration'],
         inherits: { declTypes: ['class_declaration', 'interface_declaration', 'struct_declaration', 'record_declaration'],
-            childTypes: ['base_list'] } },
+            childTypes: ['base_list'] },
+        // @implements A-SPEC-525.1 — using_directive's qualified_name (a NAMESPACE, which the
+        // resolver may fail to map to a file — that failure is measured, not hidden).
+        imports: { nodeType: 'using_directive', mode: 'csharp-using' } },
     // @implements A-SPEC-287
     // C++ listed only `function_definition`, so a member function's edges came out qualified as bare
     // `run` while the symbol walk (which treats class_specifier/struct_specifier as scopes) emitted
@@ -568,7 +579,9 @@ const EDGE_CONFIG = {
     // @implements A-SPEC-511.1 — C++ bases live in `base_class_clause`; access specifiers
     // (public/private/protected/virtual) are skipped and only the type name is taken.
     cpp: { callTypes: ['call_expression'], calleeField: 'function', scopeTypes: ['class_specifier', 'struct_specifier', 'function_definition'],
-        inherits: { declTypes: ['class_specifier', 'struct_specifier'], childTypes: ['base_class_clause'] } },
+        inherits: { declTypes: ['class_specifier', 'struct_specifier'], childTypes: ['base_class_clause'] },
+        // @implements A-SPEC-525.1 — quoted includes only; <system> headers are external.
+        imports: { nodeType: 'preproc_include', mode: 'cpp-include' } },
 };
 // The callee's bare name: a plain identifier is itself; a member/selector/scoped/field node
 // (`o.m`, `self.c`, `mod::f`, `this.C`) unwraps to its LAST identifier segment — the method name.
@@ -764,6 +777,49 @@ function walkEdges(tree, cfg) {
             }
         }
     };
+    // @implements A-SPEC-525.1 — imports, table-driven like everything else in this walk. Each
+    // mode reads ONE probed shape; anything ambiguous (use-trees, wildcards, system headers) emits
+    // nothing rather than half of something.
+    const imp = cfg.imports;
+    const emitImport = (node) => {
+        if (imp.mode === 'go-string') {
+            const lit = node.namedChildren.find((c) => c.type === 'interpreted_string_literal');
+            if (lit)
+                out.push({ from: '<module>', to: lit.text.replace(/["']/g, ''), rel: 'imports' });
+            return;
+        }
+        if (imp.mode === 'rust-use') {
+            const arg = node.namedChildren.find((c) => ['scoped_identifier', 'identifier', 'use_as_clause', 'scoped_use_list', 'use_wildcard'].includes(c.type));
+            if (!arg)
+                return;
+            if (arg.type === 'scoped_use_list' || arg.type === 'use_wildcard')
+                return; // ambiguous fan-out
+            const pathNode = arg.type === 'use_as_clause' ? arg.namedChildren[0] : arg;
+            if (pathNode)
+                out.push({ from: '<module>', to: pathNode.text, rel: 'imports' });
+            return;
+        }
+        if (imp.mode === 'java-scoped') {
+            if (node.children.some((c) => c.type === 'asterisk'))
+                return; // wildcard
+            const scoped = node.namedChildren.find((c) => ['scoped_identifier', 'identifier'].includes(c.type));
+            if (scoped)
+                out.push({ from: '<module>', to: scoped.text, rel: 'imports' });
+            return;
+        }
+        if (imp.mode === 'csharp-using') {
+            const q = node.namedChildren.find((c) => ['qualified_name', 'identifier'].includes(c.type));
+            if (q)
+                out.push({ from: '<module>', to: q.text, rel: 'imports' });
+            return;
+        }
+        if (imp.mode === 'cpp-include') {
+            const lit = node.namedChildren.find((c) => c.type === 'string_literal');
+            if (lit)
+                out.push({ from: '<module>', to: lit.text.replace(/["']/g, ''), rel: 'imports' });
+            return; // <system>: external
+        }
+    };
     const visit = (node) => {
         if (callTypes.has(node.type)) {
             const callee = calleeNameOf(node.childForFieldName(cfg.calleeField));
@@ -772,6 +828,8 @@ function walkEdges(tree, cfg) {
         }
         if (inh && declTypes.has(node.type))
             emitInherits(node);
+        if (imp && node.type === imp.nodeType)
+            emitImport(node);
         for (let i = 0; i < node.childCount; i++)
             visit(node.child(i));
     };

package/dist/holmes/mcp/handlers.js

@@ -1708,13 +1708,21 @@ function makeRawHandlers(store, opts) {
                 const { vocabularyFor } = require('../rtm/taint-vocabulary');
                 const parser = new TreeSitterTsParser();
                 const factSet = [];
-                const pythonFiles = [];
+                // @implements A-SPEC-524.1 — every non-TS language with a CFG takes the flow-sensitive
+                // lane, each judged with ITS OWN vocabulary. The TS family keeps the facts+reaching-defs
+                // lane (its interprocedural propagation lives there).
+                const FLOW_EXT = [
+                    [/\.py$/i, 'python'], [/\.go$/i, 'go'], [/\.rs$/i, 'rust'],
+                    [/\.java$/i, 'java'], [/\.cs$/i, 'csharp'], [/\.(cpp|cc|cxx|hpp|h)$/i, 'cpp'],
+                ];
+                const flowLangFiles = new Map();
                 for (const f of scanned) {
                     const vocab = vocabularyFor(f.sourcePath);
                     if (!vocab)
                         continue;
-                    if (/\.py$/i.test(f.sourcePath)) {
-                        pythonFiles.push(f.sourcePath);
+                    const flowLang = FLOW_EXT.find(([re]) => re.test(f.sourcePath))?.[1];
+                    if (flowLang !== undefined) {
+                        flowLangFiles.set(flowLang, [...(flowLangFiles.get(flowLang) ?? []), f.sourcePath]);
                         continue;
                     }
                     let src;
@@ -1740,36 +1748,40 @@ function makeRawHandlers(store, opts) {
                     kept.push(...out.kept.map((f) => ({ ...f, lane: 'facts+reaching-defs' })));
                     refuted += out.removed.length;
                 }
-                // @implements A-SPEC-513.1 — Python takes the flow-sensitive lane directly: its facts
-                // extractor has no Python walk, but its CFG/DDG do (S-510.7), and the judgement above
-                // them is language-agnostic.
-                const pyVocab = vocabularyFor('x.py');
-                if (pythonFiles.length > 0) {
+                // @implements A-SPEC-513.1 / A-SPEC-524.1 — the flow-sensitive lane, generalized from
+                // Python-only to every language whose CFG/DDG landed in P2. The judgement engine is
+                // language-agnostic; only the vocabulary is selected per language.
+                const flowLangsAnalysed = [];
+                if (flowLangFiles.size > 0) {
                     const { parseAst } = require('../cpg/foundation/ast-store');
                     const { cfgOf, functionsIn } = require('../cpg/foundation/cfg');
                     const { ddgOf } = require('../cpg/foundation/ddg');
                     const { flowSensitiveTaint } = require('../rtm/flow-sensitive-taint');
-                    for (const rel of pythonFiles) {
-                        let src;
-                        try {
-                            src = fs.readFileSync(path.join(root, rel), 'utf8');
-                        }
-                        catch {
-                            continue;
-                        }
-                        const ast = await parseAst(src, rel);
-                        if (!ast || ast.errorCount > 0)
-                            continue;
-                        for (const fn of functionsIn(ast)) {
-                            const fcfg = cfgOf(ast, fn, src);
-                            if ('unsupported' in fcfg)
+                    for (const [flowLang, files] of flowLangFiles) {
+                        flowLangsAnalysed.push(flowLang);
+                        for (const rel of files) {
+                            let src;
+                            try {
+                                src = fs.readFileSync(path.join(root, rel), 'utf8');
+                            }
+                            catch {
                                 continue;
-                            const fddg = ddgOf(ast, fcfg, fn, src);
-                            if ('unsupported' in fddg)
+                            }
+                            const vocab = vocabularyFor(rel);
+                            const ast = await parseAst(src, rel);
+                            if (!ast || ast.errorCount > 0)
                                 continue;
-                            const r = flowSensitiveTaint({ ast, cfg: fcfg, ddg: fddg, source: src, fnName: rel, config: pyVocab });
-                            for (const f of r.findings)
-                                kept.push({ ...f, file: rel, lane: 'flow-sensitive' });
+                            for (const fn of functionsIn(ast)) {
+                                const fcfg = cfgOf(ast, fn, src);
+                                if ('unsupported' in fcfg)
+                                    continue;
+                                const fddg = ddgOf(ast, fcfg, fn, src);
+                                if ('unsupported' in fddg)
+                                    continue;
+                                const r = flowSensitiveTaint({ ast, cfg: fcfg, ddg: fddg, source: src, fnName: rel, config: vocab });
+                                for (const f of r.findings)
+                                    kept.push({ ...f, file: rel, lane: 'flow-sensitive' });
+                            }
                         }
                     }
                 }
@@ -1783,7 +1795,7 @@ function makeRawHandlers(store, opts) {
                         converged: raw.converged,
                         truncated: raw.truncated,
                         /** Which languages this run could actually judge, so a zero is readable. */
-                        languagesAnalysed: [...new Set([factSet.length > 0 ? 'typescript' : null, pythonFiles.length > 0 ? 'python' : null].filter(Boolean))],
+                        languagesAnalysed: [...new Set([factSet.length > 0 ? 'typescript' : null, ...flowLangsAnalysed].filter(Boolean))],
                     },
                 };
             }