# Graph Report - .  (2026-08-09)

## Corpus Check
- 78 files · ~64,934 words
- Verdict: corpus is large enough that graph structure adds value.

## Summary
- 953 nodes · 2017 edges · 64 communities (48 shown, 16 thin omitted)
- Extraction: 91% EXTRACTED · 8% INFERRED · 0% AMBIGUOUS · INFERRED: 170 edges (avg confidence: 0.82)
- Token cost: 134,823 input · 0 output

## Community Hubs (Navigation)
- TOTP & Web Token Auth
- ACME/JWS Client
- CalDAV/CardDAV Handlers
- IMAP Command Parser
- Mail Provider Abstraction
- Server Config & Bootstrap
- Sieve Filter Interpreter
- DB Mutation Queries
- IMAP Server Loop
- POP3 Server Loop
- JMAP Auth & Sessions
- SMTP Session Header Parsing
- Admin API Handlers
- IMAP Client
- DKIM Key Signing
- Outbound Delivery Queue
- SMTP Server Networking
- Linked Account & Alias Queries
- TCP Server Lifecycle
- Calendar/Contact/TLS Queries
- OAuth2 Config
- Go-No-Deps Web App Pattern
- GoMail Build Phases Overview
- Quarantine & Message Queries
- iCal Parsing & Fuzzing
- LLM Spam Stage
- vCard Parsing & Fuzzing
- Admin Portal Bugs & CRUD
- Spam Pipeline Orchestrator
- SPF Stage
- TCP Boundary & Rate-Limit Findings
- Domain/Tenant Queries
- Rspamd Stage
- Per-IP Rate Limiter
- ClamAV Stage
- DMARC Stage
- Spam Header Injection Stage
- Iterative Build Discipline Skill
- Deployment & DNS Setup
- HTTP Middleware
- URL Extraction Stage
- SQLite Deadlock Findings
- List Rule Queries
- Sieve Script Queries
- Mail Context Domain Helpers
- Calendar Object Queries
- Contact Queries
- Shared api() Fetch Convention
- Session Continuity Practices
- Scope Prioritization Practices
- DB Migrations
- Shared esc() Helper
- SPA Login/Logout
- SPA App Boot/Routing
- Graphify Project Rules
- Admin SPA Router
- Raw MIME Body Extractor
- Go Module Root

## God Nodes (most connected - your core abstractions)
1. `DB` - 77 edges
2. `User` - 56 edges
3. `Handler` - 35 edges
4. `Store` - 27 edges
5. `session` - 25 edges
6. `session` - 25 edges
7. `writeJSON()` - 24 edges
8. `writeErr()` - 24 edges
9. `MasterKey` - 23 edges
10. `session` - 20 edges

## Surprising Connections (you probably didn't know these)
- `base.html Flask-style Block Layout` --conceptually_related_to--> `GoMail Webmail SPA (index.html)`  [AMBIGUOUS]
  .claude/go-web-app-no-deps-SKILL.md → internal/webmail/static/index.html
- `Dark Tailwind CSS Custom-Property Palette` --semantically_similar_to--> `GoMail Admin SPA (index.html)`  [INFERRED] [semantically similar]
  .claude/go-web-app-no-deps-SKILL.md → internal/admin/static/index.html
- `Dark Tailwind CSS Custom-Property Palette` --semantically_similar_to--> `GoMail Webmail SPA (index.html)`  [INFERRED] [semantically similar]
  .claude/go-web-app-no-deps-SKILL.md → internal/webmail/static/index.html
- `Shared api() Fetch Helper Convention` --semantically_similar_to--> `api() fetch helper (admin)`  [INFERRED] [semantically similar]
  .claude/go-web-app-no-deps-SKILL.md → internal/admin/static/index.html
- `Shared api() Fetch Helper Convention` --semantically_similar_to--> `api() fetch helper (webmail)`  [INFERRED] [semantically similar]
  .claude/go-web-app-no-deps-SKILL.md → internal/webmail/static/index.html

## Import Cycles
- None detected.

## Hyperedges (group relationships)
- **GoMail Project Documentation Set** — gomail_handover_overview, readme_gomail, gomail_action_plan_v4_overview, _claude_iterative_build_discipline_skill_gomail_project [INFERRED 0.85]
- **Admin Portal CRUD Feature Set** — internal_admin_static_index_domains_crud, internal_admin_static_index_users_crud, internal_admin_static_index_rules_crud, internal_admin_static_index_queue_crud, internal_admin_static_index_quarantine [EXTRACTED 1.00]
- **Recurring Bug-Pattern Documentation Across GoMail Docs** — _claude_iterative_build_discipline_skill_sqlite_single_conn, gomail_handover_sqlite_deadlock_bug, gomail_action_plan_v4_sqlite_deadlock_bug, _claude_iterative_build_discipline_skill_tcp_read_pattern, gomail_handover_tcp_bug, gomail_action_plan_v4_tcp_bug [INFERRED 0.85]

## Communities (64 total, 16 thin omitted)

### Community 0 - "TOTP & Web Token Auth"
Cohesion: 0.10
Nodes (34): User, decodeSecret(), Generate(), GenerateSecret(), Time, hotp(), ProvisioningURI(), Validate() (+26 more)

### Community 1 - "ACME/JWS Client"
Cohesion: 0.06
Nodes (31): AccountKey, Authorization, Challenge, ChallengeResponder, Client, directory, jwk, Order (+23 more)

### Community 2 - "CalDAV/CardDAV Handlers"
Cohesion: 0.08
Nodes (34): MailProvider, MasterKey, Handler, multistatusResponse, propSet, LinkedAccountProvider, Config, DB (+26 more)

### Community 3 - "IMAP Command Parser"
Cohesion: 0.06
Nodes (24): MailboxEntry, state, addFlag(), expandFetchItems(), extractHeaders(), flagsToIMAP(), session, indexOf() (+16 more)

### Community 4 - "Mail Provider Abstraction"
Cohesion: 0.09
Nodes (25): Folder, FullMessage, GoMailProvider, IMAPCredential, IMAPProvider, ListOpts, MessageHeader, OAuth2Credential (+17 more)

### Community 5 - "Server Config & Bootstrap"
Cohesion: 0.09
Nodes (30): buildOAuthConfigs(), Config, main(), Config, DatabaseConfig, JMAPConfig, LinkedAccountsConfig, NotifyConfig (+22 more)

### Community 6 - "Sieve Filter Interpreter"
Cohesion: 0.12
Nodes (20): evalTest(), execStatements(), Execute(), lookupHeader(), newLexer(), Parse(), FuzzParse(), F (+12 more)

### Community 8 - "IMAP Server Loop"
Cohesion: 0.12
Nodes (17): Config, Context, DB, Duration, Listener, WaitGroup, NewServer(), escapeQuoted() (+9 more)

### Community 9 - "POP3 Server Loop"
Cohesion: 0.15
Nodes (13): Config, Conn, Context, DB, Duration, Listener, ReadWriter, WaitGroup (+5 more)

### Community 10 - "JMAP Auth & Sessions"
Cohesion: 0.12
Nodes (20): Scope, Authenticate(), checkAppPassword(), DB, Context, DB, Request, ResponseWriter (+12 more)

### Community 11 - "SMTP Session Header Parsing"
Cohesion: 0.16
Nodes (15): extractHeader(), extractHeaderMap(), extractMessageID(), extractSubject(), Conn, Context, IP, ReadWriter (+7 more)

### Community 12 - "Admin API Handlers"
Cohesion: 0.20
Nodes (14): filterDomainsByTenant(), Handler, DB, HandlerFunc, Request, ResponseWriter, ServeMux, NewHandler() (+6 more)

### Community 13 - "IMAP Client"
Cohesion: 0.15
Nodes (12): Client, FetchedMessage, FolderInfo, SelectedInfo, Dial(), Config, Conn, Duration (+4 more)

### Community 14 - "DKIM Key Signing"
Cohesion: 0.14
Nodes (20): KeyPair, ExtractSignatureInfo(), GenerateKeyPair(), PrivateKey, ParseDNSPublicKey(), ParsePrivateKey(), buildDKIMHeader(), canonicalizeBodyRelaxed() (+12 more)

### Community 15 - "Outbound Delivery Queue"
Cohesion: 0.18
Nodes (11): backoffDuration(), domainOf(), DB, Duration, isPermanentError(), lookupMXHosts(), NewWorker(), Deliverer (+3 more)

### Community 16 - "SMTP Server Networking"
Cohesion: 0.19
Nodes (14): connHost(), Addr, Config, Conn, Context, DB, Duration, Limiter (+6 more)

### Community 17 - "Linked Account & Alias Queries"
Cohesion: 0.14
Nodes (11): Alias, AppPassword, CheckResult, LinkedAccount, LinkedAccountAuthType, MessageCheck, MFABackupCode, ReleaseToken (+3 more)

### Community 18 - "TCP Server Lifecycle"
Cohesion: 0.20
Nodes (11): Server, connHost(), Addr, Config, Context, DB, Duration, Limiter (+3 more)

### Community 19 - "Calendar/Contact/TLS Queries"
Cohesion: 0.19
Nodes (6): Addressbook, Calendar, OwnerType, Stats, TLSCert, uuidNew()

### Community 20 - "OAuth2 Config"
Cohesion: 0.23
Nodes (9): Context, Time, truncate(), WellKnownEndpoints(), XOAUTH2SASLString(), Config, Token, tokenResponse (+1 more)

### Community 21 - "Go-No-Deps Web App Pattern"
Cohesion: 0.21
Nodes (13): go-web-app-no-deps Packaged Skill (.skill zip), base.html Flask-style Block Layout, Template Block Bleeding Bug (ParseGlob shared namespace), Static Asset Cache-Busting via Version Query Param, Dark Tailwind CSS Custom-Property Palette, JS Function-in-Conditional Scoping Bug, No-Third-Party-Dependencies Principle, Go Web App No-Deps Pattern (skill) (+5 more)

### Community 22 - "GoMail Build Phases Overview"
Cohesion: 0.21
Nodes (12): GoMail (referenced project), Wire-Format Structs Need Explicit Serialization Tags, cmd/e2etestN Disposable Test Pattern, GoMail Action Plan v4 Overview, Phase 5: IMAP/POP3/Auth, Phase 7: CalDAV/CardDAV, Phase 8: Webmail (JWT + REST API + SPA), Phase 9: JMAP Core/Mail Subset (+4 more)

### Community 23 - "Quarantine & Message Queries"
Cohesion: 0.15
Nodes (5): Message, MessageVerdict, QuarantineEntry, QuarantineStatus, Time

### Community 24 - "iCal Parsing & Fuzzing"
Cohesion: 0.24
Nodes (9): Event, escape(), FuzzParse(), F, Time, Parse(), splitProperty(), unescape() (+1 more)

### Community 25 - "LLM Spam Stage"
Cohesion: 0.29
Nodes (7): extractLeadingDigits(), Context, Duration, chatCompletionRequest, chatCompletionResponse, chatMessage, LLMStage

### Community 26 - "vCard Parsing & Fuzzing"
Cohesion: 0.27
Nodes (8): escape(), FuzzParse(), F, Parse(), splitProperty(), unescape(), unfold(), Card

### Community 27 - "Admin Portal Bugs & CRUD"
Cohesion: 0.29
Nodes (10): Admin Domain Creation Missing Tenant Fallback Bug, Admin User Creation Missing domain_id Bug, Phase 11: Admin Portal, Quarantine: Admin Global Discard vs Webmail Per-User Release, Domains CRUD (loadDomains/createDomain/rotateDkim/deleteDomain), Quarantine Discard (admin), Outbound Queue Actions (retry/cancel), List Rules CRUD (+2 more)

### Community 28 - "Spam Pipeline Orchestrator"
Cohesion: 0.40
Nodes (8): DefaultStages(), Config, Context, NewOrchestrator(), StagesFromConfig(), verdictFor(), Orchestrator, Stage

### Community 29 - "SPF Stage"
Cohesion: 0.40
Nodes (7): checkSPF(), evaluateSPF(), Context, IP, matchCIDR(), spfOutcome, SPFStage

### Community 30 - "TCP Boundary & Rate-Limit Findings"
Cohesion: 0.25
Nodes (9): bufio.Reader + io.ReadFull for TCP Protocol Boundaries, Genuine EICAR Byte-Level ClamAV Verification, Phase 10: OAuth2 + Gmail/M365 Multi-Account, Phase 14: Optional External Services (ClamAV/Rspamd/LLM), Phase 15: Hardening + Deploy, Token-Bucket Per-IP Rate Limiter, Fake clamd Server TCP Over-Read Bug, Suggested Next Session Scope (+1 more)

### Community 32 - "Rspamd Stage"
Cohesion: 0.36
Nodes (5): Context, Duration, rspamdResponse, RspamdStage, rspamdSymbol

### Community 33 - "Per-IP Rate Limiter"
Cohesion: 0.33
Nodes (5): Mutex, Limiter, Time, New(), bucket

### Community 34 - "ClamAV Stage"
Cohesion: 0.39
Nodes (4): Context, Duration, parseClamAddr(), ClamAVStage

### Community 35 - "DMARC Stage"
Cohesion: 0.39
Nodes (5): dmarcTag(), extractDomainFromHeader(), Context, orgDomain(), DMARCStage

### Community 36 - "Spam Header Injection Stage"
Cohesion: 0.33
Nodes (4): Context, injectSpamHeaders(), HeaderStage, StageResult

### Community 37 - "Iterative Build Discipline Skill"
Cohesion: 0.33
Nodes (6): iterative-build-discipline Packaged Skill (.skill zip), Core Principle: Compiles is Not Correct, Disposable Real End-to-End Test Pattern, Genuinely-Enforcing Fake Protocol Server Pattern, Negative-Path Tests as Non-Optional, Verify Against Published Test Vectors (RFC 6238)

### Community 38 - "Deployment & DNS Setup"
Cohesion: 0.47
Nodes (6): Phase 13: TLS + ACME + DANE/MTA-STS, Sandbox Network/Toolchain Constraints, Immediate First Steps Setup, DNS Setup (MX/SPF/DKIM/DMARC), GoMail (Self-Hosted Email Server), TLS / ACME Quick Setup

### Community 39 - "HTTP Middleware"
Cohesion: 0.33
Nodes (4): Handler, clientIP(), Limiter, Request

### Community 40 - "URL Extraction Stage"
Cohesion: 0.47
Nodes (3): dedupe(), Context, URLStage

### Community 41 - "SQLite Deadlock Findings"
Cohesion: 0.50
Nodes (5): SQLite Single-Connection-Pool Query/Exec Deadlock Pattern, Phase 12: Auth Hardening (TOTP/App Passwords/Reset), Rationale: Phase 13 Pulled Forward, ConsumeBackupCode SQLite Deadlock Bug, SQLite Query+Exec Deadlock Bug (documented)

### Community 44 - "Mail Context Domain Helpers"
Cohesion: 0.50
Nodes (3): domainOf(), IP, MailContext

### Community 47 - "Shared api() Fetch Convention"
Cohesion: 1.00
Nodes (3): Shared api() Fetch Helper Convention, api() fetch helper (admin), api() fetch helper (webmail)

## Ambiguous Edges - Review These
- `Template Renderer (fresh-instance-per-page)` → `GoMail Admin SPA (index.html)`  [AMBIGUOUS]
  .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to
- `base.html Flask-style Block Layout` → `GoMail Webmail SPA (index.html)`  [AMBIGUOUS]
  .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to
- `Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP` → `GoMail Admin SPA (index.html)`  [AMBIGUOUS]
  .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to
- `Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP` → `GoMail Webmail SPA (index.html)`  [AMBIGUOUS]
  .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to

## Knowledge Gaps
- **23 isolated node(s):** `webmail`, `IMAPCredential`, `DB`, `migration`, `response` (+18 more)
  These have ≤1 connection - possible missing edges or undocumented components.
- **16 thin communities (<3 nodes) omitted from report** — run `graphify query` to explore isolated nodes.

## Suggested Questions
_Questions this graph is uniquely positioned to answer:_

- **What is the exact relationship between `Template Renderer (fresh-instance-per-page)` and `GoMail Admin SPA (index.html)`?**
  _Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low._
- **What is the exact relationship between `base.html Flask-style Block Layout` and `GoMail Webmail SPA (index.html)`?**
  _Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low._
- **What is the exact relationship between `Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP` and `GoMail Admin SPA (index.html)`?**
  _Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low._
- **What is the exact relationship between `Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP` and `GoMail Webmail SPA (index.html)`?**
  _Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low._
- **Why does `User` connect `TOTP & Web Token Auth` to `CalDAV/CardDAV Handlers`, `IMAP Command Parser`, `Mail Provider Abstraction`, `DB Mutation Queries`, `IMAP Server Loop`, `POP3 Server Loop`, `JMAP Auth & Sessions`, `SMTP Session Header Parsing`, `Admin API Handlers`, `Linked Account & Alias Queries`?**
  _High betweenness centrality (0.323) - this node is a cross-community bridge._
- **Why does `Store` connect `CalDAV/CardDAV Handlers` to `TOTP & Web Token Auth`, `Mail Provider Abstraction`, `POP3 Server Loop`, `JMAP Auth & Sessions`, `Outbound Delivery Queue`, `SMTP Server Networking`, `TCP Server Lifecycle`?**
  _High betweenness centrality (0.109) - this node is a cross-community bridge._
- **Why does `DB` connect `DB Mutation Queries` to `IMAP Command Parser`, `List Rule Queries`, `Sieve Script Queries`, `Calendar Object Queries`, `Contact Queries`, `Linked Account & Alias Queries`, `Calendar/Contact/TLS Queries`, `Quarantine & Message Queries`, `Domain/Tenant Queries`?**
  _High betweenness centrality (0.098) - this node is a cross-community bridge._