finance/graphify-out/GRAPH_REPORT.md

# Graph Report - finance  (2026-09-18)

## Corpus Check
- 149 files · ~63,842 words
- Verdict: corpus is large enough that graph structure adds value.

## Summary
- 1267 nodes · 3697 edges · 75 communities (54 shown, 15 thin omitted)
- Extraction: 98% EXTRACTED · 2% INFERRED · 0% AMBIGUOUS · INFERRED: 70 edges (avg confidence: 0.93)
- Token cost: 0 input · 0 output

## Graph Freshness
- Built from commit: `fb91da79`
- Run `git rev-parse HEAD` and compare to check if the graph is stale.
- Run `graphify update .` after code changes (no API cost).

## Community Hubs (Navigation)
- identity/router.py
- budgeting/router.py
- Base
- set_space_context
- imports/router.py
- alfa_xlsx.py
- Session
- types.ts
- router.tsx
- ledger/router.py
- AccountsPage.tsx
- compilerOptions
- AnalyticsPage.tsx
- analytics/router.py
- devDependencies
- test_import_holds.py
- dependencies
- ImportDetailPage.tsx
- OperationsPage.tsx
- SettingsPage.tsx
- Toaster.tsx
- ozon_pdf.py
- BudgetPage.tsx
- client.ts
- fields.tsx
- Docker Compose Development Stack
- Financial Space
- scripts
- dependencies.py
- General Pool
- TestBaseContract
- Per-File Envelope Encryption
- Operation
- Versioned Statement Imports
- Finance Frontend SPA
- Closed Beta Launch Gates
- package.json
- Financial Tracker MVP
- test_adapter_contracts.py
- generate-api.mjs
- schema.d.ts
- test_api.py
- i18n-parity.test.ts
- Expected Income
- test_private_fixtures.py
- TestAlfaDebitContract
- jsdom
- graphify
- @types/react-dom
- typescript-eslint
- SourceRow
- vitest
- Favicon SVG (ledger lines icon)
- init-app-role.sh
- Payee
- finance-backend
- LocalDirectoryBlobStore
- account_fingerprint
- Gitea CI and real statement imports
- 20260918_0002_hold_lifecycle.py
- eslint-plugin-react-hooks
- openapi-typescript
- @testing-library/dom
- @testing-library/react
- vite
- spaces/router.py
- identity/service.py
- get_settings
- ColumnChart.tsx

## God Nodes (most connected - your core abstractions)
1. `Session` - 140 edges
2. `AppError` - 53 edges
3. `Base` - 47 edges
4. `PkMixin` - 39 edges
5. `get_settings()` - 38 edges
6. `TimestampMixin` - 38 edges
7. `conflict()` - 35 edges
8. `record()` - 34 edges
9. `UnsupportedStatementLayout` - 30 edges
10. `bad_request()` - 29 edges

## Surprising Connections (you probably didn't know these)
- `Typed Same-Origin API Client` --conceptually_related_to--> `Same-Origin Reverse Proxy`  [INFERRED]
  frontend/README.md → infra/README.md
- `Financial Space Ownership` --conceptually_related_to--> `Financial Space`  [INFERRED]
  docs/adr/0001-financial-space-ownership-and-rls.md → CONTEXT.md
- `Versioned Statement Imports` --conceptually_related_to--> `Statement Import`  [INFERRED]
  docs/adr/0003-versioned-statement-imports.md → CONTEXT.md
- `MVP Release Gates` --conceptually_related_to--> `Closed Beta Launch Gates`  [INFERRED]
  .kilo/plans/1789034192214-financial-tracker-mvp.md → docs/operations/beta-release-runbook.md
- `Carry-Over Budget Reserves` --references--> `Savings Envelope`  [EXTRACTED]
  docs/adr/0002-journal-and-budget-reserves.md → CONTEXT.md

## Import Cycles
- None detected.

## Hyperedges (group relationships)
- **Auditable Financial Model** — context_operation, context_posting, docs_adr_0002_journal_and_budget_reserves_derived_balances, docs_adr_0002_journal_and_budget_reserves_plan_funding_separation, docs_adr_0002_journal_and_budget_reserves_closure_snapshots [EXTRACTED 1.00]
- **Financial Space Tenancy Boundary** — context_financial_space, context_membership, docs_adr_0001_financial_space_ownership_and_rls_defense_in_depth_authorization, docs_adr_0001_financial_space_ownership_and_rls_transaction_local_rls, docs_adr_0001_financial_space_ownership_and_rls_cross_space_integrity [EXTRACTED 1.00]
- **Safe Statement Import Flow** — context_statement_import, context_parse_run, context_source_record, docs_adr_0003_versioned_statement_imports_immutable_statement_document, docs_adr_0003_versioned_statement_imports_conservative_deduplication, docs_adr_0003_versioned_statement_imports_atomic_confirm_revert [EXTRACTED 1.00]

## Communities (75 total, 15 thin omitted)

### Community 0 - "identity/router.py"
Cohesion: 0.20
Nodes (22): accept_invite(), AcceptInviteBody, confirm_password_reset(), create_invite(), InviteBody, login(), LoginBody, logout() (+14 more)

### Community 1 - "budgeting/router.py"
Cohesion: 0.20
Nodes (34): AssignmentItem, assignments(), AssignmentsBody, categories(), CategoryBody, CategoryFundingBody, close(), close_frontend() (+26 more)

### Community 2 - "Base"
Cohesion: 0.06
Nodes (87): downgrade(), upgrade(), AuditEvent, Append-only domain/security event. Never stores raw financial payloads., ExpectedIncome, ExpectedIncomeMatch, FundingMovement, PeriodClosure (+79 more)

### Community 3 - "set_space_context"
Cohesion: 0.07
Nodes (43): get_db(), get_engine(), get_session_factory(), Any, sessionmaker, Transaction-local RLS context. No-op on SQLite (tests); fail-closed on…, Transactional scope for workers/endpoints that own the transaction lifecycle., session_scope() (+35 more)

### Community 4 - "imports/router.py"
Cohesion: 0.15
Nodes (33): confirm(), ConfirmBody, decide_row(), DecisionBody, delete_source(), detail(), HoldResolveBody, imports() (+25 more)

### Community 5 - "alfa_xlsx.py"
Cohesion: 0.14
Nodes (29): AlfaCreditXlsxAdapter, AlfaDebitXlsxAdapter, _AlfaHeaderMeta, AlfaXlsxAdapterBase, _cell_str(), _debit_find_header(), _debit_header_metadata(), _debit_header_value() (+21 more)

### Community 6 - "Session"
Cohesion: 0.07
Nodes (112): balances(), plan_fact(), Any, record(), BudgetPeriod, Calendar month budget period in the space timezone (month granularity)., add_expected_income(), archive_category() (+104 more)

### Community 7 - "types.ts"
Cohesion: 0.05
Nodes (53): api, AcceptInvitePayload, Account, AccountStatus, BalanceItem, BalancesReport, BudgetBlocker, BudgetCategory (+45 more)

### Community 8 - "router.tsx"
Cohesion: 0.09
Nodes (35): AcceptInvitePage, AccountsPage, BudgetPage, ImportDetailPage, ImportsPage, LoginPage, OperationsPage, RequireAuth() (+27 more)

### Community 9 - "ledger/router.py"
Cohesion: 0.15
Nodes (31): account_json(), AccountBody, accounts(), archive_account(), create_account(), create_operation(), delete_account(), operation_json() (+23 more)

### Community 10 - "AccountsPage.tsx"
Cohesion: 0.21
Nodes (13): AccountType, CreateAccountPayload, ConfirmDialog(), ConfirmDialogProps, Modal(), ModalProps, useAccounts(), useArchiveAccount() (+5 more)

### Community 11 - "compilerOptions"
Cohesion: 0.07
Nodes (28): compilerOptions, baseUrl, esModuleInterop, forceConsistentCasingInFileNames, isolatedModules, jsx, lib, module (+20 more)

### Community 12 - "AnalyticsPage.tsx"
Cohesion: 0.14
Nodes (15): AnalyticsPage, NotFoundPage, PlanFactBars(), PlanFactBarsProps, PlanFactRow, MonthSwitcher(), MonthSwitcherProps, PageHeader() (+7 more)

### Community 13 - "analytics/router.py"
Cohesion: 0.27
Nodes (12): balances(), cash_flow(), category_spend(), plan_fact(), Context, date, Db, get (+4 more)

### Community 14 - "devDependencies"
Cohesion: 0.11
Nodes (19): eslint, @eslint/js, eslint-plugin-jsx-a11y, devDependencies, eslint, @eslint/js, eslint-plugin-jsx-a11y, globals (+11 more)

### Community 15 - "test_import_holds.py"
Cohesion: 0.13
Nodes (43): AppError, Domain error rendered as a machine-readable JSON error payload., normalize_description(), date, record_fingerprint(), add_record(), _draft(), hold_document() (+35 more)

### Community 16 - "dependencies"
Cohesion: 0.11
Nodes (19): dependencies, @hookform/resolvers, i18next, react, react-dom, react-hook-form, react-i18next, react-router-dom (+11 more)

### Community 17 - "ImportDetailPage.tsx"
Cohesion: 0.33
Nodes (13): useToast(), useConfirmImport(), useImport(), useImportErrorToaster(), useReparseImport(), useRevertImport(), useSaveRowDecision(), useUploadImport() (+5 more)

### Community 18 - "OperationsPage.tsx"
Cohesion: 0.14
Nodes (27): CreateOperationPayload, Badge(), BadgeTone, EmptyState(), EmptyStateProps, QueryGate(), QueryGateProps, useActiveAccounts() (+19 more)

### Community 19 - "SettingsPage.tsx"
Cohesion: 0.16
Nodes (16): invalidationRoots, queryKeys, SESSION_ROOT, sessionInvalidationRoot, SPACE_ROOT, spaceInvalidationRoot, OperationFilters, useCancelDeletion() (+8 more)

### Community 20 - "Toaster.tsx"
Cohesion: 0.12
Nodes (15): Locale, App(), queryClient, AppRoutes(), ToastApi, ToastContext, ToastItem, ToastKind (+7 more)

### Community 21 - "ozon_pdf.py"
Cohesion: 0.14
Nodes (13): Protocol, StatementAdapter, StatementDraft, _first_page_text(), _ozon_cell(), _ozon_normalize(), OzonCreditPdfAdapter, OzonDebitPdfAdapter (+5 more)

### Community 22 - "BudgetPage.tsx"
Cohesion: 0.36
Nodes (12): useBudgetCategories(), useBudgetErrorToaster(), useBudgetSummary(), useCloseMonth(), useCopyPreviousMonth(), useFundCategory(), usePeriodMutation(), useReopenMonth() (+4 more)

### Community 23 - "client.ts"
Cohesion: 0.23
Nodes (10): apiClient, ApiError, buildUrl(), ErrorEnvelope, parseErrorEnvelope(), QueryValue, readCsrfToken(), request() (+2 more)

### Community 24 - "fields.tsx"
Cohesion: 0.21
Nodes (11): FieldChrome, InputProps, MoneyField(), MoneyFieldProps, SelectField(), SelectFieldProps, SelectProps, TextareaField() (+3 more)

### Community 25 - "Docker Compose Development Stack"
Cohesion: 0.29
Nodes (8): Commodity Infrastructure Services, Docker Compose Development Stack, Internal Backend Network, Same-Origin Frontend Service, Worker Parsing Isolation, Finance Infrastructure, Same-Origin Reverse Proxy, Backend and Frontend Workstream Contracts

### Community 26 - "Financial Space"
Cohesion: 0.17
Nodes (12): Credit Reserve, Financial Account, Financial Space, Membership, User, Carry-Over Budget Reserves, Provider-Neutral Data Boundary, Russian Federation Data Residency (+4 more)

### Community 27 - "scripts"
Cohesion: 0.22
Nodes (9): scripts, api:generate, build, dev, lint, preview, test, test:watch (+1 more)

### Community 28 - "dependencies.py"
Cohesion: 0.15
Nodes (21): current_context(), current_session(), alias, Context, CurrentSession, Db, Header, User (+13 more)

### Community 29 - "General Pool"
Cohesion: 0.29
Nodes (8): Budget Period, Funding, General Pool, Monthly Category, Plan Assignment, Savings Envelope, Immutable Closure Snapshots, Plan and Funding Separation

### Community 30 - "TestBaseContract"
Cohesion: 0.17
Nodes (5): detect_adapter(), make_draft(), make_source_row(), TestBaseContract, Workbook

### Community 31 - "Per-File Envelope Encryption"
Cohesion: 0.29
Nodes (7): Immutable Statement Document, Per-File Envelope Encryption, Backup and Restore Runbook, Mandatory KEK Backup, Quarterly Restore Drill, Disaster Restore Procedure, Post-Restore Deletion Replay

### Community 32 - "Operation"
Cohesion: 0.47
Nodes (6): Internal Transfer, Operation, Posting, Refund, Derived Account Balances, Operations and Postings Journal

### Community 33 - "Versioned Statement Imports"
Cohesion: 0.20
Nodes (11): Parse Run, Source Record, Statement Import, Atomic Import Confirm and Revert, Conservative Deduplication, Parser Versioning and Review Diff, Versioned Statement Imports, Layout Drift Re-Gating (+3 more)

### Community 34 - "Finance Frontend SPA"
Cohesion: 0.29
Nodes (7): Server-Side Secret Boundary, Grossbukh Application Shell, Accessible Responsive UI, Finance Frontend SPA, RU and EN Localization, Space-Scoped Query Keys, Typed Same-Origin API Client

### Community 35 - "Closed Beta Launch Gates"
Cohesion: 0.20
Nodes (11): Crypto-Shredded Deletion, Closed Beta Release Runbook, Forward-Fix Rollback Policy, Financial Data Incident Response, Closed Beta Launch Gates, Production Launch Sequence, Thirty-Day Space Deletion, Durable Deletion Ledger (+3 more)

### Community 36 - "package.json"
Cohesion: 0.40
Nodes (4): name, private, type, version

### Community 37 - "Financial Tracker MVP"
Cohesion: 0.18
Nodes (11): Audited Break-Glass Access, Cross-Space Referential Integrity, Defense-in-Depth Authorization, Financial Space Ownership, Transaction-Local RLS Context, Budget Invariants, Critical User Path, Financial Tracker MVP (+3 more)

### Community 38 - "test_adapter_contracts.py"
Cohesion: 0.11
Nodes (9): minimal_pdf(), _QuotaSettings, Sanitized synthetic contract tests for the evidenced statement adapters. These…, Build a small valid single-font PDF with empty or ASCII-only pages., same_page_rocket_lines(), synthetic_rocket_lines(), TestMoneyParsing, TestRocketbankDebitContract (+1 more)

### Community 39 - "generate-api.mjs"
Cohesion: 0.40
Nodes (5): firstReadable(), LOCAL_CANDIDATES, main(), OUT_DIR, REMOTE_CANDIDATES

### Community 40 - "schema.d.ts"
Cohesion: 0.33
Nodes (5): components, $defs, operations, paths, webhooks

### Community 41 - "test_api.py"
Cohesion: 0.67
Nodes (3): TestClient, test_invite_login_and_authenticated_space(), test_openapi_contains_critical_paths()

### Community 44 - "test_private_fixtures.py"
Cohesion: 0.12
Nodes (22): magic_kind(), _draft_json(), Any, Reconcile parsed rows against declared bank controls with stable diagnostics.…, _reconciliation_summary(), _check(), _fail(), _load_entries() (+14 more)

### Community 45 - "TestAlfaDebitContract"
Cohesion: 0.21
Nodes (3): alfa_workbook_bytes(), synthetic_alfa_rows(), TestAlfaDebitContract

### Community 47 - "graphify"
Cohesion: 0.17
Nodes (11): command, enabled, timeout, type, mcp, graphify, plugin, $schema (+3 more)

### Community 50 - "SourceRow"
Cohesion: 0.19
Nodes (9): SourceRow, _date_from(), _PendingRecord, date, Rocketbank debit statement contract, evidenced against the real document.…, RocketbankDebitPdfAdapter, open_pdf(), _quota_error() (+1 more)

### Community 62 - "LocalDirectoryBlobStore"
Cohesion: 0.39
Nodes (3): LocalDirectoryBlobStore, Path, S3-neutral local store; production swaps in an S3-compatible client.

### Community 63 - "account_fingerprint"
Cohesion: 0.25
Nodes (3): account_fingerprint(), ozon_extracted(), TestOzonDebitContract

### Community 64 - "Gitea CI and real statement imports"
Cohesion: 0.29
Nodes (6): Confirmed decisions, Gitea CI and real statement imports, Goal and constraints, Implementation plan, Principal risks, Validation and rollout

### Community 65 - "20260918_0002_hold_lifecycle.py"
Cohesion: 0.80
Nodes (4): downgrade(), _has_check_constraint(), _has_column(), upgrade()

### Community 71 - "spaces/router.py"
Cohesion: 0.16
Nodes (19): send_token_email(), cancel_deletion(), current(), deletion_status(), DeletionBody, invite_member(), MemberInviteBody, alias (+11 more)

### Community 72 - "identity/service.py"
Cohesion: 0.28
Nodes (18): unauthorized(), accept_invitation(), authenticate(), create_invitation(), create_password_reset(), create_session(), get_active_session(), normalize_email() (+10 more)

### Community 73 - "get_settings"
Cohesion: 0.16
Nodes (12): get_settings(), Settings, create_celery_app(), encrypt_file(), EncryptedFile, Per-file random DEK; DEK wrapped with the KEK from the secret manager., Crypto-shred hook: deleting wrapped DEK rows in DB plus blobs removes access., shred_dek_material() (+4 more)

### Community 74 - "ColumnChart.tsx"
Cohesion: 0.24
Nodes (7): CashFlowColumn, ColumnChart(), ColumnChartProps, BarRow, HorizontalBars(), HorizontalBarsProps, rows

## Knowledge Gaps
- **185 isolated node(s):** `$schema`, `file:///home/k1nq/repos/finance/.kilo/plugins/graphify.js`, `type`, `/home/k1nq/.local/bin/graphify-mcp`, `/home/k1nq/repos/finance/graphify-out/graph.json` (+180 more)
  These have ≤1 connection - possible missing edges or undocumented components. (Counts symbols only; 335 node(s) total have ≤1 connection when file, concept and rationale nodes are included.)
- **15 thin communities (<3 nodes) omitted from report** — run `graphify query` to explore isolated nodes.

## Suggested Questions
_Questions this graph is uniquely positioned to answer:_

- **Why does `AppError` connect `test_import_holds.py` to `identity/router.py`, `Base`, `set_space_context`, `imports/router.py`, `alfa_xlsx.py`, `Session`, `test_adapter_contracts.py`, `identity/service.py`, `get_settings`, `SourceRow`, `dependencies.py`, `account_fingerprint`?**
  _High betweenness centrality (0.078) - this node is a cross-community bridge._
- **Why does `Session` connect `Session` to `Base`, `set_space_context`, `identity/service.py`, `analytics/router.py`, `test_import_holds.py`, `dependencies.py`?**
  _High betweenness centrality (0.074) - this node is a cross-community bridge._
- **Why does `bad_request()` connect `Session` to `budgeting/router.py`, `spaces/router.py`, `identity/service.py`, `ledger/router.py`, `test_import_holds.py`?**
  _High betweenness centrality (0.025) - this node is a cross-community bridge._
- **Are the 2 inferred relationships involving `Session` (e.g. with `UTCDateTime` and `test_postgres_rls_requires_matching_transaction_context()`) actually correct?**
  _`Session` has 2 INFERRED edges - model-reasoned connections that need verification._
- **Are the 23 inferred relationships involving `AppError` (e.g. with `request_export()` and `login()`) actually correct?**
  _`AppError` has 23 INFERRED edges - model-reasoned connections that need verification._
- **Are the 3 inferred relationships involving `Base` (e.g. with `downgrade()` and `upgrade()`) actually correct?**
  _`Base` has 3 INFERRED edges - model-reasoned connections that need verification._
- **What connects `$schema`, `file:///home/k1nq/repos/finance/.kilo/plugins/graphify.js`, `type` to the rest of the system?**
  _185 weakly-connected nodes found - possible documentation gaps or missing edges._