How we validate
Public-project checks, not a tutorial. Each area was indexed from a shallow clone (default
branch, October 2026) with python -m cg_code_graph.cli index <repo> on one 8-core Linux box. Wall
time includes a cold extractor cache, not a one-off dart compile exe.
A spot check is 20 routes (or every route when there are fewer) sampled from the graph and compared by hand with the cited source line: method, full path (every prefix), parameters, and handler symbol. A pass means those rows match. Gaps sit next to the table that produced them.
Full scoreboards, timings and the "other corpora unchanged" notes are in Validation log. This page is the method plus one headline per area.
Headlines
| area | headline | log |
|---|---|---|
| Django / Python | 7 apps; sampled routes 20/20 (saleor is GraphQL: 9 routes, resolvers are endpoints) | Django |
| Flutter / Dart | 5 apps; flutter/samples 12/12 HTTP and 13/13 go_router routes; lichess 18/20 | Flutter |
| Laravel channels | UNIT3D, koel, invoiceninja, pixelfed, coolify: publishers matched each ShouldBroadcast event | Channels |
| Laravel tests | TEST_HTTP spot check 40/40 (10 per app) | same section |
| Nuxt | breeze-nuxt and elk, no npm install, no .nuxt | Nuxt |
| Presets / guards | cg starters and cg routes --unguarded, no .cg.yaml | Presets |
| Monorepo | one index per app (immich/server, cal.com/apps/web, …) | Monorepo |
| Generated files | Capacitor copies and OpenAPI / protoc output excluded; cg coverage lists them | Generated |
| Platforms | ripgrep, alacritty, libuv, curl, dart-lang/http, localsend, social-app | Platforms |
| Kotlin / Swift | heuristic calls, then scip-java and the Swift index store | Kotlin, Swift |
| Spring | spring-petclinic: 17/17 heuristic routes (PetController class prefix included). Exact-mode figures are from the original run (scip-java 0.13.1, JDK 21, --build-tool=maven, which runs mvn clean verify -DskipTests and cleans build caches), not re-measured in this tree: 50/50 Java files in the index, 364 definitions matched and 4 unmatched. A sample of 20 heuristic CALLS edges, sorted by source then target, agrees with the exact edges on 19; the full heuristic call set the exact layer compares agrees on 324 of 328 (precision 0.988, recall 0.973) | Java |
| Bridges | Capacitor, React Native, Flutter, Cordova, Pigeon, Electron, Tauri | Bridges |
| Protocols | Socket.IO, WS/SSE, webhooks, IPC, sockets, gRPC, GraphQL, jobs, brokers | Protocols |
| TS frameworks | immich, Nest samples, Ghost, dub, Next examples, realworld cg link | TS frameworks |
| External | Prisma / ORM datasources, third-party HTTP hosts, cloud SDKs | External |
| Attack surface (#47) | 12 corpora; recall 2 of 11 documented items on juice-shop, NodeGoat, DVWA; sampled precision per finding type; unguarded cut by 82% to 97.5% on netbox, outline and the cal.com web app in part 2d, with juice-shop's 4 true positives kept; 1 wrong redaction and 1 unredacted doc comment found and fixed | Attack surface |
| External systems: mail, SMS, push, infra (#42 part 3) | 6 corpora, no new external nodes or edges from 3a / 3b (no matched SDK in use); index time +26% (outline) and +31% (cal.com apps/web) over three runs, from the 2a / 2b passes | Mail / SMS / push / infra |
| AI tools | MCP / LLM tool endpoints on public harnesses | AI tools |
| Parity | Bitwarden and Element X, name match and --structure | how far to trust missing |
How to read a gap
- A handler marked external (Django
LoginView, allauth) was compared and left unresolved on purpose. {?}in a path is a setting or f-string cg did not evaluate (netboxBASE_PATH).- A route count that matches the decorator count is a census, not a spot check. The spot check is the hand sample.
- Exact mode (Kotlin scip-java, Swift index store) is a second index of the same ids. Heuristic edges that the compiler does not confirm stay in the log's precision / recall note.
More log sections
These are the same runs, split by change. Open the log for the table.
| topic | log |
|---|---|
| Overrides, inherited specs, class hierarchy | Overrides |
| Receiver types, interfaces, container bindings | Receivers |
| Swift selectors and tests | Selectors, Swift Testing |
| Sockets, gRPC, Thrift, tRPC, JSON-RPC | Sockets, gRPC |
| GraphQL, job queues, brokers | GraphQL, Jobs, Brokers |
| Webhooks and local IPC | Receivers, Senders, IPC |
| Plain JavaScript, C macros | JS, C/C++ |
| Datasources and HTTP hosts | Prisma, HTTP hosts, Cloud SDKs |
Re-run
cg index <repo> --db out/check.db
cg coverage --db out/check.db
cg routes --unguarded --db out/check.db
cg protocols --unmatched --db out/check.db
Language pages link the log section for their numbers. A census (decorator count equals route count) is not a spot check; the spot check is the hand sample.
TypeScript / JavaScript frameworks
What NestJS, Next.js, Astro, Express-style routers and React Router / Remix add on top of the TypeScript plugin. They share one program with the Nuxt layer, so aliases and types go through the checker. Plain JavaScript (CommonJS or ESM, with or without jsconfig.json) is indexed with allowJs. Samples: examples/bookstore-nest, bookstore-next, bookstore-express. Without a root tsconfig, the program is the per-package tsconfig.json next to a package.json one or two levels down, plus a tsconfig.json in src/, app/, lib/ or web/ without one. The extractor runs under Node.js 20+ or Bun (Installing and updating cg).
Validation log
Per-corpus tables behind How we validate. Shallow clones, default branch, October 2026. "Unchanged corpora" notes stay here.