@holmes-lab/holmes-kit 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+<!-- @implements A-SPEC-209 -->
+## [0.7.0] - 2026-09-02
+
+GOAL-7langs completes: all six analysis axes (relations, ast, cfg, ddg, cdg, taint) are now
+corpus-validated for all seven official languages — 42 cells, every one a measurement. The
+README's language table becomes a byte-pinned render of the same derivation, so it can no
+longer drift from what the code actually does.
+
+### Added
+
+- **Taint for all seven languages** (REQ-524): five vocabularies join the table (selected by
+  extension, never unioned), the flow-sensitive lane generalizes from Python-only to every
+  language with a CFG, and two measured engine holes close (Java/C# call nodes including
+  constructors; Java callee vs receiver). Validated with positive AND negative controls per
+  language, then measured over ten corpora: Go/Rust/Java/C# report zero (library code — same
+  structural decomposition as before), C++ reports two REAL argv→execv flows in leveldb's test
+  harness (verified; benign by intent, exactly what a taint tool should surface).
+- **Imports reach the graph in all seven languages** (REQ-525): extraction is a table row per
+  language; resolution is per-language semantics (Go strips the go.mod module prefix and fans
+  out to the package directory — with go.mod discovered by walking up from the file; Rust maps
+  crate::/super::/self:: and retries once without a trailing item segment; Java/C# resolve by
+  UNIQUE path suffix; C++ resolves quoted includes with extension preserved); ambiguity and
+  externals resolve to nothing, never to a guess. **Capability moved on measured arrival:
+  go 389, rust 64, java 2,688, csharp 316 (measurement overturned the ~0 expectation), cpp 482
+  resolved edges.**
+- **The README language table is a render** (REQ-526): a marker block generated from the live
+  matrix plus a corpus-evidence column (functions, zero violations, stated limits — C++'s 32.1%
+  L1 refusal rate is in the table), byte-pinned by the suite like docs/language-support.md.
+  The old hand-written table claimed "Full Support" for every language before it was true.
+
 <!-- @implements A-SPEC-209 -->
 ## [0.6.0] - 2026-09-02
 

package/README.md

@@ -217,15 +217,21 @@ flowchart LR
 Holmes-Kit embeds native AST & Code Property Graph (D-CPG) analyzers to track causal relationships and anchor implementations across diverse technology stacks.
 
 ### 💻 Supported Programming Languages
-| Language | CPG Parser | Anchor Syntax | Dataflow Taint & RTM |
-| :--- | :--- | :--- | :---: |
-| **TypeScript / JavaScript** | Tree-sitter TypeScript/JS | `// @implements A-SPEC-XXX` | ✅ Full Support |
-| **Python** | Tree-sitter Python | `# @implements A-SPEC-XXX` | ✅ Full Support |
-| **Go** | Tree-sitter Go | `// @implements A-SPEC-XXX` | ✅ Full Support |
-| **Rust** | Tree-sitter Rust | `// @implements A-SPEC-XXX` | ✅ Full Support |
-| **Java** | Tree-sitter Java | `// @implements A-SPEC-XXX` | ✅ Full Support |
-| **C / C++** | Tree-sitter C/C++ | `// @implements A-SPEC-XXX` | ✅ Full Support |
-| **C# (.NET)** | Tree-sitter C# | `// @implements A-SPEC-XXX` | ✅ Full Support |
+
+<!-- language-matrix:begin -->
+| Language | relations | ast | cfg | ddg | cdg | taint | Corpus evidence |
+| :--- | :---: | :---: | :---: | :---: | :---: | :---: | :--- |
+| **TypeScript / JavaScript** | ● | ● | ● | ● | ● | ● | 10,929 functions (this repository), zero invariant violations |
+| **Python** | ● | ● | ● | ● | ● | ● | 1,209 functions (jarvis), zero invariant violations |
+| **C#** | ● | ● | ● | ● | ● | ● | 9,184 functions (Newtonsoft.Json + RestSharp), zero invariant violations — 4.4% of files refuse at L1 (preprocessor across syntax) |
+| **Java** | ● | ● | ● | ● | ● | ● | 8,376 functions (gson + junit4), zero invariant violations |
+| **Go** | ● | ● | ● | ● | ● | ● | 2,637 functions (gin + cobra), zero invariant violations |
+| **Rust** | ● | ● | ● | ● | ● | ● | 5,247 functions (ripgrep + serde), zero invariant violations |
+| **C++** | ● | ● | ● | ● | ● | ● | 1,762 functions (nlohmann + fmt + leveldb), zero invariant violations — 32.1% of template/macro-heavy files refuse at L1 — layers above speak only for what parses |
+
+Every grade is a measurement, not a goal: a cell moves only when a real corpus proves it.
+Full per-cell bases (and every stated limit) live in [docs/language-support.md](docs/language-support.md), which is generated from the same derivation and byte-pinned by the suite — as is this table.
+<!-- language-matrix:end -->
 
 ### 🖥️ Supported Operating Systems & Runtimes
 | OS / Platform | Architecture | Status | Notes |

package/dist/.build-id

@@ -1 +1 @@
-814d021-mtjewubg
+7cb32c4-mtjifuwa

package/dist/holmes/cpg/foundation/cfg.js

@@ -151,9 +151,28 @@ const RUST_RULES = {
     ]),
     block: 'block',
 };
+// @implements A-SPEC-523.1 — C++, classified from three corpora. Its first fact is the PARSER:
+// 25-34% of template/macro-heavy real files refuse at L1 (measured on nlohmann/fmt/leveldb) —
+// the matrix's ast basis discloses this. What parses rides the TS chassis (else_clause wrapper,
+// C fallthrough switch, same try-clause names). Labels and goto refuse (zero corpus occurrences).
+const CPP_SIMPLE = new Set([
+    'expression_statement', 'declaration', 'alias_declaration', 'static_assert_declaration',
+    'enum_specifier', 'using_declaration', 'type_definition', 'struct_specifier',
+    'preproc_call', 'preproc_def', 'preproc_function_def', 'preproc_include',
+]);
+const CPP_RULES = {
+    simple: CPP_SIMPLE,
+    handled: new Set([
+        ...CPP_SIMPLE,
+        'compound_statement', 'if_statement', 'while_statement', 'do_statement', 'for_statement',
+        'for_range_loop', 'switch_statement', 'try_statement', 'throw_statement',
+        'break_statement', 'continue_statement', 'return_statement', 'preproc_if', 'preproc_ifdef',
+    ]),
+    block: 'compound_statement',
+};
 const LANG_RULES = {
     typescript: TS_RULES, tsx: TS_RULES, python: PY_RULES, go: GO_RULES, java: JAVA_RULES,
-    csharp: CSHARP_RULES, rust: RUST_RULES,
+    csharp: CSHARP_RULES, rust: RUST_RULES, cpp: CPP_RULES,
 };
 // @implements A-SPEC-510.6
 /**
@@ -301,6 +320,7 @@ function cfgOf(ast, fn, source) {
                 case 'statement_block':
                 case 'block':
                 case 'statement_list':
+                case 'compound_statement':
                     // Go's block carries one extra statement_list layer (probed shape) — both are containers.
                     return lowerSeq(stmtChildren(i), ctx);
                 case 'labeled_statement': {
@@ -531,9 +551,10 @@ function cfgOf(ast, fn, source) {
                 // @implements A-SPEC-520.1 — Java's enhanced for: the header owns the binding; body
                 // loops back; exhaustion exits false — same skeleton as Go's range.
                 case 'enhanced_for_statement':
-                case 'foreach_statement': {
+                case 'foreach_statement':
+                case 'for_range_loop': {
                     const header = newPoint(i);
-                    const bodyIdx = kids.of(i).find((k) => ast.nodes[k].type === 'block')
+                    const bodyIdx = kids.of(i).find((k) => ast.nodes[k].type === rules.block)
                         ?? stmtChildren(i).at(-1);
                     const myBreak = { label, target: -1 };
                     ctx.breakT.push({ label, owner: myBreak }, { label: null, owner: myBreak });
@@ -565,7 +586,8 @@ function cfgOf(ast, fn, source) {
                 // @implements A-SPEC-521.1 — the preprocessor puts ALTERNATIVES in statement position.
                 // Sequencing the arms would fabricate flow no build configuration ever runs; each arm is
                 // a branch and both rejoin after #endif (a may-analysis over every configuration).
-                case 'preproc_if': {
+                case 'preproc_if':
+                case 'preproc_ifdef': {
                     const p = newPoint(i);
                     const named = stmtChildren(i);
                     const elseArm = named.find((k) => ['preproc_else', 'preproc_elif'].includes(ast.nodes[k].type));
@@ -840,6 +862,37 @@ function cfgOf(ast, fn, source) {
                             exits.push({ from: b.point, kind: 'break' });
                         return { entry: p, exits };
                     }
+                    // @implements A-SPEC-523.1 — C++: flat case_statement children inside a
+                    // compound_statement, with C's implicit fallthrough (a value-less case is default).
+                    if (ast.lang === 'cpp') {
+                        const p = newPoint(i);
+                        const myBreak = { label, target: -1 };
+                        ctx.breakT.push({ label, owner: myBreak }, { label: null, owner: myBreak });
+                        const swBody = kids.of(i).find((k) => ast.nodes[k].type === 'compound_statement');
+                        let sawDefault = false;
+                        let prevFall = [];
+                        const exits = [];
+                        for (const c of swBody === undefined ? [] : kids.of(swBody)) {
+                            if (ast.nodes[c].type !== 'case_statement')
+                                continue;
+                            const children = stmtChildren(c);
+                            const stmts = children.filter((k) => rules.handled.has(ast.nodes[k].type));
+                            if (stmts.length === children.length)
+                                sawDefault = true; // no label value → default
+                            const cf = lowerSeq(stmts, ctx);
+                            link(p, cf.entry, stmts.length === children.length ? 'default' : 'case');
+                            for (const e of prevFall)
+                                link(e.from, cf.entry, 'seq'); // C fallthrough
+                            prevFall = cf.exits;
+                        }
+                        exits.push(...prevFall);
+                        if (!sawDefault)
+                            exits.push({ from: p, kind: 'default' });
+                        ctx.breakT.splice(-2);
+                        for (const b of claimBreaks(myBreak))
+                            exits.push({ from: b.point, kind: 'break' });
+                        return { entry: p, exits };
+                    }
                     const p = newPoint(i);
                     const body = stmtChildren(i).at(-1); // switch_body
                     const myBreak = { label, target: -1 };
@@ -908,7 +961,7 @@ function cfgOf(ast, fn, source) {
                     // @implements A-SPEC-520.1 — Java spells the try body `block`; TS `statement_block`.
                     const body = isPython
                         ? kids.of(i).find((k) => ast.nodes[k].type === 'block')
-                        : named.find((k) => ['statement_block', 'block'].includes(ast.nodes[k].type));
+                        : named.find((k) => ['statement_block', 'block', 'compound_statement'].includes(ast.nodes[k].type));
                     const handler = isPython
                         ? kids.of(i).find((k) => ast.nodes[k].type === 'except_clause')
                         : named.find((k) => ast.nodes[k].type === 'catch_clause');

package/dist/holmes/cpg/foundation/ddg.js

@@ -97,6 +97,65 @@ function defUseOf(ast, cfg, fn, source) {
             if (ty === 'field_identifier' || ty === 'package_identifier' || ty === 'label_name')
                 return;
             switch (ty) {
+                // @implements A-SPEC-523.1 — C++'s binding shapes.
+                case 'init_declarator': {
+                    // `int y = g()` / `T& r = s` — the declarator's identifier (through reference/pointer
+                    // wrappers) is the def; the initializer is a use.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    const firstId = (m) => {
+                        if (ast.nodes[m].type === 'identifier')
+                            return m;
+                        for (const c of kids.of(m)) {
+                            const r = firstId(c);
+                            if (r !== undefined)
+                                return r;
+                        }
+                        return undefined;
+                    };
+                    if (named[0] !== undefined) {
+                        const id = firstId(named[0]);
+                        if (id !== undefined)
+                            add(defs, stmt, text(id));
+                    }
+                    for (const r of named.slice(1))
+                        walk(r, false);
+                    return;
+                }
+                case 'for_range_loop': {
+                    // `for (auto& s : xs)` — the declarator's identifier binds; the range is a use.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    const body = named.find((c) => ast.nodes[c].type === 'compound_statement');
+                    for (const c of named) {
+                        if (c === body)
+                            continue;
+                        const ty = ast.nodes[c].type;
+                        if (ty.endsWith('_declarator') || ty === 'identifier') {
+                            const firstId = (m) => {
+                                if (ast.nodes[m].type === 'identifier')
+                                    return m;
+                                for (const k of kids.of(m)) {
+                                    const r = firstId(k);
+                                    if (r !== undefined)
+                                        return r;
+                                }
+                                return undefined;
+                            };
+                            // the LAST such child before the body is the RANGE when it is a bare identifier —
+                            // walk order below fixes that: declarator-shaped nodes def, the final expr uses.
+                            if (ty === 'identifier' && c === named.filter((x) => x !== body).at(-1)) {
+                                walk(c, false);
+                                continue;
+                            }
+                            const id = firstId(c);
+                            if (id !== undefined)
+                                add(defs, stmt, text(id));
+                        }
+                        else if (!ty.includes('type') && ty !== 'placeholder_type_specifier') {
+                            walk(c, false);
+                        }
+                    }
+                    return;
+                }
                 // @implements A-SPEC-522.1 — Rust's binding shapes. Pattern identifiers bind by the
                 // LOWERCASE-INITIAL convention (rustc warns on violations): `Some(x)` binds x, skips the
                 // constructor Some — a documented heuristic, not a guess about arbitrary code.
@@ -461,11 +520,24 @@ function defUseOf(ast, cfg, fn, source) {
         // @implements A-SPEC-520.1 — Java wraps the parameter in catch_formal_parameter; TS puts the
         // identifier directly under the clause. One lookup serves both.
         const formal = named.find((k) => ast.nodes[k].type === 'catch_formal_parameter');
+        // @implements A-SPEC-523.1 — C++ wraps it deeper still: parameter_list > parameter_declaration.
+        const plist = named.find((k) => ast.nodes[k].type === 'parameter_list');
+        const firstIdIn = (m) => {
+            if (ast.nodes[m].type === 'identifier')
+                return m;
+            for (const c of kids.of(m)) {
+                const r = firstIdIn(c);
+                if (r !== undefined)
+                    return r;
+            }
+            return undefined;
+        };
         const param = named.find((k) => ast.nodes[k].type === 'identifier')
             ?? (formal !== undefined
                 ? kids.of(formal).find((k) => ast.nodes[k].type === 'identifier')
-                : undefined);
-        const block = named.find((k) => ['statement_block', 'block'].includes(ast.nodes[k].type));
+                : undefined)
+            ?? (plist !== undefined ? firstIdIn(plist) : undefined);
+        const block = named.find((k) => ['statement_block', 'block', 'compound_statement'].includes(ast.nodes[k].type));
         if (param === undefined || block === undefined)
             return;
         const first = kids.of(block).find((k) => stmtSet.has(k));

package/dist/holmes/cpg/foundation/language-matrix.d.ts

@@ -55,3 +55,20 @@ export type LanguageMatrix = Record<Layer, Record<string, Cell>>;
 export declare function languageMatrix(): LanguageMatrix;
 /** Render docs/language-support.md — the table is a PRODUCT of the code, not a claim beside it. */
 export declare function renderLanguageSupport(): string;
+/**
+ * The corpus evidence behind each language's grades — TRANSCRIBED from the activation log's
+ * measurements (sources: S-510 for ts/py, S-519.1..S-523.1 for the five), so the README can cite
+ * numbers without re-running corpora at test time. If a re-run moves a number, this table moves
+ * with it in the same commit — the pin in the test makes forgetting that a red suite.
+ */
+export declare const CORPUS_EVIDENCE: Record<MatrixLanguage, {
+    fns: string;
+    corpus: string;
+    note?: string;
+}>;
+/**
+ * The README's language table — a RENDER, like docs/language-support.md, byte-pinned by a test.
+ * Glyphs are derived from the live matrix; the evidence column is CORPUS_EVIDENCE. No slogans:
+ * a grade appears next to the measurement that earned it.
+ */
+export declare function renderReadmeLanguageTable(): string;

package/dist/holmes/cpg/foundation/language-matrix.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MATRIX_LANGUAGES = exports.LAYERS = void 0;
+exports.CORPUS_EVIDENCE = exports.MATRIX_LANGUAGES = exports.LAYERS = void 0;
 exports.languageMatrix = languageMatrix;
 exports.renderLanguageSupport = renderLanguageSupport;
+exports.renderReadmeLanguageTable = renderReadmeLanguageTable;
 // @implements A-SPEC-510.6
 /**
  * The layer × language support matrix — what "officially supported" MEANS, made checkable.
@@ -57,9 +58,15 @@ function relationsCell(ext) {
 function astCell(astLang) {
     // The TS grammar family covers tsx/js too — AST_LANGUAGES is the authority on which wasm applies.
     const covered = AST_LANG_SET.has(astLang) || (astLang === 'typescript' && AST_LANG_SET.has('tsx'));
-    return covered
-        ? { support: 'full', basis: 'vendored tree-sitter grammar (L1 AST persisted)' }
-        : { support: 'none', basis: 'no vendored grammar for the L1 substrate' };
+    if (!covered)
+        return { support: 'none', basis: 'no vendored grammar for the L1 substrate' };
+    // @implements A-SPEC-523.1 — the C++ cell carries its measured limit IN the table: 25-34% of
+    // template/macro-heavy real files refuse at L1 (nlohmann/fmt/leveldb), and every layer above
+    // speaks only about what L1 accepts. Same glyph, weaker evidence — the reader sees it here.
+    if (astLang === 'cpp') {
+        return { support: 'full', basis: 'vendored tree-sitter grammar (L1 AST persisted) — limit: template/macro-heavy real files can refuse at L1 (measured 25-34% on three corpora); layers above speak only for what parses' };
+    }
+    return { support: 'full', basis: 'vendored tree-sitter grammar (L1 AST persisted)' };
 }
 function cfgFamilyCell(astLang, layer) {
     const covered = cfg_1.CFG_LANGUAGES.has(astLang) || (astLang === 'typescript' && cfg_1.CFG_LANGUAGES.has('tsx'));
@@ -147,3 +154,44 @@ function renderLanguageSupport() {
         '',
     ].join('\n');
 }
+// @implements A-SPEC-526.1
+/**
+ * The corpus evidence behind each language's grades — TRANSCRIBED from the activation log's
+ * measurements (sources: S-510 for ts/py, S-519.1..S-523.1 for the five), so the README can cite
+ * numbers without re-running corpora at test time. If a re-run moves a number, this table moves
+ * with it in the same commit — the pin in the test makes forgetting that a red suite.
+ */
+exports.CORPUS_EVIDENCE = {
+    typescript: { fns: '10,929', corpus: 'this repository' },
+    python: { fns: '1,209', corpus: 'jarvis' },
+    csharp: { fns: '9,184', corpus: 'Newtonsoft.Json + RestSharp', note: '4.4% of files refuse at L1 (preprocessor across syntax)' },
+    java: { fns: '8,376', corpus: 'gson + junit4' },
+    go: { fns: '2,637', corpus: 'gin + cobra' },
+    rust: { fns: '5,247', corpus: 'ripgrep + serde' },
+    cpp: { fns: '1,762', corpus: 'nlohmann + fmt + leveldb', note: '32.1% of template/macro-heavy files refuse at L1 — layers above speak only for what parses' },
+};
+// @implements A-SPEC-526.1
+/**
+ * The README's language table — a RENDER, like docs/language-support.md, byte-pinned by a test.
+ * Glyphs are derived from the live matrix; the evidence column is CORPUS_EVIDENCE. No slogans:
+ * a grade appears next to the measurement that earned it.
+ */
+function renderReadmeLanguageTable() {
+    const m = languageMatrix();
+    const glyph = (s) => (s === 'full' ? '●' : s === 'partial' ? '◐' : '○');
+    const lines = [];
+    lines.push('| Language | relations | ast | cfg | ddg | cdg | taint | Corpus evidence |');
+    lines.push('| :--- | :---: | :---: | :---: | :---: | :---: | :---: | :--- |');
+    for (const { lang, label } of exports.MATRIX_LANGUAGES) {
+        const ev = exports.CORPUS_EVIDENCE[lang];
+        const cells = ['relations', 'ast', 'cfg', 'ddg', 'cdg', 'taint']
+            .map((layer) => glyph(m[layer][lang].support)).join(' | ');
+        const note = ev.note ? ` — ${ev.note}` : '';
+        lines.push(`| **${label}** | ${cells} | ${ev.fns} functions (${ev.corpus}), zero invariant violations${note} |`);
+    }
+    lines.push('');
+    lines.push('Every grade is a measurement, not a goal: a cell moves only when a real corpus proves it.');
+    lines.push('Full per-cell bases (and every stated limit) live in [docs/language-support.md](docs/language-support.md), which is generated from the same derivation and byte-pinned by the suite — as is this table.');
+    lines.push('');
+    return lines.join('\n');
+}

package/dist/holmes/cpg/language-capability.js

@@ -84,6 +84,17 @@ const CALLS_ONLY = { symbols: true, relations: ['calls'], graphResolved: ['calls
 const CALLS_AND_INHERITS = {
     symbols: true, relations: ['calls', 'inherits'], graphResolved: ['calls', 'inherits'],
 };
+// @implements A-SPEC-525.1
+/**
+ * All three relations, extracted AND graph-resolved. The five non-TS/Python languages moved here
+ * when their imports were measured ARRIVING (A-SPEC-286's column): go 389, rust 64, java 2,688,
+ * csharp 316, cpp 482 resolved edges over the ten corpora. Rates differ by language semantics —
+ * C# resolves only where namespace happens to mirror the folder layout, Rust skips use-trees as
+ * ambiguous — and the unresolved remainder is external/ambiguous by design, never guessed.
+ */
+const FULL_RELATIONS = {
+    symbols: true, relations: ['calls', 'imports', 'inherits'], graphResolved: ['calls', 'imports', 'inherits'],
+};
 exports.LANGUAGE_CAPABILITY = {
     '.ts': TS_FAMILY, '.mts': TS_FAMILY, '.cts': TS_FAMILY, '.tsx': TS_FAMILY,
     '.js': TS_FAMILY, '.mjs': TS_FAMILY, '.jsx': TS_FAMILY,
@@ -93,12 +104,13 @@ exports.LANGUAGE_CAPABILITY = {
     '.py': { symbols: true, relations: ['calls', 'imports', 'inherits'], graphResolved: ['calls', 'imports', 'inherits'] },
     // @implements A-SPEC-511.1 — inheritance recovered: Java extends/implements, C# base_list,
     // Go struct embedding (interface satisfaction is a declared permanent gap), Rust `impl T for S`.
-    '.java': CALLS_AND_INHERITS, '.cs': CALLS_AND_INHERITS, '.go': CALLS_AND_INHERITS, '.rs': CALLS_AND_INHERITS,
+    // @implements A-SPEC-525.1 — imports measured arriving for all five (see FULL_RELATIONS).
+    '.java': FULL_RELATIONS, '.cs': FULL_RELATIONS, '.go': FULL_RELATIONS, '.rs': FULL_RELATIONS,
     // @implements A-SPEC-287 — C++ used to extract calls that never became graph edges, because its
     // edge scope omitted the class node the symbol walk uses. Fixed; it now resolves like the others.
     // @implements A-SPEC-511.1 — base_class_clause recovered (access specifiers skipped).
-    '.cpp': CALLS_AND_INHERITS, '.cc': CALLS_AND_INHERITS, '.cxx': CALLS_AND_INHERITS,
-    '.hpp': CALLS_AND_INHERITS, '.hh': CALLS_AND_INHERITS, '.h': CALLS_AND_INHERITS,
+    '.cpp': FULL_RELATIONS, '.cc': FULL_RELATIONS, '.cxx': FULL_RELATIONS,
+    '.hpp': FULL_RELATIONS, '.hh': FULL_RELATIONS, '.h': FULL_RELATIONS,
 };
 function capabilityFor(ext) {
     return exports.LANGUAGE_CAPABILITY[ext.toLowerCase()];

package/dist/holmes/cpg/language-parser-walk.js

@@ -538,7 +538,9 @@ const EDGE_CONFIG = {
     // syntactic fact. Interface satisfaction is implicit and structural (no `implements` keyword), so
     // recovering it needs a type checker — a DECLARED PERMANENT LIMIT, never a guess.
     go: { callTypes: ['call_expression'], calleeField: 'function', scopeTypes: ['function_declaration', 'method_declaration'],
-        inherits: { declTypes: ['type_spec'], mode: 'go-embedding' } },
+        inherits: { declTypes: ['type_spec'], mode: 'go-embedding' },
+        // @implements A-SPEC-525.1 — import_spec's interpreted_string_literal, quotes stripped.
+        imports: { nodeType: 'import_spec', mode: 'go-string' } },
     // @implements A-SPEC-300
     // `impl_item`/`trait_item` must open a qualifying scope, exactly as the symbol walk does: a method
     // in `impl Greet for En` is the symbol `En.hello`, but its edges came out qualified as bare
@@ -547,18 +549,27 @@ const EDGE_CONFIG = {
     // @implements A-SPEC-511.1 — `impl Trait for Type` ⇒ Type inherits Trait (implementer → abstract).
     // An inherent `impl Type { … }` carries no trait field and is NOT inheritance: no edge.
     rust: { callTypes: ['call_expression'], calleeField: 'function', scopeTypes: ['function_item', 'impl_item', 'trait_item'],
-        inherits: { declTypes: ['impl_item'], mode: 'rust-impl' } },
+        inherits: { declTypes: ['impl_item'], mode: 'rust-impl' },
+        // @implements A-SPEC-525.1 — use_declaration's scoped path; use-trees (braces) are
+        // ambiguous fan-outs and are skipped rather than half-read.
+        imports: { nodeType: 'use_declaration', mode: 'rust-use' } },
     // @implements A-SPEC-511.1 — Java separates the two syntactically, and BOTH are inheritance edges:
     // `superclass` (extends) and `super_interfaces` (implements), plus an interface's own extends.
     java: { callTypes: ['method_invocation'], calleeField: 'name', scopeTypes: ['class_declaration', 'method_declaration'],
         inherits: { declTypes: ['class_declaration', 'interface_declaration', 'record_declaration', 'enum_declaration'],
-            fields: ['superclass', 'super_interfaces', 'interfaces', 'extends_interfaces'] } },
+            fields: ['superclass', 'super_interfaces', 'interfaces', 'extends_interfaces'] },
+        // @implements A-SPEC-525.1 — import_declaration's scoped_identifier; a wildcard
+        // (asterisk sibling) is ambiguous and skipped.
+        imports: { nodeType: 'import_declaration', mode: 'java-scoped' } },
     // @implements A-SPEC-511.1 — C# puts the base class AND the interfaces in ONE `base_list`, with no
     // syntactic marker telling them apart. Splitting them would be a guess, so BOTH become `inherits`
     // (a deliberate asymmetry with the TS walk, which emits extends only — H-SPEC-511 decision 1).
     csharp: { callTypes: ['invocation_expression'], calleeField: 'function', scopeTypes: ['class_declaration', 'method_declaration'],
         inherits: { declTypes: ['class_declaration', 'interface_declaration', 'struct_declaration', 'record_declaration'],
-            childTypes: ['base_list'] } },
+            childTypes: ['base_list'] },
+        // @implements A-SPEC-525.1 — using_directive's qualified_name (a NAMESPACE, which the
+        // resolver may fail to map to a file — that failure is measured, not hidden).
+        imports: { nodeType: 'using_directive', mode: 'csharp-using' } },
     // @implements A-SPEC-287
     // C++ listed only `function_definition`, so a member function's edges came out qualified as bare
     // `run` while the symbol walk (which treats class_specifier/struct_specifier as scopes) emitted
@@ -568,7 +579,9 @@ const EDGE_CONFIG = {
     // @implements A-SPEC-511.1 — C++ bases live in `base_class_clause`; access specifiers
     // (public/private/protected/virtual) are skipped and only the type name is taken.
     cpp: { callTypes: ['call_expression'], calleeField: 'function', scopeTypes: ['class_specifier', 'struct_specifier', 'function_definition'],
-        inherits: { declTypes: ['class_specifier', 'struct_specifier'], childTypes: ['base_class_clause'] } },
+        inherits: { declTypes: ['class_specifier', 'struct_specifier'], childTypes: ['base_class_clause'] },
+        // @implements A-SPEC-525.1 — quoted includes only; <system> headers are external.
+        imports: { nodeType: 'preproc_include', mode: 'cpp-include' } },
 };
 // The callee's bare name: a plain identifier is itself; a member/selector/scoped/field node
 // (`o.m`, `self.c`, `mod::f`, `this.C`) unwraps to its LAST identifier segment — the method name.
@@ -764,6 +777,49 @@ function walkEdges(tree, cfg) {
             }
         }
     };
+    // @implements A-SPEC-525.1 — imports, table-driven like everything else in this walk. Each
+    // mode reads ONE probed shape; anything ambiguous (use-trees, wildcards, system headers) emits
+    // nothing rather than half of something.
+    const imp = cfg.imports;
+    const emitImport = (node) => {
+        if (imp.mode === 'go-string') {
+            const lit = node.namedChildren.find((c) => c.type === 'interpreted_string_literal');
+            if (lit)
+                out.push({ from: '<module>', to: lit.text.replace(/["']/g, ''), rel: 'imports' });
+            return;
+        }
+        if (imp.mode === 'rust-use') {
+            const arg = node.namedChildren.find((c) => ['scoped_identifier', 'identifier', 'use_as_clause', 'scoped_use_list', 'use_wildcard'].includes(c.type));
+            if (!arg)
+                return;
+            if (arg.type === 'scoped_use_list' || arg.type === 'use_wildcard')
+                return; // ambiguous fan-out
+            const pathNode = arg.type === 'use_as_clause' ? arg.namedChildren[0] : arg;
+            if (pathNode)
+                out.push({ from: '<module>', to: pathNode.text, rel: 'imports' });
+            return;
+        }
+        if (imp.mode === 'java-scoped') {
+            if (node.children.some((c) => c.type === 'asterisk'))
+                return; // wildcard
+            const scoped = node.namedChildren.find((c) => ['scoped_identifier', 'identifier'].includes(c.type));
+            if (scoped)
+                out.push({ from: '<module>', to: scoped.text, rel: 'imports' });
+            return;
+        }
+        if (imp.mode === 'csharp-using') {
+            const q = node.namedChildren.find((c) => ['qualified_name', 'identifier'].includes(c.type));
+            if (q)
+                out.push({ from: '<module>', to: q.text, rel: 'imports' });
+            return;
+        }
+        if (imp.mode === 'cpp-include') {
+            const lit = node.namedChildren.find((c) => c.type === 'string_literal');
+            if (lit)
+                out.push({ from: '<module>', to: lit.text.replace(/["']/g, ''), rel: 'imports' });
+            return; // <system>: external
+        }
+    };
     const visit = (node) => {
         if (callTypes.has(node.type)) {
             const callee = calleeNameOf(node.childForFieldName(cfg.calleeField));
@@ -772,6 +828,8 @@ function walkEdges(tree, cfg) {
         }
         if (inh && declTypes.has(node.type))
             emitInherits(node);
+        if (imp && node.type === imp.nodeType)
+            emitImport(node);
         for (let i = 0; i < node.childCount; i++)
             visit(node.child(i));
     };

package/dist/holmes/mcp/handlers.js

@@ -1708,13 +1708,21 @@ function makeRawHandlers(store, opts) {
                 const { vocabularyFor } = require('../rtm/taint-vocabulary');
                 const parser = new TreeSitterTsParser();
                 const factSet = [];
-                const pythonFiles = [];
+                // @implements A-SPEC-524.1 — every non-TS language with a CFG takes the flow-sensitive
+                // lane, each judged with ITS OWN vocabulary. The TS family keeps the facts+reaching-defs
+                // lane (its interprocedural propagation lives there).
+                const FLOW_EXT = [
+                    [/\.py$/i, 'python'], [/\.go$/i, 'go'], [/\.rs$/i, 'rust'],
+                    [/\.java$/i, 'java'], [/\.cs$/i, 'csharp'], [/\.(cpp|cc|cxx|hpp|h)$/i, 'cpp'],
+                ];
+                const flowLangFiles = new Map();
                 for (const f of scanned) {
                     const vocab = vocabularyFor(f.sourcePath);
                     if (!vocab)
                         continue;
-                    if (/\.py$/i.test(f.sourcePath)) {
-                        pythonFiles.push(f.sourcePath);
+                    const flowLang = FLOW_EXT.find(([re]) => re.test(f.sourcePath))?.[1];
+                    if (flowLang !== undefined) {
+                        flowLangFiles.set(flowLang, [...(flowLangFiles.get(flowLang) ?? []), f.sourcePath]);
                         continue;
                     }
                     let src;
@@ -1740,36 +1748,40 @@ function makeRawHandlers(store, opts) {
                     kept.push(...out.kept.map((f) => ({ ...f, lane: 'facts+reaching-defs' })));
                     refuted += out.removed.length;
                 }
-                // @implements A-SPEC-513.1 — Python takes the flow-sensitive lane directly: its facts
-                // extractor has no Python walk, but its CFG/DDG do (S-510.7), and the judgement above
-                // them is language-agnostic.
-                const pyVocab = vocabularyFor('x.py');
-                if (pythonFiles.length > 0) {
+                // @implements A-SPEC-513.1 / A-SPEC-524.1 — the flow-sensitive lane, generalized from
+                // Python-only to every language whose CFG/DDG landed in P2. The judgement engine is
+                // language-agnostic; only the vocabulary is selected per language.
+                const flowLangsAnalysed = [];
+                if (flowLangFiles.size > 0) {
                     const { parseAst } = require('../cpg/foundation/ast-store');
                     const { cfgOf, functionsIn } = require('../cpg/foundation/cfg');
                     const { ddgOf } = require('../cpg/foundation/ddg');
                     const { flowSensitiveTaint } = require('../rtm/flow-sensitive-taint');
-                    for (const rel of pythonFiles) {
-                        let src;
-                        try {
-                            src = fs.readFileSync(path.join(root, rel), 'utf8');
-                        }
-                        catch {
-                            continue;
-                        }
-                        const ast = await parseAst(src, rel);
-                        if (!ast || ast.errorCount > 0)
-                            continue;
-                        for (const fn of functionsIn(ast)) {
-                            const fcfg = cfgOf(ast, fn, src);
-                            if ('unsupported' in fcfg)
+                    for (const [flowLang, files] of flowLangFiles) {
+                        flowLangsAnalysed.push(flowLang);
+                        for (const rel of files) {
+                            let src;
+                            try {
+                                src = fs.readFileSync(path.join(root, rel), 'utf8');
+                            }
+                            catch {
                                 continue;
-                            const fddg = ddgOf(ast, fcfg, fn, src);
-                            if ('unsupported' in fddg)
+                            }
+                            const vocab = vocabularyFor(rel);
+                            const ast = await parseAst(src, rel);
+                            if (!ast || ast.errorCount > 0)
                                 continue;
-                            const r = flowSensitiveTaint({ ast, cfg: fcfg, ddg: fddg, source: src, fnName: rel, config: pyVocab });
-                            for (const f of r.findings)
-                                kept.push({ ...f, file: rel, lane: 'flow-sensitive' });
+                            for (const fn of functionsIn(ast)) {
+                                const fcfg = cfgOf(ast, fn, src);
+                                if ('unsupported' in fcfg)
+                                    continue;
+                                const fddg = ddgOf(ast, fcfg, fn, src);
+                                if ('unsupported' in fddg)
+                                    continue;
+                                const r = flowSensitiveTaint({ ast, cfg: fcfg, ddg: fddg, source: src, fnName: rel, config: vocab });
+                                for (const f of r.findings)
+                                    kept.push({ ...f, file: rel, lane: 'flow-sensitive' });
+                            }
                         }
                     }
                 }
@@ -1783,7 +1795,7 @@ function makeRawHandlers(store, opts) {
                         converged: raw.converged,
                         truncated: raw.truncated,
                         /** Which languages this run could actually judge, so a zero is readable. */
-                        languagesAnalysed: [...new Set([factSet.length > 0 ? 'typescript' : null, pythonFiles.length > 0 ? 'python' : null].filter(Boolean))],
+                        languagesAnalysed: [...new Set([factSet.length > 0 ? 'typescript' : null, ...flowLangsAnalysed].filter(Boolean))],
                     },
                 };
             }

package/dist/holmes/rtm/flow-sensitive-taint.js

@@ -6,7 +6,19 @@ const sink_matching_1 = require("./sink-matching");
 const lineOf = (source, offset) => source.slice(0, offset).split('\n').length;
 /** The callee's bare last-segment name for a call node, or null when it is not a plain call. */
 function calleeNameOf(ast, kids, call, source) {
-    const fnNode = kids.of(call).find((k) => ast.nodes[k].named);
+    const named = kids.of(call).filter((k) => ast.nodes[k].named);
+    // @implements A-SPEC-524.1 — Java's method_invocation is [receiver?, NAME, argument_list]:
+    // the first named child is the RECEIVER when present, so taking it named `runtime` where the
+    // sink is `exec` — measured before sealing. The name is the identifier just before the
+    // argument list.
+    let fnNode;
+    if (ast.nodes[call].type === 'method_invocation') {
+        const argsAt = named.findIndex((k) => ast.nodes[k].type === 'argument_list');
+        fnNode = argsAt > 0 ? named[argsAt - 1] : named[0];
+    }
+    else {
+        fnNode = named[0];
+    }
     if (fnNode === undefined)
         return null;
     const text = source.slice(ast.nodes[fnNode].start, ast.nodes[fnNode].end);
@@ -31,7 +43,11 @@ function flowSensitiveTaint(input) {
             const ty = ast.nodes[n].type;
             if (n !== stmt && stmtOfBlock.has(n))
                 return;
-            if (ty === 'call_expression' || ty === 'call')
+            // @implements A-SPEC-524.1 — the call-node set, measured per grammar: Java spells calls
+            // method_invocation and constructors object_creation_expression (where ProcessBuilder
+            // lives), C# spells them invocation_expression.
+            if (ty === 'call_expression' || ty === 'call' || ty === 'method_invocation'
+                || ty === 'invocation_expression' || ty === 'object_creation_expression')
                 out.push(n);
             for (const c of kids.of(n))
                 walk(c);

package/dist/holmes/rtm/rtm-builder.d.ts

@@ -29,6 +29,12 @@ export interface ResolutionReport {
 export interface BuildRtmOptions {
     /** Resolve a spec id to its source file path (e.g. its .md file) for provenance tagging. */
     specSourcePath?: (id: string) => string | undefined;
+    /**
+     * @implements A-SPEC-525.1 — the Go module path (go.mod's `module` line). Supplied by the
+     * caller that can read go.mod; without it every Go import is external and resolves to nothing,
+     * which is the honest default (no prefix to strip, no guess to make).
+     */
+    goModule?: string;
     /**
      * @implements A-SPEC-281
      * The observation context every fact in this build shares: which commit it was read at, which
@@ -170,20 +176,6 @@ export interface CommitRecord {
  * scanned are still recorded as nodes — they happened.
  */
 export declare function addCommitHistory(history: readonly CommitRecord[], scanned: readonly ScannedFile[], graph: RtmGraph, opts?: BuildRtmOptions): void;
-/**
- * @implements A-SPEC-289
- * FILE nodes and resolved `imports` edges.
- *
- * Import relations were extracted and then dropped, because their endpoints are a file and a module
- * path while the graph knew only symbols and specs — measured on this repository, 1,892 extracted
- * and 0 in the graph. `File` is a node kind Goal Phase 3 names, so it becomes one.
- *
- * ONLY relative specifiers are resolved, and only to a file the scan actually contains. A bare
- * specifier (`node:fs`, `js-yaml`) is an external package with no node to point at, and inventing
- * one would be a guess — the same precision-over-recall rule call resolution follows. Measured: 441
- * of 1,892 specifiers (23%) resolve inside the repository, and the rest failing to resolve is a
- * fact about the imports, not a defect in the resolver.
- */
 export declare function addImportEdges(scanned: readonly ScannedFile[], graph: RtmGraph, opts?: BuildRtmOptions): void;
 /** @implements A-SPEC-293 — one architecture decision as its record states it. */
 export interface DecisionRecord {

package/dist/holmes/rtm/rtm-builder.js

@@ -43,6 +43,7 @@ exports.addCommitHistory = addCommitHistory;
 exports.addImportEdges = addImportEdges;
 exports.addDecisionEdges = addDecisionEdges;
 const path = __importStar(require("node:path"));
+const fs = __importStar(require("node:fs"));
 const language_capability_1 = require("../cpg/language-capability");
 /**
  * @implements A-SPEC-281
@@ -341,12 +342,117 @@ function addCommitHistory(history, scanned, graph, opts) {
  * of 1,892 specifiers (23%) resolve inside the repository, and the rest failing to resolve is a
  * fact about the imports, not a defect in the resolver.
  */
+function fsReadGoMod(p) {
+    try {
+        return fs.readFileSync(p, 'utf8').match(/^module\s+(\S+)/m)?.[1] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
 function addImportEdges(scanned, graph, opts) {
     const known = new Set(scanned.map((f) => f.sourcePath));
     const EXTENSIONS = ['', '.ts', '.tsx', '.mts', '.cts', '.js', '.mjs', '.cjs', '.jsx', '.py',
         '/index.ts', '/index.js', '/__init__.py'];
     const firstKnown = (base) => EXTENSIONS.map((ext) => `${base}${ext}`).find((candidate) => known.has(candidate)) ?? null;
+    // @implements A-SPEC-525.1 — the five languages' resolution rules, selected by the IMPORTING
+    // file's extension because resolution IS per-language semantics. The founding rule is unchanged
+    // everywhere: resolve only to files the scan actually contains; the ambiguous resolve to none.
+    const knownList = [...known];
+    const uniqueSuffix = (suffix) => {
+        const hits = knownList.filter((k) => k === suffix || k.endsWith(`/${suffix}`));
+        return hits.length === 1 ? hits[0] : null; // two files may not become a guess
+    };
+    // go.mod discovery: injected via opts when the caller knows it; otherwise walked up from the
+    // first Go file's ABSOLUTE path (bounded), so production builds resolve without extra wiring.
+    let goModCache;
+    const goModuleOf = () => {
+        if (opts?.goModule)
+            return opts.goModule;
+        if (goModCache !== undefined)
+            return goModCache ?? undefined;
+        goModCache = null;
+        const anyGo = scanned.find((f) => /\.go$/.test(f.sourcePath) && f.path);
+        if (anyGo) {
+            let dir = path.dirname(anyGo.path);
+            for (let hops = 0; hops < 12; hops++) {
+                try {
+                    const txt = fsReadGoMod(path.join(dir, 'go.mod'));
+                    if (txt !== null) {
+                        goModCache = txt;
+                        break;
+                    }
+                }
+                catch { /* keep walking */ }
+                const up = path.dirname(dir);
+                if (up === dir)
+                    break;
+                dir = up;
+            }
+        }
+        return goModCache ?? undefined;
+    };
+    const goPackage = (spec) => {
+        const mod = goModuleOf();
+        if (!mod || !(spec === mod || spec.startsWith(`${mod}/`)))
+            return []; // external, honestly
+        const dir = spec === mod ? '' : spec.slice(mod.length + 1);
+        const prefix = dir === '' ? '' : `${dir}/`;
+        return knownList.filter((k) => k.startsWith(prefix) && k.endsWith('.go')
+            && !k.endsWith('_test.go') && !k.slice(prefix.length).includes('/'));
+    };
+    const rustResolve = (fromFile, spec) => {
+        const segs = spec.split('::');
+        const head = segs.shift();
+        let baseDir;
+        if (head === 'crate') {
+            // the crate root is the src/ directory nearest above the importing file
+            const m = fromFile.match(/^(.*?src)\//);
+            baseDir = m ? m[1] : 'src';
+        }
+        else if (head === 'super') {
+            baseDir = path.posix.dirname(path.posix.dirname(fromFile));
+            while (segs[0] === 'super') {
+                segs.shift();
+                baseDir = path.posix.dirname(baseDir);
+            }
+        }
+        else if (head === 'self') {
+            baseDir = path.posix.dirname(fromFile);
+        }
+        else {
+            return null; // external crate
+        }
+        const tryPath = (parts) => {
+            if (parts.length === 0)
+                return null;
+            const base = path.posix.normalize(path.posix.join(baseDir, ...parts));
+            if (known.has(`${base}.rs`))
+                return `${base}.rs`;
+            if (known.has(`${base}/mod.rs`))
+                return `${base}/mod.rs`;
+            return null;
+        };
+        // the last segment may be an ITEM, not a module — drop it once and retry
+        return tryPath(segs) ?? tryPath(segs.slice(0, -1));
+    };
     const resolve = (fromFile, spec) => {
+        // @implements A-SPEC-525.1 — language branches BEFORE the JS/Python-shaped fallthrough.
+        if (/\.go$/.test(fromFile))
+            return null; // Go fans out separately (a package is its files)
+        if (/\.rs$/.test(fromFile))
+            return rustResolve(fromFile, spec);
+        if (/\.java$/.test(fromFile))
+            return uniqueSuffix(`${spec.split('.').join('/')}.java`);
+        if (/\.cs$/.test(fromFile))
+            return uniqueSuffix(`${spec.split('.').join('/')}.cs`);
+        if (/\.(cpp|cc|cxx|hpp|h)$/.test(fromFile)) {
+            // extension preserved: the dotted split below would butcher `util/env.h`
+            const relative = path.posix.normalize(path.posix.join(path.posix.dirname(fromFile), spec));
+            if (known.has(relative))
+                return relative;
+            return known.has(spec) ? spec : null; // repo-root-relative include
+        }
         // @implements A-SPEC-406
         // A specifier without a leading dot used to be refused outright, on the ground that it names an
         // external package. That holds for `node:fs` and `js-yaml`; it does NOT hold for Python, which
@@ -381,6 +487,17 @@ function addImportEdges(scanned, graph, opts) {
             for (const e of f.edges ?? []) {
                 if (e.rel !== 'imports')
                     continue;
+                // @implements A-SPEC-525.1 — Go: importing a package imports ALL its files (that is the
+                // language's semantics, not an invention), so one specifier fans out to each scanned
+                // file of the package directory.
+                if (/\.go$/.test(f.sourcePath)) {
+                    for (const target of goPackage(e.to)) {
+                        graph.addNode(`FILE:${f.sourcePath}`, 'FILE', f.sourcePath, fact(opts, f.sourcePath, 'ast-scan', 1));
+                        graph.addNode(`FILE:${target}`, 'FILE', target, fact(opts, target, 'ast-scan', 1));
+                        graph.addEdge(`FILE:${f.sourcePath}`, `FILE:${target}`, 'imports', f.sourcePath, fact(opts, `${f.sourcePath} -> ${e.to}`, 'import-resolution', 1));
+                    }
+                    continue;
+                }
                 const target = resolve(f.sourcePath, e.to);
                 if (!target)
                     continue;

package/dist/holmes/rtm/taint-vocabulary.d.ts

@@ -13,7 +13,7 @@
  * positives.
  */
 import type { DataFlowTaintConfig } from './dataflow-taint';
-export declare const TAINT_VOCABULARY: Record<'typescript' | 'python', DataFlowTaintConfig>;
+export declare const TAINT_VOCABULARY: Record<'typescript' | 'python' | 'go' | 'java' | 'csharp' | 'rust' | 'cpp', DataFlowTaintConfig>;
 /**
  * The vocabulary this file should be judged with, or null when the file is outside the analysable
  * set. Null is deliberate: degrading an unknown language to the TypeScript list would produce

package/dist/holmes/rtm/taint-vocabulary.js

@@ -35,9 +35,44 @@ const PYTHON_VOCABULARY = {
     ],
     sanitizers: ['quote', 'escape', 'shlex.quote', 're.escape'],
 };
+// @implements A-SPEC-524.1 — five more rows. Same table discipline: sinks are matched on the
+// callee's LAST segment, sources against expression TEXT, and the vocabularies are SELECTED by
+// file extension, never unioned. Rust's `Command::new` is deliberately absent — its bare last
+// segment is 'new', far too general to be a sink; the EXECUTING methods (spawn/output/status)
+// are the sinks instead (sealed in REQ-524).
+const GO_VOCABULARY = {
+    sources: ['os.Getenv', 'os.Environ', 'os.Args', '.FormValue', 'URL.Query', 'PostForm'],
+    sinks: ['Command', 'CommandContext', 'StartProcess', 'Exec', 'Query'],
+    sanitizers: ['Quote', 'QuoteToASCII', 'EscapeString', 'QueryEscape'],
+};
+const JAVA_VOCABULARY = {
+    sources: ['System.getenv', 'System.getProperty', 'getParameter', 'getHeader', 'readLine'],
+    sinks: ['exec', 'ProcessBuilder', 'executeQuery', 'executeUpdate', 'eval', 'loadLibrary'],
+    sanitizers: ['escapeHtml', 'quoteReplacement', 'encode'],
+};
+const CSHARP_VOCABULARY = {
+    sources: ['GetEnvironmentVariable', 'ReadLine', 'QueryString', 'Form'],
+    sinks: ['Start', 'ExecuteReader', 'ExecuteNonQuery', 'ExecuteScalar', 'Deserialize'],
+    sanitizers: ['HtmlEncode', 'UrlEncode', 'EscapeDataString'],
+};
+const RUST_VOCABULARY = {
+    sources: ['env::var', 'env::args', 'read_to_string', 'stdin'],
+    sinks: ['spawn', 'output', 'status', 'exec', 'query'],
+    sanitizers: ['escape', 'quote'],
+};
+const CPP_VOCABULARY = {
+    sources: ['getenv', 'argv', 'cin', 'fgets'],
+    sinks: ['system', 'popen', 'exec', 'execl', 'execlp', 'execle', 'execv', 'execvp', 'ShellExecute'],
+    sanitizers: ['escape', 'quote'],
+};
 exports.TAINT_VOCABULARY = {
     typescript: TYPESCRIPT_VOCABULARY,
     python: PYTHON_VOCABULARY,
+    go: GO_VOCABULARY,
+    java: JAVA_VOCABULARY,
+    csharp: CSHARP_VOCABULARY,
+    rust: RUST_VOCABULARY,
+    cpp: CPP_VOCABULARY,
 };
 const TS_EXT = /\.(ts|mts|cts|tsx|js|mjs|cjs|jsx)$/i;
 const PY_EXT = /\.py$/i;
@@ -52,6 +87,17 @@ function vocabularyFor(relPath) {
         return exports.TAINT_VOCABULARY.typescript;
     if (PY_EXT.test(relPath))
         return exports.TAINT_VOCABULARY.python;
+    // @implements A-SPEC-524.1 — the five languages whose CFG/DDG landed in P2.
+    if (/\.go$/i.test(relPath))
+        return exports.TAINT_VOCABULARY.go;
+    if (/\.rs$/i.test(relPath))
+        return exports.TAINT_VOCABULARY.rust;
+    if (/\.java$/i.test(relPath))
+        return exports.TAINT_VOCABULARY.java;
+    if (/\.cs$/i.test(relPath))
+        return exports.TAINT_VOCABULARY.csharp;
+    if (/\.(cpp|cc|cxx|hpp|h)$/i.test(relPath))
+        return exports.TAINT_VOCABULARY.cpp;
     return null;
 }
 /** Languages this vocabulary table covers — the matrix derives its taint row from this. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",