[rahlk]

Namespace/application ownership now produces can://<namespace>/<application>/… roots, including the repeated default monolith root. Raw inputs are validated and UTF-8 encoded consistently; integer identity_version: 2 and raw owner metadata reject incompatible persisted outputs. Existing suffixes and application-relative keys are retained.

SDK configuration forwards explicit namespace/application bindings to reviewed local producers and scopes every graph query to one application/language. Canonical-ID module indexes preserve same-filename services, reject conflicts, and prevent currency findings from joining payment callables. Attachment stays read-only; foreign URIs fail before path fallback.

Release coordination complete: pins and lockfile now use published Python/TypeScript1.7.0, Java3.4.0 and Go0.3.0. Fresh Python3.11 environments verified the SDK2.1.0 wheel candidate against these packages with no editable analyzer dependencies or local binary overrides. Full unfiltered SDK suite:1960passed414skipped,85.48%coverage; all11 OnlineBoutique services were reprojected with published binaries and passed the installed SDK Neo4j verification. SDK PR#439 remains separate; this coordinated update supersedes its older Go pin.

Related: #435. Downstream integration joins remain open.

Coordinated tracking: codeanalyzer-python #236, codeanalyzer-typescript #221, codeanalyzer-java #276, codeanalyzer-go #40.

Existing producer PRs: Python #235, TS/JS #220, Java #275. Companion PRs: Go #41, SDK #440 (Draft).

Validation: Final SDK: 1949 passed, 422 skipped, 10 warnings; 85.34% coverage in 74.60s (75.22s runner, 240s cap). Canonical join regression: 596 passed, 2 skipped. Cross-repository native L2 smoke: 20 cases / 60 canonical endpoint references; explicit sibling services, defaults and raw punctuation/Unicode passed. Shared six-copy golden fixture hash matches; diff checks clean.

The initial isolated checks lacked Docker/live Neo4j; actual follow-up live validation is recorded below. Downstream canonical-index/finding-join adoption remains separately required; no private integration fix is claimed.

Final review validation: Strict marker/scope focused: 142 passed, 1 skipped. Fresh model and cache rejection agree on float markers.

The tiny Java L2 smoke used declared-edge fallback; strict compiled WALA was validated separately.

Online Boutique live validation (2026-10-31)

Cloned Online Boutique at c7cb6d5 over SSH and projected all 11 supported services into one Neo4j Community 5.26.0 database. C# cartservice was skipped. All SDK verification used Neo4j backends, with no SDK JSON/local fallback.

• All 11 SDK module-ID sets equal their live graph module-ID sets; reconstructed declaration IDs retain service ownership. The main namespace owns 67,898 nodes and 217,873 outgoing relationships.
• Currency server.js line 28 returns module scope/no callable; payment line 28 resolves its own constructor; currency line 92 resolves _loadProto. Both backend orders pass. Foreign service/namespace URIs are rejected.
• Canonical currency/payment/currency rows deduplicate to two modules; a finding joins only to currency by exact ID. Zero duplicate canonical IDs or cross-service canonical relationships. Two real payment loadProto calls retain distinct position-bearing body nodes.
• An omitted namespace produces the repeated default root. An additional currencyservice in another namespace stays isolated. Eager regeneration preserves node/edge counts in the other 12 service/control scopes. SDK reads are mutation-free.

The live run exposed three defects, now fixed and reviewed in TS/JS #220 (6d80997: relative graph module keys and class ownership during eager reconciliation) and SDK #440 (928ce57: retain Python module/class/callable IDs during graph reconstruction). All regressions were observed RED before the fixes.

Verification after fixes: TS/JS namespace/Neo4j suites 70 passed,23 skipped; typecheck/build passed. SDK focused88 passed; full available SDK1952 passed,422 skipped,85.34%coverage. Java and all four Go services passed strict full-depth live projection after build/toolchain setup (JDK21/Gradle8.14.5; Go1.26.10 with GOTOOLCHAIN=local). Existing skipped suites are not claimed as passing.

The release dependency gate is complete; current published-package verification is recorded below. Private integration ingestion/joins remain external. A fresh currency-only TS/JS graph still hits the existing required-relationship fingerprint; the completed multi-service database passes. Currency module-scope results include an existing source-hydration diagnostic, while ownership/position assertions pass. No microservice business RPC deployment, merge or release was performed.

SDK2.1.0 release preparation

Updated the four producer pins and uv.lock, added concise2.1.0 release notes, and refreshed the Java/TS native version expectations to the actual released pins. All11 service SDK views pass canonical-ID, lookup, exact-join, duplicate-ID, cross-service relationship and read-only assertions using the installed wheel candidate. Private integration adoption and the documented sparse-graph/source-hydration limits remain separate; this release does not claim those fixes.

Coordinated releases published

Python1.7.0, TypeScript1.7.0, Java3.4.0, Go0.3.0, and SDK2.1.0. All five task PRs are merged. SDK pins and uv.lock use these producer releases.

Fresh Python3.11 validation with the real published producers:1960SDKtests passed,414skipped,85.48%coverage. All11 supported OnlineBoutique services were reprojected into one Neo4j database using the published analyzer wheels; the installed SDK wheel passed service/namespace isolation, canonical-ID equality/deduplication, original source-position regression and read-only checks. SDK was then reinstalled directly from PyPI and passed the same live checks.

Downstream consumer integration adoption and the documented sparse-graph/source-hydration limitations remain separate from this completed release gate.