feat(java): consume codeanalyzer-java 3.2.0's text model in the Neo4j read path

.github/release.yml

@@ -0,0 +1,28 @@
+# Configures GitHub's auto-generated release notes — the "What's Changed" section
+# appended by `generate_release_notes` in .github/workflows/release.yml. Merged PRs
+# are grouped under these emoji headings by label, matching the sibling analyzer
+# repositories so a reader sees one shape across the org.
+changelog:
+  exclude:
+    authors:
+      - dependabot
+      - github-actions
+  categories:
+    # Order matters: a PR lands in the FIRST category whose label it carries, so a
+    # breaking fix must be seen as breaking before it is seen as a fix.
+    - title: 🚨 Breaking Changes
+      labels: [breaking]
+    - title: 🚀 Features
+      labels: [enhancement, kind/feature]
+    - title: 🐛 Fixes
+      labels: [bug, fix]
+    - title: ♻️ Refactoring
+      labels: [refactoring]
+    - title: ⚡️ Performance
+      labels: [performance]
+    - title: 📚 Documentation
+      labels: [documentation, doc]
+    - title: 🚦 Tests
+      labels: [test]
+    - title: 🛠 Other Changes
+      labels: ["*"]

.github/workflows/pr-label.yml

@@ -0,0 +1,51 @@
+name: Label pull requests
+
+# The release notes group merged PRs by label (.github/release.yml). Every PR in this
+# repository has historically been unlabelled, so without this every entry would land in
+# the catch-all "Other Changes" heading and a breaking change would read like a chore.
+# Titles here follow conventional commits already, so the label is derivable rather than
+# something a human has to remember.
+
+on:
+  pull_request_target:
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Apply a label from the conventional-commit prefix
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TITLE: ${{ github.event.pull_request.title }}
+          NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          # A "!" before the colon marks a breaking change in conventional commits
+          # (feat(python)!: ...). That wins over the type, because a breaking fix is
+          # first of all breaking.
+          if printf '%s' "$TITLE" | grep -qE '^[a-z]+(\([^)]*\))?!:'; then
+            label=breaking
+          else
+            type=$(printf '%s' "$TITLE" | sed -nE 's/^([a-z]+)(\([^)]*\))?:.*/\1/p')
+            case "$type" in
+              feat)              label=enhancement ;;
+              fix)               label=fix ;;
+              perf)              label=performance ;;
+              refactor)          label=refactoring ;;
+              docs)              label=documentation ;;
+              test)              label=test ;;
+              ci|build|chore)    label=other ;;
+              *)                 label="" ;;
+            esac
+          fi
+          if [ -z "$label" ]; then
+            echo "::notice::'$TITLE' has no conventional-commit type; leaving it unlabelled (it will appear under Other Changes)."
+            exit 0
+          fi
+          echo "Labelling #$NUMBER as '$label'."
+          gh pr edit "$NUMBER" --repo "$REPO" --add-label "$label"

.github/workflows/release.yml

@@ -17,6 +17,10 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
 
+      # Load-bearing for **Maven**, not for the analyzer. The analyzer jar and the JVM it runs
+      # on come from the `codeanalyzer-java` wheel (#339), but codeanalyzer-java's own auto-build
+      # shells out to `mvn`, which needs a JDK on PATH; without one the Java e2e degrades to a
+      # declared-only call graph and CI goes green on a partial answer. Do not delete this step.
       - name: Set up GraalVM CE Java 11
         uses: graalvm/setup-graalvm@v1
         with:
@@ -39,62 +43,35 @@ jobs:
       - name: Install Python package dependencies
         run: uv sync --all-groups --frozen
 
+      # codeanalyzer-python provisions a virtualenv for the project it analyses and
+      # discovers a base interpreter for it (SYSTEM_PYTHON, else PATH/pyenv/conda/asdf).
+      # A uv-managed interpreter is on none of those on a runner, so every test that
+      # runs the real analyzer errored at setup (release run 34023739548). Point it
+      # at the interpreter uv just installed -- the override the analyzer documents.
+      - name: Point codeanalyzer-python at the analysis interpreter
+        run: echo "SYSTEM_PYTHON=$(uv python find 3.11)" >> "$GITHUB_ENV"
+
       - name: Run Tests
         id: test
+        # continue-on-error is deliberate: without it a red suite fails the job
+        # immediately and the tag-deletion step below never runs. It must be paired
+        # with `outcome` (not `conclusion`) in that step — see the comment there.
         continue-on-error: true
         run: uv run make test
 
       - name: Delete tag on failure
-        if: steps.test.conclusion == 'failure'
+        # MUST be `outcome`, not `conclusion`: continue-on-error rewrites `conclusion`
+        # to `success`, so `steps.test.conclusion == 'failure'` is never true and this
+        # step never fires. `outcome` preserves the step's real result.
+        if: steps.test.outcome == 'failure'
         run: |
           echo "Tests failed. Deleting tag ${GITHUB_REF#refs/tags/}..."
           git push --delete origin ${GITHUB_REF#refs/tags/}
           exit 1
 
-      - name: Inject the latest Code Analyzer JAR
-        run: |
-          # The release has multiple .jar assets (the versioned codeanalyzer-<v>.jar and an
-          # unversioned codeanalyzer.jar) — select only the versioned one so $CODE_ANALYZER_URL
-          # is a single URL.
-          CODE_ANALYZER_URL=$(curl -s https://api.github.com/repos/codellm-devkit/codeanalyzer-java/releases/latest | jq -r '.assets[] | select(.name | test("^codeanalyzer-[0-9].*\\.jar$")) | .browser_download_url')
-          echo "Downloading: $CODE_ANALYZER_URL"
-          wget -q "$CODE_ANALYZER_URL"
-          mkdir -p ${{ github.workspace }}/cldk/analysis/java/codeanalyzer/jar/
-          mv codeanalyzer-*.jar ${{ github.workspace }}/cldk/analysis/java/codeanalyzer/jar/
-
       - name: Build Package
         run: uv build
 
-      - name: Verify the codeanalyzer JAR is bundled
-        # Guard against the hatchling/.gitignore regression (issue #284): a jarless wheel
-        # installs fine but fails at runtime with "codeanalyzer jar not found". Fail the
-        # release here rather than publish a broken artifact to PyPI.
-        #
-        # The listing is captured before grepping: piping `tar tzf` (which decompresses the
-        # whole 32MB sdist) straight into `grep -q` lets grep close the pipe on first match,
-        # SIGPIPE-killing tar and — under `pipefail` — reporting a false "missing JAR".
-        run: |
-          set -euo pipefail
-          jar_re='codeanalyzer/jar/codeanalyzer-[0-9][^/]*\.jar$'
-          fail=0
-          for f in dist/*.whl dist/*.tar.gz; do
-            case "$f" in
-              *.whl)    listing=$(unzip -l "$f") ;;
-              *.tar.gz) listing=$(tar tzf "$f") ;;
-            esac
-            if grep -qE "$jar_re" <<<"$listing"; then
-              echo "  ✓ $f"
-            else
-              echo "::error::$f is missing the codeanalyzer JAR"
-              grep -i '\.jar' <<<"$listing" || echo "  (no .jar entries at all)"
-              fail=1
-            fi
-          done
-          if [ "$fail" -ne 0 ]; then
-            echo "Refusing to publish a jarless release."; exit 1
-          fi
-          echo "codeanalyzer JAR present in wheel and sdist ✓"
-
       - name: Extract release notes from CHANGELOG.md
         id: notes
         # Source the release body from the hand-written CHANGELOG.md section for this tag —
@@ -120,13 +97,58 @@ jobs:
           } >> "$GITHUB_OUTPUT"
           echo "Release notes for $version:"; echo "$notes"
 
+      # The release body is install one-liners plus a download table; the categorized
+      # "What's Changed" (merged PRs grouped under emoji headings via .github/release.yml)
+      # is appended by generate_release_notes below. The hand-written CHANGELOG section
+      # stays the ANNOUNCEMENT's seed rather than the release body: a changelog entry
+      # explains a change to a maintainer, a release body tells a user what to install.
+      # Indented code blocks avoid backticks inside the heredoc.
+      - name: Compose release notes header (install + download)
+        run: |
+          set -euo pipefail
+          REPO="codellm-devkit/python-sdk"
+          TAG="${GITHUB_REF#refs/tags/}"          # e.g. v2.0.0-rc.2
+          VERSION="${TAG#v}"                      # 2.0.0-rc.2
+          # PyPI normalizes 2.0.0-rc.2 to 2.0.0rc2, and the built artifacts carry the
+          # normalized spelling, so the install line and the asset links must use it.
+          # Done with sed rather than packaging.version: this runs on the runner's bare
+          # python3, which is not the uv-managed environment the tests use.
+          PV=$(printf '%s' "$VERSION" \
+                | sed -E 's/-?alpha\.?([0-9]+)/a\1/; s/-?beta\.?([0-9]+)/b\1/; s/-(rc|a|b)\.?([0-9]+)/\1\2/')
+          BASE="/${REPO}/releases/download/${TAG}"
+          PRE=""
+          case "$PV" in *rc*|*a*|*b*) PRE="--pre " ;; esac
+          cat > "$RUNNER_TEMP/RELEASE_BODY.md" <<EOF
+          ## Install cldk ${TAG}
+
+          PyPI:
+
+              pip install ${PRE}cldk==${PV}
+
+          With the read-only Neo4j backend:
+
+              pip install ${PRE}'cldk[neo4j]==${PV}'
+
+          ## Download
+
+          | File | Description |
+          | --- | --- |
+          | [cldk-${PV}-py3-none-any.whl](${BASE}/cldk-${PV}-py3-none-any.whl) | Python wheel |
+          | [cldk-${PV}.tar.gz](${BASE}/cldk-${PV}.tar.gz) | Source distribution |
+          EOF
+          echo "----- composed header -----"; cat "$RUNNER_TEMP/RELEASE_BODY.md"
+
       - name: Publish Release on GitHub
         uses: softprops/action-gh-release@v2
         with:
           files: dist/*
-          body: ${{ steps.notes.outputs.notes }}
-          # Auto-open a repo-level Discussion linked to this release, seeded with
-          # the same notes. Requires Discussions enabled and this category to exist.
+          body_path: ${{ runner.temp }}/RELEASE_BODY.md
+          generate_release_notes: true   # categorized "What's Changed"; see .github/release.yml
+          # An rc tag is a candidate, not the repository's latest release.
+          prerelease: ${{ contains(github.ref_name, '-rc') }}
+          # Auto-open a repo-level Discussion linked to this release, seeded with this
+          # body. Requires Discussions enabled and this category to exist. The prose
+          # announcement is curated afterwards (see CLAUDE.md).
           discussion_category_name: Announcements
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -25,7 +25,6 @@
 .mtj.tmp/
 
 # Package Files #
-*.jar
 *.war
 *.nar
 *.ear
@@ -53,11 +52,11 @@ scratch*
 *.json
 !devcontainer.json
 
-# Blessed TS unit-test fixture: hand-built from a sample app whose source (incl. src/external.ts)
-# was never committed, so it cannot be regenerated by running codeanalyzer-typescript again. The
-# bulk-accessor tests assert exact-set constants (signature counts, ownerless sets) against this
-# exact file -- losing it breaks the suite for every fresh clone (#298).
-!tests/resources/typescript/analysis_json/slim/analysis.json
+# Blessed TS unit-test fixtures: analysis.json at each level, generated by the pinned
+# codeanalyzer-typescript from tests/resources/typescript/application (see the README there), and
+# the sample app's own manifests, which the analyzer's artifact layer reads.
+!tests/resources/typescript/analysis_json/v2/*/analysis.json
+!tests/resources/typescript/application/*.json
 
 
 # Python compiled files and env