Nishi FamilyCompare › Code Genealogy and Provenance (Genealogist)

Nishi Compare · measured, not asserted

Code Genealogy and Provenance (Genealogist)

Nishi vs the field — every Nishi cell is measured against real organ source at emit time; each gap names the watch contract that will close it.

Nishi vs Sourcegraph and CodeQL and jscpd and dependency-cruiser

Layer 1 · Executive

Where we are. The Genealogist is FamilySearch-for-code with a signature the field does not have: genesis lineage traced to the SEED, not the first commit (exceed), a relatedness graph, a sovereign whole-tree reference search with zero timeout on 89k files (exceed), duplicate and shadow-name detection with a prioritized resolution worklist, and the module dependency graph. It lacks the field's semantic depth: no language-server code graph, no dataflow query engine, no typed AST call-graph, no cross-language analysis, no coupling metrics, no token-level clone detection, no visual graph, no SBOM attestation, no churn and hotspot history, no IDE or CI surface. Lineage momentum 3121 is the hottest frontier signal on any radar.

Where we need to go. From textual reference to semantic truth: an AST-precise typed call-graph, a code-graph navigation door (go-to-def, find-refs) that the future LSP rides, a dataflow query engine over it, coupling metrics and a visual graph that the architecture ratchet can consume, token-level clones, SBOM attestation shared with the janitor and warden, and churn from our own sovereign history -- all NishiLang-first, cross-language by extension.

The unit. 1 u = one measured session-leg (estate calibration: graphics R21 in one leg 2026-08-15). Local evidence: nx_organ_callers and the dupname worklist each landed in one leg; estimates are relative to those.
Where we are: 10 open rungs. Ancestry and reference search ahead; semantic and historical depth absent. Counts measured at emit below this line.
Cost to a precise call-graph: 2 u. GN1 the typed AST call-graph -- the named next rung and the foundation every other semantic rung reads.
Cost to navigation and queries: 4.5 u. GN2 go-to-def and find-refs over GN1, GN3 the dataflow query engine over it.
Cost to the metrics and surfaces: 11 u. GN4 coupling, GN5 token clones, GN6 the SVG graph, GN7 SBOM attestation, GN8 churn, GN9 cross-language parse, GN10 the IDE and CI bridge.

Research bar. Sourcegraph is measured on precise code intelligence, cross-repo navigation. Theirs: the code-graph bar. Ours: GN1 GN2 GN9 GN10 measured on this page.

Research bar. CodeQL is measured on code as a queryable database, dataflow and taint. Theirs: the query-engine bar. Ours: GN3.

Research bar. dependency-cruiser and jscpd is measured on rule-checked dependency graphs, SVG rendering; token-hash clone detection. Theirs: the graph and clone bars. Ours: GN5 GN6.

Research bar. SLSA and in-toto is measured on supply-chain provenance attestation. Theirs: the SBOM bar. Ours: GN7.

8 of 18 capabilities measured|2 of them measured exceeds|10 open|coverage 444/1000|adoption 7 full / 1 partial

Layer 2 · Roadmap

Do this next — computed by the ranker, never chosen by a seat

Order from nx_compare_rank (nx_dr_ocm: (deficit + cost-of-delay + option + enables) x sponsor x self-sufficiency x momentum / cost). FINISH rows are rungs whose symbol is present but whose organ is short of full adoption: the cheapest closures on this board, listed before any new work. Stamp: # asof=1787883511 domain=genealogy target_version=0.1 rungs=13 done=3 open=10 finish=0 ranker=nx_dr_ocm

#StageRungPriorityDerivation
#10.1Visual dependency graph (GN6) dgs_render_svg1800v=9 m=2 c=10
#20.1Typed AST call-graph (GN1) cga_typed_edges1300v=13 m=2 c=20
#3laterCross-language parse (GN9) ml_parse_lang1000v=20 m=1 c=20
#4laterIDE and CI bridge (GN10) gide_serve1000v=15 m=1 c=15
#5laterToken-level clone detection (GN5) cla_token_clones933v=7 m=2 c=15
#6laterSBOM attestation (GN7) sba_emit_attest600v=6 m=2 c=20
#7laterCoupling and cohesion metrics (GN4) cpl_coupling_score466v=7 m=1 c=15
#8laterCode-graph navigation (GN2) cg_goto_def400v=6 m=1 c=15
#9laterChurn and hotspot history (GN8) ch_hotspot_rank200v=3 m=1 c=15
#10laterDataflow query engine (GN3) cq_dataflow_query166v=5 m=1 c=30

Critical path — contract, done-rule, executor, cost

RungCloses withDefinition of done (pre-declared)ExecutorEst.
Organ ancestry graph (GG0)gen_relatednessRelatedness by shared ancestry, genesis lineage to the seed -- LANDEDOrgan0 u
Whole-tree reference search (GG1)oc_grepNo-timeout reference walk over 89k files -- LANDEDOrgan0 u
Dependency graph of the tree (GG2)
after GG0
gen_obj_relatedlineage_graph.tsv, the sovereign dep graph -- LANDEDOrgan0 u
Typed AST call-graph (GN1)
after GG1
cga_typed_edgesCall edges resolved through the parser's own symbol table with types (no over-reporting by name); gate proves a fixture with two same-named functions in different files resolves each call to the right target where oc_grep reports both, and the edge count over the corpus is printed with its partitionOrgan2 u
Code-graph navigation (GN2)
after GN1
cg_goto_defGo-to-definition and find-references over GN1 as a door the future LSP rides (the lang lane's lsp_serve watch); gate proves goto-def on a fixture call returns the exact file:line and find-refs returns every precise callerOrgan1.5 u
Dataflow query engine (GN3)
after GN1
cq_dataflow_queryA query language over GN1 plus def-use chains: taint from a source to a sink across calls; gate proves a planted source-to-sink path through two organs is found and a sanitized path is notOrgan3 u
Coupling and cohesion metrics (GN4)
after GN1
cpl_coupling_scoreAfferent and efferent coupling plus instability per organ from GN1 edges, published per organ and per directory; gate proves the estate-wide numbers reconcile with nx_eco_graph_arch's fan-in census on the base organOrgan1.5 u
Token-level clone detection (GN5)
after GG1
cla_token_clonesHash-windowed token clones across the corpus at a declared minimum length read as data, ranked by external-caller count like the dupname worklist; gate proves a planted 40-token clone pair is found and a renamed-identifier pair is found too (type-2 clones)Organ1.5 u
Visual dependency graph (GN6)
after GG2
dgs_render_svgSVG of any organ's neighbourhood from GG2 edges through the sovereign raster path; gate proves the node and edge counts in the SVG equal the TSV subsetOrgan1 u
SBOM attestation (GN7)
after GG2
sba_emit_attestAn in-toto-style attestation over the janitor's SBOM (the sbom_emit contract on /compare/janitor) signed with the estate's ed25519 primitive, verifiable by prov_verify; gate proves a tampered SBOM fails verificationOrgan2 u
Churn and hotspot history (GN8)
after GN4
ch_hotspot_rankChange frequency per organ from the sovereign git and journals, ranked and joined to GN4 coupling to name hotspots; gate proves the most-changed organ in a fixture history ranks first and an organ with no history reads UNOBSERVEDOrgan1.5 u
Cross-language parse (GN9)
after GN1
ml_parse_langExtension-level genealogy for non-NishiLang files upgraded to a real parse for at least one foreign language through a declared grammar table; gate proves imports in a fixture JS file become edgesOrgan2 u
IDE and CI bridge (GN10)
after GN2,GN5
gide_serveExpose GN2 and GN5 through the dev API daemon so an editor or the CI lane can ask; gate proves a request over the edge returns the same answer as the CLIOrgan1.5 u

Milestones

MilestoneRungsCumulative
M1 · Precise call-graph and a picture of the treeGN1,GN63 u
M2 · Navigate and queryGN2,GN37.5 u
M3 · Metrics, clones, attestation, history, surfacesGN4,GN5,GN7,GN8,GN9,GN1017.5 u
Layer 3 · Engineering
How this is scored. Every Nishi mark is measured: the generator reads the real organ source on disk and requires the implementing symbol to exist (no self-grading). A watching tag names the organ and symbol contracted to close a gap — the mark flips itself on the next compare beat when that workstream ships, and the comparewatch- plane row flips with it. The flip is necessary, not sufficient: it proves the symbol exists, never that the capability is good. The bar is the rung's pre-declared done-rule, proven by its gate — a symbol shipped without the behaviour behind it is a defect, and the flip is exactly what makes that defect visible instead of quiet. Competitor marks record documented capability presence — presence, not depth or scale. Adoption is measured too: every measured row carries where its organ stands on the estate's ladder (source → built → promoted → registered → invoked; libraries by importer reach minus validation importers; gates by the execution surfaces that run them). A row is fully adopted only at the top of its ladder; anything short is tagged partial with the exact remedy, so a build nobody promoted can no longer read as shipped. Census stamps: importers asof 1787849099, gate census asof 1787855507 (unix seconds; -1 = census absent).

Capability matrix — measured against source

leads / measured exceed present partial absent · click any capability for its evidence

CapabilityNishiSourcegraphCodeQLjscpddependency-cruiser
Organ ancestry and relatedness graphMeasured: gen_relatedness exists in runtime/_hdl_build/nx_genealogist.nx, verified at emit. gen_register + gen_relatedness build the module family-tree (relatedness by shared ancestry); ancestry momentum measured 2673 on the 2026-07-10 radar = the hottest frontier signal; the field tracks references + git blame, not ancestry Adoption: LIB-WIRED importers=4 nonval=1 — fully adopted (top of its ladder).
Genesis lineage traced to the seedMeasured: gen_register exists in runtime/_hdl_build/nx_genealogist.nx, verified at emit. genesis_lineage.tsv + idea_genealogy.tsv record where a capability CAME FROM (its genesis), not its first commit -- provenance to the root; no code-intel tool ships genesis lineage Adoption: LIB-WIRED importers=4 nonval=1 — fully adopted (top of its ladder).
Caller and blast-radius analysisMeasured: oc_referenced exists in runtime/_hdl_build/nx_organ_callers.nx, verified at emit. Sovereign whole-tree reference search, no timeout on 89k files; powers the checked rename method (22 collisions to 14, zero loss, 2026-06-23); Sourcegraph precise refs lead cross-language Adoption: LIB-WIRED importers=6 nonval=4 — fully adopted (top of its ladder).
Duplicate and shadow-name detectionMeasured: jdn_scan exists in runtime/_hdl_build/nx_janitor_dupname.nx, verified at emit. Finds organs that run the WRONG code by name (name-shadowing); jscpd is the token-clone bar [jscpd]; shared with the janitor census Adoption: LIB-WIRED importers=12 nonval=6 — fully adopted (top of its ladder).
Prioritized dedup / resolution worklistMeasured: wl_walk exists in runtime/_hdl_build/nx_dupname_worklist.nx, verified at emit. Ranks every collision by external-caller count so the safest are resolved first; the field reports clones, it does not rank the fix order Adoption: LIB-GATE-ONLY importers=1 — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program.
adoption LIB-GATE-ONLY importers=1
Dependency graph of the module treeMeasured: gen_obj_related exists in runtime/_hdl_build/nx_genealogist.nx, verified at emit. lineage_graph.tsv is the sovereign dep graph; dependency-cruiser + Sourcegraph lead on precision + visualization [dependency-cruiser] Adoption: LIB-WIRED importers=4 nonval=1 — fully adopted (top of its ladder).
Semantic code-graph navigation (go-to-def / refs)Open — watching runtime/nx_code_graph.nx : cg_goto_def, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. Sourcegraph cross-repo code intelligence is the bar [sourcegraph-docs]; ours is textual reference search, not a language-server graph
watching cg_goto_def
Semantic dataflow / dependency queriesOpen — watching runtime/nx_codeql_query.nx : cq_dataflow_query, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. CodeQL treats code as a queryable database (dataflow, taint) [codeql-docs]; we have no query engine
watching cq_dataflow_query
Precise typed call-graph (AST + types)Open — watching runtime/nx_callgraph_ast.nx : cga_typed_edges, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. Reference search over-reports (safe but imprecise); a type-resolved call-graph is the named next rung [scip]
watching cga_typed_edges
Cross-language analysisOpen — watching runtime/nx_multilang_graph.nx : ml_parse_lang, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. Sourcegraph/CodeQL span 20+ languages; our genealogy is NishiLang-shaped (extension-level for others)
watching ml_parse_lang
Coupling and cohesion / architecture metricsOpen — watching runtime/nx_coupling.nx : cpl_coupling_score, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. NDepend-class coupling scoring; dependency-cruiser rules are partial; absent here
watching cpl_coupling_score
Clone detection at token / AST granularityOpen — watching runtime/nx_clone_ast.nx : cla_token_clones, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. jscpd token-hash clones are the bar; ours is name-shadow only, not body-similarity [roy-cordy2007]
watching cla_token_clones
Visual dependency graphOpen — watching runtime/nx_depgraph_svg.nx : dgs_render_svg, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. dependency-cruiser + madge render SVG graphs; ours is TSV data, no diagram
watching dgs_render_svg
SBOM and supply-chain attestationOpen — watching runtime/nx_sbom_attest.nx : sba_emit_attest, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. in-toto / SLSA provenance attestation [slsa-spec]; ties to the janitor SBOM gap (mom 1864) and the warden artifact-policy gap [in-toto-attestation]
watching sba_emit_attest
Historical churn and hotspot analysisOpen — watching runtime/nx_churn.nx : ch_hotspot_rank, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. git-history churn/hotspot (CodeScene-class) [codescene-docs]; we have lineage but not time-series churn
watching ch_hotspot_rank
IDE / CI integrationOpen — watching runtime/nx_gen_ide.nx : gide_serve, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. Sourcegraph editor extensions + CodeQL Actions are the bar; our genealogy is console + registry
watching gide_serve
Genesis provenance to the seed (ancestry to the root, not the first commit)Measured exceed: gen_register in runtime/_hdl_build/nx_genealogist.nx, verified at emit. The spore/genesis lineage records a capability's true origin back to the seed idea; git-based tools start at the first commit -- we start at conception Adoption: LIB-WIRED importers=4 nonval=1 — fully adopted (top of its ladder).
Sovereign whole-tree reference search with zero timeoutMeasured exceed: oc_grep in runtime/_hdl_build/nx_organ_callers.nx, verified at emit. oc_grep walks all 89k files with no external index, no timeout, no SaaS -- the caller/blast-radius engine that made the checked collision resolution possible; the field needs a hosted index Adoption: LIB-WIRED importers=6 nonval=4 — fully adopted (top of its ladder).

Risk register

RiskLikelihood x impactMitigation
A typed call-graph that is wrong is worse than the textual one that over-reports safelypossible x highGN1 done-rule compares against oc_grep as the conservative superset: every precise edge must be in the textual set.
Clone detection with a tuned window fires on every boilerplate headerlikely x mediumGN5 reads its minimum length as data and publishes precision on a labelled sample of the corpus before ranking.
On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.
Honest verdict. The Genealogist is FamilySearch-for-code, and its signature capability is one the code-intelligence field does not have: it traces a module's ancestry all the way back to the SEED. genesis_lineage and idea_genealogy record where a capability came from -- its genesis, not just its git history -- so provenance runs to the root, not to the first commit. On top of that it keeps the family tree clean: a relatedness graph, a sovereign whole-tree reference search that does not time out on 89,000 files and drove the collision resolution that took 22 shadow collisions to 14 with zero functionality lost, and duplicate/shadow detection with a prioritized worklist. What it lacks is the field's semantic depth: no language-server code graph (Sourcegraph), no dataflow query engine (CodeQL), no typed AST call-graph, no cross-language analysis, no coupling metrics, no visual dependency graph, no SBOM attestation, no churn/hotspot history. Our analysis is textual-reference and NishiLang-shaped. The climb: an AST-precise call-graph, then coupling metrics, then SBOM attestation (which also serves the janitor and warden). Lineage momentum is the hottest signal on any radar (3121) -- this crew sits on the field's fastest-moving frontier.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/genealogy.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain genealogy, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.
  1. [sourcegraph-docs] Sourcegraph. Sourcegraph documentation -- Code Search, precise code navigation (go-to-definition, find references), cross-repository code intelligence, editor extensions. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_genealogy_sourcegraph-docs.html · pin ha221aa6da30b94baab690458850b97a396b9af0912fc217369111aee4ffa05cc · accessed 2026-08-18 · vendor-docGrounds: The Sourcegraph column: Semantic code-graph navigation (go-to-def / refs) and Caller and blast-radius analysis are coded Best (precise refs lead cross-language), with Cross-language analysis, Visual dependency graph and IDE / CI integration -- the hosted-index bar the sovereign oc_grep whole-tree search is contrasted with.
  2. [scip] Sourcegraph. SCIP Code Intelligence Protocol -- the language-agnostic protocol and index format for precise code navigation (successor to LSIF), repository README and protobuf schema. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_genealogy_scip.html · pin hf2cb4921b42561b6ba331c068400a32a8d8e57ee6ce881d66bf3be5fb702ffd2 · accessed 2026-08-18 · vendor-docGrounds: Semantic code-graph navigation (go-to-def / refs) and Precise typed call-graph (AST + types) -- the concrete artifact behind Sourcegraph's precise navigation: an indexer emits SCIP symbols and occurrences per language, which is the shape the named nx_callgraph_ast rung would have to emit to stop over-reporting from textual reference search.
  3. [codeql-docs] GitHub. CodeQL documentation -- code as a queryable database, the QL language, dataflow and taint-tracking libraries, CodeQL CLI and Actions. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_genealogy_codeql-docs.html · pin h2382aa728f3dc76e99dccda526ab166d21fff63c193362f5075512a95ecc3466 · accessed 2026-08-18 · vendor-docGrounds: The CodeQL column: Semantic dataflow / dependency queries is coded Best (CodeQL treats code as a queryable database, dataflow and taint) and Precise typed call-graph Best; Nishi has no nx_codeql_query engine, and IDE / CI integration names CodeQL Actions as the bar.
  4. [jscpd] Kucherenko, A. and contributors. jscpd -- copy/paste detector for programming source code (token-hash clone detection across 150+ formats), repository README, v5.x. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_genealogy_jscpd.html · pin h778988ea93700d898022461fefc6114b5aa069e73f77303de16f40ddc30a740e · accessed 2026-08-18 · vendor-docGrounds: The jscpd column (bar v5.0.14, npm as-of 2026-08-04): Duplicate and shadow-name detection names jscpd as the token-clone bar and Clone detection at token / AST granularity is coded Part for jscpd and _ABSENT_ for Nishi (name-shadow only, not body similarity).
  5. [dependency-cruiser] Verweij, S. and contributors. dependency-cruiser -- validate and visualise dependencies with rules (forbidden, allowed, orphans, cycles) and dot/SVG graph output for JavaScript, TypeScript and CoffeeScript, repository README, v18.x. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_genealogy_dependency-cruiser.html · pin h558b2d7bf1b65ffb7f62c1094615e5aa10b0a3b1081235ba6fea3fd9ee9250e5 · accessed 2026-08-18 · vendor-docGrounds: The dependency-cruiser column (bar v18.1.1, npm as-of 2026-08-04): Dependency graph of the module tree (dependency-cruiser + Sourcegraph lead on precision and visualization) and Visual dependency graph (dependency-cruiser + madge render SVG; ours is TSV, no diagram) plus its Part on Coupling and cohesion / architecture metrics via rules.
  6. [slsa-spec] OpenSSF SLSA community. SLSA (Supply-chain Levels for Software Artifacts) specification v1.0 -- build provenance levels L1-L3 and the provenance predicate. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_genealogy_slsa-spec.html · pin h94a6630c0ec4310ad583a35c0d4576a35100a027e1e6dbdd6ba0c9484e593247 · accessed 2026-08-18 · published-standardGrounds: SBOM and supply-chain attestation -- the note names in-toto / SLSA provenance attestation as the bar; this is the SLSA level specification the _ABSENT_ nx_sbom_attest rung would target, shared with the janitor SBOM gap and the warden artifact-policy gap.
  7. [in-toto-attestation] in-toto project (CNCF). in-toto Attestation Framework -- the Statement, Predicate and DSSE envelope specification for authenticated software supply-chain metadata (repository README and spec). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_genealogy_in-toto-attestation.html · pin h69361fea3a6b2f0ea0cc20b74ad55cf6419dc6d4066fc07fd43586389fb27280 · accessed 2026-08-18 · published-standardGrounds: SBOM and supply-chain attestation -- the attestation envelope SLSA provenance rides in; the estate already ships nx_coe_intoto and nx_coe_dsse organs, so this spec is the interoperability contract between them and the genealogist's provenance-to-the-seed claim.
  8. [codescene-docs] CodeScene AB. CodeScene documentation -- behavioural code analysis: hotspots, code health, change coupling and knowledge maps from version-control history. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_genealogy_codescene-docs.html · pin hfbfbc96aad40eb72cedda5a0449cd9139518171ecf27cf3dbc4f4a61839dbbe8 · accessed 2026-08-18 · vendor-docGrounds: Historical churn and hotspot analysis -- the note names git-history churn/hotspot (CodeScene-class) as the bar and Nishi _ABSENT_ (lineage but no time-series churn); these docs define hotspots and change coupling as the measurements an nx_churn rung would reproduce.
  9. [roy-cordy2007] Roy, C.K., Cordy, J.R. A Survey on Software Clone Detection Research. Queen's University School of Computing Technical Report 2007-541, Kingston, Ontario, 2007. Confirmed by search-index read; the queensu.ca host refused the sovereign TLS handshake, so no mirror is claimed. publisher · accessed 2026-08-18 · published-paperGrounds: Clone detection at token / AST granularity -- the survey that fixes the clone taxonomy (Type-1 to Type-4) and the text, token, tree and metrics detection families; jscpd's token-hash approach sits in that taxonomy and the _ABSENT_ nx_clone_ast row is named against it.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/genealogy.matrix · every Nishi cell verified against organ source at emit time · watch cells re-measured on every compare beat · zero JS, zero trackers