nfrgate 0.1.0__tar.gz

nfrgate-0.1.0/PKG-INFO

@@ -0,0 +1,25 @@
+Metadata-Version: 2.4
+Name: nfrgate
+Version: 0.1.0
+Summary: AI-based Observability & NFR Gating Platform
+Requires-Python: >=3.12
+Requires-Dist: tree-sitter>=0.23
+Requires-Dist: tree-sitter-python>=0.23
+Requires-Dist: tree-sitter-java>=0.23
+Requires-Dist: tree-sitter-go>=0.23
+Requires-Dist: pydantic>=2.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: psycopg[binary]>=3.1
+Requires-Dist: alembic>=1.13
+Requires-Dist: sqlalchemy>=2.0
+Requires-Dist: opentelemetry-api>=1.24
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: httpx>=0.27; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+Provides-Extra: api
+Requires-Dist: fastapi>=0.110; extra == "api"
+Requires-Dist: uvicorn>=0.29; extra == "api"
+Provides-Extra: otel
+Requires-Dist: opentelemetry-sdk>=1.24; extra == "otel"
+Requires-Dist: opentelemetry-exporter-otlp-proto-http>=1.24; extra == "otel"

nfrgate-0.1.0/README.md

@@ -0,0 +1,62 @@
+# NFR Gate
+
+AI-based Observability & NFR (Non-Functional Requirement) Gating Platform — static analysis (Python/Java/Go) plus LLM semantic assessment, with confidence-based routing to gate CI/CD merges. See `docs/nfr_rubric_v1.md` for the rubric itself and `docs/` more broadly for the design/measurement docs (false-positive/false-negative studies, confidence retuning, implementation spec).
+
+## Install
+
+```bash
+pip install nfrgate            # static analysis + LLM assessment
+pip install "nfrgate[api]"     # + the overrides HTTP API (FastAPI/uvicorn)
+```
+
+Or via Docker (builds and runs the overrides API by default — see below):
+
+```bash
+docker build -t nfrgate .
+docker run --rm -p 8000:8000 -e NFR_GATE_API_KEY=<a-real-secret> nfrgate
+```
+
+## Configuration
+
+Every piece of deployment-specific config is an environment variable — no source edits needed to point at different infrastructure. See `src/nfr_gate/config.py` for the single source of truth; summary:
+
+| Env var | Default | Purpose |
+|---|---|---|
+| `NFR_GATE_DATABASE_URL` | `postgresql://nfr_gate:nfr_gate_dev@localhost:5432/nfr_gate` | Postgres connection for the findings store |
+| `NFR_GATE_SERVICE_TIERS_PATH` | `config/service_tiers.yaml` (repo checkout only) | Service-criticality tier registry; missing file → every service defaults to the most conservative tier (`tier0`), never a crash |
+| `NFR_GATE_LLM_BACKEND` | `ollama` | `ollama` (local model, no API key) or `anthropic` (hosted, needs `ANTHROPIC_API_KEY`) |
+| `NFR_GATE_LLM_MODEL` | backend's own default | Override the model name for either backend |
+| `NFR_GATE_OLLAMA_BASE_URL` | `http://localhost:11434` | Where to reach Ollama |
+| `NFR_GATE_API_KEY` | *(none — required to start the API)* | Shared bearer-token secret the overrides API checks and the CLI sends |
+| `NFR_GATE_API_URL` | `http://localhost:8000` | Where the `nfrgate-override` CLI reaches the API |
+| `NFR_GATE_API_PORT` | `8000` | Port `nfrgate-api` binds to |
+| `OTEL_EXPORTER_OTLP_ENDPOINT` | *(unset — tracing/metrics are no-ops)* | Where nfrgate exports its own traces/metrics; needs `pip install "nfrgate[otel]"` |
+| `NFR_GATE_LOG_LEVEL` | `INFO` | Level for nfrgate's own structured JSON logs (to stderr) |
+
+## Observability (nfrgate observes itself)
+
+nfrgate emits the same three signals it grades other services on: structured JSON logs (stderr, always on, each line carrying the current trace id as its correlation id), OpenTelemetry spans around each pipeline run and each LLM call, and metrics for exactly the things the platform depends on being healthy — `nfrgate.pipeline.duration_ms`, `nfrgate.llm.calls` (by success/error), `nfrgate.db.write_failures`. Tracing/metrics use OpenTelemetry's standard no-op providers until `OTEL_EXPORTER_OTLP_ENDPOINT` is set (and the `otel` extra installed), so nothing needs to be stood up just to run the CI gate.
+
+## Running it
+
+- **CI gate**: `python -m nfr_gate.ci.pr_gate` (GitHub Actions) / `python -m nfr_gate.ci.mr_gate` (GitLab CI) — reads PR/MR context from the CI environment, analyzes the diff, posts a comment, and fails the job on high-confidence violations.
+- **Overrides API**: `nfrgate-api` (or `uvicorn nfr_gate.api.app:app`) — HTTP surface for the human-override audit trail; requires `NFR_GATE_API_KEY`. Serves plain HTTP — put a TLS-terminating reverse proxy/load balancer in front of it for any non-localhost deployment (the bearer token is interceptable in transit otherwise). See `docs/security_review_v1.md` for this and other accepted/mitigated risks on this API and the LLM prompt surface.
+  - `GET /healthz` — unauthenticated liveness probe (`{"status": "ok"}`), independent of database reachability; point a k8s/load-balancer health check here.
+- **Overrides CLI**: `nfrgate-override list --source-ref <ref>` / `nfrgate-override apply ...` — a thin authenticated client of the API above.
+
+## Development
+
+```bash
+pip install -e ".[dev,api]"
+cd db && docker compose up -d && cd ..
+alembic upgrade head
+pytest
+```
+
+Schema changes are Alembic migrations under `db/alembic/versions/`, applied with `alembic upgrade head` — never hand-run SQL against a live database.
+
+## CI/CD
+
+- `.github/workflows/ci.yml` — every push/PR: `ruff check .`, `alembic upgrade head` against a service-container Postgres, then the full unit + integration suite.
+- `.github/workflows/release.yml` — on a `vX.Y.Z` tag: builds the sdist/wheel (uploaded as a build artifact regardless), publishes to PyPI if `PYPI_API_TOKEN` is set, and builds/pushes the Docker image to `ghcr.io/<this repo>` (no extra secret needed).
+- `.github/workflows/nfrgate-ci.yml` — dogfooding: runs nfrgate's own static analyzer against PRs opened on this repo.

nfrgate-0.1.0/pyproject.toml

@@ -0,0 +1,62 @@
+[project]
+name = "nfrgate"
+version = "0.1.0"
+description = "AI-based Observability & NFR Gating Platform"
+requires-python = ">=3.12"
+dependencies = [
+    "tree-sitter>=0.23",
+    "tree-sitter-python>=0.23",
+    "tree-sitter-java>=0.23",
+    "tree-sitter-go>=0.23",
+    "pydantic>=2.0",
+    "pyyaml>=6.0",
+    "psycopg[binary]>=3.1",
+    "alembic>=1.13",
+    "sqlalchemy>=2.0",
+    "opentelemetry-api>=1.24",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0",
+    "httpx>=0.27",
+    "ruff>=0.6",
+]
+api = [
+    "fastapi>=0.110",
+    "uvicorn>=0.29",
+]
+otel = [
+    "opentelemetry-sdk>=1.24",
+    "opentelemetry-exporter-otlp-proto-http>=1.24",
+]
+
+[project.scripts]
+nfrgate-pr-gate = "nfr_gate.ci.pr_gate:main"
+nfrgate-mr-gate = "nfr_gate.ci.mr_gate:main"
+nfrgate-override = "nfr_gate.ci.override:main"
+nfrgate-api = "nfr_gate.api.app:main"
+
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+"nfr_gate.analysis.queries" = ["**/*.scm"]
+"rubric_store" = ["definitions/*.yaml", "schema/*.yaml"]
+
+[tool.ruff]
+line-length = 120
+target-version = "py312"
+extend-exclude = ["tests/fixtures"]
+
+[tool.ruff.lint]
+select = ["E", "F", "I"]
+
+[tool.ruff.lint.per-file-ignores]
+# Test literals (JSON payloads, error strings) read better whole than
+# wrapped — production code under src/ stays strictly within line-length.
+"tests/**" = ["E501"]

nfrgate-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

nfrgate-0.1.0/src/nfr_gate/analysis/base.py

@@ -0,0 +1,67 @@
+"""Language-agnostic core of the AST parsing pipeline. `LanguageAnalyzer` is
+the Strategy interface (technical_implementation_spec.md §C.1) — the pipeline
+that walks a `DiffContext` for constructs of interest never imports a
+concrete language analyzer, only this interface, so adding Go or Java later
+means adding a new `languages/*.py` file, not touching this one.
+"""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+from tree_sitter import Language, Tree
+
+if TYPE_CHECKING:
+    # Deferred to avoid a circular import: constructs.py imports DiffContext
+    # from this module. Safe at type-check time only because of the
+    # `from __future__ import annotations` above (annotations are strings,
+    # never evaluated at runtime).
+    from nfr_gate.analysis.constructs import Construct
+    from nfr_gate.domain.models.finding import Finding, FindingCategory
+
+
+@dataclass(frozen=True)
+class DiffContext:
+    file_path: str
+    language: str
+    tree: Tree
+    source_bytes: bytes
+    changed_line_ranges: list[tuple[int, int]]  # from diff_parser.FileDiff.added_line_ranges
+
+
+class LanguageAnalyzer(ABC):
+    language: str
+
+    @property
+    @abstractmethod
+    def ts_language(self) -> Language:
+        """The compiled tree-sitter grammar, needed to build Query objects
+        against this language's node types."""
+
+    @abstractmethod
+    def parse(self, source: bytes) -> Tree: ...
+
+
+class RuleEvaluator(ABC):
+    """Strategy interface: one implementation per static-analyzable (or
+    static-component-of-'both') rule code. The pipeline calls every
+    applicable evaluator with the *same* pre-computed construct list from
+    constructs.find_constructs() — evaluators do not run their own queries,
+    so adding a 5th rule never means re-parsing or re-querying the diff."""
+
+    rule_code: str
+    category: "FindingCategory"
+    languages: frozenset[str]
+
+    def applies_to(self, language: str) -> bool:
+        return language in self.languages
+
+    @abstractmethod
+    def evaluate(self, ctx: DiffContext, constructs: list["Construct"]) -> list["Finding"]:
+        """Implementations filter `constructs` to the kind(s) and
+        `in_diff=True` entries they care about, and return one Finding per
+        construct they have an opinion on. Constructs the rule doesn't
+        apply to are simply not represented in the output — evaluate()
+        never raises or returns a placeholder for "not applicable"."""

nfrgate-0.1.0/src/nfr_gate/analysis/cli.py

@@ -0,0 +1,83 @@
+"""Sprint 2 done-when demo:
+
+    python -m nfr_gate.analysis.cli <diff_file> <source_file>
+
+Given a PR diff and the post-change source file it targets (as the CI job
+would have from a real checkout — see diff_parser.py's docstring for why the
+diff itself isn't used to reconstruct content), parses the file to an AST,
+prints the syntax tree, lists every construct of interest the query files
+find (flagging which fall inside lines the diff actually added), and runs
+every registered rule evaluator against them, printing the resulting
+normalized Findings — this is the full parse -> construct -> Finding
+pipeline end to end, not just the parsing half.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+from nfr_gate.analysis.base import DiffContext
+from nfr_gate.analysis.constructs import find_constructs
+from nfr_gate.analysis.diff_parser import parse_unified_diff
+from nfr_gate.analysis.languages.python_analyzer import PythonAnalyzer
+from nfr_gate.analysis.rules.registry import rules_for_language
+
+
+def analyze(diff_path: Path, source_path: Path) -> None:
+    file_diffs = parse_unified_diff(diff_path.read_text())
+    if not file_diffs:
+        raise SystemExit(f"No file diffs found in {diff_path}")
+    file_diff = file_diffs[0]  # sample diff touches exactly one file
+
+    analyzer = PythonAnalyzer()
+    source_bytes = source_path.read_bytes()
+    tree = analyzer.parse(source_bytes)
+
+    ctx = DiffContext(
+        file_path=file_diff.file_path,
+        language=analyzer.language,
+        tree=tree,
+        source_bytes=source_bytes,
+        changed_line_ranges=file_diff.added_line_ranges,
+    )
+
+    print(f"=== Parsed {ctx.file_path} ({len(source_bytes)} bytes, {tree.root_node.end_point[0] + 1} lines) ===")
+    print(f"Changed line ranges from diff: {ctx.changed_line_ranges}")
+    print()
+    print("=== Syntax tree (S-expression) ===")
+    print(str(tree.root_node))
+    print()
+
+    constructs = find_constructs(ctx, analyzer.ts_language)
+    in_diff_count = sum(c.in_diff for c in constructs)
+    print(f"=== Constructs found: {len(constructs)} ({in_diff_count} within changed lines) ===")
+    for c in sorted(constructs, key=lambda c: c.start_line):
+        marker = "DIFF" if c.in_diff else "    "
+        first_line = c.snippet.splitlines()[0]
+        print(f"[{marker}] {c.kind:<16} L{c.start_line}-{c.end_line}  {first_line}")
+    print()
+
+    findings = [
+        finding
+        for rule in rules_for_language(analyzer.language)
+        for finding in rule.evaluate(ctx, constructs)
+    ]
+    print(f"=== Findings: {len(findings)} ===")
+    for f in sorted(findings, key=lambda f: (f.line_number or 0, f.rule_code)):
+        print(
+            f"[{f.result:<7}] {f.rule_code}  L{f.line_number}  "
+            f"confidence={f.confidence:.2f}  {f.evidence.splitlines()[0]}"
+        )
+        if f.reasoning:
+            print(f"           {f.reasoning}")
+
+
+def main() -> None:
+    if len(sys.argv) != 3:
+        raise SystemExit("usage: python -m nfr_gate.analysis.cli <diff_file> <source_file>")
+    analyze(Path(sys.argv[1]), Path(sys.argv[2]))
+
+
+if __name__ == "__main__":
+    main()

nfrgate-0.1.0/src/nfr_gate/analysis/constructs.py

@@ -0,0 +1,113 @@
+"""Runs the tree-sitter query files in queries/{language}/ against a parsed
+AST and yields the constructs of interest they find. This is deliberately
+construct identification only — no confidence score, no pass/fail, no
+normalized Finding — that's the next task (normalized finding interface +
+rule evaluators). This module just answers "where are the outbound calls,
+catch blocks, and route definitions," restricted to lines the diff touched.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from functools import lru_cache
+from pathlib import Path
+
+from tree_sitter import Language, Node, Query, QueryCursor
+
+from nfr_gate.analysis.base import DiffContext
+from nfr_gate.analysis.diff_parser import line_in_ranges
+
+QUERIES_DIR = Path(__file__).parent / "queries"
+
+# Per language: (query filename stem, capture name for the whole construct,
+# construct kind). `kind` is the language-agnostic label rule evaluators
+# filter on — languages whose grammar has no direct equivalent of a
+# Python-style except block (Go) still produce a `catch_block`-kind
+# construct from whatever their own error-handling idiom's query finds
+# (Go: an `if err != nil { ... }` block), so rule logic that filters on
+# `kind` doesn't need to know which language it's looking at.
+CONSTRUCT_QUERIES: dict[str, list[tuple[str, str, str]]] = {
+    "python": [
+        ("outbound_calls", "outbound_call", "external_call"),
+        ("exception_handlers", "catch_block", "catch_block"),
+        ("route_definitions", "route_definition", "route_definition"),
+        ("retry_blocks", "sleep_call", "sleep_call"),
+        ("span_calls", "span_call", "span_call"),
+        ("metric_label_calls", "metric_label_call", "metric_label_call"),
+    ],
+    "java": [
+        ("outbound_calls", "outbound_call", "external_call"),
+        ("exception_handlers", "catch_block", "catch_block"),
+        ("retry_blocks", "sleep_call", "sleep_call"),
+        ("route_definitions", "route_definition", "route_definition"),
+        ("span_calls", "span_call", "span_call"),
+        ("metric_label_calls", "metric_label_call", "metric_label_call"),
+    ],
+    "go": [
+        ("outbound_calls", "outbound_call", "external_call"),
+        ("error_checks", "error_check_block", "catch_block"),
+        ("retry_blocks", "sleep_call", "sleep_call"),
+        ("route_definitions", "route_definition", "route_definition"),
+        ("span_calls", "span_call", "span_call"),
+        ("metric_label_calls", "metric_label_call", "metric_label_call"),
+    ],
+}
+
+
+@dataclass(frozen=True)
+class Construct:
+    kind: str  # 'external_call' | 'catch_block' | 'route_definition' | 'sleep_call' | 'span_call' | 'metric_label_call'
+    file_path: str
+    start_line: int  # 1-indexed
+    end_line: int
+    snippet: str
+    in_diff: bool  # whether this construct falls within a changed line range
+    node: Node = field(repr=False, compare=False)
+    # Rule evaluators need the actual node (to inspect arguments, walk
+    # parents for an enclosing span/loop, etc.) — constructs.py only finds
+    # *where* things are; rule-specific inspection stays in analysis/rules/.
+
+
+@lru_cache(maxsize=None)
+def _load_query(ts_language: Language, language: str, query_name: str) -> Query:
+    # Query compilation is real, non-trivial work (parses the .scm pattern
+    # itself). The query text is static per (language, query_name) — a CI
+    # run touching N files must not recompile the same 3 queries N times.
+    # Cached for the life of the process, keyed by object identity of
+    # ts_language, which is stable for a given LanguageAnalyzer instance.
+    path = QUERIES_DIR / language / f"{query_name}.scm"
+    return Query(ts_language, path.read_text())
+
+
+def find_constructs(ctx: DiffContext, ts_language: Language) -> list[Construct]:
+    """Runs every registered query for ctx.language and returns every match,
+    tagged with whether it falls inside a line range the diff actually added.
+    Callers that only care about new code (e.g. static rule evaluators, which
+    should not re-flag pre-existing gaps) filter on `in_diff`."""
+    results: list[Construct] = []
+
+    for query_name, capture_name, kind in CONSTRUCT_QUERIES.get(ctx.language, []):
+        query = _load_query(ts_language, ctx.language, query_name)
+        cursor = QueryCursor(query)
+        matches = cursor.matches(ctx.tree.root_node)
+
+        for _pattern_index, captures in matches:
+            for node in captures.get(capture_name, []):
+                start_line = node.start_point[0] + 1
+                end_line = node.end_point[0] + 1
+                results.append(
+                    Construct(
+                        kind=kind,
+                        file_path=ctx.file_path,
+                        start_line=start_line,
+                        end_line=end_line,
+                        snippet=node.text.decode("utf-8", errors="replace"),
+                        in_diff=any(
+                            line_in_ranges(line, ctx.changed_line_ranges)
+                            for line in range(start_line, end_line + 1)
+                        ),
+                        node=node,
+                    )
+                )
+
+    return results

nfrgate-0.1.0/src/nfr_gate/analysis/diff_parser.py

@@ -0,0 +1,73 @@
+"""Parses a unified diff (`git diff` / `diff -u` format, same shape a PR diff
+arrives in from GitHub/GitLab) into, per file, the line ranges that were
+actually added — nothing more. It does not reconstruct file content: the
+pipeline reads the real post-change source from the checked-out repo and
+uses this module only to know which lines in that source are new, so rule
+evaluators can skip untouched code instead of re-flagging pre-existing gaps
+on every PR that happens to touch the same file.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+_HUNK_HEADER_RE = re.compile(r"^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@")
+
+
+@dataclass(frozen=True)
+class FileDiff:
+    file_path: str
+    added_line_ranges: list[tuple[int, int]]  # 1-indexed, inclusive, in the NEW file
+
+
+def parse_unified_diff(diff_text: str) -> list[FileDiff]:
+    files: list[FileDiff] = []
+    current_path: str | None = None
+    current_ranges: list[list[int]] = []
+    new_line_no: int | None = None
+
+    def flush() -> None:
+        nonlocal current_path, current_ranges
+        if current_path is not None:
+            files.append(FileDiff(current_path, [tuple(r) for r in current_ranges]))
+        current_path, current_ranges = None, []
+
+    for line in diff_text.splitlines():
+        if line.startswith("+++ "):
+            flush()
+            path = line[4:].strip()
+            current_path = path[2:] if path.startswith("b/") else path
+            new_line_no = None
+            continue
+
+        if line.startswith("--- ") or line.startswith("diff ") or line.startswith("index "):
+            continue
+
+        hunk_match = _HUNK_HEADER_RE.match(line)
+        if hunk_match:
+            new_line_no = int(hunk_match.group(3))
+            continue
+
+        if current_path is None or new_line_no is None:
+            continue
+
+        if line.startswith("\\"):  # ""
+            continue
+        if line.startswith("+"):
+            if current_ranges and current_ranges[-1][1] == new_line_no - 1:
+                current_ranges[-1][1] = new_line_no
+            else:
+                current_ranges.append([new_line_no, new_line_no])
+            new_line_no += 1
+        elif line.startswith("-"):
+            pass  # removed line: doesn't exist in the new file, don't advance the counter
+        else:
+            new_line_no += 1  # context line
+
+    flush()
+    return files
+
+
+def line_in_ranges(line: int, ranges: list[tuple[int, int]]) -> bool:
+    return any(start <= line <= end for start, end in ranges)

nfrgate-0.1.0/src/nfr_gate/analysis/languages/go_analyzer.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+
+import tree_sitter_go as tsgo
+from tree_sitter import Language, Parser, Tree
+
+from nfr_gate.analysis.base import LanguageAnalyzer
+
+
+class GoAnalyzer(LanguageAnalyzer):
+    language = "go"
+
+    def __init__(self) -> None:
+        self._ts_language = Language(tsgo.language())
+        self._parser = Parser(self._ts_language)
+
+    @property
+    def ts_language(self) -> Language:
+        return self._ts_language
+
+    def parse(self, source: bytes) -> Tree:
+        return self._parser.parse(source)

nfrgate-0.1.0/src/nfr_gate/analysis/languages/java_analyzer.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+
+import tree_sitter_java as tsjava
+from tree_sitter import Language, Parser, Tree
+
+from nfr_gate.analysis.base import LanguageAnalyzer
+
+
+class JavaAnalyzer(LanguageAnalyzer):
+    language = "java"
+
+    def __init__(self) -> None:
+        self._ts_language = Language(tsjava.language())
+        self._parser = Parser(self._ts_language)
+
+    @property
+    def ts_language(self) -> Language:
+        return self._ts_language
+
+    def parse(self, source: bytes) -> Tree:
+        return self._parser.parse(source)

nfrgate-0.1.0/src/nfr_gate/analysis/languages/python_analyzer.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+
+import tree_sitter_python as tspython
+from tree_sitter import Language, Parser, Tree
+
+from nfr_gate.analysis.base import LanguageAnalyzer
+
+
+class PythonAnalyzer(LanguageAnalyzer):
+    language = "python"
+
+    def __init__(self) -> None:
+        self._ts_language = Language(tspython.language())
+        self._parser = Parser(self._ts_language)
+
+    @property
+    def ts_language(self) -> Language:
+        return self._ts_language
+
+    def parse(self, source: bytes) -> Tree:
+        return self._parser.parse(source)

nfrgate-0.1.0/src/nfr_gate/analysis/languages/registry.py

@@ -0,0 +1,33 @@
+"""Maps a file extension to the LanguageAnalyzer that handles it — the one
+place that needs to know which languages exist. constructs.py, the rule
+evaluators, and the CI pipeline are all parameterized by `language: str`
+and don't care how a file got mapped to one, so adding a fourth language
+is additive here, not a change to any of them.
+"""
+
+from __future__ import annotations
+
+from nfr_gate.analysis.base import LanguageAnalyzer
+from nfr_gate.analysis.languages.go_analyzer import GoAnalyzer
+from nfr_gate.analysis.languages.java_analyzer import JavaAnalyzer
+from nfr_gate.analysis.languages.python_analyzer import PythonAnalyzer
+
+# Instantiated once at import time — building a tree-sitter Parser per file
+# would be the same wasted-repeated-work pattern the query cache in
+# constructs.py already exists to avoid.
+_ANALYZERS: dict[str, LanguageAnalyzer] = {
+    ".py": PythonAnalyzer(),
+    ".java": JavaAnalyzer(),
+    ".go": GoAnalyzer(),
+}
+
+
+def analyzer_for_path(file_path: str) -> LanguageAnalyzer | None:
+    for ext, analyzer in _ANALYZERS.items():
+        if file_path.endswith(ext):
+            return analyzer
+    return None
+
+
+def supported_extensions() -> list[str]:
+    return list(_ANALYZERS.keys())

nfrgate-0.1.0/src/nfr_gate/analysis/queries/go/error_checks.scm

@@ -0,0 +1,22 @@
+; Go has no exception/catch construct — the idiomatic equivalent of "did
+; this error path get handled" is `if err != nil { ... }`. This query
+; matches that shape specifically (excludes `== nil`, i.e. the success
+; branch) and maps to the SAME construct kind ("catch_block") that
+; except_clause/catch_clause map to in Python/Java, so rule L2's logic
+; doesn't need to know which language it's looking at — only that a
+; "catch_block"-kind construct's body might or might not contain a
+; structured log call.
+;
+; #match? on "err" is a substring match, matching Go's near-universal
+; convention of naming error variables err/writeErr/parseErr/etc. — not a
+; guarantee every err-shaped comparison is really an error check, but a
+; defensible heuristic for v1.
+
+(if_statement
+  condition: (binary_expression
+    left: (identifier) @_err_ident
+    "!="
+    right: (nil))
+  consequence: (block) @_consequence
+  (#match? @_err_ident "err")
+) @error_check_block

nfrgate-0.1.0/src/nfr_gate/analysis/queries/go/metric_label_calls.scm

@@ -0,0 +1,9 @@
+; Matches `.With(...)` calls — the standard prometheus client_golang idiom
+; for attaching a `prometheus.Labels{...}` composite literal to a metric
+; before incrementing/observing it. M3 inspects the argument text for
+; unbounded-looking keys, not the query's job.
+
+(call_expression
+  function: (selector_expression field: (field_identifier) @_method)
+  (#eq? @_method "With")
+) @metric_label_call

nfrgate-0.1.0/src/nfr_gate/analysis/queries/go/outbound_calls.scm

@@ -0,0 +1,13 @@
+; Matches "obj.Method(...)"-shaped calls where the receiver is a plain
+; identifier: client.Post(...), db.Query(...). Deliberately requires the
+; operand to be a bare identifier (not a chained selector like
+; resp.Body.Close()), which cuts some of the false-positive rate the
+; Python/Java versions of this heuristic carry, as a side effect rather
+; than a deliberate precision fix — still not a whitelist of real
+; HTTP/DB clients. Consumed by rules T1 and R1.
+
+(call_expression
+  function: (selector_expression
+    operand: (identifier) @callee_object
+    field: (field_identifier) @callee_method)
+) @outbound_call

nfrgate-0.1.0/src/nfr_gate/analysis/queries/go/retry_blocks.scm

@@ -0,0 +1,14 @@
+; Matches time.Sleep(...) — the standard Go retry-delay idiom. Consumed by
+; rule R2 (retry_without_backoff). Classifying the delay expression's shape
+; (fixed vs. backoff-shaped) happens in Python against the captured node —
+; see analysis/rules/go/retry_backoff_rule.py, which has to account for
+; Go's `N * time.Second` idiom meaning a FIXED delay, not backoff, unlike a
+; bare arithmetic expression in Python.
+
+(call_expression
+  function: (selector_expression
+    operand: (identifier) @_sleep_object
+    field: (field_identifier) @_sleep_method)
+  (#eq? @_sleep_object "time")
+  (#eq? @_sleep_method "Sleep")
+) @sleep_call