# Graph Report - webmail  (2026-08-09)

## Corpus Check
- 85 files · ~80,564 words
- Verdict: corpus is large enough that graph structure adds value.

## Summary
- 1144 nodes · 2550 edges · 71 communities (53 shown, 18 thin omitted)
- Extraction: 92% EXTRACTED · 8% INFERRED · 0% AMBIGUOUS · INFERRED: 205 edges (avg confidence: 0.81)
- Token cost: 0 input · 0 output

## Graph Freshness
- Built from commit: `d7ca591b`
- Run `git rev-parse HEAD` and compare to check if the graph is stale.
- Run `graphify update .` after code changes (no API cost).

## Community Hubs (Navigation)
- User
- Client
- webauthn.go
- session
- GoMailProvider
- config.go
- parser
- DB
- session
- session
- Handler
- session
- writeErr
- Client
- Sign
- Worker
- Server
- models.go
- Store
- uuidNew
- oauth2.go
- Go Web App No-Deps Pattern (skill)
- GoMail Action Plan v4 Overview
- QuarantineEntry
- ical.go
- .Run
- vcard.go
- Phase 11: Admin Portal
- app.js
- dnsutil.go
- Suggested Next Session Scope
- Domain
- checkSPF
- Limiter
- .Run
- .Run
- StageResult
- Core Principle: Compiles is Not Correct
- Phase 13: TLS + ACME + DANE/MTA-STS
- Server
- .Run
- Phase 12: Auth Hardening (TOTP/App Passwords/Reset)
- gomail
- SieveScript
- MailContext
- CalendarObject
- OutboundQueueEntry
- Shared api() Fetch Helper Convention
- Checkpoint Working State as Durable Artifact
- Prioritize by Risk Reduction Over Task Order
- migration
- esc() HTML-escape helper (admin)
- login() (admin)
- showApp()/showLogin() (admin)
- graphify Project Rules
- showPage() router (admin)
- bodyOf() raw MIME body extractor
- ListRule
- Contact
- session
- MailboxEntry
- Server
- pipeline.go
- expandFetchItems
- .GetTLSCert

## God Nodes (most connected - your core abstractions)
1. `DB` - 81 edges
2. `User` - 64 edges
3. `Handler` - 47 edges
4. `writeErr()` - 34 edges
5. `writeJSON()` - 33 edges
6. `Store` - 28 edges
7. `api()` - 28 edges
8. `MasterKey` - 27 edges
9. `session` - 25 edges
10. `session` - 25 edges

## Surprising Connections (you probably didn't know these)
- `base.html Flask-style Block Layout` --conceptually_related_to--> `GoMail Webmail SPA (index.html)`  [AMBIGUOUS]
  .claude/go-web-app-no-deps-SKILL.md → internal/webmail/static/index.html
- `Dark Tailwind CSS Custom-Property Palette` --semantically_similar_to--> `GoMail Admin SPA (index.html)`  [INFERRED] [semantically similar]
  .claude/go-web-app-no-deps-SKILL.md → internal/admin/static/index.html
- `Dark Tailwind CSS Custom-Property Palette` --semantically_similar_to--> `GoMail Webmail SPA (index.html)`  [INFERRED] [semantically similar]
  .claude/go-web-app-no-deps-SKILL.md → internal/webmail/static/index.html
- `Shared api() Fetch Helper Convention` --semantically_similar_to--> `api() fetch helper (admin)`  [INFERRED] [semantically similar]
  .claude/go-web-app-no-deps-SKILL.md → internal/admin/static/index.html
- `Shared api() Fetch Helper Convention` --semantically_similar_to--> `api() fetch helper (webmail)`  [INFERRED] [semantically similar]
  .claude/go-web-app-no-deps-SKILL.md → internal/webmail/static/index.html

## Import Cycles
- None detected.

## Hyperedges (group relationships)
- **GoMail Project Documentation Set** — gomail_handover_overview, readme_gomail, gomail_action_plan_v4_overview, _claude_iterative_build_discipline_skill_gomail_project [INFERRED 0.85]
- **Admin Portal CRUD Feature Set** — internal_admin_static_index_domains_crud, internal_admin_static_index_users_crud, internal_admin_static_index_rules_crud, internal_admin_static_index_queue_crud, internal_admin_static_index_quarantine [EXTRACTED 1.00]
- **Recurring Bug-Pattern Documentation Across GoMail Docs** — _claude_iterative_build_discipline_skill_sqlite_single_conn, gomail_handover_sqlite_deadlock_bug, gomail_action_plan_v4_sqlite_deadlock_bug, _claude_iterative_build_discipline_skill_tcp_read_pattern, gomail_handover_tcp_bug, gomail_action_plan_v4_tcp_bug [INFERRED 0.85]

## Communities (71 total, 18 thin omitted)

### Community 0 - "User"
Cohesion: 0.09
Nodes (42): User, NewGoMailProvider(), decodeSecret(), Generate(), GenerateSecret(), Time, hotp(), ProvisioningURI() (+34 more)

### Community 1 - "Client"
Cohesion: 0.06
Nodes (30): AccountKey, Authorization, Challenge, ChallengeResponder, Client, directory, jwk, Order (+22 more)

### Community 2 - "webauthn.go"
Cohesion: 0.17
Nodes (16): cborDecode(), cborDecodeWithLength(), DecodePublicKey(), EncodePublicKey(), Time, ParseAttestationObject(), ParseAuthData(), parseCOSEKey() (+8 more)

### Community 3 - "session"
Cohesion: 0.19
Nodes (8): state, Config, Conn, Context, session, ReadWriter, Server, newSession()

### Community 4 - "GoMailProvider"
Cohesion: 0.06
Nodes (38): Folder, FullMessage, GmailAPIProvider, gmailLabel, GoMailProvider, GraphAPIProvider, graphFolder, graphMessage (+30 more)

### Community 5 - "config.go"
Cohesion: 0.07
Nodes (36): buildOAuthConfigs(), Config, Handler, ipAllowlistMiddleware(), main(), Config, DatabaseConfig, JMAPConfig (+28 more)

### Community 6 - "parser"
Cohesion: 0.13
Nodes (19): evalTest(), execStatements(), Execute(), lookupHeader(), newLexer(), Parse(), FuzzParse(), F (+11 more)

### Community 8 - "session"
Cohesion: 0.14
Nodes (15): Scope, Authenticate(), checkAppPassword(), DB, escapeQuoted(), Conn, Context, ReadWriter (+7 more)

### Community 9 - "session"
Cohesion: 0.13
Nodes (16): connHost(), Addr, Config, Conn, Context, DB, Duration, Limiter (+8 more)

### Community 10 - "Handler"
Cohesion: 0.19
Nodes (14): Context, DB, Request, ResponseWriter, ServeMux, jmapRole(), NewHandler(), splitCompositeID() (+6 more)

### Community 11 - "session"
Cohesion: 0.15
Nodes (16): applySieve(), extractHeader(), extractHeaderMap(), extractMessageID(), extractSubject(), Conn, Context, IP (+8 more)

### Community 12 - "writeErr"
Cohesion: 0.20
Nodes (14): filterDomainsByTenant(), Handler, DB, HandlerFunc, Request, ResponseWriter, ServeMux, NewHandler() (+6 more)

### Community 13 - "Client"
Cohesion: 0.15
Nodes (12): Client, FetchedMessage, FolderInfo, SelectedInfo, Dial(), Config, Conn, Duration (+4 more)

### Community 14 - "Sign"
Cohesion: 0.14
Nodes (20): KeyPair, ExtractSignatureInfo(), GenerateKeyPair(), PrivateKey, ParseDNSPublicKey(), ParsePrivateKey(), buildDKIMHeader(), canonicalizeBodyRelaxed() (+12 more)

### Community 15 - "Worker"
Cohesion: 0.12
Nodes (20): Discover(), Context, Duration, Matches(), parsePolicy(), backoffDuration(), domainOf(), Config (+12 more)

### Community 16 - "Server"
Cohesion: 0.19
Nodes (14): connHost(), Addr, Config, Conn, Context, DB, Duration, Limiter (+6 more)

### Community 17 - "models.go"
Cohesion: 0.17
Nodes (12): Addressbook, Alias, AppPassword, Calendar, CheckResult, MessageCheck, MFABackupCode, OwnerType (+4 more)

### Community 18 - "Store"
Cohesion: 0.06
Nodes (46): IMAPCredential, MailProvider, OAuth2Credential, keyCacheKey, MasterKey, Handler, multistatusResponse, propSet (+38 more)

### Community 19 - "uuidNew"
Cohesion: 0.25
Nodes (3): MTASTSPolicy, Stats, uuidNew()

### Community 20 - "oauth2.go"
Cohesion: 0.18
Nodes (11): Context, Reader, Request, Time, NewAuthedRequest(), truncate(), WellKnownEndpoints(), Config (+3 more)

### Community 21 - "Go Web App No-Deps Pattern (skill)"
Cohesion: 0.21
Nodes (13): go-web-app-no-deps Packaged Skill (.skill zip), base.html Flask-style Block Layout, Template Block Bleeding Bug (ParseGlob shared namespace), Static Asset Cache-Busting via Version Query Param, Dark Tailwind CSS Custom-Property Palette, JS Function-in-Conditional Scoping Bug, No-Third-Party-Dependencies Principle, Go Web App No-Deps Pattern (skill) (+5 more)

### Community 22 - "GoMail Action Plan v4 Overview"
Cohesion: 0.21
Nodes (12): GoMail (referenced project), Wire-Format Structs Need Explicit Serialization Tags, cmd/e2etestN Disposable Test Pattern, GoMail Action Plan v4 Overview, Phase 5: IMAP/POP3/Auth, Phase 7: CalDAV/CardDAV, Phase 8: Webmail (JWT + REST API + SPA), Phase 9: JMAP Core/Mail Subset (+4 more)

### Community 23 - "QuarantineEntry"
Cohesion: 0.22
Nodes (3): QuarantineEntry, QuarantineStatus, Time

### Community 24 - "ical.go"
Cohesion: 0.24
Nodes (9): Event, escape(), FuzzParse(), F, Time, Parse(), splitProperty(), unescape() (+1 more)

### Community 25 - ".Run"
Cohesion: 0.29
Nodes (7): extractLeadingDigits(), Context, Duration, chatCompletionRequest, chatCompletionResponse, chatMessage, LLMStage

### Community 26 - "vcard.go"
Cohesion: 0.27
Nodes (8): escape(), FuzzParse(), F, Parse(), splitProperty(), unescape(), unfold(), Card

### Community 27 - "Phase 11: Admin Portal"
Cohesion: 0.29
Nodes (10): Admin Domain Creation Missing Tenant Fallback Bug, Admin User Creation Missing domain_id Bug, Phase 11: Admin Portal, Quarantine: Admin Global Discard vs Webmail Per-User Release, Domains CRUD (loadDomains/createDomain/rotateDkim/deleteDomain), Quarantine Discard (admin), Outbound Queue Actions (retry/cancel), List Rules CRUD (+2 more)

### Community 28 - "app.js"
Cohesion: 0.10
Nodes (56): accounts, acctQuery(), addPasskey(), api(), b64urlToBuf(), bodyOf(), boot(), bufToB64url() (+48 more)

### Community 29 - "dnsutil.go"
Cohesion: 0.20
Nodes (18): TLSARecord, Response, RR, Certificate, Context, Lookup(), VerifyPeerCertificate(), buildQuery() (+10 more)

### Community 30 - "Suggested Next Session Scope"
Cohesion: 0.25
Nodes (9): bufio.Reader + io.ReadFull for TCP Protocol Boundaries, Genuine EICAR Byte-Level ClamAV Verification, Phase 10: OAuth2 + Gmail/M365 Multi-Account, Phase 14: Optional External Services (ClamAV/Rspamd/LLM), Phase 15: Hardening + Deploy, Token-Bucket Per-IP Rate Limiter, Fake clamd Server TCP Over-Read Bug, Suggested Next Session Scope (+1 more)

### Community 32 - "checkSPF"
Cohesion: 0.40
Nodes (7): checkSPF(), evaluateSPF(), Context, IP, matchCIDR(), spfOutcome, SPFStage

### Community 33 - "Limiter"
Cohesion: 0.33
Nodes (5): Mutex, Limiter, Time, New(), bucket

### Community 34 - ".Run"
Cohesion: 0.36
Nodes (5): Context, Duration, rspamdResponse, RspamdStage, rspamdSymbol

### Community 35 - ".Run"
Cohesion: 0.39
Nodes (4): Context, Duration, parseClamAddr(), ClamAVStage

### Community 36 - "StageResult"
Cohesion: 0.19
Nodes (9): dmarcTag(), extractDomainFromHeader(), Context, orgDomain(), Context, injectSpamHeaders(), DMARCStage, HeaderStage (+1 more)

### Community 37 - "Core Principle: Compiles is Not Correct"
Cohesion: 0.33
Nodes (6): iterative-build-discipline Packaged Skill (.skill zip), Core Principle: Compiles is Not Correct, Disposable Real End-to-End Test Pattern, Genuinely-Enforcing Fake Protocol Server Pattern, Negative-Path Tests as Non-Optional, Verify Against Published Test Vectors (RFC 6238)

### Community 38 - "Phase 13: TLS + ACME + DANE/MTA-STS"
Cohesion: 0.47
Nodes (6): Phase 13: TLS + ACME + DANE/MTA-STS, Sandbox Network/Toolchain Constraints, Immediate First Steps Setup, DNS Setup (MX/SPF/DKIM/DMARC), GoMail (Self-Hosted Email Server), TLS / ACME Quick Setup

### Community 39 - "Server"
Cohesion: 0.18
Nodes (11): Server, connHost(), Addr, Config, Context, DB, Duration, Limiter (+3 more)

### Community 40 - ".Run"
Cohesion: 0.47
Nodes (3): dedupe(), Context, URLStage

### Community 41 - "Phase 12: Auth Hardening (TOTP/App Passwords/Reset)"
Cohesion: 0.50
Nodes (5): SQLite Single-Connection-Pool Query/Exec Deadlock Pattern, Phase 12: Auth Hardening (TOTP/App Passwords/Reset), Rationale: Phase 13 Pulled Forward, ConsumeBackupCode SQLite Deadlock Bug, SQLite Query+Exec Deadlock Bug (documented)

### Community 44 - "MailContext"
Cohesion: 0.31
Nodes (5): Message, MessageVerdict, domainOf(), IP, MailContext

### Community 47 - "Shared api() Fetch Helper Convention"
Cohesion: 1.00
Nodes (3): Shared api() Fetch Helper Convention, api() fetch helper (admin), api() fetch helper (webmail)

### Community 65 - "session"
Cohesion: 0.20
Nodes (3): session, matchesSearch(), quoteIfNeeded()

### Community 66 - "MailboxEntry"
Cohesion: 0.26
Nodes (7): MailboxEntry, addFlag(), extractHeaders(), flagsToIMAP(), indexOf(), parseSeqNum(), removeFlag()

### Community 67 - "Server"
Cohesion: 0.26
Nodes (8): Config, Context, DB, Duration, Listener, WaitGroup, NewServer(), Server

### Community 68 - "pipeline.go"
Cohesion: 0.40
Nodes (8): DefaultStages(), Config, Context, NewOrchestrator(), StagesFromConfig(), verdictFor(), Orchestrator, Stage

### Community 69 - "expandFetchItems"
Cohesion: 0.32
Nodes (6): expandFetchItems(), isList(), splitList(), tokenize(), FuzzTokenize(), F

## Ambiguous Edges - Review These
- `Template Renderer (fresh-instance-per-page)` → `GoMail Admin SPA (index.html)`  [AMBIGUOUS]
  .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to
- `base.html Flask-style Block Layout` → `GoMail Webmail SPA (index.html)`  [AMBIGUOUS]
  .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to
- `Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP` → `GoMail Admin SPA (index.html)`  [AMBIGUOUS]
  .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to
- `Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP` → `GoMail Webmail SPA (index.html)`  [AMBIGUOUS]
  .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to

## Knowledge Gaps
- **29 isolated node(s):** `gomail`, `gmailLabel`, `graphFolder`, `IMAPCredential`, `keyCacheKey` (+24 more)
  These have ≤1 connection - possible missing edges or undocumented components.
- **18 thin communities (<3 nodes) omitted from report** — run `graphify query` to explore isolated nodes.

## Suggested Questions
_Questions this graph is uniquely positioned to answer:_

- **What is the exact relationship between `Template Renderer (fresh-instance-per-page)` and `GoMail Admin SPA (index.html)`?**
  _Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low._
- **What is the exact relationship between `base.html Flask-style Block Layout` and `GoMail Webmail SPA (index.html)`?**
  _Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low._
- **What is the exact relationship between `Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP` and `GoMail Admin SPA (index.html)`?**
  _Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low._
- **What is the exact relationship between `Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP` and `GoMail Webmail SPA (index.html)`?**
  _Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low._
- **Why does `User` connect `User` to `session`, `GoMailProvider`, `DB`, `session`, `session`, `Handler`, `session`, `writeErr`, `models.go`, `Store`?**
  _High betweenness centrality (0.297) - this node is a cross-community bridge._
- **Why does `Store` connect `Store` to `User`, `GoMailProvider`, `Server`, `session`, `Handler`, `Worker`, `Server`?**
  _High betweenness centrality (0.150) - this node is a cross-community bridge._
- **Why does `DB` connect `DB` to `Contact`, `MailboxEntry`, `.GetTLSCert`, `SieveScript`, `MailContext`, `CalendarObject`, `OutboundQueueEntry`, `models.go`, `Store`, `uuidNew`, `QuarantineEntry`, `Domain`, `ListRule`?**
  _High betweenness centrality (0.095) - this node is a cross-community bridge._