Add opt-in Android platform analysis

.dockerignore

@@ -2,7 +2,6 @@ node_modules
 dist
 .git
 .codegraph
-.kommandr
 docs
 assets
 codegraph-kernel/target

.github/workflows/ci.yml

@@ -0,0 +1,90 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: ["**"]
+  merge_group:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CODEGRAPH_TELEMETRY: '0'
+  CODEGRAPH_NO_UPDATE_CHECK: '1'
+
+jobs:
+  test:
+    name: Build and test (Node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [22, 24]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - name: Prepare sensitive-path test directory
+        run: mkdir -p "$HOME/.ssh"
+      - name: Test portable engine and viewer
+        env:
+          CODEGRAPH_KERNEL: '0'
+        run: npm test -- --maxWorkers=2 --minWorkers=1
+
+  kernel:
+    name: Native kernel and AOSP
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - name: Build Linux kernel
+        run: bash scripts/build-kernel.sh --target x86_64-unknown-linux-gnu
+      - run: npm run build
+      - name: Require the native binary
+        run: test -s codegraph-kernel/prebuilds/linux-x64/codegraph-kernel.node
+      - name: Verify kernel parity and Android tracing
+        env:
+          CODEGRAPH_KERNEL_EXPECT: '1'
+        run: >-
+          npx vitest run
+          __tests__/kernel-*.test.ts
+          __tests__/aosp-*.test.ts
+          __tests__/kotlin-object-literal.test.ts
+          __tests__/extraction.test.ts
+          __tests__/resolution.test.ts
+          --maxWorkers=2 --minWorkers=1
+
+  checks:
+    name: CI checks
+    if: always()
+    needs: [test, kernel]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require every validation job to pass
+        env:
+          TEST_RESULT: ${{ needs.test.result }}
+          KERNEL_RESULT: ${{ needs.kernel.result }}
+        run: |
+          test "$TEST_RESULT" = success
+          test "$KERNEL_RESULT" = success

.gitignore

@@ -7,8 +7,6 @@ dist/
 # svelte-package's scratch dir (ui/ library build)
 .svelte-kit/
 
-.cmem
-
 # IDE
 .idea/
 .vscode/
@@ -63,25 +61,15 @@ test-languages/
 nul
 release/
 
-.antigravitycli/
-
-# Local-only: browser-based tmux session launcher (see tmux-web/README.md)
-tmux-web/
-
 assets/__pycache__/
 
 assets/generate-waitlist.py
 
-.kommandr/
-
 # Local scratch tests (never commit)
 __tests__/zz-scratch*
 
 # linux-arm64 kernel cross-build cache (rust:1-bookworm builder)
 target-linux/
-.kommandr/kommandr.db
-.kommandr/kommandr.db-wal
-.kommandr/kommandr.db-shm
 
 # Stray git bundles from the Windows VM transfer (a lost `:` in an scp target
 # once committed three of these, 7.9 MB, into a feature branch).

CHANGELOG.md

@@ -25,6 +25,7 @@ and adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### New Features
 
+- Analyze Android platform code with CLI commands and opt-in MCP tools for AIDL/HIDL implementation candidates, JNI bindings, system services, permission and broadcast literals, and Messenger, ContentProvider, and local-socket evidence.
 - **Codex and Astra read project guidance from `AGENTS.md`.** The canonical agent guide now lives in `AGENTS.md` (with a nested `docs/AGENTS.md` for long validation notes); `CLAUDE.md` is a thin `@AGENTS.md` wrapper for Claude Code. Codex/Astra no longer miss the old CLAUDE-only instructions.
 
 - **A big screen's picture stops wrapping into a column.** How wide a screen's lines run before they wrap was worked out with a formula, and the formula was wrong for the way these pictures are actually drawn: a part of a screen spends lines on its own structure — a step that fires things gets a line to itself, and what it fires starts another — so estimating the lines from the boxes alone badly undercounted them, and one screen's 98 boxes wrapped into a 4,356px column. Laying a picture out is cheap and exact, so the widths are now simply tried and the one that comes out closest to the shape of a window is kept. Across one app's 51 screens the tallest picture went from 4,356px to 3,796px, total height fell 8%, and — because a shorter picture is also a picture whose lines have less far to go — lines running over other boxes fell by a third and lines crossing each other went from 13 to 5.
@@ -311,6 +312,13 @@ and adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 - Python calls and file dependencies through `from package import module as alias` now appear in the graph, so renamed imports no longer hide live callers or imported modules. Thanks @JoeyNPP. (#1626)
 
+#### Type resolution and Android source extraction
+
+- Inheritance references no longer resolve to unrelated methods with matching names.
+- Qualified nested types and C++ namespace aliases resolve more accurately across source files.
+- The portable parser preserves members and inheritance in Java anonymous classes and Kotlin object expressions for implementation searches.
+- Qualified type lookups no longer match partial identifiers from unrelated scopes.
+
 ## [1.6.0] - 2026-08-26
 
 ### Highlights

CONTRIBUTING.md

@@ -0,0 +1,84 @@
+# Contributing to CodeGraph
+
+Start with a focused change and describe the behavior it improves. For bugs,
+include a small reproducer, the CodeGraph version or commit, the operating
+system, and the expected and actual results.
+
+## Build from source
+
+Use Node.js 22.5 or later within the supported Node 22–24 range and npm.
+The source checkout uses `node:sqlite`; the published installers bundle their
+own runtime. Installing the published npm package does not run your local changes.
+
+From your checkout:
+
+```bash
+npm ci
+npm run build
+node dist/bin/codegraph.js --help
+```
+
+The build includes the CLI, SQL schema, parser grammars, and browser viewer.
+`npm run build:lib` separately builds the viewer component library when working
+on that package. See [BUNDLING.md](BUNDLING.md) for release packaging.
+
+## Validate your change
+
+Run the relevant tests while developing, then the full suite for code changes:
+
+```bash
+npx vitest run __tests__/extraction.test.ts
+npm test
+git diff --check
+```
+
+Choose focused test files that cover your change; the extraction suite above is
+an example. Some tests spawn the compiled CLI or load viewer assets, so build
+first and rebuild after changing source. Tests use real temporary files and
+SQLite databases. Include a regression case that fails before a bug fix.
+
+For documentation-only changes, verify examples, relative links, and formatting.
+Report what you actually ran, including failures and any platform or environment
+you could not validate. A focused test pass does not establish full-suite or
+cross-platform compatibility.
+
+New language or framework support also requires real-repository flow validation;
+see the [validation methodology](docs/AGENTS.md#validation-methodology-required-for-every-new-languageframework)
+and [coverage playbook](docs/design/dynamic-dispatch-coverage-playbook.md).
+Platform-sensitive changes need validation on the affected operating systems;
+the [project guide](AGENTS.md#cross-platform-validation) describes the workflow.
+
+## Continuous integration
+
+[CI](.github/workflows/ci.yml) builds and runs the portable engine and viewer
+suite on Linux with Node 22 and 24. A separate Linux job builds the native
+kernel and runs kernel parity, AOSP, extraction, and resolution tests. Both jobs
+must pass for the aggregate `CI checks` job to succeed; skipped or cancelled
+jobs do not satisfy it. Repository maintainers can select `CI checks` as a
+required status check in branch protection.
+
+The workflow runs for pull requests, branch pushes, and merge queues, with
+read-only repository permissions and no publishing credentials. Release and
+site deployment remain separate workflows. A green Linux run does not establish
+macOS or Windows compatibility.
+
+## Prepare a pull request
+
+- Keep the change focused; separate unrelated CI, formatting, and feature work.
+- Explain the concrete problem, resulting behavior, and how you validated it.
+- Preserve existing CLI commands and the default MCP tool surface unless the
+  change explicitly proposes and explains a compatibility change.
+- Add user-facing release notes under `CHANGELOG.md`'s `[Unreleased]` section
+  for behavior changes. Do not bump the package version as part of unrelated work.
+- Use synthetic or public reproductions. Keep local paths, private project data,
+  and machine-specific configuration out of new examples and fixtures.
+
+For AOSP changes, start with the [Android platform guide](docs/design/android-platform-analysis.md).
+Distinguish verified evidence, convention-derived candidates, and unresolved
+boundaries. Document CLI usage separately from optional MCP tool exposure.
+
+## Find your way around
+
+See the [documentation index](docs/README.md) for design and validation material.
+[AGENTS.md](AGENTS.md) contains the canonical architecture and development rules;
+[CLAUDE.md](CLAUDE.md) imports it for Claude Code.