gomail/graphify-out/GRAPH_REPORT.md

Graph Report - . (2026-08-09)

Corpus Check

• 78 files · ~64,934 words
• Verdict: corpus is large enough that graph structure adds value.

Summary

• 953 nodes · 2017 edges · 64 communities (48 shown, 16 thin omitted)
• Extraction: 91% EXTRACTED · 8% INFERRED · 0% AMBIGUOUS · INFERRED: 170 edges (avg confidence: 0.82)
• Token cost: 134,823 input · 0 output

Community Hubs (Navigation)

• TOTP & Web Token Auth
• ACME/JWS Client
• CalDAV/CardDAV Handlers
• IMAP Command Parser
• Mail Provider Abstraction
• Server Config & Bootstrap
• Sieve Filter Interpreter
• DB Mutation Queries
• IMAP Server Loop
• POP3 Server Loop
• JMAP Auth & Sessions
• SMTP Session Header Parsing
• Admin API Handlers
• IMAP Client
• DKIM Key Signing
• Outbound Delivery Queue
• SMTP Server Networking
• Linked Account & Alias Queries
• TCP Server Lifecycle
• Calendar/Contact/TLS Queries
• OAuth2 Config
• Go-No-Deps Web App Pattern
• GoMail Build Phases Overview
• Quarantine & Message Queries
• iCal Parsing & Fuzzing
• LLM Spam Stage
• vCard Parsing & Fuzzing
• Admin Portal Bugs & CRUD
• Spam Pipeline Orchestrator
• SPF Stage
• TCP Boundary & Rate-Limit Findings
• Domain/Tenant Queries
• Rspamd Stage
• Per-IP Rate Limiter
• ClamAV Stage
• DMARC Stage
• Spam Header Injection Stage
• Iterative Build Discipline Skill
• Deployment & DNS Setup
• HTTP Middleware
• URL Extraction Stage
• SQLite Deadlock Findings
• List Rule Queries
• Sieve Script Queries
• Mail Context Domain Helpers
• Calendar Object Queries
• Contact Queries
• Shared api() Fetch Convention
• Session Continuity Practices
• Scope Prioritization Practices
• DB Migrations
• Shared esc() Helper
• SPA Login/Logout
• SPA App Boot/Routing
• Graphify Project Rules
• Admin SPA Router
• Raw MIME Body Extractor
• Go Module Root

God Nodes (most connected - your core abstractions)

1. DB - 77 edges
2. User - 56 edges
3. Handler - 35 edges
4. Store - 27 edges
5. session - 25 edges
6. session - 25 edges
7. writeJSON() - 24 edges
8. writeErr() - 24 edges
9. MasterKey - 23 edges
10. session - 20 edges

Surprising Connections (you probably didn't know these)

• base.html Flask-style Block Layout --conceptually_related_to--> GoMail Webmail SPA (index.html) [AMBIGUOUS] .claude/go-web-app-no-deps-SKILL.md → internal/webmail/static/index.html
• Dark Tailwind CSS Custom-Property Palette --semantically_similar_to--> GoMail Admin SPA (index.html) [INFERRED] [semantically similar] .claude/go-web-app-no-deps-SKILL.md → internal/admin/static/index.html
• Dark Tailwind CSS Custom-Property Palette --semantically_similar_to--> GoMail Webmail SPA (index.html) [INFERRED] [semantically similar] .claude/go-web-app-no-deps-SKILL.md → internal/webmail/static/index.html
• Shared api() Fetch Helper Convention --semantically_similar_to--> api() fetch helper (admin) [INFERRED] [semantically similar] .claude/go-web-app-no-deps-SKILL.md → internal/admin/static/index.html
• Shared api() Fetch Helper Convention --semantically_similar_to--> api() fetch helper (webmail) [INFERRED] [semantically similar] .claude/go-web-app-no-deps-SKILL.md → internal/webmail/static/index.html

Import Cycles

• None detected.

Hyperedges (group relationships)

• GoMail Project Documentation Set — gomail_handover_overview, readme_gomail, gomail_action_plan_v4_overview, _claude_iterative_build_discipline_skill_gomail_project [INFERRED 0.85]
• Admin Portal CRUD Feature Set — internal_admin_static_index_domains_crud, internal_admin_static_index_users_crud, internal_admin_static_index_rules_crud, internal_admin_static_index_queue_crud, internal_admin_static_index_quarantine [EXTRACTED 1.00]
• Recurring Bug-Pattern Documentation Across GoMail Docs — _claude_iterative_build_discipline_skill_sqlite_single_conn, gomail_handover_sqlite_deadlock_bug, gomail_action_plan_v4_sqlite_deadlock_bug, _claude_iterative_build_discipline_skill_tcp_read_pattern, gomail_handover_tcp_bug, gomail_action_plan_v4_tcp_bug [INFERRED 0.85]

Communities (64 total, 16 thin omitted)

Community 0 - "TOTP & Web Token Auth"

Cohesion: 0.10 Nodes (34): User, decodeSecret(), Generate(), GenerateSecret(), Time, hotp(), ProvisioningURI(), Validate() (+26 more)

Community 1 - "ACME/JWS Client"

Cohesion: 0.06 Nodes (31): AccountKey, Authorization, Challenge, ChallengeResponder, Client, directory, jwk, Order (+23 more)

Community 2 - "CalDAV/CardDAV Handlers"

Cohesion: 0.08 Nodes (34): MailProvider, MasterKey, Handler, multistatusResponse, propSet, LinkedAccountProvider, Config, DB (+26 more)

Community 3 - "IMAP Command Parser"

Cohesion: 0.06 Nodes (24): MailboxEntry, state, addFlag(), expandFetchItems(), extractHeaders(), flagsToIMAP(), session, indexOf() (+16 more)

Community 4 - "Mail Provider Abstraction"

Cohesion: 0.09 Nodes (25): Folder, FullMessage, GoMailProvider, IMAPCredential, IMAPProvider, ListOpts, MessageHeader, OAuth2Credential (+17 more)

Community 5 - "Server Config & Bootstrap"

Cohesion: 0.09 Nodes (30): buildOAuthConfigs(), Config, main(), Config, DatabaseConfig, JMAPConfig, LinkedAccountsConfig, NotifyConfig (+22 more)

Community 6 - "Sieve Filter Interpreter"

Cohesion: 0.12 Nodes (20): evalTest(), execStatements(), Execute(), lookupHeader(), newLexer(), Parse(), FuzzParse(), F (+12 more)

Community 8 - "IMAP Server Loop"

Cohesion: 0.12 Nodes (17): Config, Context, DB, Duration, Listener, WaitGroup, NewServer(), escapeQuoted() (+9 more)

Community 9 - "POP3 Server Loop"

Cohesion: 0.15 Nodes (13): Config, Conn, Context, DB, Duration, Listener, ReadWriter, WaitGroup (+5 more)

Community 10 - "JMAP Auth & Sessions"

Cohesion: 0.12 Nodes (20): Scope, Authenticate(), checkAppPassword(), DB, Context, DB, Request, ResponseWriter (+12 more)

Community 11 - "SMTP Session Header Parsing"

Cohesion: 0.16 Nodes (15): extractHeader(), extractHeaderMap(), extractMessageID(), extractSubject(), Conn, Context, IP, ReadWriter (+7 more)

Community 12 - "Admin API Handlers"

Cohesion: 0.20 Nodes (14): filterDomainsByTenant(), Handler, DB, HandlerFunc, Request, ResponseWriter, ServeMux, NewHandler() (+6 more)

Community 13 - "IMAP Client"

Cohesion: 0.15 Nodes (12): Client, FetchedMessage, FolderInfo, SelectedInfo, Dial(), Config, Conn, Duration (+4 more)

Community 14 - "DKIM Key Signing"

Cohesion: 0.14 Nodes (20): KeyPair, ExtractSignatureInfo(), GenerateKeyPair(), PrivateKey, ParseDNSPublicKey(), ParsePrivateKey(), buildDKIMHeader(), canonicalizeBodyRelaxed() (+12 more)

Community 15 - "Outbound Delivery Queue"

Cohesion: 0.18 Nodes (11): backoffDuration(), domainOf(), DB, Duration, isPermanentError(), lookupMXHosts(), NewWorker(), Deliverer (+3 more)

Community 16 - "SMTP Server Networking"

Cohesion: 0.19 Nodes (14): connHost(), Addr, Config, Conn, Context, DB, Duration, Limiter (+6 more)

Community 17 - "Linked Account & Alias Queries"

Cohesion: 0.14 Nodes (11): Alias, AppPassword, CheckResult, LinkedAccount, LinkedAccountAuthType, MessageCheck, MFABackupCode, ReleaseToken (+3 more)

Community 18 - "TCP Server Lifecycle"

Cohesion: 0.20 Nodes (11): Server, connHost(), Addr, Config, Context, DB, Duration, Limiter (+3 more)

Community 19 - "Calendar/Contact/TLS Queries"

Cohesion: 0.19 Nodes (6): Addressbook, Calendar, OwnerType, Stats, TLSCert, uuidNew()

Community 20 - "OAuth2 Config"

Cohesion: 0.23 Nodes (9): Context, Time, truncate(), WellKnownEndpoints(), XOAUTH2SASLString(), Config, Token, tokenResponse (+1 more)

Community 21 - "Go-No-Deps Web App Pattern"

Cohesion: 0.21 Nodes (13): go-web-app-no-deps Packaged Skill (.skill zip), base.html Flask-style Block Layout, Template Block Bleeding Bug (ParseGlob shared namespace), Static Asset Cache-Busting via Version Query Param, Dark Tailwind CSS Custom-Property Palette, JS Function-in-Conditional Scoping Bug, No-Third-Party-Dependencies Principle, Go Web App No-Deps Pattern (skill) (+5 more)

Community 22 - "GoMail Build Phases Overview"

Cohesion: 0.21 Nodes (12): GoMail (referenced project), Wire-Format Structs Need Explicit Serialization Tags, cmd/e2etestN Disposable Test Pattern, GoMail Action Plan v4 Overview, Phase 5: IMAP/POP3/Auth, Phase 7: CalDAV/CardDAV, Phase 8: Webmail (JWT + REST API + SPA), Phase 9: JMAP Core/Mail Subset (+4 more)

Community 23 - "Quarantine & Message Queries"

Cohesion: 0.15 Nodes (5): Message, MessageVerdict, QuarantineEntry, QuarantineStatus, Time

Community 24 - "iCal Parsing & Fuzzing"

Cohesion: 0.24 Nodes (9): Event, escape(), FuzzParse(), F, Time, Parse(), splitProperty(), unescape() (+1 more)

Community 25 - "LLM Spam Stage"

Cohesion: 0.29 Nodes (7): extractLeadingDigits(), Context, Duration, chatCompletionRequest, chatCompletionResponse, chatMessage, LLMStage

Community 26 - "vCard Parsing & Fuzzing"

Cohesion: 0.27 Nodes (8): escape(), FuzzParse(), F, Parse(), splitProperty(), unescape(), unfold(), Card

Community 27 - "Admin Portal Bugs & CRUD"

Cohesion: 0.29 Nodes (10): Admin Domain Creation Missing Tenant Fallback Bug, Admin User Creation Missing domain_id Bug, Phase 11: Admin Portal, Quarantine: Admin Global Discard vs Webmail Per-User Release, Domains CRUD (loadDomains/createDomain/rotateDkim/deleteDomain), Quarantine Discard (admin), Outbound Queue Actions (retry/cancel), List Rules CRUD (+2 more)

Community 28 - "Spam Pipeline Orchestrator"

Cohesion: 0.40 Nodes (8): DefaultStages(), Config, Context, NewOrchestrator(), StagesFromConfig(), verdictFor(), Orchestrator, Stage

Community 29 - "SPF Stage"

Cohesion: 0.40 Nodes (7): checkSPF(), evaluateSPF(), Context, IP, matchCIDR(), spfOutcome, SPFStage

Community 30 - "TCP Boundary & Rate-Limit Findings"

Cohesion: 0.25 Nodes (9): bufio.Reader + io.ReadFull for TCP Protocol Boundaries, Genuine EICAR Byte-Level ClamAV Verification, Phase 10: OAuth2 + Gmail/M365 Multi-Account, Phase 14: Optional External Services (ClamAV/Rspamd/LLM), Phase 15: Hardening + Deploy, Token-Bucket Per-IP Rate Limiter, Fake clamd Server TCP Over-Read Bug, Suggested Next Session Scope (+1 more)

Community 32 - "Rspamd Stage"

Cohesion: 0.36 Nodes (5): Context, Duration, rspamdResponse, RspamdStage, rspamdSymbol

Community 33 - "Per-IP Rate Limiter"

Cohesion: 0.33 Nodes (5): Mutex, Limiter, Time, New(), bucket

Community 34 - "ClamAV Stage"

Cohesion: 0.39 Nodes (4): Context, Duration, parseClamAddr(), ClamAVStage

Community 35 - "DMARC Stage"

Cohesion: 0.39 Nodes (5): dmarcTag(), extractDomainFromHeader(), Context, orgDomain(), DMARCStage

Community 36 - "Spam Header Injection Stage"

Cohesion: 0.33 Nodes (4): Context, injectSpamHeaders(), HeaderStage, StageResult

Community 37 - "Iterative Build Discipline Skill"

Cohesion: 0.33 Nodes (6): iterative-build-discipline Packaged Skill (.skill zip), Core Principle: Compiles is Not Correct, Disposable Real End-to-End Test Pattern, Genuinely-Enforcing Fake Protocol Server Pattern, Negative-Path Tests as Non-Optional, Verify Against Published Test Vectors (RFC 6238)

Community 38 - "Deployment & DNS Setup"

Cohesion: 0.47 Nodes (6): Phase 13: TLS + ACME + DANE/MTA-STS, Sandbox Network/Toolchain Constraints, Immediate First Steps Setup, DNS Setup (MX/SPF/DKIM/DMARC), GoMail (Self-Hosted Email Server), TLS / ACME Quick Setup

Community 39 - "HTTP Middleware"

Cohesion: 0.33 Nodes (4): Handler, clientIP(), Limiter, Request

Community 40 - "URL Extraction Stage"

Cohesion: 0.47 Nodes (3): dedupe(), Context, URLStage

Community 41 - "SQLite Deadlock Findings"

Cohesion: 0.50 Nodes (5): SQLite Single-Connection-Pool Query/Exec Deadlock Pattern, Phase 12: Auth Hardening (TOTP/App Passwords/Reset), Rationale: Phase 13 Pulled Forward, ConsumeBackupCode SQLite Deadlock Bug, SQLite Query+Exec Deadlock Bug (documented)

Community 44 - "Mail Context Domain Helpers"

Cohesion: 0.50 Nodes (3): domainOf(), IP, MailContext

Community 47 - "Shared api() Fetch Convention"

Cohesion: 1.00 Nodes (3): Shared api() Fetch Helper Convention, api() fetch helper (admin), api() fetch helper (webmail)

Ambiguous Edges - Review These

• Template Renderer (fresh-instance-per-page) → GoMail Admin SPA (index.html) [AMBIGUOUS] .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to
• base.html Flask-style Block Layout → GoMail Webmail SPA (index.html) [AMBIGUOUS] .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to
• Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP → GoMail Admin SPA (index.html) [AMBIGUOUS] .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to
• Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP → GoMail Webmail SPA (index.html) [AMBIGUOUS] .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to

Knowledge Gaps

• 23 isolated node(s): webmail, IMAPCredential, DB, migration, response (+18 more) These have ≤1 connection - possible missing edges or undocumented components.
• 16 thin communities (<3 nodes) omitted from report — run graphify query to explore isolated nodes.

Suggested Questions

Questions this graph is uniquely positioned to answer:

• What is the exact relationship between Template Renderer (fresh-instance-per-page) and GoMail Admin SPA (index.html)? Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low.
• What is the exact relationship between base.html Flask-style Block Layout and GoMail Webmail SPA (index.html)? Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low.
• What is the exact relationship between Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP and GoMail Admin SPA (index.html)? Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low.
• What is the exact relationship between Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP and GoMail Webmail SPA (index.html)? Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low.
• Why does User connect TOTP & Web Token Auth to CalDAV/CardDAV Handlers, IMAP Command Parser, Mail Provider Abstraction, DB Mutation Queries, IMAP Server Loop, POP3 Server Loop, JMAP Auth & Sessions, SMTP Session Header Parsing, Admin API Handlers, Linked Account & Alias Queries? High betweenness centrality (0.323) - this node is a cross-community bridge.
• Why does Store connect CalDAV/CardDAV Handlers to TOTP & Web Token Auth, Mail Provider Abstraction, POP3 Server Loop, JMAP Auth & Sessions, Outbound Delivery Queue, SMTP Server Networking, TCP Server Lifecycle? High betweenness centrality (0.109) - this node is a cross-community bridge.
• Why does DB connect DB Mutation Queries to IMAP Command Parser, List Rule Queries, Sieve Script Queries, Calendar Object Queries, Contact Queries, Linked Account & Alias Queries, Calendar/Contact/TLS Queries, Quarantine & Message Queries, Domain/Tenant Queries? High betweenness centrality (0.098) - this node is a cross-community bridge.