Epic: codeanalyzer-iac — unified IaC backend, Helm first

[rahlk]

Spec

docs/design/specs/2026-09-02-codeanalyzer-iac-helm.md in codellm-devkit/.github (design commit 087b9d0).

Summary

Create one typed codeanalyzer-iac backend for the IaC umbrella, with compiled dialect frontends and Helm first. It supports two entry modes: one or more filesystem assets under a stable workspace root, or an existing Neo4j application populated with complete can://artifact/<app>/... source nodes.

The backend progressively enriches the existing source-bearing :Artifact node:

Artifact → IaCArtifact → HelmArtifact → HelmChart | HelmValues | HelmTemplate | ...

It does not replace, re-key, or delete the neutral artifact. Contained Helm semantics and render results use canonical can://iac/... IDs; alternative logical names are first-class aliases.

Affected repositories

• codeanalyzer-schema — additive schema-v2 IaC artifact facets, contained node/edge contracts, Neo4j catalog fixtures
• new codeanalyzer-iac — Go CLI/backend, filesystem and graph ingestion, Helm L1–L3, JSON and Neo4j projection
• codellm-devkit docs — support matrix, CLI and graph-query guide
• .github — coordinating design and epic

Python/TypeScript/Java analyzers retain their existing responsibilities. Their shared integration point is the neutral artifact ID plus complete source; no language-specific analyzer gains Helm logic.

Locked contract

• One backend for Helm, Terraform/OpenTofu, Ansible, Dockerfile/Compose, Packer, Kubernetes/Kustomize, CloudFormation/SAM, ARM/Bicep, Pulumi/CDKs, Chef/Puppet/Salt, Nomad, Vagrant, and later dialects; only Helm is implemented in this train.
• Existing :Artifact is the canonical source node. IaC kinds are same-node labels/facets, not replacement nodes.
• One IaC source dialect per artifact; generated/cross-dialect meaning is represented by contained nodes and edges.
• No concrete IaCEntity catch-all and no generic entities[] bag; each dialect has typed named containment.
• Canonical whole-file IDs remain can://artifact/...; semantic aliases are :IdentityAlias:IaCAlias nodes with exactly one IAC_ALIAS_OF target.
• Helm API v1/v2, chart metadata, dependencies, values/config keys, value-reference sites, named templates/calls, CRDs, locks, and deterministic diagnostics are typed.
• Every chart gets a deterministic default render. An optional typed --config artifact adds named profiles and ordered Helm value layers.
• Rendered Kubernetes objects are render-scoped KubernetesResource nodes targeting stable KubernetesResourceAddress nodes.
• No cluster access, install/upgrade, dependency download, registry access, plugin execution, or secret amplification.
• JSON and Neo4j are projections of one model and must have exact parity. Reconciliation is idempotent and never deletes shared Artifact, ConfigKey, or Package nodes.

Delivery slices

1. Shared IaC contract and conformance fixtures in codeanalyzer-schema.
2. codeanalyzer-iac 0.1.0: foundation, both ingestion modes, Helm L1 source model and L2 resolution.
3. codeanalyzer-iac 0.2.0: typed config artifacts, render profiles, Helm L3 evaluation, Kubernetes outputs.
4. User documentation after released behavior exists.

Child issues are filed per pull request, just in time. No SDK facade is in this train.

Definition of done

• The spec is reviewed and any amendment is committed before implementation.
• Shared JSON and Neo4j contracts are generated and validated from one model.
• Filesystem and graph ingestion produce identical IaC facts for the same source set.
• L1 ⊆ L2 ⊆ L3 and repeated runs are deterministic/idempotent.
• Existing foreign labels, properties, edges, and neutral source nodes survive enrichment and eager cleanup.
• Helm source, resolution, render, failure, security, and no-network fixtures pass.
• 0.1.0 and 0.2.0 release slices and the documentation update are complete.