cldk-forge compliance — contract-correctness cluster #26

Is your feature request related to a problem? Please describe.

Not stated in the original issue.

Describe the solution you'd like

Not stated in the original issue.

Describe alternatives you've considered

Not stated in the original issue.

Additional context

cldk-forge compliance: contract-correctness cluster

Tracking epic: bring codeanalyzer-typescript's emitted contract (both the analysis.json and Neo4j projections) into compliance with the cldk-forge skillset (codeanalyzer-backend), and make the additive L1 ⊆ L2 ⊆ L3 ⊆ L4 invariant CI-enforced.

Audit verdict: MOSTLY COMPLIANT. The v2 migration substance is faithful — schema keystone, symbol table, call graph, dataflow L3/L4, Neo4j projection, and packaging all land close to spec. This epic closes the contract-correctness gaps: the ones that change what the SDK and Neo4j actually consume.

Child issues

• test: real L1⊆L2⊆L3⊆L4 monotonicity gate + neo4j↔json count parity #27 — monotonicity gate (L1⊆L2⊆L3⊆L4 + neo4j↔json parity) — PR Real L1⊆L2⊆L3⊆L4 monotonicity gate + neo4j↔json count parity #35
• fix: byte-sliceable L3 statement nodes #28 — L3 byte-spans — PR Byte-sliceable L3 statement nodes #36
• feat: analyzer{name,version} schema envelope #29 — analyzer{name,version} manifest — PR analyzer{name,version} schema envelope #37
• feat: -f/--format flag with strict msgpack rejection #30 — -f/--format flag — dropped (msgpack has no consumers; json is the sole/default output, so the flag is vestigial)
• fix: level-gate the call-graph solve at -a 1 #31 — level-gate the call-graph solve at -a 1 — PR Level-gate the call-graph solve at -a 1 #39
• chore: formalize reaching-defs ddg prov token (+ python-sdk lockstep) #32 — formalize reaching-defs prov token — PR Formalize the reaching-defs DDG prov token #40
• feat: neo4j EXTENDS/IMPLEMENTS inheritance edges #33 — neo4j EXTENDS/IMPLEMENTS inheritance edges — PR Neo4j EXTENDS/IMPLEMENTS inheritance edges #41

Delivered as a stacked PR chain merging bottom-up into feat/issue-2-program-graphs (the v2 base is not yet on main). Each PR shows exactly one issue's diff. Order: the monotonicity gate lands first (it is the regression net for the rest); the Neo4j inheritance edges land last (most involved).

Status: all six shipping issues implemented (TDD, per-task review + a final whole-branch review → READY TO MERGE); suite 95 pass / 0 fail, typecheck clean, schema.neo4j.json in lockstep; validated end-to-end on OWASP Juice Shop (5.7 MB analysis.json, correct analyzer manifest).

Out of scope (separate epics)

• Theme A — modularity (the skillset's named anti-example): a pluggable analysis/ pass + registry layer and a frameworks/ finder layer, plus splitting the ~998-line flat src/syntactic_analysis/builders.ts. Real, but touches no emitted output.
• Theme G — breaking-release hygiene: CHANGELOG.md + curated breaking-change notes for the v1→v2 break; a caching test gate (second-run-reuse / eager-rebuild); release-workflow wheel smoke-test, per-artifact checksums, and a musllinux/Alpine decision.

Follow-ups surfaced during implementation (filed)

• fix: neo4j :Application node has no version (JSON/neo4j analyzer-identity divergence) #43 — Neo4j :Application node has no version (JSON↔Neo4j analyzer-identity divergence).
• chore: replace raw NUL separators with \0 escape in rows.ts / dataflow.ts #44 — replace raw NUL separators with \0 escape in rows.ts / dataflow.ts (restore text-diffability; byte-identical).
• test: cover interface-extends-interface EXTENDS + entry/exit/param byte-slice fidelity #45 — cover interface-extends-interface EXTENDS + entry/exit/param byte-slice fidelity.
• fix: update stale :Symbol expectations in neo4j-bolt.test.ts to v2 labels #46 — update stale :Symbol expectations in the Docker-gated test/neo4j-bolt.test.ts.
• Track .claude/SCHEMA_DECISIONS.md (un-ignore the schema-decisions doc) #47 — track .claude/SCHEMA_DECISIONS.md (un-ignore the schema-decisions doc).
• Cross-repo: feat: accept reaching-defs ddg prov token from codeanalyzer-typescript python-sdk#232 — accept the reaching-defs prov literal in the SDK model.