feat: port codeiq from Java/Spring Boot to Go single-binary (Phases 1-4)

.github/workflows/ci-java.yml

@@ -1,15 +1,35 @@
 name: Java CI
+
+# Lean Java CI — fast compile + unit-test gate on the Java reference side.
+# Pairs with go-parity.yml: this workflow proves the Java jar still builds
+# on every PR; go-parity.yml then uses the same build to diff against the
+# Go port.
+#
+# Heavier checks (jacoco coverage, SpotBugs, OWASP dependency-check) live
+# under workflow_dispatch via release-java.yml — they're not in the per-PR
+# loop because they slow the Go port's PRs without adding signal.
+#
+# Disappears in Phase 6 cutover along with the rest of the Java tree.
+
 on:
   push:
     branches: [main]
-    paths: ['src/**', 'pom.xml']
+    paths:
+      - 'src/**'
+      - 'pom.xml'
+      - '.github/workflows/ci-java.yml'
   pull_request:
     branches: [main]
+    paths:
+      - 'src/**'
+      - 'pom.xml'
+      - '.github/workflows/ci-java.yml'
 
 permissions: read-all
 
 jobs:
   build:
+    name: build
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -22,14 +42,14 @@ jobs:
           distribution: 'temurin'
           java-version: '25'
           cache: 'maven'
-      - name: Build + verify (jacoco 85% + SpotBugs)
-        run: mvn -B -ntp clean verify
+      - name: Compile + unit tests (skip frontend)
+        # -Dfrontend.skip=true so the npm step doesn't run — CI image
+        # doesn't carry node 20 by default and the frontend is owned by
+        # a separate workflow. -B (batch) + -ntp (no transfer progress)
+        # for quiet logs.
+        run: mvn -B -ntp -Dfrontend.skip=true verify
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.2
         if: always()
         with:
-          name: test-results
+          name: java-test-results
           path: target/surefire-reports/
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.2
-        with:
-          name: coverage-report
-          path: target/site/jacoco/

.github/workflows/go-ci.yml

@@ -0,0 +1,66 @@
+name: go-ci
+
+on:
+  push:
+    branches: [main]
+    paths: ['go/**', '.github/workflows/go-ci.yml']
+  pull_request:
+    branches: [main]
+    paths: ['go/**', '.github/workflows/go-ci.yml']
+
+permissions:
+  contents: read
+
+jobs:
+  go:
+    name: vet / test / staticcheck / gosec / govulncheck
+    runs-on: ubuntu-latest
+    env:
+      CGO_ENABLED: "1"
+    defaults:
+      run:
+        working-directory: go
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          # Pin to 1.25.x — 1.26+ isn't on enough developer machines yet.
+          # 1.25.10 includes the fix for GO-2026-4918 (HTTP/2 SETTINGS
+          # infinite loop) which is reachable via review.Client.Review.
+          go-version: '1.25.10'
+          cache: true
+          cache-dependency-path: go/go.sum
+      - name: Install C toolchain
+        run: sudo apt-get update -y && sudo apt-get install -y build-essential
+      - name: go vet
+        run: go vet ./...
+      - name: go test (race)
+        run: go test ./... -race -count=1
+      - name: staticcheck
+        run: |
+          # staticcheck must understand the Go toolchain version that built
+          # the binaries above. 2024.1.1 errors with "internal error in
+          # importing internal/byteorder (unsupported version: 2)" against
+          # Go 1.25's stdlib. 2025.1.1 is the first release that handles it.
+          go install honnef.co/go/tools/cmd/staticcheck@2025.1.1
+          "$(go env GOPATH)/bin/staticcheck" ./...
+      - name: gosec
+        run: |
+          # v2.21.4 won't compile under Go 1.25 — its pinned
+          # golang.org/x/tools v0.25.0 hits an int64 constant-overflow
+          # bug in tokeninternal.go. v2.22.0 ships an x/tools bump that
+          # builds clean on 1.25.x.
+          go install github.com/securego/gosec/v2/cmd/gosec@v2.22.0
+          # Suppressed rule rationale (all reviewed manually):
+          # G104 — idiomatic deferred Close()/Rollback() error drops
+          # G115 — uint64→int64 on counter rows from Kuzu, bounded
+          # G202 — analysis-cache LIMIT/OFFSET; ints, not user input
+          # G204 — git ls-files / mvn shellouts, no user input
+          # G301/G306 — codeiq cache files are dev-local, 0o755/0o644 ok
+          # G304 — fixture and cache files under controlled dirs
+          # G401/G404/G501 — non-crypto hashing (MD5 for ID dedup, etc.)
+          "$(go env GOPATH)/bin/gosec" -quiet -exclude=G104,G115,G202,G204,G301,G304,G306,G401,G404,G501 ./...
+      - name: govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          "$(go env GOPATH)/bin/govulncheck" ./...

.github/workflows/go-parity.yml

@@ -0,0 +1,101 @@
+name: go-parity
+
+# Java vs Go parity test for fixture-minimal. Validates that the Go port
+# produces the same canonical graph shape as the Java reference until
+# Phase 6 cutover deletes the Java tree. Runs on PRs that touch the Go
+# tree, the Java tree, the parity harness, or this workflow.
+#
+# The Java side ships a JSON graph via `codeiq graph -f json` from the
+# `serving` profile (Neo4j-backed). A small jq filter
+# (go/parity/java-normalize.jq) rewrites that into the same per-file
+# canonical shape that the Go-side parity.Normalize emits. The two
+# normalized JSON blobs are then diff'd by the `parity` build tag in
+# go/parity/parity_test.go, with expected-divergence.json holding the
+# allow-list of intentional drift.
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'go/**'
+      - 'src/**'
+      - 'pom.xml'
+      - '.github/workflows/go-parity.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  parity:
+    name: Java vs Go parity (fixture-minimal)
+    runs-on: ubuntu-latest
+    env:
+      CGO_ENABLED: "1"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+      - uses: actions/setup-go@v5
+        with:
+          # Pin to 1.25.x — 1.26+ isn't on enough developer machines yet.
+          go-version: '1.25.10'
+          cache: true
+          cache-dependency-path: go/go.sum
+      - name: Install C toolchain
+        run: sudo apt-get update -y && sudo apt-get install -y build-essential jq
+
+      # ---- Java side ----------------------------------------------------
+      - name: Build Java jar (skip frontend)
+        run: mvn -B -q -DskipTests -Dfrontend.skip=true package
+      - name: Stage Java fixture (separate copy so caches don't collide)
+        run: cp -r go/testdata/fixture-minimal /tmp/fm-java
+      - name: Java index → H2 cache
+        run: java -jar target/code-iq-*-cli.jar index /tmp/fm-java
+      - name: Java enrich → Neo4j (serving profile)
+        # `graph -f json` reads from Neo4j under the serving profile, not
+        # H2. Need to enrich first or the export prints "No graph data
+        # found. Run 'codeiq analyze' first."
+        run: |
+          java -Dspring.profiles.active=serving \
+            -jar target/code-iq-*-cli.jar enrich /tmp/fm-java
+      - name: Java graph → normalized JSON
+        # Run from inside the fixture so Neo4j path resolution finds the
+        # store enrich wrote. java-normalize.jq pivots the Java
+        # {nodes:[...]} shape into the per-file array shape
+        # parity.Normalize uses on the Go side.
+        #
+        # The Java CLI prints Logback JSON log lines to stdout BEFORE the
+        # graph JSON, so we capture everything then awk to the first line
+        # that is exactly "{" — that's the pretty-printed graph object.
+        run: |
+          cd /tmp/fm-java
+          java -Dspring.profiles.active=serving \
+            -jar "$GITHUB_WORKSPACE"/target/code-iq-*-cli.jar graph . -f json \
+            > /tmp/java-raw-with-logs.json
+          awk '/^\{$/ {f=1} f' /tmp/java-raw-with-logs.json > /tmp/java-raw.json
+          jq -f "$GITHUB_WORKSPACE"/go/parity/java-normalize.jq /tmp/java-raw.json \
+            > /tmp/java-normalized.json
+
+      # ---- Go side ------------------------------------------------------
+      - name: Build Go binary
+        working-directory: go
+        run: go build -o codeiq ./cmd/codeiq
+      - name: Go parity test (diff vs normalized Java output)
+        working-directory: go
+        env:
+          TEST_JAVA_NORMALIZED: /tmp/java-normalized.json
+        run: go test -tags=parity ./parity/... -v
+
+      # ---- Failure artifact --------------------------------------------
+      - name: Upload normalized JSON on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: parity-diff
+          path: |
+            /tmp/java-normalized.json
+            /tmp/java-raw.json

.gitignore

@@ -16,6 +16,9 @@ target/
 *.swo
 *~
 
+# Claude Code local state (progress trackers, settings, ralph-loop state)
+.claude/
+
 # OS
 .DS_Store
 Thumbs.db
@@ -94,6 +97,7 @@ dist/
 build/
 *.whl
 pyproject.toml
+!go/testdata/**/pyproject.toml
 uv.lock
 .venv/
 venv/
@@ -116,3 +120,7 @@ graph.db/
 # Phase A baseline
 .seeds/
 docs/superpowers/baselines/**/raw/**
+
+# Agent-generated plans / scratch (not project deliverables)
+go-port-phase4-plan.md
+phase*-plan.md

CHANGELOG.md

@@ -16,6 +16,24 @@ for that specific tag for the per-commit details.
 
 ### Added
 
+- **Go port (Phases 1-4 of the rewrite)** — codeiq is being ported from
+  Java/Spring Boot to a single static Go binary on the `port/go-port`
+  branch. PR #130. 100 detectors at 1:1 parity with the Java side; 34 MCP
+  tools (deprecated) + 6 consolidated mode-driven tools (new); `codeiq
+  review` CLI + `review_changes` MCP tool for LLM-driven PR review via
+  Ollama (Cloud or local). Java tree untouched until Phase 6 cutover.
+- **Graph dedup + determinism** (Go side) — `GraphBuilder` deduplicates
+  nodes by ID with confidence-aware merging, edges by canonical
+  `(source, target, kind)` tuple. Linker output sorted at the boundary.
+  `codeiq index` surfaces "Deduped: N nodes, M edges  Dropped: K phantom
+  edges" so graph hygiene is visible.
+- **`codeiq review`** — LLM-driven review of `git diff base..head` against
+  the indexed graph. Defaults to local Ollama (`gpt-oss:20b`); set
+  `OLLAMA_API_KEY` to flip to Ollama Cloud. `--format=markdown|json`,
+  `--out`, `--focus`. Graph evidence (nodes-in-file + 1-hop blast radius)
+  attached per changed file when the Kuzu store is enriched.
+- **`review_changes` MCP tool** — same review flow exposed over MCP for
+  agent-driven invocation. Strictly read-only against the graph.
 - OpenSSF supply-chain wiring — Best Practices project
   [12650](https://www.bestpractices.dev/projects/12650), live Scorecard at
   [securityscorecards.dev](https://api.securityscorecards.dev/projects/github.com/RandomCodeSpace/codeiq),

README.md

@@ -19,6 +19,27 @@
 
 ---
 
+## Development — Go Port (Phase 1)
+
+An in-progress Go port lives in [`go/`](./go/). Phase 1 ships `codeiq index`
+over 5 detectors with byte-level parity against the Java side on
+`go/testdata/fixture-minimal`. Phases 2-6 land enrich, MCP, the remaining 94
+detectors, release infra, and Java cutover (see
+[`docs/superpowers/specs/2026-05-11-codeiq-go-port-design.md`](docs/superpowers/specs/2026-05-11-codeiq-go-port-design.md)).
+
+Build and run:
+
+```bash
+cd go
+CGO_ENABLED=1 go build -o codeiq ./cmd/codeiq
+./codeiq index .
+./codeiq --version
+```
+
+The Go binary writes to the same `.codeiq/cache/` location the Java side
+uses, but `CACHE_VERSION` is bumped to 6 so the first run triggers a clean
+rebuild. Phase 1 is parity-only — use the Java side for production runs.
+
 ## Quick Start
 
 ```bash

go/.gitignore

@@ -0,0 +1,6 @@
+/codeiq
+/codeiq.exe
+/coverage.out
+/coverage.html
+/dist/
+/.cache/

go/cmd/codeiq/main.go

@@ -0,0 +1,13 @@
+// Binary codeiq is the codeiq CLI entry point. All logic lives in
+// internal/cli; this file is just the os.Exit shim.
+package main
+
+import (
+	"os"
+
+	"github.com/randomcodespace/codeiq/go/internal/cli"
+)
+
+func main() {
+	os.Exit(cli.Execute())
+}

go/cmd/extcheck/main.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/randomcodespace/codeiq/go/internal/detector"
+	// Same blank imports as the CLI uses
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/auth"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/csharp"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/frontend"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/generic"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/golang"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/iac"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/jvm/java"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/jvm/kotlin"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/jvm/scala"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/markup"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/proto"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/python"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/script/shell"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/sql"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/structured"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/systems/cpp"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/systems/rust"
+	_ "github.com/randomcodespace/codeiq/go/internal/detector/typescript"
+)
+
+func main() {
+	for _, lang := range []string{"terraform", "csharp", "kotlin", "vue", "bash", "rust", "powershell"} {
+		dets := detector.Default.For(lang)
+		fmt.Printf("%-12s: %d detectors\n", lang, len(dets))
+	}
+}

go/go.mod

@@ -0,0 +1,37 @@
+module github.com/randomcodespace/codeiq/go
+
+// Minimum Go version that can compile this module — clamped at 1.25.0
+// because github.com/modelcontextprotocol/go-sdk v1.6 (Phase 3, MCP
+// server) declares `go 1.25.0`. `go mod tidy` rewrites anything lower
+// back to 1.25.0. Bumping out of 1.25 should wait until a release of
+// that SDK that targets 1.26+.
+go 1.25.0
+
+// Actual build toolchain. Pinned to 1.25.7 — 1.26+ isn't on enough
+// developer machines yet. CI pins the same version (.github/workflows/
+// go-ci.yml + go-parity.yml).
+toolchain go1.25.10
+
+require github.com/mattn/go-sqlite3 v1.14.22
+
+require (
+	github.com/google/uuid v1.6.0
+	github.com/kuzudb/go-kuzu v0.7.1
+	github.com/modelcontextprotocol/go-sdk v1.6.0
+	github.com/pmezard/go-difflib v1.0.0
+	github.com/smacker/go-tree-sitter v0.0.0-20240827094217-dd81d9e9be82
+	github.com/spf13/cobra v1.8.0
+	github.com/spf13/pflag v1.0.5
+	gopkg.in/yaml.v3 v3.0.1
+)
+
+require (
+	github.com/google/jsonschema-go v0.4.3 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/segmentio/asm v1.1.3 // indirect
+	github.com/segmentio/encoding v0.5.4 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
+	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
+	golang.org/x/oauth2 v0.35.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+)