gomail/graphify-out/2026-08-10/GRAPH_REPORT.md

Graph Report - webmail (2026-08-10)

Corpus Check

• 85 files · ~82,056 words
• Verdict: corpus is large enough that graph structure adds value.

Summary

• 1169 nodes · 2612 edges · 70 communities (52 shown, 18 thin omitted)
• Extraction: 92% EXTRACTED · 8% INFERRED · 0% AMBIGUOUS · INFERRED: 201 edges (avg confidence: 0.81)
• Token cost: 0 input · 0 output

Graph Freshness

• Built from commit: d7ca591b
• Run git rev-parse HEAD and compare to check if the graph is stale.
• Run graphify update . after code changes (no API cost).

Community Hubs (Navigation)

• User
• Client
• webauthn.go
• session
• GmailAPIProvider
• config.go
• parser
• DB
• session
• session
• Handler
• session
• writeErr
• Client
• Sign
• Worker
• session
• models.go
• Store
• uuidNew
• oauth2.go
• Go Web App No-Deps Pattern (skill)
• GoMail Action Plan v4 Overview
• QuarantineEntry
• ical.go
• .Run
• vcard.go
• Phase 11: Admin Portal
• app.js
• Server
• Suggested Next Session Scope
• Domain
• checkSPF
• Limiter
• .Run
• .Run
• .Run
• Core Principle: Compiles is Not Correct
• Phase 13: TLS + ACME + DANE/MTA-STS
• GraphAPIProvider
• .Run
• Phase 12: Auth Hardening (TOTP/App Passwords/Reset)
• gomail
• SieveScript
• MailContext
• CalendarObject
• OutboundQueueEntry
• Shared api() Fetch Helper Convention
• Checkpoint Working State as Durable Artifact
• Prioritize by Risk Reduction Over Task Order
• migration
• esc() HTML-escape helper (admin)
• login() (admin)
• showApp()/showLogin() (admin)
• graphify Project Rules
• showPage() router (admin)
• bodyOf() raw MIME body extractor
• ListRule
• .GetContact
• dnssec.go
• totp.go
• StageResult
• pipeline.go
• .GetTLSCert

God Nodes (most connected - your core abstractions)

1. DB - 81 edges
2. User - 67 edges
3. Handler - 50 edges
4. writeErr() - 36 edges
5. writeJSON() - 35 edges
6. Store - 28 edges
7. api() - 28 edges
8. MasterKey - 27 edges
9. session - 25 edges
10. session - 25 edges

Surprising Connections (you probably didn't know these)

• base.html Flask-style Block Layout --conceptually_related_to--> GoMail Webmail SPA (index.html) [AMBIGUOUS] .claude/go-web-app-no-deps-SKILL.md → internal/webmail/static/index.html
• Dark Tailwind CSS Custom-Property Palette --semantically_similar_to--> GoMail Admin SPA (index.html) [INFERRED] [semantically similar] .claude/go-web-app-no-deps-SKILL.md → internal/admin/static/index.html
• Dark Tailwind CSS Custom-Property Palette --semantically_similar_to--> GoMail Webmail SPA (index.html) [INFERRED] [semantically similar] .claude/go-web-app-no-deps-SKILL.md → internal/webmail/static/index.html
• Shared api() Fetch Helper Convention --semantically_similar_to--> api() fetch helper (admin) [INFERRED] [semantically similar] .claude/go-web-app-no-deps-SKILL.md → internal/admin/static/index.html
• Shared api() Fetch Helper Convention --semantically_similar_to--> api() fetch helper (webmail) [INFERRED] [semantically similar] .claude/go-web-app-no-deps-SKILL.md → internal/webmail/static/index.html

Import Cycles

• None detected.

Hyperedges (group relationships)

• GoMail Project Documentation Set — gomail_handover_overview, readme_gomail, gomail_action_plan_v4_overview, _claude_iterative_build_discipline_skill_gomail_project [INFERRED 0.85]
• Admin Portal CRUD Feature Set — internal_admin_static_index_domains_crud, internal_admin_static_index_users_crud, internal_admin_static_index_rules_crud, internal_admin_static_index_queue_crud, internal_admin_static_index_quarantine [EXTRACTED 1.00]
• Recurring Bug-Pattern Documentation Across GoMail Docs — _claude_iterative_build_discipline_skill_sqlite_single_conn, gomail_handover_sqlite_deadlock_bug, gomail_action_plan_v4_sqlite_deadlock_bug, _claude_iterative_build_discipline_skill_tcp_read_pattern, gomail_handover_tcp_bug, gomail_action_plan_v4_tcp_bug [INFERRED 0.85]

Communities (70 total, 18 thin omitted)

Community 0 - "User"

Cohesion: 0.10 Nodes (36): MailProvider, User, GenerateSecret(), NewChallenge(), Config, DB, Duration, HandlerFunc (+28 more)

Community 1 - "Client"

Cohesion: 0.06 Nodes (31): AccountKey, Authorization, Challenge, ChallengeResponder, Client, directory, jwk, Order (+23 more)

Community 2 - "webauthn.go"

Cohesion: 0.17 Nodes (16): cborDecode(), cborDecodeWithLength(), DecodePublicKey(), EncodePublicKey(), Time, ParseAttestationObject(), ParseAuthData(), parseCOSEKey() (+8 more)

Community 3 - "session"

Cohesion: 0.11 Nodes (15): addFlag(), expandFetchItems(), extractHeaders(), flagsToIMAP(), session, indexOf(), matchesSearch(), parseSeqNum() (+7 more)

Community 4 - "GmailAPIProvider"

Cohesion: 0.07 Nodes (36): CalendarEvent, CalendarProvider, Contact, ContactProvider, Folder, FullMessage, GmailAPIProvider, gmailDateTime (+28 more)

Community 5 - "config.go"

Cohesion: 0.07 Nodes (36): buildOAuthConfigs(), Config, Handler, ipAllowlistMiddleware(), main(), Config, DatabaseConfig, JMAPConfig (+28 more)

Community 6 - "parser"

Cohesion: 0.12 Nodes (21): evalTest(), execStatements(), Execute(), lookupHeader(), newLexer(), Parse(), FuzzParse(), F (+13 more)

Community 8 - "session"

Cohesion: 0.12 Nodes (17): Config, Context, DB, Duration, Listener, WaitGroup, NewServer(), escapeQuoted() (+9 more)

Community 9 - "session"

Cohesion: 0.13 Nodes (16): connHost(), Addr, Config, Conn, Context, DB, Duration, Limiter (+8 more)

Community 10 - "Handler"

Cohesion: 0.19 Nodes (14): Context, DB, Request, ResponseWriter, ServeMux, jmapRole(), NewHandler(), splitCompositeID() (+6 more)

Community 11 - "session"

Cohesion: 0.09 Nodes (28): connHost(), Addr, Config, Conn, Context, DB, Duration, Limiter (+20 more)

Community 12 - "writeErr"

Cohesion: 0.20 Nodes (14): filterDomainsByTenant(), Handler, DB, HandlerFunc, Request, ResponseWriter, ServeMux, NewHandler() (+6 more)

Community 13 - "Client"

Cohesion: 0.15 Nodes (12): Client, FetchedMessage, FolderInfo, SelectedInfo, Dial(), Config, Conn, Duration (+4 more)

Community 14 - "Sign"

Cohesion: 0.14 Nodes (20): KeyPair, ExtractSignatureInfo(), GenerateKeyPair(), PrivateKey, ParseDNSPublicKey(), ParsePrivateKey(), buildDKIMHeader(), canonicalizeBodyRelaxed() (+12 more)

Community 15 - "Worker"

Cohesion: 0.10 Nodes (25): TLSARecord, Certificate, Context, Lookup(), VerifyPeerCertificate(), Discover(), Context, Duration (+17 more)

Community 16 - "session"

Cohesion: 0.12 Nodes (14): Scope, state, Authenticate(), checkAppPassword(), DB, Config, Conn, Context (+6 more)

Community 17 - "models.go"

Cohesion: 0.15 Nodes (13): Addressbook, Alias, AppPassword, Calendar, Contact, LinkedAccountAuthType, MailboxEntry, MFABackupCode (+5 more)

Community 18 - "Store"

Cohesion: 0.07 Nodes (46): IMAPCredential, OAuth2Credential, keyCacheKey, MasterKey, Handler, multistatusResponse, propSet, LinkedAccount (+38 more)

Community 19 - "uuidNew"

Cohesion: 0.25 Nodes (3): MTASTSPolicy, Stats, uuidNew()

Community 20 - "oauth2.go"

Cohesion: 0.20 Nodes (10): Context, Reader, Request, Time, NewAuthedRequest(), truncate(), Config, Token (+2 more)

Community 21 - "Go Web App No-Deps Pattern (skill)"

Cohesion: 0.21 Nodes (13): go-web-app-no-deps Packaged Skill (.skill zip), base.html Flask-style Block Layout, Template Block Bleeding Bug (ParseGlob shared namespace), Static Asset Cache-Busting via Version Query Param, Dark Tailwind CSS Custom-Property Palette, JS Function-in-Conditional Scoping Bug, No-Third-Party-Dependencies Principle, Go Web App No-Deps Pattern (skill) (+5 more)

Community 22 - "GoMail Action Plan v4 Overview"

Cohesion: 0.21 Nodes (12): GoMail (referenced project), Wire-Format Structs Need Explicit Serialization Tags, cmd/e2etestN Disposable Test Pattern, GoMail Action Plan v4 Overview, Phase 5: IMAP/POP3/Auth, Phase 7: CalDAV/CardDAV, Phase 8: Webmail (JWT + REST API + SPA), Phase 9: JMAP Core/Mail Subset (+4 more)

Community 23 - "QuarantineEntry"

Cohesion: 0.22 Nodes (3): QuarantineEntry, QuarantineStatus, Time

Community 24 - "ical.go"

Cohesion: 0.24 Nodes (9): Event, escape(), FuzzParse(), F, Time, Parse(), splitProperty(), unescape() (+1 more)

Community 25 - ".Run"

Cohesion: 0.29 Nodes (7): extractLeadingDigits(), Context, Duration, chatCompletionRequest, chatCompletionResponse, chatMessage, LLMStage

Community 26 - "vcard.go"

Cohesion: 0.27 Nodes (8): escape(), FuzzParse(), F, Parse(), splitProperty(), unescape(), unfold(), Card

Community 27 - "Phase 11: Admin Portal"

Cohesion: 0.29 Nodes (10): Admin Domain Creation Missing Tenant Fallback Bug, Admin User Creation Missing domain_id Bug, Phase 11: Admin Portal, Quarantine: Admin Global Discard vs Webmail Per-User Release, Domains CRUD (loadDomains/createDomain/rotateDkim/deleteDomain), Quarantine Discard (admin), Outbound Queue Actions (retry/cancel), List Rules CRUD (+2 more)

Community 28 - "app.js"

Cohesion: 0.10 Nodes (56): accounts, acctQuery(), addPasskey(), api(), b64urlToBuf(), bodyOf(), boot(), bufToB64url() (+48 more)

Community 29 - "Server"

Cohesion: 0.18 Nodes (11): Server, connHost(), Addr, Config, Context, DB, Duration, Limiter (+3 more)

Community 30 - "Suggested Next Session Scope"

Cohesion: 0.25 Nodes (9): bufio.Reader + io.ReadFull for TCP Protocol Boundaries, Genuine EICAR Byte-Level ClamAV Verification, Phase 10: OAuth2 + Gmail/M365 Multi-Account, Phase 14: Optional External Services (ClamAV/Rspamd/LLM), Phase 15: Hardening + Deploy, Token-Bucket Per-IP Rate Limiter, Fake clamd Server TCP Over-Read Bug, Suggested Next Session Scope (+1 more)

Community 32 - "checkSPF"

Cohesion: 0.40 Nodes (7): checkSPF(), evaluateSPF(), Context, IP, matchCIDR(), spfOutcome, SPFStage

Community 33 - "Limiter"

Cohesion: 0.33 Nodes (5): Mutex, Limiter, Time, New(), bucket

Community 34 - ".Run"

Cohesion: 0.36 Nodes (5): Context, Duration, rspamdResponse, RspamdStage, rspamdSymbol

Community 35 - ".Run"

Cohesion: 0.39 Nodes (4): Context, Duration, parseClamAddr(), ClamAVStage

Community 36 - ".Run"

Cohesion: 0.22 Nodes (7): dmarcTag(), extractDomainFromHeader(), Context, orgDomain(), Context, DMARCStage, HeaderStage

Community 37 - "Core Principle: Compiles is Not Correct"

Cohesion: 0.33 Nodes (6): iterative-build-discipline Packaged Skill (.skill zip), Core Principle: Compiles is Not Correct, Disposable Real End-to-End Test Pattern, Genuinely-Enforcing Fake Protocol Server Pattern, Negative-Path Tests as Non-Optional, Verify Against Published Test Vectors (RFC 6238)

Community 38 - "Phase 13: TLS + ACME + DANE/MTA-STS"

Cohesion: 0.47 Nodes (6): Phase 13: TLS + ACME + DANE/MTA-STS, Sandbox Network/Toolchain Constraints, Immediate First Steps Setup, DNS Setup (MX/SPF/DKIM/DMARC), GoMail (Self-Hosted Email Server), TLS / ACME Quick Setup

Community 39 - "GraphAPIProvider"

Cohesion: 0.17 Nodes (14): GraphAPIProvider, graphDateTimeTZ, graphFolder, graphMessage, graphRecipient, Config, Contact, Context (+6 more)

Community 40 - ".Run"

Cohesion: 0.47 Nodes (3): dedupe(), Context, URLStage

Community 41 - "Phase 12: Auth Hardening (TOTP/App Passwords/Reset)"

Cohesion: 0.50 Nodes (5): SQLite Single-Connection-Pool Query/Exec Deadlock Pattern, Phase 12: Auth Hardening (TOTP/App Passwords/Reset), Rationale: Phase 13 Pulled Forward, ConsumeBackupCode SQLite Deadlock Bug, SQLite Query+Exec Deadlock Bug (documented)

Community 44 - "MailContext"

Cohesion: 0.31 Nodes (5): Message, MessageVerdict, domainOf(), IP, MailContext

Community 47 - "Shared api() Fetch Helper Convention"

Cohesion: 1.00 Nodes (3): Shared api() Fetch Helper Convention, api() fetch helper (admin), api() fetch helper (webmail)

Community 65 - "dnssec.go"

Cohesion: 0.38 Nodes (15): DNSKEY, DS, Context, query(), resolvers(), rrsetOf(), rrsigsOf(), Validate() (+7 more)

Community 66 - "totp.go"

Cohesion: 0.48 Nodes (6): decodeSecret(), Generate(), Time, hotp(), ProvisioningURI(), Validate()

Community 67 - "StageResult"

Cohesion: 0.40 Nodes (4): CheckResult, MessageCheck, injectSpamHeaders(), StageResult

Community 68 - "pipeline.go"

Cohesion: 0.40 Nodes (8): DefaultStages(), Config, Context, NewOrchestrator(), StagesFromConfig(), verdictFor(), Orchestrator, Stage

Ambiguous Edges - Review These

• Template Renderer (fresh-instance-per-page) → GoMail Admin SPA (index.html) [AMBIGUOUS] .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to
• base.html Flask-style Block Layout → GoMail Webmail SPA (index.html) [AMBIGUOUS] .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to
• Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP → GoMail Admin SPA (index.html) [AMBIGUOUS] .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to
• Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP → GoMail Webmail SPA (index.html) [AMBIGUOUS] .claude/go-web-app-no-deps-SKILL.md · relation: conceptually_related_to

Knowledge Gaps

• 33 isolated node(s): gomail, Contact, CalendarProvider, ContactProvider, gmailLabel (+28 more) These have ≤1 connection - possible missing edges or undocumented components.
• 18 thin communities (<3 nodes) omitted from report — run graphify query to explore isolated nodes.

Suggested Questions

Questions this graph is uniquely positioned to answer:

• What is the exact relationship between Template Renderer (fresh-instance-per-page) and GoMail Admin SPA (index.html)? Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low.
• What is the exact relationship between base.html Flask-style Block Layout and GoMail Webmail SPA (index.html)? Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low.
• What is the exact relationship between Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP and GoMail Admin SPA (index.html)? Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low.
• What is the exact relationship between Security Basics: CSRF/Path-Traversal/Atomic-Write/CSP and GoMail Webmail SPA (index.html)? Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low.
• Why does User connect User to GmailAPIProvider, DB, session, session, Handler, session, writeErr, session, models.go, Store? High betweenness centrality (0.297) - this node is a cross-community bridge.
• Why does Store connect Store to User, GmailAPIProvider, session, Handler, session, Worker, Server? High betweenness centrality (0.105) - this node is a cross-community bridge.
• Why does DB connect DB to .GetContact, StageResult, .GetTLSCert, SieveScript, MailContext, CalendarObject, OutboundQueueEntry, models.go, uuidNew, QuarantineEntry, Domain, ListRule? High betweenness centrality (0.085) - this node is a cross-community bridge.