@mmerterden/multi-agent-pipeline 16.13.0 → 16.15.0

package/CHANGELOG.md

@@ -16,6 +16,30 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [16.15.0] - 2026-08-30
+
+### Fixed
+
+- **Usage reporting only ever reported runs that finished.** The reporter was called from Phase 7, and Phase 7 is the phase a run is least likely to reach: across the whole local log history, exactly one run got there. So the admin dashboard read zero of everything while the table held real rows, and the question it exists to answer - who is using this - had no answer. Phase 0's exit gate now reports the run as started, on the same upsert key, so Phase 7 replaces that row with the final state and nothing is double-counted. The read side of the same bug is fixed in the dashboard: its rollup folded only `terminal` rows, and an unfinished run was scored `fail`.
+
+
+### Changed
+
+- **`/multi-agent:help` now covers the plugins and the toolkit MCP.** It named both in passing - a `refactor` line, a `sync` line, a `design-check` footnote - and never said what they are or how to call one. The catalog gained a Plugins & tools block in both languages: how a stack skill is invoked, which plugins are always on, and the MCP's 83 tools grouped by what they drive (device control, web, design comparison, store and accessibility audits), with the note that its registration survives uninstall. Paid for by compressing the `design-check` entry, which was restating its own contract in fifteen lines: 353 tokens reclaimed before a byte was added, so the file sits within its 8500 ceiling. The tool count that went in with it was wrong and is now absent: `rules/outside-the-pipeline.md` said 83 while the server serves 84, and the pipeline cannot check either number because it does not vendor the toolkit. Both places now say 80+, which stays true; the exact count lives in the toolkit's own README, where a gate boots the server and compares `tools/list` against it.
+
+- **ADR-0010 now says where its numbers come from.** The coverage and token figures were published with no path to the harness that produced them, because the harness names a private codebase and cannot ship. It lives beside the graph it measured, under `~/.claude/knowledge/<project>/gate/`, and the ADR points at it: a number nobody can re-derive is an assertion, not a measurement.
+
+## [16.14.0] - 2026-08-28
+
+### Added
+
+- **Go joins the code graph, and `web` / `frontend` resolve to the node rules.** Phase 1 has detected Go since the stack table existed, while both rule layers rejected it: there was no `test-gap-rules/go.json` either, so `/multi-agent:test "test-gap"` was equally blind to a Go repo. Both files now exist. The alias is the other half of the same gap: the rule files are named after the toolchain (`node`) and the rest of the pipeline names the product surface (`web`), so a caller typing the word they were last shown got "unsupported". `backend` is deliberately NOT an alias - it could be node, python or go, and the error names all three rather than guessing one.
+- **Analysis ranks its repo-evidence candidates with the graph (opt-in).** The reuse-first scan (Locked 11) caps its candidate set at 200 files and warns when a generic feature name blows past it. `head -200` truncates in grep's walk order, so the cap was dropping an arbitrary file, not the least relevant one. With `prefs.global.codeGraph.enabled`, a graph query over the feature name sorts the set first. It is a sort key, never a filter: a file grep found and the graph did not rank is still scanned, because a regex extractor's silence is not evidence of absence. The 13 buckets, the cap and the no-graph behaviour are unchanged.
+
+### Fixed
+
+- **The code-graph ref did not say to build when no graph exists.** It said "build only when `baseCommit` no longer matches HEAD", which has no answer when there is nothing to compare. That is the case that matters: the knowledge base's prose files are written in Phase 7, the phase a run is least likely to reach, so a repo can carry a long task history and an empty knowledge directory. The graph must not inherit that dependency, and `--status` exiting 1 on a missing file now explicitly means build.
+
 ## [16.13.0] - 2026-08-28
 
 ### Added

package/docs/adr/0010-own-code-graph.md

@@ -96,6 +96,12 @@ domain words, the graph scored 63.3% against 32.0% at 10,937 tokens against
 24,983. The value is in narrowing an open-ended search, not in replacing a
 grep for a name you already know.
 
+The harness, the ten graded questions and the raw per-question result live
+beside the graph they measured, under `~/.claude/knowledge/<project>/gate/`.
+They stay there rather than in this repo because they name the private
+codebase's files and symbols, and a number nobody can re-derive is an assertion
+rather than a measurement: `node run-gate.mjs` reproduces the table above.
+
 That measurement covers the context each strategy assembles, not the quality
 of an answer written from it. graphify's numbers measure the latter. The two
 are not directly comparable and this ADR does not claim they are.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "16.13.0",
+  "version": "16.15.0",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/multi-agent/help/SKILL.md

@@ -147,8 +147,17 @@ Setup & Maintenance:
 
 ------------------------------------------------------------
 
-Stack plugin skills: call directly as ai-<stack>-toolkit:<skill>. Catalog:
-  ai-<stack>-toolkit:help. Active plugins per repo: /multi-agent:stack.
+Plugins & tools (called directly, no wrappers):
+
+  Stack plugins    ai-<stack>-toolkit:<skill>, e.g. ai-ios-toolkit:create-component
+                   Catalog: ai-<stack>-toolkit:help   Enable per repo: /multi-agent:stack
+                   common + analyst are always on; the rest follow the repo's stack.
+  Toolkit MCP      multi-agent-toolkit  -  80+ tools for a RUNNING app, no pipeline run needed:
+                   ios_* / android_* (launch, tap, screenshot, ui tree, logs, crashes,
+                   locale, dark mode), web_*, design_* (Design Check above), and the
+                   audits (ios_app_store_audit, ios_testflight_validate, android_apk_audit,
+                   *_accessibility_audit). Use them instead of guessing about on-screen
+                   state. Its registration survives uninstall. Not registered = silent no-op.
 
 ------------------------------------------------------------
 
@@ -202,24 +211,17 @@ Manual Test (Phase 5 standalone  -  Xcode hint flow):
   /multi-agent:manual-test           Checkout task branch, print Xcode/SourceTree hints,
   /multi-agent:manual-test #N        wait for your "ok" / "fix: ..." verdict.
 
-Design Check (mock-mode vs Figma, local-only  -  powered by the toolkit MCP design_* tools):
-
-  /multi-agent:design-check                Whole-module design audit: pick repo+module, gate on mock support,
-                                           enumerate every state driver (launch args, scenario cases, scenario codes,
-                                           fixtures, deep links) into a countable target set, build Debug in a worktree,
-                                           drive each target in mock mode via idb, compare each vs its Figma frame
-                                           (padding/width/spacing/font/color/component/localization), and export a
-                                           report (HTML+PDF, ~/DesignChecks).
-  /multi-agent:design-check <screen>       Scope to one screen's targets (e.g. boarding-pass).
-  /multi-agent:design-check <screen@var>   Scope to a single variant (e.g. boarding-pass@expired).
-  /multi-agent:design-check <figma-url...>   Scope to the frame(s) those URLs name.
-  /multi-agent:design-check --resume       Audit the unaudited remainder of the last run for this repo+module.
-  # COVERAGE GATE: every target is either audited or skipped WITH a concrete reason. Anything else fails the
-  # gate and the run is reported INCOMPLETE with the missing target ids  -  a partial audit never reads as clean.
-  # "Requires a scenario / prefix / launch-arg" is not a reason; reaching those states is the run's job.
-  # When a live screen has no confident Figma match, it SHOWS you the screenshot and asks for the node-id.
-
-  Drives the toolkit design_* tools (+ ios_* / android_* device control).
+Design Check (mock-mode vs Figma, local-only):
+
+  /multi-agent:design-check                Whole-module audit: enumerate every state driver into a countable
+                                           target set, build Debug in a worktree, drive each in mock mode,
+                                           diff against its Figma frame, export HTML+PDF to ~/DesignChecks.
+  /multi-agent:design-check <screen>       Scope to one screen (e.g. boarding-pass).
+  /multi-agent:design-check <screen@var>   Scope to one variant (e.g. boarding-pass@expired).
+  /multi-agent:design-check <figma-url...> Scope to the frame(s) those URLs name.
+  /multi-agent:design-check --resume       Audit what the last run for this repo+module left unaudited.
+  # COVERAGE GATE: every target is audited or skipped WITH a concrete reason; anything else reports
+  # INCOMPLETE with the missing ids. "Needs a scenario/launch-arg" is not a reason, reaching it is the job.
 
 ------------------------------------------------------------
 
@@ -421,9 +423,17 @@ Setup & Maintenance:
 
 ------------------------------------------------------------
 
-Stack plugin skill'leri: doğrudan ai-<stack>-toolkit:<skill> olarak çağrılır
-  (örn. ai-ios-toolkit:create-component). Lokal kopya ve sarmalayıcı yok. Katalog:
-  ai-<stack>-toolkit:help. Aktif plugin'ler repo bazında: /multi-agent:stack.
+Plugin'ler ve tool'lar (doğrudan çağrılır, sarmalayıcı yok):
+
+  Stack plugin     ai-<stack>-toolkit:<skill>, örn. ai-ios-toolkit:create-component
+                   Katalog: ai-<stack>-toolkit:help   Repo bazında aç: /multi-agent:stack
+                   common + analyst hep açık; gerisi repo'nun stack'ini izler.
+  Toolkit MCP      multi-agent-toolkit  -  ÇALIŞAN uygulama için 80+ tool, pipeline koşusu
+                   gerektirmez: ios_* / android_* (başlat, tap, screenshot, ui ağacı, log,
+                   crash, locale, koyu mod), web_*, design_* (yukarıdaki Design Check), ve
+                   denetimler (ios_app_store_audit, ios_testflight_validate,
+                   android_apk_audit, *_accessibility_audit). Ekrandaki durumu tahmin etmek
+                   yerine bunları kullan. Kaydı uninstall'dan sağ çıkar. Kayıtlı değilse sessizce devre dışı.
 
 ------------------------------------------------------------
 
@@ -477,24 +487,17 @@ Manuel Test (Phase 5 standalone  -  Xcode hint akışı):
   /multi-agent:manual-test           Task branch'ine checkout, Xcode/SourceTree hint basar,
   /multi-agent:manual-test #N        "ok" / "fix: ..." yanıtını bekler.
 
-Design Check (mock-mod vs Figma, yalnızca lokal  -  multi-agent-toolkit-mcp design_* tool'larıyla):
+Design Check (mock-mod vs Figma, yalnızca lokal):
 
-  /multi-agent:design-check                Tüm modül tasarım denetimi: repo+modül seç, mock desteğini geçitle,
-                                           her state sürücüsünü (launch arg, senaryo case'leri, senaryo kodları,
-                                           fixture'lar, deep link'ler) sayılabilir bir hedef kümesine çıkar,
-                                           worktree'de Debug derle, her hedefi mock modda idb ile sür, her birini
-                                           Figma frame'iyle karşılaştır (padding/genişlik/spacing/font/renk/
-                                           component/localization), rapor çıkar (HTML+PDF, ~/DesignChecks).
-  /multi-agent:design-check <ekran>        Tek ekranın hedeflerine kapsa (örn. boarding-pass).
+  /multi-agent:design-check                Tüm modül denetimi: her state sürücüsünü sayılabilir hedef kümesine
+                                           çıkar, worktree'de Debug derle, her hedefi mock modda sür, Figma
+                                           frame'iyle diff'le, HTML+PDF raporu ~/DesignChecks'e yaz.
+  /multi-agent:design-check <ekran>        Tek ekrana kapsa (örn. boarding-pass).
   /multi-agent:design-check <ekran@varyant> Tek varyanta kapsa (örn. boarding-pass@expired).
-  /multi-agent:design-check <figma-url...>   URL'lerin işaret ettiği frame'lere kapsa.
-  /multi-agent:design-check --resume       Bu repo+modül için son koşunun denetlenmemiş kalanını denetle.
-  # KAPSAM GEÇİDİ: her hedef ya denetlenir ya da SOMUT bir gerekçeyle atlanır. Başka her durum geçidi
-  # düşürür ve koşu eksik hedef id'leriyle EKSİK raporlanır  -  kısmi denetim asla temiz görünmez.
-  # "Senaryo / prefix / launch-arg gerektirir" gerekçe değildir; o state'lere ulaşmak koşunun işidir.
-  # Canlı ekranın Figma karşılığı kesin bulunamazsa SANA screenshot'ı gösterip node-id sorar.
-
-  multi-agent-toolkit-mcp design_* tool takımını sürer (+ ios_* / android_* cihaz kontrolü).
+  /multi-agent:design-check <figma-url...> URL'lerin işaret ettiği frame'lere kapsa.
+  /multi-agent:design-check --resume       Son koşunun denetlenmemiş kalanını denetle.
+  # KAPSAM GEÇİDİ: her hedef ya denetlenir ya da SOMUT gerekçeyle atlanır; başka her durum eksik hedef
+  # id'leriyle EKSİK raporlanır. "Senaryo/launch-arg gerektirir" gerekçe değil, oraya ulaşmak koşunun işi.
 
 ------------------------------------------------------------
 

package/pipeline/multi-agent-refs/analysis/evidence.md

@@ -75,6 +75,27 @@ grep -rilE "$slugs" $WHITELIST --include="*.swift" --include="*.kt" --include="*
 
 If `wc -l < $CANDIDATES` exceeds 200, record `fetchWarnings += "feature-name too generic; candidate cap hit"` in `repoEvidence[<repo>]`.
 
+**Ranking the candidates (opt-in, `prefs.global.codeGraph.enabled`).** `head -200`
+truncates in grep's walk order, so the cap drops an arbitrary file rather than the
+least relevant one - the failure the warning above names and cannot fix. When a
+graph exists for the repo, rank the set first:
+
+```bash
+GRAPH_PATH="$HOME/.claude/knowledge/$(basename "$REPO_ROOT")/code-graph.json"
+node $HOME/.claude/scripts/graph-report.mjs --graph "$GRAPH_PATH" --status \
+  || node $HOME/.claude/scripts/graph-build.mjs --root "$REPO_ROOT" --stack "$STACK" --json
+node $HOME/.claude/scripts/graph-query.mjs "$featureName" --graph "$GRAPH_PATH" --json
+```
+
+Ranked paths go to the front of `$CANDIDATES`, grep-only hits keep their order
+behind them, everything else is unchanged, and a repo with no graph, an
+unsupported stack or a failing validator gets exactly today's order. It is a sort
+key, never a filter: a file grep found and the graph did not rank is still
+scanned, because a regex extractor's silence is not evidence of absence. Sorting
+rather than detecting is where each tool measured better - the graph beats grep on
+domain words, a feature name is domain words, and it loses on the exact symbols
+the bucket patterns use (`docs/adr/0010-own-code-graph.md`).
+
 **13 buckets** (each scanned in parallel with a 30 s timeout per bucket; timeout marks the bucket as `partial`, never blocks the others):
 
 | Bucket | Detection (iOS Swift sketch) | Cross-platform variant |

package/pipeline/multi-agent-refs/features/code-graph.md

@@ -29,7 +29,14 @@ report scripts default it from the CWD's basename, and a run happens in a
 worktree whose basename need not equal the repo's, so a defaulted path can point
 at a graph that was never built. Pass it.
 
-Build only when `baseCommit` no longer matches HEAD. A build is not usable until
+Build when there is no graph at all, and when `baseCommit` no longer matches
+HEAD. The missing case is the one that matters in practice: `architecture.md`
+and its siblings are written in Phase 7, which is the phase a run is least
+likely to reach, so a repo can have a long history of tasks and an empty
+knowledge directory. The graph must not inherit that. `--status` exits 1 on a
+missing file, and that exit means build, not skip.
+
+A build is not usable until
 `validate-code-graph.mjs` exits 0: a graph whose edges point at missing nodes
 truncates traversals silently, so a non-zero exit means skip the injection and
 run Explore as if no graph existed.

package/pipeline/multi-agent-refs/phases/phase-0-init.md

@@ -631,8 +631,12 @@ Phase 0 owns `agent-state.json`. Do not call
 
 ```bash
 node "$HOME/.claude/scripts/phase0-exit-gate.mjs" "$TASK_ID" --input "$ORIGINAL_INPUT"
+node "$HOME/.claude/scripts/usage-report.mjs" --task-id "$TASK_ID" >/dev/null 2>&1 || true
 ```
 
+The second line reports the run as started: reporting only from Phase 7 reported
+only runs that finish, and few do. Phase 7 upserts the same key over it.
+
 It asserts three things, each of which has failed silently in a real run:
 
 1. **`agent-state.json` exists.** A run once reported Phase 0 `completed` with only

package/pipeline/multi-agent-refs/phases/phase-7-report.md

@@ -196,7 +196,7 @@ $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 7 task.completed \
   duration_ms=$TOTAL_DURATION
 ```
 
-**Operational reporting.** On by default since v16.8.0; `enabled: false` or `optOut: true` silences it. Sends command, duration, tokens, outcome - never a repo name or path. One POST per run, fire-and-forget, coarse run metadata only  -  no prompts, code, diffs, or absolute paths. The script no-ops when `usageLog.enabled` is not true or no token resolves, so the call is unconditional and never blocks the run.
+**Operational reporting.** On by default since v16.8.0; `enabled: false` or `optOut: true` silences it. Coarse run metadata only, never prompts, code, diffs, repo names or paths. Fire-and-forget: it no-ops without a token and never blocks the run, so the call is unconditional. Phase 0 already reported this run as started; this upserts the final state over it.
 
 ```bash
 node $HOME/.claude/scripts/usage-report.mjs --state "$STATE_FILE" >/dev/null 2>&1 || true

package/pipeline/rules/outside-the-pipeline.md

@@ -21,6 +21,6 @@ available. Read the effective `enabledPlugins` and load each enabled toolkit's
 `ai-common-toolkit` and `ai-analyst-toolkit` are on everywhere. Nothing enabled
 is a normal state.
 
-**multi-agent-toolkit MCP.** 83 tools for a running app: `ui-inspect`,
+**multi-agent-toolkit MCP.** 80+ tools for a running app: `ui-inspect`,
 `crash-logs`, `design-check`, `ios-app-store-audit`, `ios-testflight`. Use them
 instead of guessing about on-screen state. Not registered is a silent no-op.

package/pipeline/schemas/code-graph.schema.json

@@ -12,7 +12,7 @@
     },
     "stack": {
       "type": "string",
-      "enum": ["ios", "android", "node", "python"]
+      "enum": ["ios", "android", "node", "python", "go"]
     },
     "root": {
       "type": "string",

package/pipeline/scripts/_code-graph.mjs

@@ -37,6 +37,27 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 
 export const GRAPH_SCHEMA_VERSION = "1.0.0";
 
+/**
+ * Stack words the pipeline uses elsewhere, mapped to the rule-file id.
+ *
+ * The rule files are named after the toolchain (`node`), but the rest of the
+ * pipeline names the product surface (`web`), and a caller reasonably types
+ * whichever one they were last shown. Aliasing is safe only where the mapping
+ * is one-to-one: `backend` is deliberately absent, because it could be node,
+ * python or go and picking one would be a guess dressed as support.
+ */
+export const STACK_ALIASES = { web: "node", frontend: "node" };
+
+/**
+ * Canonical rule-file id for a stack word.
+ *
+ * @param {string} stack
+ * @returns {string}
+ */
+export function resolveStack(stack) {
+  return STACK_ALIASES[stack] || stack;
+}
+
 /**
  * Load and merge the two rule files for a stack.
  *
@@ -48,9 +69,15 @@ export const GRAPH_SCHEMA_VERSION = "1.0.0";
  * @param {string} [baseDir] - directory holding the two rule dirs
  * @returns {object} merged rules
  */
-export function loadRules(stack, baseDir = __dirname) {
+export function loadRules(requested, baseDir = __dirname) {
+  const stack = resolveStack(requested);
   const gapPath = join(baseDir, "test-gap-rules", `${stack}.json`);
   const graphPath = join(baseDir, "code-graph-rules", `${stack}.json`);
+  if (requested === "backend") {
+    throw new Error(
+      "'backend' names a role, not a toolchain: pass node, python or go so the right rules load",
+    );
+  }
   if (!existsSync(gapPath)) throw new Error(`no test-gap rules for stack '${stack}': ${gapPath}`);
   if (!existsSync(graphPath))
     throw new Error(`no code-graph rules for stack '${stack}': ${graphPath}`);

package/pipeline/scripts/code-graph-rules/go.json

@@ -0,0 +1,124 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "stack": "go",
+  "description": "Go code-graph rules. Adds what the graph needs on top of test-gap-rules/go.json, which already owns sourceExtensions, excludePathGlobs and the test-path predicates. Definition patterns here are deliberately broader than the test-gap publicApiPatterns: the graph wants unexported declarations too, because Phase 1 narrows scope on the whole package, not just its exported surface.",
+  "comments": {
+    "line": [
+      "//"
+    ],
+    "block": [
+      [
+        "/*",
+        "*/"
+      ]
+    ],
+    "string": [
+      "`",
+      "\"",
+      "'"
+    ]
+  },
+  "importSpecifiersAreStrings": true,
+  "definitionPatterns": [
+    {
+      "id": "struct",
+      "kind": "struct",
+      "regex": "\\btype\\s+([A-Za-z_][A-Za-z0-9_]*)\\s+struct\\b"
+    },
+    {
+      "id": "interface",
+      "kind": "interface",
+      "regex": "\\btype\\s+([A-Za-z_][A-Za-z0-9_]*)\\s+interface\\b"
+    },
+    {
+      "id": "type",
+      "kind": "type",
+      "regex": "\\btype\\s+([A-Za-z_][A-Za-z0-9_]*)\\s+(?!struct\\b|interface\\b)[A-Za-z_*\\[]"
+    },
+    {
+      "id": "func",
+      "kind": "func",
+      "regex": "^func\\s+(?:\\([^)]*\\)\\s+)?([A-Za-z_][A-Za-z0-9_]*)\\s*[(\\[]"
+    }
+  ],
+  "importPatterns": [
+    {
+      "id": "specifier",
+      "regex": "^[ \\t]*(?:import[ \\t]+)?(?:[A-Za-z_.][A-Za-z0-9_]*[ \\t]+)?\"(?:[^\"]*/)?([A-Za-z_][A-Za-z0-9_.-]*)\"[ \\t]*$"
+    }
+  ],
+  "referenceKinds": [
+    "struct",
+    "interface",
+    "type"
+  ],
+  "referenceKindsNote": "func is deliberately absent, for the reason the Swift, Kotlin, Node and Python rules all record: a bare name matched across files is almost never a call to that exact declaration, and Go's short-name convention (New, Run, Get, Close, Error) makes it worse than most. Functions still reach the graph through their defines edge, so they stay findable by name.",
+  "ignoredIdentifiers": [
+    "package",
+    "import",
+    "func",
+    "type",
+    "struct",
+    "interface",
+    "map",
+    "chan",
+    "var",
+    "const",
+    "return",
+    "if",
+    "else",
+    "for",
+    "range",
+    "switch",
+    "case",
+    "default",
+    "select",
+    "go",
+    "defer",
+    "break",
+    "continue",
+    "fallthrough",
+    "goto",
+    "nil",
+    "true",
+    "false",
+    "iota",
+    "make",
+    "new",
+    "len",
+    "cap",
+    "append",
+    "copy",
+    "delete",
+    "panic",
+    "recover",
+    "print",
+    "println",
+    "error",
+    "string",
+    "bool",
+    "byte",
+    "rune",
+    "int",
+    "int8",
+    "int16",
+    "int32",
+    "int64",
+    "uint",
+    "uint8",
+    "uint16",
+    "uint32",
+    "uint64",
+    "float32",
+    "float64",
+    "complex64",
+    "complex128",
+    "uintptr",
+    "any",
+    "comparable",
+    "err",
+    "ctx",
+    "ok"
+  ],
+  "note": "A Go import path is a string literal, so `importSpecifiersAreStrings` applies exactly as it does for JavaScript: the import pass reads a text with comments stripped and strings intact, and the pattern captures the last path segment, which is the package name in the overwhelmingly common case where the two agree. The pattern is anchored to a whole line holding nothing but an optional `import`, an optional alias and the quoted path, because Go has no import keyword on the lines inside a parenthesized block. Without that anchor it matched EVERY double-quoted string in the file and turned each one into a module node. A named import (`sql \"database/sql\"`) and the handful of packages whose name differs from their directory both resolve to the directory name, which is what the engine matches against a file basename anyway. The three type patterns are ordered so `struct` and `interface` claim their shapes before the general `type` alias pattern, which excludes them by lookahead rather than by order alone - order and lookahead together, because a rule file that relies on order silently changes meaning when someone sorts it. `func` is anchored to column 0, which is where every Go function and method declaration lives; the engine's nesting rule then never has to fire for this stack.\n\nUNMEASURED: unlike ios, android, node and python, these rules were never run against a real Go codebase. There was no Go repo and no toolchain on the machine that wrote them. The smoke exercises them on a synthetic fixture, which proves they parse and produce a schema-valid graph, not that they produce a USEFUL one. Treat the first real build as the measurement, and check the hub list before trusting it."
+}

package/pipeline/scripts/test-gap-rules/go.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "stack": "go",
+  "description": "Go test gap rules. Sources in *.go; tests are *_test.go beside the code they cover, which is why there is no test directory convention here.",
+  "sourceExtensions": [".go"],
+  "testPathSuffixes": ["_test.go"],
+  "testPathContains": [],
+  "excludePathGlobs": ["vendor/", "third_party/", "*.pb.go", "*_generated.go", "*_mock.go"],
+  "publicApiPatterns": [
+    {
+      "id": "exported_func",
+      "regex": "^func\\s+([A-Z][A-Za-z0-9_]*)\\s*\\("
+    },
+    {
+      "id": "exported_method",
+      "regex": "^func\\s+\\([^)]*\\)\\s+([A-Z][A-Za-z0-9_]*)\\s*\\("
+    },
+    {
+      "id": "exported_type",
+      "regex": "^type\\s+([A-Z][A-Za-z0-9_]*)\\s+(?:struct|interface|func|map|\\[|chan|\\*|[A-Za-z])"
+    }
+  ],
+  "hint": "Cover exported identifiers with a table-driven Test<Name> in the same package's <file>_test.go. An unexported identifier is covered through the exported one that calls it."
+}

package/pipeline/scripts/validate-code-graph.mjs

@@ -15,7 +15,7 @@
 
 import { readFileSync } from "node:fs";
 
-const ALLOWED_STACK = new Set(["ios", "android", "node", "python"]);
+const ALLOWED_STACK = new Set(["ios", "android", "node", "python", "go"]);
 const ALLOWED_NODE_KIND = new Set(["file", "symbol", "module"]);
 const ALLOWED_EDGE_KIND = new Set(["defines", "imports", "references"]);
 const MAX_REPORTED_DANGLING = 5;