julie-extract v2.7.0

v2.7.0

This minor release ships the backend HTTP boundary coverage lane: 16 new
server-side route/mount fact families across 10 languages, the
http.client_request.v1 extension to five backend languages, and the
cross-family normalized join key that lets Miller connect outbound client
calls to handler definitions. It also includes the full resolution of the
38-finding pre-release code review of this lane
(docs/reviews/2026-07-02-backend-http-boundary-review-findings.md).

New Structural-Fact Families

Handler-definition facts (all emit route_template plus the cross-family
normalized_route_template join key in :param flavor, with
dynamic_segments, attested verb/verb_source, and prefix/effective keys
where the framework has them):

• JavaScript/TypeScript/JSX/TSX: express.route.v1,
  express.router_mount.v1, fastify.route.v1
• Python: fastapi.route.v1, fastapi.include_router.v1, flask.route.v1,
  flask.blueprint_registration.v1, django.url_pattern.v1,
  django.url_include.v1
• Java: spring.request_mapping.v1
• Go: go.net_http.route.v1, gin.route.v1, echo.route.v1
• Ruby: rails.route.v1, rails.resource_route.v1, rails.mount.v1

Outbound-call facts: http.client_request.v1 now also covers Python
(requests/httpx module calls), C# (HttpClient methods and
HttpRequestMessage), Go (net/http package calls), Java (HttpRequest
builder chains), and Ruby (Net::HTTP with literal URI(...)/URI.parse(...)),
in addition to the existing fetch/axios coverage.

ASP.NET route families additionally emit normalized_route_template as the
same cross-family join key.

Cross-Family Doctrine

• normalized_route_template is the universal join key: :param flavor,
  computed per family from the raw source template; trailing slashes are
  preserved as written.
• M2 static-literal silence: only static string literals emit route or client
  facts. Template literals, interpolations, concatenations, and identifier
  arguments stay silent; a non-literal method:/group prefix poisons that
  fact (or its prefix chain) rather than degrading to a guess.
• Verbs are recorded only when source-attested (verb_source="attested");
  verbless registrations (app.all, gin/echo Any, method-less
  @RequestMapping, verbless Go patterns) omit verb.
• Receiver attestation is in-file only: routes emit on receivers traceable to
  a framework constructor or an import-gated plugin parameter in the same
  file. Mount facts (express.router_mount.v1, fastapi.include_router.v1,
  flask.blueprint_registration.v1, django.url_include.v1) are the
  cross-file prefix-join inputs for consumers.

Behavior Details From the Review-Fix Lane

• Go net/http patterns follow the Go 1.22 [METHOD ][HOST]/[PATH] grammar:
  route_template carries the path part, verb the method token, and a new
  optional host key the host part; normalization uses the path only, so
  host-scoped and host-less routes share a join key.
• gin/echo facts emit api_style="call_routing"; mux_routing is reserved
  for go.net_http.route.v1. Nested Group calls compose literal prefixes;
  the echo import gate accepts any major version of github.com/labstack/echo.
• Spring templates come only from the positional value or value =/path =
  annotation elements — produces/consumes/params/headers literals are
  not routes. Method-level @GetMapping-style annotations emit
  attribute_kind="http_method"; method-level @RequestMapping emits
  attribute_kind="request_mapping". Each class declaration resets the
  class-level prefix.
• Express: multi-line app.route(...).get(h).post(h) chains emit per-verb
  facts without scanning handler bodies; single-string-argument verb calls
  (app.get('port') settings getter) stay silent.
• Fastify: a plugin parameter named fastify attests the framework by
  itself; a generic app parameter requires an in-file fastify import.
• Rails: config/routes.rb DSL must sit inside a routes.draw do ... end
  block; split files under config/routes/ allow top-level DSL; nested
  non-scope blocks (member, collection, constraints) no longer pop
  enclosing namespace/scope prefixes.
• Python: Django single-argument path("x") calls stay silent (previously a
  panic path); triple-quoted strings (including docstrings with apostrophes)
  are masked correctly across all Python scanning.
• Java client facts anchor the enclosing statement for builder chains; the
  contract docs state this explicitly.

Contract Changes

• Rust package versions change from 2.6.1 to 2.7.0.
• EXTRACTION_CONTRACT_VERSION gains the trailing
  backend-http-boundary-v1 marker.
• docs/contracts/structural-fact-patterns.json adds the 16 route/mount
  family specs and the client extension, including the optional host key on
  go.net_http.route.v1 and the corrected api_style descriptions for
  gin.route.v1/echo.route.v1.
• SQLite schema version remains 3. Artifact integer
  extract_contract_version remains 3. JSONL schema version remains 3.
  JSON report schema version remains 3.
• Parser dependency versions are unchanged.

Documented Exclusions

Per family, dynamic values stay silent by doctrine: non-literal route
templates, f-string/interpolated URLs, computed group prefixes (poisoned
chains emit route_template only), non-traceable receivers, session/
instance HTTP clients, and DSL outside the Rails draw block. Negative
coverage is pinned by unit tests and the
fixtures/extraction/javascript/backend_http_boundary_negatives golden.

Verification

Local prep gates run on July 2, 2026:

• cargo test --workspace (2811 passed, 0 failed)
• cargo clippy --workspace --all-targets --all-features --no-deps -- -D warnings
• cargo fmt --all -- --check
• git diff --check
• cargo test -p julie-extractors --features test-golden golden_fixtures_match_canonical_extraction
• cargo test -p julie-extractors --features test-capability-matrix capability_matrix
• node scripts/language-data-quality-report.mjs --strict (silent_cells 0, quality_bar_debts 0)
• cargo test -p xtask
• cargo xtask test default
• cargo xtask test contract
• cargo xtask release preflight --version 2.7.0

Published-asset verification is recorded in
docs/release-evidence/2026-07-02-v2-7-0-release.md after the
Release Binaries workflow completes.

Miller Handoff

Companion-plan inputs for Miller's fetch↔handler bridge: client target_path
joins against normalized_route_template across all server families; the
four mount/include facts are the cross-file prefix-join inputs;
rails.resource_route.v1 is a join input that needs Rails-semantics
expansion on Miller's side if desired.