python-sdk 2.0 leg 1: Python onto codeanalyzer-python 1.4.0, addressing surface, drop C #319

Parent: codellm-devkit/.github#55 · Spec: docs/design/specs/2026-09-03-agent-facing-query-facade.md · Plan: docs/design/plans/2026-09-03-leg-1-python.md (both on #318)

Problem

The Python facade is pinned to codeanalyzer-python 0.3.1 while the analyzer is at 1.4.0, and its Neo4j backend queries a vocabulary the analyzer no longer emits — PyCallSite, PY_HAS_CALLSITE and PySymbol, where 1.4.0 emits call sites as PyBodyNode {kind: 'call'} reached by PY_HAS_BODY_NODE. Against a graph built by a current analyzer that returns zero rows with no error, so an empty result is indistinguishable from a broken query.

Leg 1 of the 2.0 plan: bring Python onto 1.4.0 behind an unchanged public API, add the addressing / body / artifact / entrypoint surface, make version mismatch loud, and delete C.

Scope boundary

Python only. Java is leg 2 (#310), TypeScript + JavaScript leg 3 (#307), and the selector / taint / reachability query surface is leg 4 (#311), written once across all three languages after the ABC is proven. locate() is pulled forward into this leg rather than waiting for the sweep.

Goals

• Drop C entirely — cldk/analysis/c/, cldk/models/c/, tests, the 3.3 MB fixture, CLDK.c(), and four dependencies (clang, libclang, and tree-sitter-c/tree-sitter-go, which have zero imports)
• Pin codeanalyzer-python==1.4.0 and widen the model re-export to the v2 additions
• GraphSchemaMismatch probe on attach — name the vocabulary expected, the vocabulary found, and the analyzer generation each implies
• Migrate the Neo4j Cypher to the 1.4.0 vocabulary
• Extract the generic AnalysisBackend ABC; PythonAnalysisBackend parameterises it
• locate() / locate_many() returning the enclosing callable with its source slice, keeping in-callable, module-scope and not-analysed distinct
• get_source() for any node; bodyless callables omitted from get_method_bodies
• Repository-artifact getters — artifacts, dependencies, config keys, config uses
• get_entrypoints()
• External symbol resolution, so no call-graph edge dangles

Caveats and known risks

• The public API does not move. Every existing accessor keeps its name, parameters and return type, and the existing tests/analysis/python/ suite must pass unmodified after every task. A test that needs editing is a design change, not an implementation detail.
• Signature compatibility is not graph compatibility: after this leg, a graph built by 0.3.x stops working and one built by 1.4.0 starts. That is the point of the probe, and it needs saying in the rc notes.
• Dropping C is breaking. Consumers validating a language against a closed Literal[..., "c"] drop one token; no known deployment selects it.

Definition of done

• Every pre-existing Python test passes unmodified.
• Attaching to a 0.3.x graph raises GraphSchemaMismatch naming both vocabularies; it never returns zero rows.
• locate distinguishes in-callable, module-scope and not-analysed.
• pyproject.toml pins codeanalyzer-python==1.4.0 and carries none of clang, libclang, tree-sitter-c, tree-sitter-go.
• CLAUDE.md's supported-languages table drops C; CHANGELOG.md carries the Removed and Changed entries.
• Closes Incorporate codeanalyzer-python v1.2.0 #315, Incorporate codeanalyzer-python v1.3.0 #316, Incorporate codeanalyzer-python v1.4.0 #317, Python get_method_bodies lacks the None-code omission filter (twin of the TS #298 rule) #301.
• 2.0.0-rc.1 cut with the SDK-to-analyzer-generation compatibility matrix in its notes.